About Justin

martin_mueller · ‎09-30-2015

Counting is literally a billion times faster than loading the event off disk... so you won't notice any overhead from counting. Saving on field extraction however will be noticable. I guess the key performance hog is the sheer number of events loaded. This can be solved with summary indexing or acceleration, changing the expiration is just a bandaid.

Justin · ‎06-08-2012

I was able to get the time conversion to work. What I did was upgrade to splunk version 4.3.2 on the forwarder and indexer, added spaces around the "=" for the TZ variable, changed the timezone to "Africa/Casablanca", and I restarted the splunkd service on the indexer. I am not sure if all of those were required for the fix, but after I did all that the time conversions started working. Here is the new props.conf config from the indexer for reference. [iis-3] pulldown_type = true MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = False REPORT-iis_referer = iis_referer TRANSFORMS-comment = comment TZ = Africa/Casablanca

Justin · ‎02-17-2012

Thanks Kristian, that did the trick.

vgollapudi · ‎05-22-2018

Look at this documentation Link: https://docs.splunk.com/Documentation/Splunk/7.1.0/Admin/Inputsconf If set to the literal string (including the angle brackets), the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC. When crcSalt is invoked, it is usually set to .

ogdin · ‎02-13-2014

In Splunk 6, you can also use INDEXED_EXTRACTIONS=W3C which auto-extracts the fields from the headers at index-time. http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime

Posts	14
Solutions	3
Karma Given	1
Karma Received	10
Member Since	‎04-27-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How do I optimize the performance of a dedup searc...

IIS + DST = Time Conversion Problem

stats for user internet traffic

Windows DHCP Logs

IIS and Exchange Log Header Extraction

Re: How do I optimize the performance of a dedup s...

Re: IIS + DST = Time Conversion Problem

Re: stats for user internet traffic

Re: Windows DHCP Logs

Re: IIS and Exchange Log Header Extraction

Join the Conversation