About Genti

Genti · ‎09-13-2010

sounds to me like you have not yet set up forwarding... try that first, and if so, try pasting the whole inputs.conf as well as your outputs.conf. Also make sure your indexer is set up to receive events.

Genti · ‎09-13-2010

crcSalt = followtail = 1 crcSalt = * Use this to force Splunk to consume files with matching CRCs. * Set any string to add to the CRC. * If set to "crcSalt = ", then the full source path is added to the CRC. Im assuming after the upgrade splunk is reading a different CRC, and this is causing the double indexing.

Genti · ‎09-13-2010

cd to the dir where you untared cd splunk/bin/ ./splunk start Please read the installation docs found at: http://www.splunk.com/base/Documentation/latest/Installation/InstallonLinux

Genti · ‎09-13-2010

Caio, is this on a unix box? If so, there might be a permission issue as only root can open ports under 1024. You can try listening to tcp on a higher port, say 9001. Let us know if you get similar errors then. Cheers, .gz

Genti · ‎09-13-2010

Issue seems to have been fixed. Not sure if the update to recent version is what fixed it or if they are just better connected to the syslog server.. In anycase, customer seems to be content!

Genti · ‎08-03-2010

Another thing you can try is use fschange on /splunkhome/etc/users/ directory. This way you could use the DIFF command for the files within to see what changed. I doubt you would be able to tell WHO changed it though. So, by the first reply, you can possibly see who changed user privileges, and by the second one you can tracked what was changed. I think this is as far as we can presently go with splunk.

Genti · ‎08-03-2010

i think that is all the logs will be able to tell you. If you want more info you can file an enhancement request.

Genti · ‎08-03-2010

good point. So far i told them to keep their indexes untouched, and have all the new data on the new indexes be separated. Depending on their retention policies, the old index will be moved to frozen anyway..

Genti · ‎08-02-2010

See if this other thread helps you out: http://answers.splunk.com/questions/2286/search-for-deleted-splunk-users/3346#3346 Granted deleted vs modified is a bit different but im assuming it could be done in a similar way?

Genti · ‎08-02-2010

specificlly: Do you want to monitor logs only? Monitor config files? JVM Metrics? All of the above? Where do the logs reside, i assume locally on each of the websphere application server instances? Is the websphere ND admin console going to generate logs as well, or is it only managing the server instances?

Genti · ‎08-02-2010

mdobbie, can you be more specific: 1- what are you trying to achieve, 2- what are you intending to monitor? I believe what you ask can be supported, but more info is needed before we give a more complete answer.

Genti · ‎08-01-2010

show some sample data and the two regexes in props/transforms.

Genti · ‎07-31-2010

The license should clear 30 days after the latest violation. Last one was july 1st, so it should clear july 31st. If it has not cleared yet it might be because of the time on which it happened? (ie, check back and notify support if it has not cleared by Aug 1st)

Genti · ‎07-30-2010

(sorry, couldnt fit all the reply into one comment)

Genti · ‎07-30-2010

So you can ask your search to only show you the field you are interested in, and dedup by that field (so you do not get duplicates)... Perhaps im not understanding your question too well either 😕

Genti · ‎07-30-2010

well from what i understood it seemed like the first search is running, and returning some sort of result. If the result > 0 (or whatever condition you have put) it seems like a second search is running and returning results, but theres too much noise and not easy for you to see the necessary info. (you say - "I have tried ways to do this with subsearches as well as appending the two searches, which works but has too much data") So, if that is the case, what you see is results to your second search but too much noise,

Genti · ‎07-30-2010

(i assume) sourceip and username are actually fields. If so then i think you can use: < your search > | fields sourceip, username | dedup sourceip Try the above in the search that runs second, this way perhaps you will get less data and only the fields you want? Note, i havent tested this so i cant tell if it works 100% but i think it should... Best, .gz

Genti · ‎07-30-2010

so the key/value pairs are extracted automatically by splunk. basically anything that has in the logs, username=user123 role=role1 will be picked up as fields (ie, username and role will be fields and user123 and role1 will become the values). If however your delimiters are different (like double colon :: or something else) , you might want to define them prior to starting indexing. Another thing you can do is have a few sample logs be indexed and train your splunk to recognize the fields that you want either by regexes within props.conf/transforms.conf or within splunkweb. Cheers, .gz

Genti · ‎07-30-2010

Noah, you can ask another question with more specifics but what you want to do can be achieved using props/transforms.conf. Check the following: http://www.splunk.com/base/Documentation/4.1.4/Admin/Advancedsourcetypeoverrides

Genti · ‎07-30-2010

it should be easy to achieve by the following (or similar input stanza) [monitor:///var/log/messages/] sourcetype = syslog index = chosen-one It would be beneficial to show us what the current configuration is so that we can take a peak and if needed, edit the necessary bits. Cheers!

Genti · ‎07-29-2010

replacing inputs.conf (and restarting the server) will only make the new data that comes in obey the rules in the new inputs.conf. The data that is originally there will not be reindexed and it will not change to obey the new rules. For reindexing you will need to use the clean command, or perhaps use crcSalt

Genti · ‎07-28-2010

I had a similar case just today. Try the following props.conf: [weblogs] KV_MODE = none REPORT-extracts = csv_extract protocol_extract Let me know how it goes, .gz

Genti · ‎07-27-2010

This came up yesterday when i wanted to find out if there was a difference in time between the event creation time and event logging time. Yes, Splunk reads the timestamp from the actual event and when indexing the log puts the correct timestamp that it reads, however does this happen real time, or does it take splunk a while to have the event come in? - This is very important for alerting purposes.. So, in order to check how quickly splunk is indexing your logs you can run a search such as the following and get some pretty cool results: <your specific search> | eval time=_time | eval indextime=_indextime | eval diff=indextime-time | where diff>=0 | convert ctime(indextime) | convert ctime(time) | fields indextime time diff

Genti · ‎07-27-2010

I think it is taking splunk some time to capture new events. Is there a way to be able to tell exactly how long it takes Splunk to index new events, or even a way to tell how long it has taken for each event to get into Splunk?

Genti · ‎07-27-2010

By going to Permissions and choosing the ALL APPS option you can set the permission to the specific app only or globally... Furthermore, you should allow everyone to READ and the owner only to Write. Otherwise just cut and paste the .conf file as you already have done.. Hope this helps, .gz

Posts	377
Solutions	82
Karma Given	153
Karma Received	345
Member Since	‎05-04-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Search help: remove intersection of two sets from ...

When creating a diag, splunk complains about splun...

How can i modify flashtimeline so that i can show ...

How to monitor .dat.gz files?

time format for results in en-US vs en-GB

on a '| metadata type=hosts' search, what do each ...

how to get host, sourcetype and source from a sing...

(search time) extracted field not showing up on th...

date_* fields not being extracted

Using the Rest API endpoint, how do i know if a se...

Re: Monitoring a file in windows forwarder on Splu...

Re: Why are my files being re-indexed?

Re: Splunk Install on Ubuntu 10.4

Re: Setting up Splunk receiver through TCP/IP

Re: syslog data missing

Re: Audit modifications to a user account

Re: Audit modifications to a user account

Re: How to divide an existing index into a few new...

Re: Audit modifications to a user account

Re: Can Splunk monitor a WebSphere Application Ser...

Re: Can Splunk monitor a WebSphere Application Ser...

Re: Transform, but only when matching this RE

Re: License violation message

Re: Having a search trigger another search

Re: Having a search trigger another search

Re: Having a search trigger another search

Re: Having a search trigger another search

Re: Is it necessary to define your fields ahead of...

Re: How do I get my Splunk server to start reading...

Re: Capture Forwarded syslog events from a syslog ...

Re: replacing inputs.conf

Re: Trying to extract field, from a CSV extracted ...

Re: How do i find out how long it takes Splunk to ...

How do i find out how long it takes Splunk to actu...

Re: How to save a search in an app instead of user...

Join the Conversation