About kbecker - Splunk Community

Topics I've Started

Subject

Karma

Author

Latest Post

View Packet Payload in Stream

0

by

Search Head Cluster: How do I resolve "Error Fixup...

5

by

Splunk DB Connect 2: What is the proper syntax for...

3

by

Should the list of fields be separated by a space ...

1

by

DBConnect Java Error After Starting Splunk

0

by

Is the directory for the splunkd.pid configurable

0

by

Can outputs.conf be reloaded without restarting sp...

0

by

How do you enable debug logging for scripted input

1

by

What Happened to "Events Table" in 4.3

1

by

What does the following "red bar" message mean "Re...

1

by

Have the same requirement. Just set frozen time period and maxtotaldatasizemb to some very large value ( greater than physical disk you have ). Then nothing will get deleted until frozen time period which in your case is 7 years.

+1 for the feature request to parallel fsck. Since this isn't avail. wrote a quick bash script that generates a list of buckets to fsck and uses the parallel command to kick of many bucket fsck's at a time. I then distributed this to hundred plus indexers and executed via pssh. #!/bin/bash # Find buckets between two epoch time stamps and output to file /data/index/splunk/bin/splunk fsck scan --all-buckets-one-index --index-name=_internal --min-ET=1483250400 --max-LT=1485928800 > /home/splunk/bucket_repair_07152017/buckets_tmp.list 2>&1 # Format bucket list cat /home/splunk/bucket_repair_07152017/buckets_tmp.list | grep idx | cut -d " " -f 4 | cut -d "=" -f 2 | cut -d "'" -f 2 > /home/splunk/bucket_repair_07152017/buckets.list # Fix buckets cat /home/splunk/bucket_repair_07152017/buckets.list | parallel /data/index/splunk/bin/splunk fsck repair --one-bucket --bucket-path={} >> /home/splunk/bucket_repair_07152017/buckets_repair.log 2>&1

We are running 6.5.1 and no longer have this issue. I think there was some internal Splunk confusion in regards to which release this was actually fixed in.

Ignore my comment, this was a config issue. The jira admins changed the port we needed to update our configs.

The Jira add on also working after upgrading to 6.5.1. In the search.log I see this error 12-21-2016 06:52:52.475 WARN ScriptRunner - Killing script, probably timed out, grace=0sec, script="/data/search/splunk/bin/python /data/search/splunk/etc/apps/jira/bin/jira_rest.py jqlsearch project=itw" If you look at the duration of the is its < 1 sec. This search has completed and has returned 1 results by scanning 0 events in 0.13 seconds

This does increase the value but there is still an upper limit that is hard coded

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support ticket with Splunk, we are trying to get them to remove these limits and more customers will help drive this.

Have you opened a case with Splunk for this? This is a hard limit which we have an enhancement request ticket open, more customers requesting this to be raised should push Splunk to fix this.

Have you opened a case with Splunk for this? This is a hard limit which we have an enhancement request ticket open, more customers requesting this to be raised should push Splunk to fix this.

We are using 6.3.1 and I still see the " These results may be truncated. Your search generated too much data for the current visualization configuration." message even with the following two options set. Is there still an bug associated with this? 10000000 10000000 This is the search earliest=-60m index=_introspection host=carf-splunkil* component=Hostwide | timechart useother=f limit=80 span=10s values(data.normalized_load_avg_1min) by host

Using 6.3.1, this is a distributed search cluster and indexer cluster. We are only seeing this on 3 of 80 indexes. Es indexes are on this indexer cluster and a standalone search head is running Es.

I am seeing this too. ERROR EAIOutParameters - invalid entry title in toAtom(): INDEXER_MISSING_INDEX-p\x00\x00z\x00fr

It looks like you need to tune the line breaking of these events as in your example Splunk is merging 4 log events into a separate Splunk events (check out props.conf). Once you have line breaking setup properly your searches should work as currently Splunk is trying to extract 4 values for this event and only one of them is winning.

Does the MacAddress field exist in both events? If so "join" would work.

Correct, the src_content and dest_content fields are only populated in just under 5% of our events (this is combined after enabling src_content & dest_content for both TCP & UDP). What are the packet count fields, packets_in & packets_out? Is there something else I need to do to view the packet payload within Splunk or will I need to generate some pcaps to start creating parsers for our custom apps?

Starting looking at Stream and have a good amount of tcp/udp flow events in which app is "unknown". How can I view the packets payload in Splunk in order to parse out data/create custom streams? I have enabled src_content but this doesn't show the payload for "unknown" events. Thanks in advance.

You can set the splunktcpin queue size in inputs.conf.

Does anybody happen to know what the following error means and how to resolve it? I linked this back to a saved search via the scheduler log and verified that the expiration of search is 15 minutes so it should be enough time to replicate the data. 04-28-2015 10:11:37.454 -0500 ERROR Fixup - failed to kick off replication from src=FA5DD091-47DE-44C0-BF4C-FF60B8DF4B72 tgt=6458DFA1-C04B-43D2-BCE6-C2D3B5AB74C3 aid=scheduler__jdoe__search__RMD5ebb33acee6403ee2_at_1430233560_69456_15082AA6-AAE2-47B5-BD24-7643F4C96F15 err='src FA5DD091-47DE-44C0-BF4C-FF60B8DF4B72 cannot be valid source for scheduler__jdoe__search__RMD5ebb33acee6403ee2_at_1430233560_69456_15082AA6-AAE2-47B5-BD24-7643F4C96F15' Thanks in advance.

Karma from

User

Karma Count

1

1

1

1

Splunk Employee

1

Karma given to

User

Karma Count

1

1

1

1

1