Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About modernjameschen
modernjameschen
Loves-to-Learn Everything
Member since:
12-02-2019
05-15-2021
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-02-2019 |
Activity Feed
- Posted Re: "No results found " when monitoring remote devices on All Apps and Add-ons. 11-03-2020 07:25 PM
- Tagged "No results found " when monitoring remote devices on All Apps and Add-ons. 10-23-2020 11:36 PM
- Posted "No results found " when monitoring remote devices on All Apps and Add-ons. 10-23-2020 11:25 PM
- Posted "No results found "when I run a search on the dashboard on All Apps and Add-ons. 01-02-2020 01:39 AM
- Tagged "No results found "when I run a search on the dashboard on All Apps and Add-ons. 01-02-2020 01:39 AM
- Tagged "No results found "when I run a search on the dashboard on All Apps and Add-ons. 01-02-2020 01:39 AM
- Tagged "No results found "when I run a search on the dashboard on All Apps and Add-ons. 01-02-2020 01:39 AM
- Tagged "No results found "when I run a search on the dashboard on All Apps and Add-ons. 01-02-2020 01:39 AM
- Tagged "No results found "when I run a search on the dashboard on All Apps and Add-ons. 01-02-2020 01:39 AM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-28-2019 12:06 AM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-28-2019 12:03 AM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-22-2019 07:51 PM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-21-2019 12:50 AM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-19-2019 07:10 PM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-16-2019 07:20 PM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-16-2019 06:50 PM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-13-2019 06:30 PM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-08-2019 11:22 PM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-07-2019 12:44 AM
- Posted Re: How can I monitor network device or server on splunk ? like pingstatus command or something? on Splunk Enterprise Security. 12-05-2019 07:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-03-2020
07:25 PM
@kennetkline Thank you for your quick reply to my question. 1.I think just need to "packet_loss" this data point for each panel. And the panel's common sources is "index="pingstatus" "dest=192.168.x.x" | chart avg(packet_loss)" ,Just hosts destination is different. 2.Like index = "pingstatus" can get the data. l need to monitor about 70 hosts. 3.Because I have about 70 hosts that need to be monitored, I don’t know which deployment architecture to use. Currently I use Single-Instance Deployment: All-in-One Using a splunk-enterprise-addon app (Network-toolkit) , I don't know how many users are needed。Currently testing the splunk environment It is a single-core cpu, 1.5G of memory, a dashboard requires a background search, there are already about 70 Because I want to monitor the normal operation of the equipment or server in real time, so you suggest what core CPU and how much memory I need. I want to know clearly which equipment is missing，Or is it that the refresh interval between my two times is too short to cause my performance consumption?Or is it that the refresh interval between my two times is too short to cause my performance consumption? Or do you have other better ways to monitor these devices? thank you very much
... View more
10-23-2020
11:25 PM
Hello，guys I using the [network toolkit] application to monitor remote device,Set in Data inputs> ping 5 pings in 60 seconds,search field with Visualization,Below is my search code index="pingstatus" "dest=192.168.0.210" | chart avg(packet_loss) I add about 20 devices，But the dashboard shows no search results No results found after a few minutes Below is my time limit & refresh code <search>
<query>index="pingstatus" "dest=192.168.0.12" | chart avg(packet_loss)</query>
<earliest>-60s</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search> Warning message appears on the page The instance is approaching the maximum number of historical searches that can be run concurrently. And I check$SPLUNK_HOME/var/log/splunk/splunkd.log and there are warning messages 10-22-2020 14:18:56.436 +0800 WARN DispatchManager - The instance is approaching the maximum number of historical searches that can be run concurrently.
10-22-2020 14:19:31.376 +0800 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/admin__admin__search__search4_1603347571.892/metadata.csv splunk version :splunk-enterprise 8.0.6 network toolkit version:1.4.3 virtualbox: Operating system : Ubuntu 18.0.4(64bit) CPU Cores(Physical/Virtual):1/1 Disk Usage(GB):80 Physical Memory Capacity(MB):1489 ------------------------------------------------------- Anyone can help me ? Or does anyone have other ideas for monitoring remote devices? Thanks a lot!
... View more
- Tags:
- net
Labels
- Labels:
-
dashboard
-
search
-
troubleshooting
01-02-2020
01:39 AM
I create a dashboard to monitor the device
Using the network toolkit application
Set in Data inputs> ping
Run every 30 seconds
search field with Visualization
Below is my dashboard code
<dashboard>
<label>Monitor Device</label>
<row>
<panel>
<title>192.168.x.x</title>
<single>
<search>
<query>index = main "dest=192.168.x.x" | chart avg(packet_loss)</query>
<earliest>-30s</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>15s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051","0xf8be34","0xf1813f","0xdc4e41","0xdc4e41"]</option>
<option name="rangeValues">[26,51,76,100]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
...
</dashboard>
No results found after a few minutes
This is very confusing to me
Who can help me
Thanks a lot
Incidentally ,I monitor about 70 devices
Use splunk enterprise version:8.0.1
network toolkit version:1.4.3
Operating system : Ubuntu 18.0.4
I am changing parameters in SPLUNK_HOME /etc/system/local/limits.conf
# The base number of concurrent searches.
base_max_searches = 30
# Max real-time searches = max_rt_search_multiplier x max historical searches.
max_rt_search_multiplier = 30
# The maximum number of concurrent searches per CPU.
max_searches_per_cpu = 30
... View more
12-28-2019
12:06 AM
HIi @woodcock
Thanks for your response
But my job needs to use splunk to monitor the device
... View more
12-28-2019
12:03 AM
HI @DavidHourani
Thanks for your help, thank you very much
... View more
12-22-2019
07:51 PM
Thanks , @DavidHourani
I would like to ask,If I change the system / default folder.
Will other problems occur? Or will they just be warned?
What is the correct way?
Should I add a limits.conf in system / local?
And how to ad hoc searches ?
Please give me teaching or steps
Also I need to monitor about 80 devices
Thank a lot~
... View more
12-21-2019
12:50 AM
Sorry i didn't express clearly
I added multiple search results to the dashboard
But only seven or six searches are working, and other searches appear to be pending
I query other information and need to change splunk_home / etc / systems / default / limits.comf
The base number of concurrent searches.
Default :"base_max_searches = 6"
Modify to my search limit
Yes, I am the admin of splunk platform
But new warning messages appears
Configuration initialization for /opt/splunk/etc took longer than expected (1044ms) when dispatching a search with search ID rt_admin_adminsearch_search124_rt_1576917618.450. This usually indicates problems with underlying storage performance.
other warning message is
File Integrity checks found 1 files that did not match the system-provided manifest. Review the list of problems reported by the InstalledFileHashChecker in splunkd.log File Integrity Check View ; potentially restore files from installation media, change practices to avoid changing files, or work with support to identify the problem.
any ideal?
... View more
12-19-2019
07:10 PM
hi @DavidHourani
I met a problem
I try to create a monitoring dashboard
Save each search result as a monitoring dashboard
But i have a problem
You ca n’t add more than seven search results
I try to edit the source of the dashboard
Can increase search results but not perform
Can only perform up to seven searches
Below is my code
Any ideas
<dashboard>
<label>Monitor device</label>
<row>
<panel>
<title>2F-AP : 192.168.0.12</title>
<single>
<title>192.168.0.12 happne error</title>
<search>
<query>index = main "dest=192.168.0.12" | chart avg(packet_loss)</query>
<earliest>rt-60s</earliest>
<latest>rtnow</latest>
<sampleRatio>1</sampleRatio>
<refresh>10m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0.0</option>
<option name="rangeColors">["0x53a051","0x53a051","0xf8be34","0xf1813f","0xdc4e41","0xdc4e41"]</option>
<option name="rangeValues">[0,26,51,76,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
．
．
．
</row>
</dashboard>
Or where I can setup limit
Thanks a lot
... View more
12-16-2019
07:20 PM
And I have a question，
I want to create a dashboard for visualisation.
How to use the field search to show two charts
One side show dest ip and avd_ping
The other side show the value of dest ip and packet_loss rate
any ideal or suggest ?
... View more
12-16-2019
06:50 PM
Thanks @DavidHourani
I changed the Mail host and Email securtiy
Then successfully send email
Mail host : smtp.gmail.com:587
Email security : Enable TLS
Can send mail with gmail account
... View more
12-13-2019
06:30 PM
hi @DavidHourani
I have configured splunk instance
But I could n’t receive EMAIL, so I checked $ SPLUNK_HOME / var / log / splunk / splunkd.log
An error message appears
12-14-2019 10:10:00.256 +0800 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=http://user:8000/app/search/@go?sid=rt_scheduler__admin__search__RMD5f497f97cb39c3595_at_1576144552_1.21" "ssname=test 2f2p error" "graceful=True" "trigger_time=1576289398" results_file="/opt/splunk/var/run/splunk/dispatch/rt_scheduler__admin__search__RMD5f497f97cb39c3595_at_1576144552_1.21/results.csv.gz" "is_stream_malert=False"': ERROR:root:{u'myemail@mdg.com.tw': (553, '5.7.1 <splunk@user>: Sender address rejected: not owned by user Username@mdg.com.tw')} while sending mail to: myemail@mdg.com.tw
Have any ideal?
Thanks a lot
... View more
12-08-2019
11:22 PM
hi @DavidHourani ,
I changed the trigger condition to
Number of results >0
Also change the trigger action to
Add to Triggered Alerts list and sent email.
I can see that Triggered Alerts have events.
But it still cann't to send email
It's very confused to me
Any ideal ?
Thanks ，james
... View more
12-07-2019
12:44 AM
hi @DavidHourani
I change my search
index = main sourcetype = "ping_input" packet_loss = 100
And also set alert
But the alert still not working
I don't know what went wrong
Is it possible to trigger a condition?
I don't know which one to choose
(Number of Results
Source of Results
Host of Results)
Please help me
thank you very much
Alarm type: real-time
Number of Results
Trigger: Number of sources equals 100
Once in 1 minute
Per-Result trigger option.
Trigger action: send email
... View more
12-05-2019
07:11 PM
Hi @DavidHourani
Yes ，I am created alert in the network toolkit app,
and I setup the permissions of the network toolkit app to global ，But I have a question, why should I create an index
Where to go to add a profile index
Which folder?
Can you give me steps
thank you very much
... View more
12-05-2019
01:17 AM
@DavidHourani
I already have search
[sourcetype = "ping_input" packet_loss = 100]
Saved as an alert, but the alert is not working
Alarm type: real-time
Trigger: Number of sources equals 100
Once in 1 minute
Per-Result trigger option.
Trigger action: send email
And I don't know where to set the script
In splunk / etc / apps / network_tool / bin ?
Which folder?
Please help me
19/12/05 16:29:16.000
sent=3 received=0 packet_loss=100 min_ping=NA avg_ping=NA max_ping=NA jitter=NA return_code=1 dest=192.168.0.12
host = ubuntusource = pingsourcetype = ping_input
Above is my search: [sourcetype = "ping_input" packet_loss = 100]
... View more
12-03-2019
08:05 PM
Thank @DavidHourani .
I started running ping in network toolkit
But I have a question, how can I make the setting return a Response Time every second
And how to set an alert when the ping packet is lost
Or need to configure anything else
Any ideas?
... View more
12-03-2019
12:57 AM
Hi @DavidHourani ,
Thank you for your quick response
Yes,l using "pingstatus" command from Splunkbase
But I still don't understand how pingstatus works and configures
I want to know immediately the status of the ping ,Iike Destination host 、Feedback time、Packet loss rate ...
Or you suggest me to use NETWORK TOOLKIT
Which one is easier to get started
Or any idea
james,Thanks
... View more
12-02-2019
11:19 PM
Hello everyone,
I am a Rookie, I use splunk for linux,I tried running pingstatus command on splunk
But I don’t know if it was successful, I also read Readme.txt
and configured in commands.conf and authorize.conf
Can someone answer or teach me ? or there are other methods or applications that can monitor network devices
and if package have loss 100% then send a alert notification
It's best to start over
The more detailed the better
Thanks everyone
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-15-2021
04:17 AM
|
