Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About brettw10
brettw10
Explorer
Member since:
11-21-2011
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 11-21-2011 |
Activity Feed
- Got Karma for Universal Forwarder buffering during Indexer outage?. 06-05-2020 12:46 AM
- Got Karma for multikv extraction fails when table contains empty fields. 06-05-2020 12:46 AM
- Got Karma for multikv extraction fails when table contains empty fields. 06-05-2020 12:46 AM
- Posted Universal Forwarder buffering during Indexer outage? on Getting Data In. 08-28-2013 05:16 PM
- Tagged Universal Forwarder buffering during Indexer outage? on Getting Data In. 08-28-2013 05:16 PM
- Tagged Universal Forwarder buffering during Indexer outage? on Getting Data In. 08-28-2013 05:16 PM
- Tagged Universal Forwarder buffering during Indexer outage? on Getting Data In. 08-28-2013 05:16 PM
- Posted Re: multikv extraction fails when table contains empty fields on All Apps and Add-ons. 07-17-2013 06:44 PM
- Posted Re: multikv extraction fails when table contains empty fields on All Apps and Add-ons. 07-17-2013 06:43 PM
- Posted multikv extraction fails when table contains empty fields on All Apps and Add-ons. 07-16-2013 11:43 PM
- Tagged multikv extraction fails when table contains empty fields on All Apps and Add-ons. 07-16-2013 11:43 PM
- Tagged multikv extraction fails when table contains empty fields on All Apps and Add-ons. 07-16-2013 11:43 PM
- Tagged multikv extraction fails when table contains empty fields on All Apps and Add-ons. 07-16-2013 11:43 PM
- Posted streamstats sum() by not functioning as expected on Splunk Search. 07-04-2013 09:12 PM
- Tagged streamstats sum() by not functioning as expected on Splunk Search. 07-04-2013 09:12 PM
- Tagged streamstats sum() by not functioning as expected on Splunk Search. 07-04-2013 09:12 PM
- Tagged streamstats sum() by not functioning as expected on Splunk Search. 07-04-2013 09:12 PM
- Posted Re: Extracting multiple occurrences of a field from a syslog-ng statistics message. on Getting Data In. 02-25-2013 04:36 PM
- Posted Extracting multiple occurrences of a field from a syslog-ng statistics message. on Getting Data In. 02-24-2013 07:01 PM
- Tagged Extracting multiple occurrences of a field from a syslog-ng statistics message. on Getting Data In. 02-24-2013 07:01 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 |
08-28-2013
05:16 PM
1 Karma
Say I have a UF set up to monitor a file – let’s call it /var/log/syslog-stats.log – which rotates every day (syslog-stats.log, syslog-stats.log.0, syslog-stats.log.1, etc.). The UF is only configured to look at syslog-stats.log, and not the rotated files.
Now let’s say that the Indexer that the UF forwards to goes down for a period of time. During this time, the syslog-stats.log file rotates. Once the Indexer comes on line again, will it only see the events that are in the current syslog-stats.log file, or will it also see the events that occurred while it was down, which are now recorded in syslog-stats.log.0?
I guess the question really is, at a much simpler level – will the UF buffer for a given period of time if an indexer is down? If so, how long for?
... View more
07-17-2013
06:44 PM
And df.sh:
% df.sh
Filesystem Type Size Used Avail UsePct MountedOn
/dev/md/dsk/d15 ufs 9.6G 3.8G 5.7G 41% /
10.173.22.82:/vol/vf_slog_lons01_logs_vol01/archive_q01 1.5T 1.3T 205G 87% /logpool/logs/archive_global
... View more
07-17-2013
06:43 PM
Solaris 10. Here is some (edited) output, due to the character limit of replies.
% df -n
/ : ufs
/logpool/logs/archive_global: nfs
% df -h
Filesystem size used avail capacity Mounted on
/dev/md/dsk/d15 9.6G 3.8G 5.7G 41% /
10.173.22.82:/vol/vf_slog_lons01_logs_vol01/archive_q01
1.5T 1.3T 205G 87% /logpool/logs/archive_global
If I can ever get this site to let me post the full output, I will.
Rgds,
Brett.
... View more
07-16-2013
11:43 PM
2 Karma
Hi,
I am trying to use multikv to parse the output of df.sh, which is part of the *nix application. On Solaris, the output of df.sh looks like this:
Filesystem Type Size Used Avail UsePct MountedOn
/dev/md/dsk/d15 ufs 9.6G 3.8G 5.7G 40% /
sharefs sharefs 0K 0K 0K 0% /etc/dfs/sharetab
10.173.22.82:/vol/vf_slog_lons01_logs_vol01/archive_q01 1.5T 1.3T 214G 86% /logpool/logs/archive_global
Using multikv against this table results in the following mapping for the last line (NFS mount), due to an empty/null entry for Type:
Filesystem: 10.173.22.82:/vol/vf_slog_lons01_logs_vol01/archive_q01
Type: 1.5T
Size: 1.3T
Used: 214G
Avail: 86%
UsePct: /logpool/logs/archive_global
MountedOn: <null>
All other rows extract correctly, given that they have a value for Type.
So, how can I get multikv to extract the fields correctly for all rows?
Regards,
Brett.
... View more
07-04-2013
09:12 PM
Hi,
I have the following search, which is attempting to add up the number of dropped and processed syslog messages in each event, based on the field syslog_dest_host:
sourcetype="syslog-stats" | streamstats window=1 sum(syslog_dropped) as Dest_Syslog_Dropped, sum(syslog_processed) as Dest_Syslog_Processed by syslog_dest_host | table _time, host, syslog_dest_host, syslog_dropped, Dest_Syslog_Dropped, syslog_processed, Dest_Syslog_Processed
When this is run, however, I see that the sum is being taken over all values of syslog_dest_host in the event, rather than one sum per syslog_dest_host, eg:
host syslog_dest_host syslog_dropped Dest_Syslog_Dropped ...
host1 dest1 1 12
dest2 1
dest2 3
dest1 4
dest1 2
dest2 1
However, what I would like to see is:
host syslog_dest_host syslog_dropped Dest_Syslog_Dropped ...
host1 dest1 1 7
dest2 1 5
dest2 3
dest1 4
dest1 2
dest2 1
Is what I want even possible?
If not, is there a way to filter within the event, such that only the instances of syslog_dest_host and syslog_dropped are returned when syslog_dest_host=host1? I tried adding this to the search string "sourcetype=syslog-stats syslog_dest_host=host1", but because host1 appears somewhere in the event, the entire event is returned.
Rgds,
Brett.
... View more
- Tags:
- by
- streamstats
- sum
02-25-2013
04:36 PM
Hi,
It actually turns out that I had forgotten to set the right sourcetype in props.conf. Here is the correct props.conf:
[syslog]
KV_MODE = auto
REPORT-syslog_host = syslog-ng_host
REPORT-syslog_host_drops = syslog-ng_drops
Rgds,
Brett.
... View more
02-24-2013
07:01 PM
Hi,
I am trying to extract multiple occurrences of two fields from the statistics message that is generated by syslog-ng. You can find an example single-lined entry below. I need to extract every destination name - between dropped='dst.tcp( and # - and the corresponding dropped statistic value - between )= and '.
I tried adding the following to props and transforms, but haven't had any luck so far:
props.conf
[syslog-ng_syslog]
KV_MODE = auto
REPORT-syslog_host = syslog-ng_host
REPORT-syslog_host_drops = syslog-ng_drops
transforms.conf
[syslog-ng_host]
CLEAN_KEYS = 1
MV_ADD = 1
REGEX = dropped='dst.tcp[(](?<syslog_host>\w+[^#]+)
SOURCE_KEY = _raw
[syslog-ng_drops]
CLEAN_KEYS = 1
MV_ADD = 1
REGEX = dropped='dst.tcp[(]\S+[)]=(?<syslog_drops>\d+[^'])
SOURCE_KEY = _raw
Sample statistics entry
Feb 13 03:11:01 slavvwelss01v01 syslog-ng[19001]: Log statistics; processed='destination(d_10.173.249.211_5)=100544707', processed='source(s_network_6)=100544708', processed='global(payload_reallocs)=401769', dropped='dst.tcp(<b>d_10.173.249.211_3</b>#0,10.173.249.211:514)=<b>88484837</b>', processed='dst.tcp(d_10.173.249.211_3#0,10.173.249.211:514)=100544708', stored='dst.tcp(d_10.173.249.211_3#0,10.173.249.211:514)=20001', processed='destination(d_10.173.249.211_6)=100544708', processed='source(s_network_7)=100544560', dropped='dst.tcp(<b>d_10.173.249.211_6</b>#0,10.173.249.211:514)=<b>88263146</b>', processed='dst.tcp(d_10.173.249.211_6#0,10.173.249.211:514)=100544709', stored='dst.tcp(d_10.173.249.211_6#0,10.173.249.211:514)=20001', processed='destination(d_10.173.249.211_7)=100544560', processed='source(s_local)=225508438', processed='global(msg_clones)=0', dropped='dst.tcp(d_10.173.249.211_1#0,10.173.249.211:514)=300011709', processed='dst.tcp(d_10.173.249.211_1#0,10.173.249.211:514)=326053162', stored='dst.tcp(d_10.173.249.211_1#0,10.173.249.211:514)=20001', processed='destination(d_local_msgs)=225508438', dropped='dst.tcp(d_10.173.249.211_4#0,10.173.249.211:514)=88282600', processed='dst.tcp(d_10.173.249.211_4#0,10.173.249.211:514)=100544706', stored='dst.tcp(d_10.173.249.211_4#0,10.173.249.211:514)=20001', processed='src.internal(s_local#1)=225506018', stamp='src.internal(s_local#1)=1360685461', processed='source(s_network_1)=100544726', dropped='dst.tcp(d_10.173.249.211_7#0,10.173.249.211:514)=88356001', processed='dst.tcp(d_10.173.249.211_7#0,10.173.249.211:514)=100544562', stored='dst.tcp(d_10.173.249.211_7#0,10.173.249.211:514)=20001', processed='global(sdata_updates)=1407495255', processed='destination(d_10.173.249.211_1)=326053164', processed='source(s_network_2)=100544585', dropped='dst.tcp(d_10.173.249.211_2#0,10.173.249.211:514)=88193930', processed='dst.tcp(d_10.173.249.211_2#0,10.173.249.211:514)=100544585', stored='dst.tcp(d_10.173.249.211_2#0,10.173.249.211:514)=20001', processed='destination(d_10.173.249.211_2)=100544585', processed='source(s_network_3)=100544708', processed='center(received)=0', processed='destination(d_10.173.249.211_3)=100544708', processed='source(s_network_4)=100544706', dropped='dst.tcp(d_10.173.249.211_5#0,10.173.249.211:514)=88461990', processed='dst.tcp(d_10.173.249.211_5#0,10.173.249.211:514)=100544707', stored='dst.tcp(d_10.173.249.211_5#0,10.173.249.211:514)=20001', processed='center(queued)=0', processed='destination(d_10.173.249.211_4)=100544706', processed='source(s_network_5)=100544707'
Any help would be greatly appreciated.
Regards,
Brett.
... View more
04-17-2012
10:18 PM
Hey gkanapathy,
Thanks for the response.I guess that I have two options for the server-side SSL connection then:
1.Import the load balancer's default key into the indexer as the trusted key; or
2.Load the search head's key into the load balancer (server side SSL config) and the indexer, so that the LB can present this to the indexer on behalf of the search head.
Which approach would be considered "best practice"?
Rgds,
Brett.
... View more
04-17-2012
08:55 PM
Hi,
I have 2 sites that both contain the same full set of syslog log files. I am currently looking to ingest the logfiles at both sites, using the other site to fail over to in the event of an indexer going down - a load balancer (F5 LTM) would take care of this for me. Each site will also have some local indexers that ingest information that is only relevant to that site. The search head at each site would be configured for distributed search, pointing at the indexers containing site-relevant data and at a virtual server on the load balancer, which is configured with a pool containing the local and remote syslog indexers (local site preferred).
Is it possible to front an indexer with a load balancer for high availability in a distributed search scenario, and if so, what caveats, if any, exist? What about any certificate exchange between the search head and indexer(s)?
Regards,
Brett.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
