Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mkelderm
mkelderm
Path Finder
Member since:
10-28-2011
06-05-2020
Community Statistics
| Posts | 45 |
| Solutions | 4 |
| Karma Given | 5 |
| Karma Received | 19 |
| Member Since | 10-28-2011 |
Activity Feed
- Karma Re: Compare two periods, results shows only from today for sideview. 06-05-2020 12:46 AM
- Karma Re: This volume configuration will *not* manage space used by this index for sowings. 06-05-2020 12:46 AM
- Karma Re: What happens when maxVolumeDataSizeMB parameters will be decreased? for yannK. 06-05-2020 12:46 AM
- Karma Re: Add text to login page (web.conf), restart needed? for cmeinco. 06-05-2020 12:46 AM
- Karma Re: Predict: Can I show only the predicted events in the future? for guilmxm. 06-05-2020 12:46 AM
- Got Karma for Re: How to change the path of "datamodel_summary". 06-05-2020 12:46 AM
- Got Karma for What happens when maxVolumeDataSizeMB parameters will be decreased?. 06-05-2020 12:46 AM
- Got Karma for Re: Search Dashboard: "What to Search", what query is executed?. 06-05-2020 12:46 AM
- Got Karma for Re: Search Dashboard: "What to Search", what query is executed?. 06-05-2020 12:46 AM
- Got Karma for Search Dashboard: "What to Search", what query is executed?. 06-05-2020 12:46 AM
- Got Karma for Re: How to change the path of "datamodel_summary". 06-05-2020 12:46 AM
- Got Karma for Re: How to change the path of "datamodel_summary". 06-05-2020 12:46 AM
- Got Karma for Re: How to change the path of "datamodel_summary". 06-05-2020 12:46 AM
- Got Karma for Re: How to change the path of "datamodel_summary". 06-05-2020 12:46 AM
- Got Karma for Re: How to change the path of "datamodel_summary". 06-05-2020 12:46 AM
- Got Karma for Can we save queries and reports in folders?. 06-05-2020 12:46 AM
- Got Karma for Re: Timechart show no 'zero' values. 06-05-2020 12:46 AM
- Got Karma for Multiple Wildcards in inputs.conf. 06-05-2020 12:46 AM
- Got Karma for Error in search head pooling validate: Failed to lock. 06-05-2020 12:46 AM
- Got Karma for Re: How to remove "received event for unconfigured/disabled/deleted index" messages. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
02-03-2014
11:46 AM
Can I find out wich buckets are frozen and move them to cold?
... View more
02-03-2014
11:01 AM
1 Karma
Hi,
Our maxVolumeDataSizeMB parameter for the warm-bucketss is set to 1.9 TB. What happens if I set this parameters to 1.5 TB? Will the warm-buckets moved to cold after the restart?
Greetz,
Marc
... View more
12-23-2013
01:50 AM
so simple ! Thanks!
... View more
11-29-2013
01:48 AM
I like the predict clause, but how can I show only the prediction of the 'future'. For example:
index=prd_stats earliest=-5d sourcetype=appman:DatabaseQueryMonitor resource=Counts@GMPROD_MONDRIAAN attribute=AANTAL | timechart useother=f usenull=f span=15m limit=0 avg(value) as aantal | predict aantal lower99=low upper99=high algorithm=LLP future_timespan=40
This query shows the prediction for the comming 10 hours (span*40). But I only want to see the prediction of this 10 hours.
... View more
11-20-2013
10:49 AM
I know you can add custom HTML in the web.conf (login_content) but IMHO, SplunkWeb needs a restart. Can you add a custom message without restart?
... View more
11-04-2013
12:36 PM
2 Karma
The solution is that my users, even the admin user, did not search the internal indexes by default. I needed to change the /local/authorize.conf file
[role_my_role]
srchIndexesAllowed = *;_*
srchIndexesDefault = _*;main
Thanks to Mart Mueller For giving me the thoughts on the solution
... View more
11-04-2013
12:18 PM
You triggered me on the issue, it is solved now
... View more
11-04-2013
06:51 AM
On de SH as admin: no results
On the SP as admin: results
... View more
11-04-2013
06:36 AM
We do not see any data on this start page, while Splunk> is working fine. We can query etc. We are running on three servers, one search-head and 2 indexers.
... View more
11-02-2013
06:17 AM
Just de default search app, on Splunk 6.0:
http://myhost:8000/en-GB/app/search/search
... View more
11-02-2013
05:00 AM
1 Karma
What kind of search query is executed on the Search Dashboard on "What to Search"?
In my dashboard (search-head), I only see "Waiting for data...."
Marc
... View more
11-02-2013
04:49 AM
Issue has to do with 'old' 5.0 non-compatible app. We removed all add-on apps, used the defaults application. Then the issue did not occur. Later on we added the latest 6.0 compatible apps.
... View more
10-31-2013
02:32 AM
It is not an answer, but a finding
... View more
10-30-2013
07:33 AM
Yes it can, for single (serach-head) instances. this will not work multiple search-head instances.
Marc
... View more
To complete for our viewers:
indexes.conf
# SAN Storage
#
[volume:splunkdb_cold]
path=/data/splunkdb_cold
# Maximum size of the volume will be 2.0 TB
maxVolumeDataSizeMB=2000000
#
# Local Disks
#
[volume:splunkdb_warm]
path=/data/splunkdb_warm
# Maximum size of the volume will be 1.9 TB
maxVolumeDataSizeMB=1900000
#
# Indexes refering to the volumes.
[prd_log]
coldPath = volume:splunkdb_cold/prd_log/colddb
homePath = volume:splunkdb_warm/prd_log/db
tstatsHomePath = volume:splunkdb_warm/prd_log/datamodel_summary
thawedPath = /data/splunkdb_warm/prd_log/thaweddb
frozenTimePeriodInSecs = 217728000
maxDataSize = auto_high_volume
... View more
