Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About myandow
myandow
Path Finder
Member since:
04-18-2011
05-23-2022
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 16 |
| Karma Received | 4 |
| Member Since | 04-18-2011 |
Activity Feed
- Karma Re: Why is a value appearing twice in a table but only occurs once in the event data? for jbillings. 01-05-2022 07:16 AM
- Karma Re: Why am I seeing inconsistent results when specifying fields from an index time extraction in my searches? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How can i query to get all alerts which are configured? for woodcock. 06-05-2020 12:48 AM
- Got Karma for What is the best practice for bringing down a search head cluster member?. 06-05-2020 12:48 AM
- Karma Re: Search head returning no results from peer for TAE2112. 06-05-2020 12:47 AM
- Karma Re: ldapfilter is giving me ERROR Missing required value for server in ldap/mydomain but ldapsearch works for ktwombley. 06-05-2020 12:47 AM
- Karma Host override at search time for giorgio_adami_m. 06-05-2020 12:47 AM
- Karma Re: Host override at search time for claudio_manig. 06-05-2020 12:47 AM
- Karma Re: Finding searches for a user for yannK. 06-05-2020 12:46 AM
- Karma Re: Transaction incorrectly grouping results for baerrach. 06-05-2020 12:46 AM
- Karma Re: How do I set up the S.o.S app to monitor Splunk's system resource consumption? for hexx. 06-05-2020 12:46 AM
- Karma Splunk Lookups Return Error Even When Permissions Are Global for aelliott. 06-05-2020 12:46 AM
- Karma Re: How can I configure Splunk Forwarder to NOT index historical WinEvents? for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: Lost forwarder search case sensitive for host name for rgcox1. 06-05-2020 12:45 AM
- Karma Re: AuthorizationFailed: [HTTP 403] when clicking on the link in an alert email for Ellen. 06-05-2020 12:45 AM
- Karma Re: Problem with Stacked Area Chart for sideview. 06-05-2020 12:45 AM
- Karma Re: What are the metrics.log fields avg_age and max_age? for jbsplunk. 06-05-2020 12:45 AM
- Got Karma for What are the metrics.log fields avg_age and max_age?. 06-05-2020 12:45 AM
- Got Karma for What are the metrics.log fields avg_age and max_age?. 06-05-2020 12:45 AM
- Got Karma for What are the metrics.log fields avg_age and max_age?. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 3 |
05-02-2017
06:08 AM
Is there a best practice to restrict access to events in Splunk by index and sourcetype?
I have tested using the "Restrict search terms" setting, but have found that there are far too many unintended side-effects that make this an undesirable option. As far as I can tell the best option is to use the forwarder to split up sourcetypes by index, and then assign the access to each index via roles.
Am I missing any other options? What do other people do to provide this functionality?
... View more
02-14-2017
09:24 AM
We have a number of indexes that have a coldToFrozenDir specified with both maxTotalDataSizeMB and frozenTimePeriodInSecs in our indexer cluster.
As expected based on this document: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Automatearchiving#Clustered_data_archiving
we are seeing multiple copies of buckets being frozen across our indexers, one that starts with db_ and the others start with rb_.
Per the following answers:
https://answers.splunk.com/answers/258816/thawing-data-in-an-indexer-clustering-environment.html
https://answers.splunk.com/answers/153341/thawed-buckets-error-clusterslavebuckethandler-failed-to-trigger-replication.html
it sounds like we can thaw our data outside the cluster on a stand alone indexer using only the db_ buckets.
If that is the case, is it safe for us to just delete all the rb_ frozen buckets? Will we face any data loss by only using the db_ buckets to thaw frozen data from the cluster?
... View more
10-24-2016
11:29 AM
I just wanted to add that in order to avoid impacting any long running adhoc searches you should first check the search activity in the DMC for the search head in question and verify there are no active adhoc searches. After that has been verified then wait 10 minutes before starting the maintenance.
... View more
09-20-2016
05:58 AM
In our existing distributed indexer cluster we have systems with slightly different configurations(storage and some slight hardware differences). I'm trying to determine if there is any difference in performance being seen by Splunk across each of these systems related to typical indexer functionality. Is there a way to measure the performance of each indexer in the existing environment for comparison?
... View more
09-19-2016
10:11 AM
I will follow up with a more open ended question regarding performance comparisons. I am still interested in finding the answer to this particular question as well.
Replication:
origin:3,total:6
Search:
origin:2,total:4
... View more
09-19-2016
06:27 AM
The reason I am looking to query the indexers in this way is for troubleshooting and performance testing. We have some indexers setup on different hardware/storage and with different OS configurations and want to see if we can get an apples to apples comparison on performance for searches and indexing. If we can pull the same events from each indexer then we can be more confident in the uniformity of the data set that we are querying.
... View more
09-16-2016
08:03 AM
We have a distributed environment with multi-site indexer clustering and search head clustering. The replication factor is setup so that every indexer will have a copy of all data that has been indexed by the cluster. I'm trying to figure out if there is a way to craft a query from our search heads that will be directed to a specified indexer in the cluster and get it to return all data for a particular index.
If I specify splunk_server in the query, it seems to direct the request to the indexer specified, but it only returns events that were indexed by that particular indexer, not all events that have been indexed by the cluster.
Is there another way to go about this?
... View more
09-13-2016
06:28 PM
This lead me down the right path, although it wasn't adding them to the fields.conf on the search heads that fixed the problem, it was adding them to the fields.conf on the indexers. We are running 6.2 for reference.
... View more
09-07-2016
08:00 AM
Using the walklex command as suggested, and searching for facility* seems to return expected results:
my needle: facility*
836948 19333 facility::auth
836949 14587 facility::authpriv
836950 5172 facility::cron
836951 1264740 facility::daemon
836952 6634 facility::kern
836953 173438 facility::local0
836954 54 facility::local1
836955 394973 facility::local4
836956 2306 facility::local6
836957 242 facility::local7
836958 526506 facility::mail
836959 84882 facility::news
836960 1344 facility::syslog
836961 173157 facility::user
Configuration settings on the indexers
props.conf
[unix-syslog]
SHOULD_LINEMERGE = False
TRANSFORMS-strip-usyslog = usyslog-priority-facility, usyslog-host, usyslog-header-stripper-ts-prio-host
transforms.conf
[usyslog-priority-facility]
REGEX = ^<(\w+)\.(\w+)> [A-Z][a-z]+\s+\d+\s+\d+:\d+:\d+\s[^\s]*\s.*$
FORMAT = facility::$1 severity::$2
WRITE_META = true
[usyslog-host]
REGEX = ^<\w+\.\w+> [A-Z][a-z]+\s+\d+\s+\d+:\d+:\d+\s([^\s]*)\s.*$
FORMAT = host::$1
DEST_KEY = MetaData:Host
[usyslog-header-stripper-ts-prio-host]
REGEX = ^<\w+\.\w+> [A-Z][a-z]+\s+\d+\s+\d+:\d+:\d+\s[^\s]*\s(.*)$
FORMAT = $1
DEST_KEY = _raw
Sample message (with ips and hostnames redacted)
<daemon.info> Sep 7 13:37:19 XXXXXX.XXXXXXX.XXXXXX.XXXXX.com named[1147]: zone XXXXXX.XXXXXX.XXXXXX.com/IN/default: refused notify from non-master: XXX.XX.XXX.XXX#43538
... View more
09-06-2016
02:14 PM
The results when I use facility::daemon match the results of facility=*daemon , in that I get 27 results returned.
The results when I use facility=TERM(daemon) match the results of facility=daemon in that I get 0 results returned.
Is there a reason that the format of key::value works, but key=value does not work as expected in the searches?
... View more
09-06-2016
10:40 AM
We have an index time extraction that pulls out the facility and severity from syslog. This extraction occurs prior to another extraction that removes the values from _raw before indexing.
What I am seeing is that when I search using one of those two fields I get very odd, inconsistent search results.
For instance, for a set period of time (1 minute):
index=test "test search string11223344" | search facility=daemon
yields 27 results.
while the search:
index=test "test search string11223344" facility=daemon
yields 0 results.
And the search:
index=test "test search string11223344" facility=*daemon
yields 27 results.
It is almost like there is an invisible character at the beginning of the fields, but if there was I wouldn't expect the first example to work as it does.
... View more
07-22-2016
08:50 AM
We have a lot of users that kick off long running searches and then background them. Are those still considered ad-hoc searches? It is not ideal if a user does this, and then never gets a notification that the search completed or failed to complete, due to a scheduled maintenance.
... View more
07-12-2016
10:45 AM
As a follow up question, will a rolling restart of the cluster kill off running searches as well?
... View more
07-08-2016
10:32 AM
1 Karma
I'm trying to find some guidance on the best way to bring down a member of a search head cluster without impacting any of the searches that are currently running on it. What I have found in my limited testing is that following this documentation: http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/Removeaclustermember will cause the searches running on the search head to be orphaned and they are no longer viewable in the job manager on the remaining active cluster members.
Is there a best practice when preparing for a scheduled maintenance to bring down a member of a search head cluster so that there will be no impact to the system as a whole?
... View more
07-17-2012
07:52 AM
In case anyone else is trying to do this as well, this is what I found worked for me. I assigned the weights to each different event using case() then appended another search where I assigned EndTime to _time and applied the negative weights. Then using accum, kept a running sum of the weights, which then represents the Concurrency.
index=myIndex | eval Weight=case(eventType="eventA", 2, eventType="eventB", 3,eventType="eventC",1,1=1,0) | append [search index=myIndex | eval Weight=case(eventType="eventA", -2, eventType="eventB", -3,eventType="eventC",-1,1=1,0) | eval _time=EndTime | sort _time] | sort _time | accum Weight as Concurrency
... View more
07-16-2012
07:57 AM
I am trying to calculate a weighted concurrency across 3 different event types. Each of these event types has a single log entry that contains the type, the startTime, and EndTime. Each of the event types has a different weight associated with them, so using the straight up concurrency result returned by the concurrency command is not accurate. For instance:
eventA - weight 2
eventB - weight 3
eventC - weight 1
If eventC starts when 2 other eventCs are running then the concurrency is 3 (as returned by the concurrency command). But, if eventC starts when 2 other eventAs are running then the concurrency should be 5. If eventC starts when an EventA and an eventB are running then the concurrency should be 6. Any suggestions on how to calculate these weighted concurrency values?
... View more
- Tags:
- concurrency
05-09-2011
11:50 AM
3 Karma
Can someone point me to documentation that explains what the avg_age and max_age fields in the metrics logs are for? They do not appear in all of my metrics logs, but they are the last two fields when they do show up.
example:
05-09-2011 18:39:33.979 +0000 INFO Metrics - group=per_index_thruput, series="my_index", kbps=79.754883, eps=86.866667, kb=2392.646484, ev=2606, avg_age=420232.710668, max_age=420241
... View more
- Tags:
- metrics.log
