Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About koshyk
koshyk
Super Champion
Member since:
03-20-2013
06-17-2025
Community Statistics
| Posts | 1145 |
| Solutions | 115 |
| Karma Given | 283 |
| Karma Received | 361 |
| Member Since | 03-20-2013 |
Activity Feed
- Posted Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server on Splunk Enterprise. 06-17-2025 03:44 PM
- Karma Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server for isoutamo. 06-17-2025 03:38 PM
- Posted Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server on Splunk Enterprise. 06-15-2025 11:12 PM
- Karma Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server for cklunck. 06-15-2025 11:07 PM
- Posted Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server on Splunk Enterprise. 06-15-2025 03:46 PM
- Posted How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server on Splunk Enterprise. 06-15-2025 05:20 AM
- Got Karma for Re: Where can I download Splunk .conf2017 session materials?. 06-01-2025 06:51 AM
- Posted Re: Splunk Enterprise security & ESCU: Customization of ESCU and upgrades on Splunk Enterprise Security. 05-13-2025 01:02 AM
- Karma Re: Splunk Enterprise security & ESCU: Customization of ESCU and upgrades for livehybrid. 05-13-2025 12:59 AM
- Posted Splunk Enterprise security & ESCU: Customization of ESCU and upgrades on Splunk Enterprise Security. 05-12-2025 02:37 AM
- Posted Re: How to insert ESCU detections via REST API into Splunk ESS? on Splunk Enterprise Security. 05-09-2025 03:06 PM
- Karma Re: How to insert ESCU detections via REST API into Splunk ESS? for livehybrid. 05-09-2025 02:59 PM
- Posted How to insert ESCU detections via REST API into Splunk ESS? on Splunk Enterprise Security. 05-08-2025 10:30 PM
- Karma call not properly authenticated for NatanS. 05-07-2025 11:40 PM
- Posted Re: call not properly authenticated on Getting Data In. 05-07-2025 11:38 PM
- Got Karma for Re: Explain Data Models (Like I'm Five). 04-04-2025 11:27 AM
- Posted Re: Presenting Splunk Large-Scale Design with Mermaid / Draw.io or similar products on Deployment Architecture. 03-20-2025 04:22 AM
- Karma Re: Presenting Splunk Large-Scale Design with Mermaid / Draw.io or similar products for livehybrid. 03-20-2025 04:22 AM
- Posted Re: Presenting Splunk Large-Scale Design with Mermaid / Draw.io or similar products on Deployment Architecture. 03-20-2025 04:21 AM
- Posted Presenting Splunk Large-Scale Design with Mermaid / Draw.io or similar products on Deployment Architecture. 03-19-2025 04:50 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-09-2016
02:32 AM
hi
say we have an index called as "my_network". the rollover period is 1 month to cold index. This needs to be tested by Testing team.
How can they test if a particular event/bucket is existing in cold or warm/hot? Is there a more granular way to interrogate within an _index using Search?
... View more
04-12-2016
07:55 AM
1 Karma
do you know how to change it in a Clustered ES system? (coz via its not changeable)
... View more
04-02-2016
10:12 AM
thanks for your reply. How do you do constraint by index/sourcetype? Do you indvidually amend Splunk_TA_CIM's queries and put index=xyz? an example would be very helpful. cheers
... View more
03-31-2016
07:08 AM
1 Karma
We are using datamodel_summary heavily for Splunk Enterprise Security and its quite slow in datamodel acceleration. Are there any good practices to speed up this acceleration from a design point of view? Would below suggestions help?
- Use separate Filesystem for tstatsHomePath
- Use SSD disk for tstatsHomePath filesystem
- Use max_time and backfill_time in datamodels.conf if possible
Any other suggestions would be very helpful.
... View more
03-28-2016
08:56 AM
Clustering in Splunk is a whole different beast from standalone.
What I would do is go in baby steps and then horizontally expand
1. Install just a standalone splunk
2. Install deployment Server alongside this standalone splunk
3. Now make existing standalone splunk into a Search Head and add a new Indexer
4. and so on...
Also how I've done is to write apps for every thing. (eg. myapp_enable_sh_only : So the systems which receive this app, will be a search head only. Once you design it properly, Splunk works amazingly perfect)
... View more
03-28-2016
08:48 AM
that's another good option it seems. Theoretically it seems feasible, but need to try out. (want to keep away it from being a SH cluster though)
... View more
03-26-2016
02:21 AM
thanks Martin for your help. Accepted your answer.
... View more
03-26-2016
02:17 AM
Thanks mate for the workaround. I guess, we may need to raise it as an enhancement request to Splunk?
... View more
03-26-2016
02:13 AM
@martin_mueller. Thank you
Regarding (4) : I meant to ask once the data is in high perfomance store, the extraction is independent of TAs? or during a search, will it still have to go through all TA regex etc?
... View more
03-24-2016
05:02 PM
1 Karma
I was going through the documents on Datamodel Acceleration. Can you please help me in confirming if my understanding below is correct?
An Addon (TA) does the Data interpretation, classification, enrichment and normalisation. Most key value pairs are extracted during search-time.
A data model then abstracts/maps multiple such datasets (and brings hierarchy) during search-time . So datamodel as such does not speed-up searches, but just abstracts to make it easy for end-user.
During acceleration of datamodel, key value pairs (which were search-time in Step2) are extracted and stored as indexed key-value pairs ?
The fields stored in .tsidx files, are independent of TA's and any search on it, should NOT require effort on re-extracting data from _raw?
... View more
03-16-2016
09:55 AM
definitely. But you are asking it to Split by date, then by user, then by computerName..
So it will do splitting on each of them
if you are thinking to have non-relational data output, you have many other commands to have a single date entry for multiple users,computerName etc..
(Please vote/mark answer if the solution helped) Cheers.
... View more
03-16-2016
09:35 AM
can you please try sourcetype instead of source .. (amended the above query). Are you getting some data at all?
... View more
03-16-2016
08:58 AM
if its Standard Windows Eventlogs, please use Windows Addon (TA)
This will extract all the fields and is Common Information Model (CIM) compatible for future proof
... View more
03-16-2016
08:52 AM
1 Karma
I haven't looked into your logic, but I suppose your question is to include Date also into the grouping? Please try this
sourcetype="WinEventLog:Security" EventCode=4624 OR EventCode=4634 Account_Name=* action=success
| eval User=if(mvcount(Account_Name)>1, mvindex(Account_Name,1), mvindex(Account_Name, 0))
| eval User=lower(User)| search NOT User=*$
| transaction User maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1
| convert timeformat="%Y-%m-%d" ctime(_time) AS date
| stats sum(duration) As Duration by date, User, ComputerName
| eval Duration(M)=round((Duration/60), 0)
| table date,User,Duration(M),ComputerName
... View more
03-10-2016
08:20 AM
Universal Forwarder or Enterprise?
... View more
03-09-2016
01:09 AM
35 Karma
hi,
we have few heavy forwarders which are used for intermediate forwarding to Indexers. In DMC (Distributed management console), we have got these forwarders correctly in the "Forwarders" Section and identified as "Heavy Forwarder" alongside 1000's of other external universal forwarders
But we are really looking to include it to be part of the core resource, so we can see "Resource Usage" section. Currently the resource Usage has "Cluster Master", "Indexer", "KV Store", SH, Deployment server but NO Heavy Forwarder.
Is there a way to include this into DMC to check resource utilisation etc on these heavy fwd's?
... View more
03-02-2016
06:16 AM
thank you for your assistance. I will hopefully raise a support request
... View more
03-02-2016
05:09 AM
nothing is reading the file other than Splunk UniversalForwader itself trying to send to Indexer
... View more
03-02-2016
04:42 AM
We have deployed universal forwarders on Windows and are running as "local system" (admin). This is installed in C:\Program Files\SplunkUniversalForwarder . When we checked into the splunkd.log details, none of the logs are getting rotated due to permission issues:
WARN Logger - Error unlinking "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\metrics.log.1": Access is denied
WARN Logger - Error renaming "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\metrics.log" to "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\metrics.log.1": Access is denied
As an admin, I can read/write into the same folder. Splunkd can write the log files Ok as the data and size is growing in each of the files. Any reason why access is denied when it tries to rename/unlink?
... View more
03-01-2016
08:11 AM
@muebel thanks for the answer. So if the rollover fails, we are Ok as long as it won't bring down Splunk installation itself.(We are not really concerned about the data loss to cold bucket as of now).
... View more
03-01-2016
02:32 AM
hi folks,
We have an issue with our cold database filesystem and the estimate to bring it back is around 10 days.
So my question is:
What happens if a cold database path is not present and there is data to be rolled over from warm to cold?
Will warm buckets be kept till it get's hold of the cold database path? or will it be deleted? or will Splunk stop abruptly?
... View more
02-29-2016
02:18 AM
well.. this is a whole app itself with multiple lookups etc. So wanted to keep it separate
... View more
02-26-2016
05:25 AM
@bmacias84 : Can you please elaborate on "inputs from a remote machine".
So you mean to say to install "Universal Forwarder" on same machine which has Search Head and run them parallelly?
... View more
02-26-2016
05:14 AM
@jkat54 . I've updated query as we have to run this as scripted input
2nd point: This is the real problem: Even if we use regular deployment server, the apps will come to $SPLUNK_HOME/etc/apps , i.e. same location as if we do via shcluster
Unix option is limited as we have security requirement of not using SSH keys etc..
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-17-2025
03:38 PM
|
