Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About splunkjpm
splunkjpm
Loves-to-Learn Lots
Member since:
03-20-2013
05-17-2024
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-20-2013 |
Activity Feed
- Posted Splunk stop sending data after log rotation on Getting Data In. 05-16-2024 11:04 PM
- Posted Re: how can I change the default search time for all users who are accessing a custom app i created? on Splunk Search. 01-29-2014 08:50 AM
- Posted Re: how can I change the default search time for all users who are accessing a custom app i created? on Splunk Search. 01-28-2014 03:01 PM
- Posted how can I change the default search time for all users who are accessing a custom app i created? on Splunk Search. 01-28-2014 11:56 AM
- Tagged how can I change the default search time for all users who are accessing a custom app i created? on Splunk Search. 01-28-2014 11:56 AM
- Tagged how can I change the default search time for all users who are accessing a custom app i created? on Splunk Search. 01-28-2014 11:56 AM
- Tagged how can I change the default search time for all users who are accessing a custom app i created? on Splunk Search. 01-28-2014 11:56 AM
- Posted data retention for an index how to control archiving policy on Knowledge Management. 01-09-2014 12:29 PM
- Tagged data retention for an index how to control archiving policy on Knowledge Management. 01-09-2014 12:29 PM
- Tagged data retention for an index how to control archiving policy on Knowledge Management. 01-09-2014 12:29 PM
- Tagged data retention for an index how to control archiving policy on Knowledge Management. 01-09-2014 12:29 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
05-16-2024
11:04 PM
We have an app input config monitor containing wildcards with whitelist configured to pick up only .log and .out. There are about 120 log files matching the whitelist regex. All the logfiles are ingesting fine except for 1 specific logfile that seems unable to continue the ingestion after log rotation. crcSalt and initCrcLength already defined as below - initCrcLength = 1048576 crcSalt = <SOURCE> On splunkd.log, the below event can be found - 05-15-2024 00:32:57.332 -0400 INFO WatchedFile [16425 tailreader0] - Logfile truncated while open, original pathname file='/xxx/catalina-.out', will begin reading from start. Is 120 logs on 1 input too many for Splunk to handle? How can we resolve this issue?
... View more
Labels
- Labels:
-
inputs.conf
-
universal forwarder
-
whitelist
01-29-2014
08:50 AM
yes i did restart splunk but when app comes up it still shows all time, I did notice serveral reference to this change related to version 6 can you please confirm if this change is supported in 5.0.5 the version we are running on . Also to clarify we want the default for the search for this custom app for all user to be 4 hrs, not all time, even if they change the search time the next they access the custom app the default time that appears on the screen next to the search bar should be 4 hrs
... View more
01-28-2014
03:01 PM
Thank you for the suggestion, since the ui-prefs.conf file did not exists in $SPLUNK_HOME/etc/system/default i created in in the default directory for my app and added in lines
dispatch.earliest_time = -4h@h
dispatch.latest_time = now
unfortunately it still does not work, when i access the app on the search bar it still has a default value of all time for the searches
I dont know if this mattr but we are running version 5.0.5 any other suggestions would be appreciated
... View more
01-28-2014
11:56 AM
I would like to change the default search time for all users who select the custom app i have created from all time to only search by default the last 4 hrs. How can i make this change so that all users who select this custom app from their app dropdown menu will automatically get a default of 4 hrs for all searches they request, not all time?
... View more
01-09-2014
12:29 PM
We have several indexes where we have set the maxTotalDataSIzeMB to a specific value is it also possible to configure the frozenTimePeriodInSecs for the same indexes. Can you have both paramters configured for the same index and if so which one takes priority in determining when to delete data is it the size of index or age of the date. For our purpose we are first looking for data to roll off if it exceed 30 days old and as a second check if data is less than 30 days old but index size is greater than 10 GB dta should roll off
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-17-2024
07:05 PM
|
