About keithevanscdcr

keithevanscdcr · ‎11-06-2023

Thank you for the clarification.

keithevanscdcr · ‎11-03-2023

Are you sure about one sslVerifyServerName = true automatically sets useIPAddressAsHost = false. On the server sslVerifyServerName is the Splunk search head communicating to the indexers for distributed search, the sslVerifyServerName is asking for the certificate CN or SAN to match the server name returned. It's the Indexer that has to respond to the search with it's server name and not IP. Seems like these two attributes should be on separate hosts. I am trying to understand as well, but I don't. Right now we're on 9.0.2 and I'm now getting the below error when using this attribute, where I didn't before: - Invalid key in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 2: useIPAddrAsHost (value: false). Thanks much in advance.

keithevanscdcr · ‎01-17-2023

If my enterprise AD admins will not allow Splunk Agent on DCs, is DNS Debug logging and Windows Event Forwarding my only option? Do you have any reference/suggestions regarding this configuration? Additionally, and read on the article, it seems Stream is the preferred implementation and not DNS Debug. Can you elaborate as to why? Thank you much in advance.

keithevanscdcr · ‎03-17-2022

Hello all. Thanks in advance for your assistance. I have a 6 node index cluster with a search factor of 6 and replication factor of 3. My ingest is 130GB per/day for proxy data My Hardware: 7TB hot/warm SSD and 112TB cold 10k spindle per/indexer I have a requirement for 30 days hot/warm and 1,065 days cold = 1,095 days (3 years) total Calculations I have found say: (Daily Avg. Ingest x Compression Rate x Num Days Retention) / # of Indexers So: Hot/Warm: 130GB * .6 compression * 15 days) / 6 = 390 GB p/indexer Cold: 130GB * .6 compression * 1,065 days) / 6 = 13,845 GB p/indexer Total: 130GB * .6 compression * 1,095 days) / 6 = 14,235 GB p/indexer Given that, I think my indexes.conf would have: [idx_proxy] homePath = volume:primary/idx_proxy/db coldPath = volume:secondary/idx_proxy/colddb thawedPath = $SPLUNK_DB/idx_proxy/thaweddb maxTotalDataSizeMB = 14576640 maxDataSize = auto_high_volume homePath.maxDataSizeMB = 399360 frozenTimePeriodInSecs = 94608000 The question: With replication factor, I'm thinking this answer is not complete. Can anyone help? Updated formula/calc? This is current storage: [splunk@splunkidx1 ~]$ du -sh /splunkData/*/idx_proxy/ 8.0T /splunkData/cold/idx_proxy/ 947G /splunkData/hot/idx_proxy/ [splunk@splunkidx2 ~]$ du -sh /splunkData/*/idx_proxy/ 8.0T /splunkData/cold/idx_proxy/ 826G /splunkData/hot/idx_proxy/ [splunk@splunkidx3 ~]$ 7.9T /splunkData/cold/idx_proxy/ 955G /splunkData/hot/idx_proxy/ [splunk@splunkidx4 ~]$ du -sh /splunkData/*/idx_proxy/ 7.8T /splunkData/cold/idx_proxy/ 952G /splunkData/hot/idx_proxy/ [splunk@splunkidx5 ~]$ du -sh /splunkData/*/idx_proxy/ 8.0T /splunkData/cold/idx_proxy/ 936G /splunkData/hot/idx_proxy/ [splunk@splunkidx6 ~]$ du -sh /splunkData/*/idx_proxy/ 7.8T /splunkData/cold/idx_proxy/ 911G /splunkData/hot/idx_proxy/

keithevanscdcr · ‎11-18-2021

Does anyone know how to determine the App/TA that is calling this? I had the Zscaler App and TA installed on my test instance and it was throwing an incredible # of errors. I uninstalled both (zscalersplunkapp, TA-Zscaler_CIM) an these errors disappeared, but I'd like to know how to trace this to the caller instead of removing apps one by one. TIA!

keithevanscdcr · ‎07-13-2021

Sizing for O365 is typically not a clear cut exercise. There are so many different variables that can affect the volume. A couple of examples: O365 Subscription type: E1, E3, A5, .. (Will affect the apps they have and the apps that are logged) OneDrive - If customer is redirecting home drives to OneDrive, this creates audit events for every read/write to home directories Customer size Use cases and inputs they turn on\ Customers SSO / federation configuration My preference is to encourage the customer to turn it on for a few hours/days to get a baseline as the inputs will go back and retrieve 30+ days (depending on size of tenant). This can be done on a dev box etc if customer is worried about prod impact. I normally scope for 500kb > 1mb per user per day (again depending on their usage). In terms of very rough numbers based on a couple of customers: 5000 users: 3-4GB per day 20000 users: 9GB per day 500,000 users: 40GB per day

keithevanscdcr · ‎03-11-2021

They're still adding this without the quotes in the default app props.conf, WTH...

Posts	7
Solutions	0
Karma Given	19
Karma Received	0
Member Since	‎01-13-2021

Online Status	Offline
Date Last Visited	‎02-05-2024 07:36 PM

Indexes.conf Stanza Storage for Indexer Cluster Se...

Re: ERROR DistributedPeerManagerHeartbeat [xxxxx D...

Re: ERROR DistributedPeerManagerHeartbeat [xxxxx D...

Re: Best method for pulling Microsoft DNS logs wit...

Indexes.conf Stanza Storage for Indexer Cluster Se...

Re: Website Monitoring App stops the splunk servic...

Re: O365 and Azure AD - estimation of volume of da...

Re: Why am I getting an invalid eval expression er...