About NickCorbettAt

NickCorbettAt · ‎08-21-2015

Hi Thanks for your response. I have installed the Splunk Add-On for AWS. I can see from the docs link that you posted how to capture a CloudWatch Metric, but not how to capture a CloudWatch Log. This should involve getting Splunk to read from the CloudWatch Log stream to which events are written - this is different from reading published metrics. Thanks Nick

NickCorbettAt · ‎08-20-2015

Hi I am using Splunk in AWS and, using the the Splunk App for AWS, want to get VPC Flow logs into Splunk. VPC Flow logs are put into Cloudwatch Logs. Does anyone know how to get Cloudwatch logs into Splunk? Thanks Nick

NickCorbettAt · ‎06-11-2015

Hi When I first set up Hunk in AWS it automatically 'discovered' my Hunk-enabled EMR cluster that was running. I've now added another Hunk-enabled EMR cluster - is there a way to re-run the discovery process so that it gets configured correctly? Thanks Nick

NickCorbettAt · ‎05-28-2015

Hi I think I've worked this out... I had entered my hdfs uri as: hdfs://<< node name >:<< port > and is should be: << node name >:<< port > In other words, you don't need to specify the hdfs:// Regards Nick

NickCorbettAt · ‎05-21-2015

Hi I am trying to configure the Splunk Hadoop Connect app. When I try to add a new cluster, I get the following error: > Failed to get entities' object ''. The Splunk server works as a Hadoop CLI (everything on this page is working: http://docs.splunk.com/Documentation/HadoopConnect/latest/DeployHadoopConnect/HadoopCLI) Any help appreciated 🙂 Thanks Nick

NickCorbettAt · ‎05-12-2015

Hi I would like to run Splunk in AWS. I would like to send log data to the system and, as Splunk indexes this, I would like Splunk to build a copy of my raw data in Amazon S3. I've looked at the following options, but nothing seems to quite fit: Shuttl (https://github.com/splunk/splunk-shuttl) looks good, but nobody is actively developing this Splunk Archiving: This archives Splunk's native files. I could write something to move files to S3, but it doesn't seem that I could get the raw data? I would guess that the raw data is somewhere deep in Splunk's file format, but is this likely to change in the future? Also, archiving looks like it works on old data and I would like to move data to S3 as it is indexed. Splunk Hadoop Connect: This seems to export parsed data, not the raw data (although I may have read this wrong). Any pointers would be most appreciated, Thanks Nick

NickCorbettAt · ‎04-30-2015

Hi To frame the question, here's a cut and paste from the the Splunk manual: If all goes well, the indexer: Receives the block of data. Parses the data. Writes the data to the file system as events (raw data and index data). Sends an acknowledgment to the forwarder. The acknowledgment tells the forwarder that the indexer received the data and successfully wrote it to the file system. Upon receiving the acknowledgment, the forwarder releases the block from memory. My question is this: what happens if the acknowledgement is lost? Will the forwarder then send the same block to another indexer (assuming that you have >1 indexer). Does this mean you get duplicate data on your server? Thanks Nick

NickCorbettAt · ‎03-24-2015

Hi I am using Hunk on Amazon EMR. My source data is in 3 different folders in an S3 bucket. Can I tell Hunk to combine these 3 sources into a single Virtual Index? If not, whats the best way round this issue? Thanks Nick

Posts	8
Solutions	1
Karma Given	0
Karma Received	8
Member Since	‎03-24-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk App for AWS: How to get Cloudwatch (vpc flo...

How does Hunk automatically detect an EMR Cluster?

Config Error in Splunk Hadoop Connect

Export raw data from Splunk

How does a forwarder protect against the loss of i...

Can I tell Hunk to combine 3 different folders in ...

Re: Splunk App for AWS: How to get Cloudwatch (vpc...