Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About andrew_burnett
andrew_burnett
Path Finder
Member since:
10-14-2021
a week ago
Community Statistics
| Posts | 50 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 2 |
| Member Since | 10-14-2021 |
Activity Feed
- Posted Re: KVStore Memory Leak on Splunk Enterprise. a week ago
- Posted KVStore Memory Leak- How to manage without restarting every week? on Splunk Enterprise. 2 weeks ago
- Karma Re: IDX crashed out of nowhere- What is the cause of this? for richgalloway. 02-13-2023 11:54 AM
- Posted IDX crashed out of nowhere- What is the cause of this? on Splunk Enterprise. 02-13-2023 08:58 AM
- Posted Re: Error in splunkd - fileclassifiermanager - Error (bad allocation) encountered ... on Getting Data In. 02-10-2023 08:09 AM
- Posted Re: Need help with a Search on Splunk Search. 09-28-2022 12:46 PM
- Posted Help with Search for sporadic servers in the past 14 days? on Splunk Search. 09-28-2022 10:03 AM
- Posted Re: Why are windows UF in Windows Event Log getting this message "Splunk could not get description"? on Security. 06-30-2022 10:19 PM
- Posted Why are windows UF in Windows Event Log getting this message "Splunk could not get description"? on Security. 06-30-2022 05:09 PM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-06-2022 07:45 AM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-03-2022 07:23 AM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-02-2022 01:58 PM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-02-2022 01:22 PM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-02-2022 01:19 PM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-02-2022 01:01 PM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-02-2022 12:33 PM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-02-2022 12:30 PM
- Posted Re: Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-02-2022 12:29 PM
- Posted Splunk Add-On for AWS Small Hot Buckets- Why are we receiving warning? on Getting Data In. 06-02-2022 08:53 AM
- Posted Re: Ingestion Latency after updating to 8.2.1 on Splunk Enterprise. 06-01-2022 02:05 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
2 weeks ago
Our KVStore, which is wiredTiger, slowly grows and consumes the entire cache and then will eventually grow outside the cache until restarted. It requires rolling restarts about once a week, and has persisted for months. Anyone else had this issue?
... View more
Labels
- Labels:
-
troubleshooting
02-13-2023
08:58 AM
We had a Splunk indexer crash out of nowhere, and this is the message I received before the crash in the logs.
Encountered S2S Exception=Unexpected duplicate in addUncommittedEventId eventid=57 received from for data received from src=*.
What is the cause of this?
... View more
Labels
- Labels:
-
troubleshooting
02-10-2023
08:09 AM
I'm also getting this issue, except my UF is delayed by 400 hours sending logs to Splunk. And only for Windows Events.
... View more
09-28-2022
12:46 PM
@ITWhisperer So I am trying to find sporadic hosts, or hosts that will have over 24-hour gaps or maybe just 24-hour gaps in between sending data to indexers. My search looks like this | tstats count as hourcount where (index=_* OR index=*) by _time,host span=1h | appendpipe [ | stats count by host | addinfo | eval _time = mvappend(info_mintime,info_maxtime) | stats values(_time) as Time by host | mvexpand Time | rename Time as _time ] | sort 0 _time host | streamstats time_window=24h count as skipno by host | where skipno=1 AND _time>relative_time(now(),"-13d@d") | stats sum(skipno) as count by host | eval mySporadicFlag = if(count=1,"yes","no") Except the problem is if it reports every 48 hours in a 14-day period, that's sporadic but the streamstats count would be higher than 1. But if you reversed the yes and no, than everything would be sporadic even hosts that only have minute gaps in data. So I'm stuck on how to improve this search from here to find actually sporadic hosts.
... View more
09-28-2022
10:03 AM
Trying to build a search looking for sporadic servers in the past 14 days, here is my search so far.
| tstats count as hourcount where (index=_* OR index=*) by _time, host span=1h
| appendpipe [
| stats count by host
| addinfo
| eval _time = mvappend(info_mintime,info_maxtime)
| stats values(_time) as Time by host
| mvexpand Time
| rename Time as _time
]
| sort 0 _time host
| streamstats time_window=24h count as skipno by host
| where skipno = 1
| stats sum(skipno) as count by host
| eval mySporadicFlag = if(count=1,"no","yes")
But how the streamstats is set up, and the filtering. Every host starts at 1, the first time an event was encountered in the first 14 days. So it's flagging all my hosts as sporadic despite there being no gap. Any assistance?
... View more
Labels
- Labels:
-
stats
06-30-2022
10:19 PM
What about the ones where that doesn’t fix it?
... View more
06-30-2022
05:09 PM
A lot of our Windows UF are getting this message in Windows Event Logs, "Splunk could not get the description for this event". Does anyone know why?
... View more
Labels
- Labels:
-
other
06-06-2022
07:45 AM
This is the update of the first search.
... View more
06-03-2022
07:23 AM
It came back within 2 hours and is now affecting two indexers.
... View more
06-02-2022
01:58 PM
Well there is no errors in Splunk for that sourcetype, so nothing like that is flagging in the data. And all the connections seem fine, there is other add-ons on that HF that are reporting fine.
... View more
06-02-2022
01:22 PM
Beyond just a second ago when I restarted it, I have nothing popping up.
... View more
06-02-2022
01:19 PM
Restarting the indexer got rid of the problem for now, not sure it's going to fix the underlying problem.
... View more
06-02-2022
01:01 PM
I am running 8.2.4 with 69% of small buckets and it's only flagging on one of my indexers. And I don't see any errors in splunkd regarding that add-on.
... View more
06-02-2022
12:33 PM
I have no events in the future.
... View more
06-02-2022
12:30 PM
And all the timestamps are the same TZ, so no weird differing times that I can see either.
... View more
06-02-2022
12:29 PM
So the add-on came with props, and what I mean by offset is that all the events are in a timezone 6 hours ahead of us, but when I search it converts it to my time. When I tried to search it failed with this message "Unable to parse the search: Invalid time bounds in search: start=1654750800 > end=1654198380."
... View more
06-02-2022
08:53 AM
We are getting the small hot buckets warning for this index, but the timestamps look fine just with a few hours offset. Not quite sure where to go from here.
... View more
Labels
- Labels:
-
heavy forwarder
06-01-2022
02:05 PM
Commenting on this to be notified of the solution.
... View more
05-19-2022
10:57 AM
I created a custom alert action, but btool is flagging it as wrong. The script is in /opt/splunk/etc/apps/<app>/bin
... View more
Labels
- Labels:
-
alert action
-
alert condition
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
