About wmosher

wmosher · ‎09-24-2012

For bonus points PDE, any creative solutions to still using restartSplunkd=true in my Deployment Server's serverclass.conf and not ending up with all my forwarders in SMF maintenance mode every time I want to push a change?

wmosher · ‎05-22-2012

Thanks dwaddle this is exactly what I'm looking for. We have the occasional event above 51,200 characters. The field I am interested in is always the last thing in the event. Since performance could be a concern would it make more sense to extract that field at index time with a transform or would this also be just as taxing?

wmosher · ‎05-14-2012

Automatic field extraction doesn't appear to always work after a certain number of characters deep into a (single line) event. One of our data types always ends in a key=value timinging of how long the transaction took to process. It appears that after around 10,000 bytes of data the field does not automatically get extracted. The event is not visibly truncated, and I can see the field we want in _raw. I can even rex it out just fine. Is there a setting somewhere that tells the field extractor how deep in an event to look?

wmosher · ‎02-17-2012

I'm still confused. Is it safe to say the first value is always the success count, and the second value is always the failure count? Or is there something linking some events to other events that I am missing? Do you care about time or just overall totals and averages in your output? Is the average you want supposed to be an average over some span of time or average per event? Would your example timechart work better with sum(success_count) rather than count?

wmosher · ‎02-16-2012

I'm going back and forth with myself as to whether or not I understand your issue. Would something like "timechart avg(f1), min(f1), max(f1), avg(f2), min(f2), max(f2)" be what you are looking for? You could also throw the ratio in there using an eval. If I am still way off maybe providing the example output you want for your example input above would help clarify?

wmosher · ‎02-16-2012

Would the rex command help you? Something like: {your search} | rex field=_raw " \d\d:\d\d:\d\d\",(? \d*),(? \d*)" | timechart avg(field2) by field1

wmosher · ‎02-16-2012

I don't know about desktop widgets specifically, but there is a Splunk Java SDK which could probably be used to accomplish something like this. Info is here: http://dev.splunk.com/view/java-sdk/SP-CAAAECN

wmosher · ‎02-10-2012

Not sure if you ever found an answer to this but the default tool tips in version 4.3 are so much better. Worth upgrading for that alone!

wmosher · ‎02-07-2012

Clever idea piebob!

wmosher · ‎02-07-2012

Yes, I mentioned that command in my original post. The help only states "deploy-server disable or enable deployment server capability" which as I noted doesn't tell me what it does. I am trying to ensure this will not cause the deployment clients remove the apps that came from the deployment server.

wmosher · ‎02-03-2012

+1 for less aggressive here

wmosher · ‎02-03-2012

I am going to upgrade from 4.2.4 to 4.3 and the documentation recommends disabling the deployment server first and enabling it last. The problem is my summary jobs live on the same Splunk instance and so leaving the whole thing down while I upgrade five indexers is not feasible. Is there some way to turn off the deployment server without causing all the deployment clients to remove their apps? I found something mentioning running "/opt/splunk/bin/splunk disable deploy-server" but I have no idea what this will actually do and how the deployment clients would behave. Thanks.

wmosher · ‎01-09-2012

This is pretty much an entirely new question, however if you save your search and check the box to schedule it, some alerting options will present themselves.

wmosher · ‎01-03-2012

The numbers from this query in your post look more accurate. index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB) The one I was trying to use must have worked at some point though, I got it from here: http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume We are using the Deployment Monitor app as well and love it, just wanted some additional total GB alerts at mid-day. Thanks so much!

wmosher · ‎01-03-2012

I am using the following query and getting data indexed totals much higher than expected. On our previous version/implementation of Splunk we encountered an occasional license violation but nothing like these numbers yet we have even less inputs turned on at this point. These are nearly three times larger than our license yet we have no violations so something has to be out of whack. index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool Does this query look okay? Am I using this data wrong? Does this log list pre-compressed totals or does it log cumulative totals?

wmosher · ‎05-12-2011

Thanks gkanapathy. Good point about the license. I was just using two as an example, we are pushing for four. Since we value performance over availability (at least until it goes down, LOL) I'm assuming a single cluster of four search peers is better than two mirrored clusters of two search peers. Under option one (splitting the data among the search heads) is this best managed by load-balancing or deliberately dividing up where forwarders are sending their data?

wmosher · ‎05-11-2011

We'd like to do a distributed search setup but it doesn't look like we'll be able to afford a second cluster of search peers for redundancy. If I understand things right (which very well may not be the case) this leaves me with two potential options (for simplicity sake we'll assume two search peers): OPTION 1: Send only half the data (by forwarder config or through load-balancing) to each search peer (indexer). ASSUMED CON: If a search peer goes down half the data is left out of any search. OPTION 2: Send all data to both search peers (indexer). ASSUMED CON: Search performance decreased because each has to index double the data. ASSUMED CON: Double the disk space needed for desired retention. ASSUMED CON: Must load-balance searches or add dedup to every search. Knowing full well that only I can answer this - which option is worse? Hopefully someone can tell me I just don't understand the intensions of distributed search or that there is some other solution. Thanks.

Posts	18
Solutions	0
Karma Given	4
Karma Received	7
Member Since	‎04-15-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Field extraction a problem with large events?

Temporarily disable deployment server?

License usage monitoring issue

DISTRIBUTED SEARCH: performance -vs- highavailabil...

Re: Is there a Solaris SMF manifest for Splunk?

Re: Field extraction a problem with large events?

Field extraction a problem with large events?

Re: Extracting stats from different fields in the ...

Re: Extracting stats from different fields in the ...

Re: Extracting stats from different fields in the ...

Re: Splunk widget for desktop environments?

Re: Controlling format of chart tooltips

Re: Temporarily disable deployment server?

Re: Temporarily disable deployment server?

Re: Deployment monitor reporting indexers overload...

Temporarily disable deployment server?

Re: License usage monitoring issue

Re: License usage monitoring issue

License usage monitoring issue

Re: DISTRIBUTED SEARCH: performance -vs- highavail...

DISTRIBUTED SEARCH: performance -vs- highavailabil...