About hieuba6868

hieuba6868 · ‎11-12-2024

you can try REPORT instead of TRANSFORMS in props.conf

hieuba6868 · ‎11-12-2024

you can check field call "splunk_server"

hieuba6868 · ‎11-12-2024

Yeah, you have a same issue as me, Our Deployment start lagging for any function that need to call API for UFs phonehome information. Call Support and they confirm as a "bug" and will be fix at 9.4. I updated to 9.3.1 recently, no more "wrong apps" by still very lagging. I need to run commnd reload deploy-server each time want to deploy some TA to our agent.

hieuba6868 · ‎10-18-2024

Ty. Work greate in 2024

hieuba6868 · ‎10-03-2024

Hi @tlmayes, i have a same issue. Any solutions for this? Pls

hieuba6868 · ‎11-22-2023

So, after asking for Splunk Support, they said: 1. The possible reasons and conditions under which the fishbucket could exceed the configured threshold of 500MB. It is because of the amount of data ingestion you are doing per day & the fishbucket can be up to 2 or 3 times larger than the configured limit. And this happens because of its backup mechanism with file save and snapshot.tmp 2. If there are any log files or diagnostic tools within Splunk that can help us track and understand the growth of the fishbucket index. If you have the nmon app installed we found that it was contributing to the fishbucket's rapid growth. 3.The absolute maximum size that the fishbucket can reach within the Splunk system. There is no strict maximum size for the splunk fish bucket. It is the size influenced by factors like the volume of data being ingested, the frequency of indexing & the specific configuration of the your splunk environment. 4.Any factors that could contribute to the fishbucket exceeding the expected maximum by such a substantial margin. It can only grow with the time, volume of the data, frequency of indexing.

hieuba6868 · ‎11-07-2023

Hi @richgalloway, Do you have any documentation that validates the possibility of the fishbucket's size being up to four times larger than the limit specified in the limits.conf file? Any official resources or explanations that could clarify why the fishbucket index might exceed the configured threshold by such a significant margin would be extremely helpful. Concerning TA-nmon: I've noticed that it monitors the server by generating new CSV files every minute, and it deletes the older ones. I suspect that this process could incrementally increase the size of the fishbucket, as it continuously logs the CRCs of newly created log files without removing the CRCs of the old, deleted logs. This situation seems to be evidenced by the _internal log errors related to checksum faild when the log files no longer exist.

hieuba6868 · ‎11-06-2023

Hi, I have an issue here with the fishbucket of the Universal Forwarder. I have tried to look for quite a lot of documentation, but it seems that there is too little documentation, and there are also few topics on it. The problem I am facing is that the fishbucket is taking up a large amount of space, about 2GB on the hard drive, while the limit configuration in limits.conf is: file_tracking_db_threshold_mb = 500 In some other topics, I read that the fishbucket can be up to 2 or 3 times larger than the configured limit. And this happens because of its backup mechanism with file save and snapshot.tmp However, is there a limit to the size of the fishbucket? Will it continue to expand over time without limit, or only expand to a certain limit? PS: i have nmon TA install on my server. Please, provide me with Splunk documentation on this part. Thank you.

hieuba6868 · ‎11-29-2022

Did you get any solution for this issue ?

hieuba6868 · ‎04-14-2022

I have 2 sourcetype WinHostMon and wineventlog with Splunk add-on for Microsoft windows. After doing Asset and Identity configuration in Splunk ES. the lookup file is fine and I can see the results with the search command: | inputlookup test_assets2.csv and Asset Lookup information is also displayed in ES > Security Domains > Identity > Asset Center dashboard. But there is a problem that the enrichment fields for data like dest_asset, dest_asset_id, ... only appear in the WinHostMon sourcetype. Can someone help me pls? Thank you very much!

Posts	12
Solutions	1
Karma Given	9
Karma Received	1
Member Since	‎04-14-2022

Online Status	Offline
Date Last Visited	‎11-18-2024 10:01 PM

Fishbucket Growing Issue

How to write Asset and Identity configuration?

Re: REGEX not being applied even though it is work...

Re: How to Identify which HF is sending logs/metri...

Re: Deployment Server clients have wrong apps

Re: File will not be read, seekptr checksum did no...

Re: Deployment Server clients have wrong apps

Re: Fishbucket Growing Issue

Re: Fishbucket Growing Issue

Fishbucket Growing Issue

Re: Saved Search: Could not find variable in Argum...

How to write Asset and Identity configuration?