About Sharzi

Sharzi · ‎03-14-2024

Thank you @richgalloway for your reply! Since all of the monitoring searches are under my username, would you know a solution to set dispatch.ttl based on the username, not the search names? so all searches under my username would have dispatch.ttl=3p .

Sharzi · ‎03-14-2024

Hi, I have multiple searches that follow a naming convention like "Server1_Monitoring", "Server2_Monitoring", and so on. I used an asterisk in the search name stanza to match all of them in the savedsearches.conf file, like: [Server*_Monitoring] dispatch.ttl=3p I restarted the search head after the change, but it didn't work. Is there any way to avoid listing all the searches explicitly in savedsearches.conf? Thank you!

Sharzi · ‎04-19-2023

Thank you @efavreau! It might be the case since we recently reduced the instance type of several of our nodes from c5.9xlarge to c5.4xlarge (due to very low CPU usage and "over-provisioned" flag), and there is also the IOWait warning. So I'm wondering what you upgraded to solve the issue.

Sharzi · ‎04-19-2023

Hi @VatsalJagani , Thank you for your reply. We spread out the schedule, but we still have the same issue. Since the searches are running with no error, would you think the backfill script solves this issue? Thanks,

Sharzi · ‎04-17-2023

Hi, I've faced an issue with summary indexing since last week. I have around 25 saved searches running 15 mins past the hour and save the results in the Summary index. Based on the jobs, these searches run fine with no error, but sometimes, summary index data is not written for some of these searches. I check the _internal log and found the following: reason=The maximum number of concurrent historical scheduled searches on this instance has been reached, Status=Continued The concurrency limit on the search head is 39, and I changed max_searches_per_cpu to 2 on both SH and indexers, but no improvement! My issue is similar to this post, but the solution is for version 5. Could someone please help me with this? Thank you!

Sharzi · ‎11-05-2021

I had the same problem, but I wasn't aware of "$trellis.value$"! It solved my problem. Thanks!

Sharzi · ‎10-26-2021

Hi, I'm trying to use a lookup file inside an if statement, and it doesn't return any data. I would appreciate it if anyone could help me. Thanks! The lookup file has 4 columns (TenantName, tenantId, Region, DB) and my base search is returning 5 columns (_time, TenantName, tenantId, Region, Status). I need to find the database name (or DB) for each record, and it should be done by using tenantId in base search wherever tenantId is not "Unknown". <base search> | table _time TenantName tenantId Region Status | eval Database=if(tenantId!="Unknown", [| inputlookup myLookup | where tenantId=tenantId | return $DB], [| inputlookup myLookup | where TenantName=TenantName | return $DB])

Sharzi · ‎09-10-2021

Try: | eval Date=strftime(CreatedDate/1000, "%y%m%d%H%M%S") or | eval Date=strftime(CreatedDate/1000, "%d/%m/%y %H:%M:%S") Also, you can use either %y or %Y for the year.

Sharzi · ‎03-15-2021

Hi @richgalloway , We don't have any transaction command in our search query, but as you said, the problem was "latest". I changed the "latest" and now it is working fine! Thanks.

Sharzi · ‎03-12-2021

Hello, I recently faced an issue when populating a summary index. I scheduled a saved search to run every hour (with the last 60 minutes time range) and populate a summary index. The search takes around 5 minutes every time to be completed. My problem is that every time this scheduled search runs to populate the index, events in the last 30 seconds of the time range will be discarded from the results by Splunk. For example, for a one-hour time range like 9:00:00 to 10:00:00, the index is only populated with the events from 9:00:00 to 9:59:30. This issue caused some gaps and discrepancies in our index data. Is there any way to solve this? I searched a lot but couldn't find any answer 😞 Thanks.

Posts	10
Solutions	0
Karma Given	21
Karma Received	1
Member Since	‎01-30-2021

Online Status	Offline
Date Last Visited	‎01-03-2025 12:40 PM

Can asterisks (*) be used in search names within t...

Why doesn't summary index data get written sometim...

use lookup file inside if statement

Scheduled search for populating summary index igno...

Re: Can asterisks (*) be used in search names with...

Can asterisks (*) be used in search names within t...

Re: Why doesn't summary index data get written som...

Re: Why doesn't summary index data get written som...

Why doesn't summary index data get written sometim...

Re: In a trellis layout, how come the "split by" f...

use lookup file inside if statement

Re: Convert 210910085155 to yymmddhhmmss or dd/mm/...

Re: Scheduled search for populating summary index ...

Scheduled search for populating summary index igno...

Are you a member of the Splunk Community?