About olivera

olivera · ‎05-18-2023

I created a standalone splunk container on openshift container platform with the help of "splunk operator for kubernetes". unfortunately I can't run splunk queries. The following error occures: job terminated unexpectedly. The search job has failed due to an error. You may be able to view the job in the job inspector. When I enter the the job inspector and search for errors with ctrl+f I find only something like: "Error ScopedAliveProcessToken, unable to create FIFO, path="/opt/splunk/var/run/splunk/dispatch/1684409027.39/alive.token", permission denied pleaseeeee help me I am desperate

olivera · ‎02-16-2023

I downloaded the app to my HF and send their my alarms from vcenter via snmp. I also condigured the following SNMP input and opened the ports needed. What should I do for it to work so I can see the events (in my sh of course)? What am I missing??

olivera · ‎01-24-2023

Can you please tell me the basic steps for how to do it? I feel lost in the documentation 😞

olivera · ‎01-24-2023

I am now considering all options. Can you explain more about the syslog solution and how to do it?

olivera · ‎01-24-2023

I want to monitor my all hosts, esxi's, etc in my vCenter environment. I am working in a distributed environment and I want to send all alarms (for errors) and all data that can help me to ensure that the health of my vcenter environment is good. Can someone please help and send me the steps in order to do that? It will be helpful to also add tutorials or documentation for each part. (I don't know for example in what component to enable the HEC token or how to use API to send the alarms from vCenter to my Splunk)

olivera · ‎01-08-2023

I recently started collecting data from my servers with the Add-On for unix and linux. I did a dashboard with pannels like CPU, RAM, storage by usage by mount point, services and their status... Now I want to create a dashboard that will collect all the warnings from the panels and will show it in a nice table. For example, if the file system usage is above 90 percent, show it in the dashboard and if someone cleaned it it will automatically disappear from the panel. I find it hard to collect all warnings in one panel because my data comes from different sourcetypes. Can you please help me?? I don't have a clue from where to start or what SPL queries to do. Thank you

olivera · ‎01-01-2023

Hello again @gcusello In what directory should I put the props.conf file in the HF and Indexers? It's confusing because it is now located in the Add-On directory and I don't deploy this Add-On to those servers. Wish you luck in 2023!

olivera · ‎01-01-2023

@PickleRick You made things clear for me. I have indexers and intermediate forwarders, but I configured them long ago. How can I know where the parsing of my data is? In addition, according to my knowledge, my app is only deployed to my UFs, so in what directory should I put my props.conf file? (currently in the UFs it's in ./app_name/local/props.conf) In addition, I didn't understand what you meant by the TZ and daylight saving. Can you please explain? Thank you

olivera · ‎12-31-2022

Hello @PickleRick Actually my source is correct. I live in Israel and IST stands for Israel standard time but for some reason splunk interprets it as India standard time (also IST), which I believe creates the problem in the parsing of the raw text of the event. I tried to configure TZ ALIAS in the props.conf but after many syntax tries it looks like it doesn't want to be applied. The props file is in an app which is on my UF's. I restarted the UF's and it still did not work. What should I do to override the IST in the event? pictures of props.conf:

olivera · ‎12-31-2022

I just found out that my time zone should be GMT +2 and it is written IST instead. Is there a way to change it in the event so the right time (which appears already in the event itself but not in the timestamp) will be parsed with this timezone? Thank you in advance

olivera · ‎12-31-2022

Hello again @gcusello I put it in the deployment apps because then I deploy it to from the DS to my universal forwarders. I meant that after the deploy of the new configuration the time of the source type still did not change. Do you have another solution? I'm a bit clueless. It's weird that only one source type's time is wrong. Thank you for your answers

olivera · ‎12-28-2022

I added the configuration and it did not change anything. Should it be in /opt/splunk/etc/deployment-apps/Splunk_TA_nix-default?

olivera · ‎12-28-2022

I assume it's caused because of the IST in the event but I don't know how to change it. Can you help please?

olivera · ‎12-28-2022

I assume it's caused because of the IST in the event but I don't know how to change it. Can you help?

olivera · ‎12-26-2022

I have an add on for unix and linux downloaded on my monitored servers and the data is sent to my indexers. In the Unix:Service sourcetype the time that is wrriten is 3.5 hours delayed, meanwhile the time that is wrriten in the event itself is the correct time. Can someone help please and know how to fix it???

Posts	15
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎12-26-2022

Online Status	Offline
Date Last Visited	‎10-04-2023 11:53 AM

Running queries not working at all

How to get SNMP modular input to work?

How to set alarms from vCenter with HEC token?

How to create a Dashboard\query that gathers all O...

Getting wrong time for event?

Running queries not working at all

How to get SNMP modular input to work?

Re: Getting alarms from vCenter with HEC token

Re: Getting alarms from vCenter with HEC token

How to set alarms from vCenter with HEC token?

How to create a Dashboard\query that gathers all O...

Re: Getting wrong time for event

Re: Getting wrong time for event

Re: Getting wrong time for event

Re: Getting wrong time for event

Re: Getting wrong time for event

Re: Getting wrong time for event

Re: Getting wrong time for event

Re: Getting wrong time for event

Getting wrong time for event?

Are you a member of the Splunk Community?