About thetech

thetech · ‎09-21-2021

Hi, Can you please describe your deployment? I.E What roles the servers are. how many indexers, are they clustered. Are you using ES/ISTI. Regards theTech

thetech · ‎07-14-2021

G'day, Hot buckets are created when data is ingested into Splunk. Hot buckets are rolled to warm when one of the following occurs. "MaxDataSize" limit is reached - The maximum size, in megabytes, that a hot bucket can reach before splunkd triggers a roll to warm. Lifetime of the hotbucket is older than "maxHotSpanSecs" Manual rollover of Hot bucket Indexer restart With MaxDataSize set to auto (750MB) and maxHotSpanSecs set to 86400(1 Day) they should roll over as you require (assuming the bucket size is ~20-30MB). Are you able to send through what you have configured in you indexes.conf (Both global and per index). *EDIT* I missed your title statement "maxHotSpanSecs of 1h" - You need to roll every hour? maxHotSpanSecs would need to be configured as 3600 (1 Hour). Please note 3600 is the minimum setting for maxHotSpanSecs Either way let me know/send through your current config Regards theTech

thetech · ‎01-23-2021

Hi all, I am receiving Windows event logs from a domain controller via an NXLogs agent. This data is being sent over UDP/514 and the data format is in BSD style syslog. Whilst I am successfully receiving and ingesting this data the problem I have is as follows How do I have splunk successfully parse this data so that it can be used by the Windows TA addon I am thinking I need to create something in the props.conf maybe? Any questions please ask Regards TheTech

thetech · ‎10-02-2020

### Update - Resolved ### Issue has been resolved. All the inputs.conf files had the following URL configured: 8000/en-us/app/splunk_app_stream/ The Splunk Stream TA will try and append "ping" to the URL in the inputs.conf. The appended ping only exists on the following URL 8000/en-us/custom/splunk_app_stream/ So the fix is to change the URL to en-us/custom/splunk_app_stream/ instead of en-us/app/splunk_app_stream/ in your TA inputs.conf

thetech · ‎10-02-2020

Hello all, I have a distributed environment containing the following: 3 x Search heads (1 captain) 4 x Indexers clustered 1 x dedicated linux server for Splunk Stream (UF + TA addon) 1 x deployment server 1x SHCD 1x CM The problem I am having is that for unknown reasons the dedicated splunk stream server is now unable to ping the server with the splunk stream app. This all was working but I fear I have made a config slip up somewhere. The Splunk stream TA is deployed to the dedicated stream server from the deployment server and contains the following files/config inputs.conf streamfwdlog.conf inputs.conf - [streamfwd://streamfwd] splunk_stream_app_location = https://<SERVER_IP>:8000/en-us/app/splunk_app_stream/ stream_forwarder_id = disabled = 0 I am able to successfully navigate to the stream app location https://<SERVER_IP>:8000/en-us/app/splunk_app_stream/ But the streamfwd logs are showing the following error message stream.CaptureServer - Unable to ping server (d6e0ed72-789a-4044-95f7-7de95ddbb221): /en-us/app/splunk_app_stream/ping/ status=303 If I navigate to the same URL with "ping" appended then it returns a 404. If you require any other info please let me know. Regards

Posts	5
Solutions	1
Karma Given	0
Karma Received	5
Member Since	‎10-02-2020

Online Status	Offline
Date Last Visited	‎10-13-2021 03:46 AM

Windows event logs - BSD syslog format

Splunk Stream TA - Unable to ping server

Re: Splunk Instances Utilizing HIGH CPU Usage in V...

Re: Splunk not respecting maxHotSpanSecs of 1h

Windows event logs - BSD syslog format

Re: Splunk Stream TA - Unable to ping server

Splunk Stream TA - Unable to ping server