Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About SamHTexas
SamHTexas
Builder
Member since:
11-10-2020
02-05-2024
Community Statistics
| Posts | 499 |
| Solutions | 1 |
| Karma Given | 132 |
| Karma Received | 9 |
| Member Since | 11-10-2020 |
Activity Feed
- Got Karma for How should the McAfee Threat Data be ingested into Splunk. Via syslog push or pull by the Mcafee ePO add-on. 03-21-2022 11:19 AM
- Got Karma for Is there a way to share Dashboard panels between Splunk Enterprise & ES ?. 02-10-2022 04:15 PM
- Posted Receiving errors after upgrading to 8.2.4, like "Sum of 3 Highest per-cpu iowaits reached red Threshold of 15" on Splunk Enterprise. 02-07-2022 10:06 AM
- Karma Re: Need help help reg. KVSTORE running on the Search Heads? Do you agree that kvstores should only run on the SHs? Thx for richgalloway. 02-03-2022 12:10 PM
- Posted Need help help reg. KVSTORE running on the Search Heads? Do you agree that kvstores should only run on the SHs? Thx on Splunk Enterprise. 02-03-2022 10:55 AM
- Posted Re: Need help with an SPL to check an Index to see list of servers it contains. Thx a million on Splunk Enterprise. 01-28-2022 10:37 AM
- Posted Need help with an SPL to check an Index to see list of servers it contains. Thx a million on Splunk Enterprise. 01-28-2022 08:14 AM
- Karma Re: How do I create a list of indexes (internal & non-internal) used by users - am getting performance errors for ad for isoutamo. 01-20-2022 09:26 AM
- Posted Re: Windows Updates Monitoring on Alerting. 01-19-2022 02:22 PM
- Posted Re: How to create an alert to trigger when the license usage of a heavy forwarder reaches 90%? on Alerting. 01-19-2022 01:18 PM
- Posted How do I find list of assets or servers "exceeding the field limits set in the asset & identity management page" Thx on Splunk Enterprise Security. 01-18-2022 02:51 PM
- Posted Re: How do I create a list of indexes (internal & non-internal) used by users - am getting performance errors for ad on Splunk Enterprise Security. 01-18-2022 02:17 PM
- Posted Re: How do I create a list of indexes (internal & non-internal) used by users - am getting performance errors for ad on Splunk Enterprise Security. 01-18-2022 10:59 AM
- Karma Re: How do I create a list of indexes (internal & non-internal) used by users - am getting performance errors for ad for richgalloway. 01-18-2022 10:57 AM
- Posted Re: Need help with preparing a list of Middleware reports on the Ent. + write an alert to be notified when they are chan on Splunk Enterprise. 01-13-2022 02:22 PM
- Posted Re: How to detect cause & source of Search delays on Splunk Ent. In a clustered SH + Indexer environment. Thank u on Getting Data In. 01-13-2022 01:31 PM
- Karma Re: How to detect cause & source of Search delays on Splunk Ent. In a clustered SH + Indexer environment. Thank u for tshah-splunk. 01-13-2022 01:30 PM
- Posted Re: Need help with preparing a list of Middleware reports on the Ent. + write an alert to be notified when they are chan on Splunk Enterprise. 01-13-2022 11:58 AM
- Karma Re: Need help with preparing a list of Middleware reports on the Ent. + write an alert to be notified when they are chan for SinghK. 01-13-2022 11:57 AM
- Posted Re: How do I create a list of indexes (internal & non-internal) used by users - am getting performance errors for ad on Splunk Enterprise Security. 01-13-2022 11:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-07-2022
10:06 AM
I get the following after upgrading to Splunk 8.2.4 on Splunk Ent. + ES. I have a large environment with clustered SHs & Indexers. Thank u for your reply in advance.
"Sum of 3 Highest per-cpu iowaits reached red Threshold of 15" on ES
"Maximum per-cpu iowait reached yellow Threshold of 5" on Search heads
What do they mean & How do I fix the issues please.
... View more
Labels
- Labels:
-
upgrade
02-03-2022
10:55 AM
I work in a large Splunk, ES clustered environment. Should the KVSTORES only be running on the SHs? Looks like after upg. to 8.2.4, we have to use WiredTiger kvstore. Do you have any input on what tier should the kvstores need to be running on? Any input on using WiredTiger kvstore please. I appreciate your response in advance.
... View more
Labels
- Labels:
-
configuration
01-28-2022
10:37 AM
I appreciate your help. I would like to see the list of servers's name ( machine names). I believe this list of servers would show that they are being monitored correct? So, is there a SPL you may share that would show mw this list of servers? We do have about 100 indexes. Thanks buddy.
... View more
01-28-2022
08:14 AM
I work in a large environment, Splunk Ent + ES ( SH & Indexer clustered). I need to see what network servers are viewed / contained / monitored in any of indexes. Any help / SPLs are much appreciated.
... View more
Labels
- Labels:
-
using Splunk Enterprise
01-19-2022
02:22 PM
Dal, would you please help with how I receive alerts from Heavy Forwarders when their data amount drop below say 20% of the daily total? We have only a few HFs but many UFs both in Win / Linux environment. Thanx very much in advance.
... View more
- Tags:
- monitoring
01-19-2022
01:18 PM
Sir, is there a way (SPL) to be notified when data sent by a HF changes / degrades to for example 15-20 % of the daily sent amount ? Thank u very much.
... View more
- Tags:
- Splunk health check
01-18-2022
02:51 PM
On ES am getting warning messages the " two assets are exceeding the field limits set in the asset & identity management page". It says that this might cause performance issues & the field limits need to be increased. How do I increase the field limits please? Thx a million for your help in advance.
... View more
- Tags:
- Splunk health check
Labels
- Labels:
-
using Enterprise Security
01-18-2022
02:17 PM
Thanks very much but this does not name indexes by name. It shows indexes like "all_shcluster_indexes". I am looking for individual index names & they are used.
... View more
01-18-2022
10:59 AM
Please, is there a way to make a list of indexes each user uses. How do I make a list of internal & non -internal indexes that user roles are using. Thanks very much as usual.
... View more
01-13-2022
02:22 PM
Would you please share an SPL that would make a list of the only the middleware reports. Thanks a million
... View more
- Tags:
- administration
01-13-2022
01:31 PM
How would I do this on the ES? Does the MC has to be in Distributed mode? Thx a bunch.
... View more
- Tags:
- administration
01-13-2022
11:58 AM
Thanks very much. Would this work on the Splunk Ent. as well as the ES?
... View more
- Tags:
- monitoring
01-13-2022
11:53 AM
Thank u for your message. The message I am getting now on ES is " The list of indexes to be searched by default by admin role includes all non-internal indexes" that is causing the performance problem. So I need to learn how to create a list of users & indexes they are using by role & possible amount of data being ingested or so. Because we have local admin accounts aside from routine accts by user name. I hope I explained what am facing. I appreciate any SPLs or directions. Per your suggestion am using the MC very closely. We have it on distributed mode on the Ent & non-distributed mode on the ES.
... View more
01-12-2022
01:56 PM
I am getting performance errors on the ES reg. many indexes used by users, specially the admin role. Any SPLs or direction is much appreciated.
... View more
Labels
- Labels:
-
using Enterprise Security
01-12-2022
12:50 PM
Thank u very much for your reply. Would you share a SPL I can use in GUI for all & one for 2 Teams that create the middleware reports. I really appreciate your help. Thx
... View more
01-12-2022
11:21 AM
Have a few Windows server that I need to enable file monitoring on to be sending logs to Splunk Ent. server. I could use your hands-on experience please, including any SPLs, do's & don't. I found this link but is too generic. https://docs.splunk.com/Documentation/Splunk/8.2.4/Data/MonitorfilesystemchangesonWindows Thanks a million in advance. Have a great week ahead.
... View more
Labels
- Labels:
-
administration
-
configuration
01-11-2022
02:37 PM
I need help with writing an SPL to list all the Middleware reports on the Splunk Ent. & An alert to email me when any report is changed please. Thank very much.
... View more
- Tags:
- monitoring
Labels
- Labels:
-
metrics
01-11-2022
09:23 AM
Hello sir, do you by any chance know how to set up Alerts for a few Heavy Forwarders we have to notify us when the rate of output / sending data decreases below a certain level like 15% of the daily total? Thank u in advance.
... View more
01-10-2022
01:18 PM
Please help with an SPL or use MC to see if / when a HF stops sending data or there is a big drop in the amount of data it usually sends like 10% of the normal data sent. How do I tell if a HF is sick & not functioning? I appreciate your time in advance. Thc
... View more
Labels
- Labels:
-
using Splunk Enterprise
01-07-2022
11:42 AM
I posted this subject a few days ago & a couple of champs stated that it was not advisable because it would over load the ES & was best to create the reports in ES to use the ES use cases. Ok, I have a ton of reports that I'd like to use in ES as well. So what other options are there in order not to put a burden on ES. I appreciate your response in advance. Happy 2022.
... View more
Labels
- Labels:
-
using Splunk Enterprise
01-06-2022
08:21 AM
I have a few apps that contain repots that I need to copy to ES please. Thank u
... View more
Labels
- Labels:
-
configuration
01-05-2022
02:02 PM
I have read on Splunk.com that Ent. reports don't satisfy use cases the ones on the ES. And that they should not be copied or synched to ES. Please tell me why? Thanks a million
... View more
Labels
- Labels:
-
using Enterprise Security
01-04-2022
08:05 PM
Happy 2022 to you & yours. I will give your solution a try in the morning in my Ent server & let u know. Thank u
... View more
01-04-2022
03:10 PM
Happy 2022 Bro. Just noticed that I did not give you credit for your help then. So I just did. Thank u for all your help in 2021. Stay safe.
... View more
01-04-2022
02:34 PM
We have a ton or reports on the Splunk Ent. & I need to find if any are not finishing due to an error. Some reports are large in size ( the out put is large). Thank u & Happy 2022
... View more
Labels
- Labels:
-
troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-05-2024
03:18 PM
|
Karma given to
