About dmlee

dmlee · ‎09-19-2011

Hi, there are lots of ERROR messages in splunkd.log (version 4.2.3 , play as LightForwarder) and this Splunk LWF send all of the WinEventLog to indexer again and again , so there are many duplicate events in indexer. 09-20-2011 12:15:49.744 +0800 ERROR WinEventLogChannel - saveCheckpointStr: Unable to write checkpoint with a null string 09-20-2011 12:15:49.744 +0800 ERROR WinEventLogChannel - WELCheckPoint::save: Failed to save checkpoint file='': 操作順利完成(success)。 09-20-2011 12:15:49.837 +0800 ERROR WinEventLogChannel - saveCheckpointStr: Failed to rename checkpoint file '.tmp' -> '': 系統找不到指定的路徑(can't find the path) 。 any idea about it? thanks

dmlee · ‎08-09-2011

sorry , I missed something I saw you use "TRANSFORMS" to extract fields, it's index time field extraction , you need to "reindex" (chean and index again) your log files , I suggest you change to "REPORT" , it's search time field extraction . for more information about the difference between REPORT and TRANSFORMS , please refer to props.con.spec line 413.

dmlee · ‎08-09-2011

Hi , you can refer to below link : http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

dmlee · ‎08-05-2011

I think may be you mistyping : [monitor:///var/log/apache2] sourcetype = apache index = main whitelist = (access|error)\.log$ # there is only one backslash before dot and you can try another way : in inputs.conf [monitor:///var/log] whitelist = /client\.log|/apache2/access\.log$|/apache2/error\.log$|/app2\.log # there is only one backslash before dot index = main in props.conf [source::/var/log/app1/client.log] sourcetype = app1 [source::/var/log/apache2/*.log] sourcetype = apache [source::/var/log/app2.log] sourcetype = app2

dmlee · ‎08-05-2011

in your case , props.conf should be put on indexer not on UF (http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F )

dmlee · ‎08-05-2011

I think the regex is \w+\s\d+\s\d+:\d+:\d+\s\w+\s([^:[]+)

dmlee · ‎06-15-2011

Hi , the case is about splunk deployment issue there is a deployment server and 20 deployment clients , we had finished setup 19 deployment clients already , they all use 8089 port to communicate to deployment server and works fine. when we setup the last one client , we found its 8089 port is occupied by other application , and user said it is impossible to release the port . My question is: is it possible to add another management port (for example 8090) on deployment server to communicate to the 20th client ? and keep the original 8089 port for other 19 clients ? thanks

dmlee · ‎05-29-2011

Hi thanks for your reply. I think my issue may be is different , because I can see the events sent from UF was indexed properly ( I can search all events from UF ) .

dmlee · ‎05-27-2011

Hi, my suggestion is to use REGEX tool to test your extract rule first ( if you are using "EXTRACT-" or "REPORT-" to extract field). or you can share your props.conf , transforms.conf and some sample events , we can take a look .

dmlee · ‎05-27-2011

hi, I think you already make sure your sourcetype is "strongmail_failed" second, you can put those two conf files under $SPLUNK_HOME/etc/system/local if you haven't create your own App . if you had created your own App said "strongmail", you can put conf files under $SPLUNK_HOME/etc/apps/strongmail/local/ and because it is "search time" configuration , so you should put them on search head

dmlee · ‎05-27-2011

Hi, I just upgraded two Splunk LWF 4.1.4 to Splunk UF 4.2.1 , other Splunk instances ( middle forwarders and indexers) are still in 4.1.4 . I found there are many error messages in middle forwarder (after I upgraded LWF) , for example : "05-27-2011 17:11:11.297 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v3--! from hostname=172.30.5.39, ip=172.30.5.39, port=50588" "05-27-2011 17:11:04.822 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v3--! from hostname=172.30.5.39, ip=172.30.5.39, port=56588" "05-27-2011 17:10:57.976 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v3--! from hostname=172.20.3.141, ip=172.20.3.141, port=47021" 172.20.3.141 and 172.30.5.39 are UF , above messages exist in middle forwarders' splunkd.log any idea ? thanks

dmlee · ‎05-25-2011

I agree with lguinn, below are my lookup setting in props.conf , I am sure they works : LOOKUP_1 = service_tree SERVICE_ID AS LOG_PAGE HANDSETTYPE as Platform OUTPUT NAME AS SERVICE_NAME_L10, PARENT_ID AS SERVICE_PARENT_ID_L9 LOOKUP_2 = service_tree SERVICE_ID as SERVICE_PARENT_ID_L9 HANDSETTYPE as Platform OUTPUT NAME as SERVICE_NAME_L9, PARENT_ID as SERVICE_PARENT_ID_L8 LOOKUP_3 = service_tree SERVICE_ID as SERVICE_PARENT_ID_L8 HANDSETTYPE as Platform OUTPUT NAME as SERVICE_NAME_L8, PARENT_ID as SERVICE_PARENT_ID_L7

dmlee · ‎05-12-2011

Hi Araitz, could you explain more detail about "we do not anticipate moving to the OpenSSL FIPS Object Model because of compatibility and portability reasons" ? thanks

dmlee · ‎05-01-2011

Hi, I think you should use %Y instead of %y , because the year is "2011" (four digits). and , if possible, you can use TIME_PREFIX to tell splunk where is the exact date field you want splunk to recognize.

dmlee · ‎03-24-2011

lessons learned, thanks

dmlee · ‎03-24-2011

Hi, as we know , before splunk eat a compressed file, splunk will decompress it first then index it. but, if we have many compressed files under the same directory (ex: ap_20110301.zip, ap_20110302.zip ...) and their original file name are the same (ex:ap.log), what will happen ? will splunk decompress all those files then index them ? or decompress and index one by one ? because their original file name are the same , if splunk decompress all of the files at first , it will overwrite existing files (actually, this is what we observed, but we want to make sure). thanks.

dmlee · ‎03-17-2011

Hi Ayme, no problem, I sent to your email box a few minutes ago, if there is any bug or question or comment, please let me know, thanks

dmlee · ‎03-08-2011

Hi Jrodman, yes , we set "enableSplunkSSL=false" (server.conf) to improve replication speed. I will file a support case, thanks

dmlee · ‎03-08-2011

Hi, I have one search head(ver 4.1.4) and two index servers(4.1.4) , when I do search , sometimes I got an error message "Unable to distribute to peer named splunk_index01 at url https://172.30.6.xxx:8089 because peer has status=Certificate Mismatch" , but sometimes it works fine (with no error message, and I can see search results correctlly ) All three servers have "enableSplunkSSL=false" (server.conf) Any idea about it ? thanks.

dmlee · ‎02-14-2011

Hi, Can Splunk monitor IBM MQ (Message Queue) ? Customer wants to monitor MQ's performance on IBM2096 system, I don't know from where and how to get MQ's performance data (ex:transaction volume) from IBM2096. Thanks~

dmlee · ‎01-17-2011

please refer below shell command : cat $original_Filename | sed 's/,"__mv[^,]*//g' | sed 's/,"_*"//g' | sed 's/,,*/,/g' | sed 's/,$//g' > $your_Filename

dmlee · ‎01-07-2011

do you know what is the limitation in 4.1.6 ?

dmlee · ‎01-06-2011

Hi Stephen, where can we change the limitation on splunk 4.1.6 ?

dmlee · ‎01-06-2011

we also have this problem, is there any way to extend the limition ? because we can't find other way to reduce events on a single timestamp.

dmlee · ‎01-06-2011

Hi Stephen, I tried to modify search.py as you said , my Splunk is 4.1.6 , there is some different in the source code, I think maybe it is not the right place to add code , anyway I tried to add your code as below, restart splunk services , search something , export result as csv file, open csv file using Excel 2008 ... Excel still doesn't recognise chinese words (grabeled) # pass through the search options output = job.getFeed(asset, **kwargs) if 'isDownload' in kwargs: import codecs output = "".join((codecs.BOM_UTF8, output))

Posts	80
Solutions	8
Karma Given	44
Karma Received	48
Member Since	‎05-04-2010

Online Status	Offline
Date Last Visited	‎07-12-2024 01:26 AM

Sideview Utils Table module question

drilldown function of SimpleResultsTable does not ...

the mechanism of tpstatusquery command

the flashtimeline dashboard only shows first 1000 ...

significant clock differences

can't sort table results from a form search

WinEventLogChannel - saveCheckpointStr : Unable to...

multiple management ports

Received unrecognized signature --splunk-cooked-mo...

load compressed files

WinEventLogChannel - saveCheckpointStr : Unable to...

Re: Extract filed from delimited log file

Re: Extract filed from delimited log file

Re: monitor files in /var/log with different sourc...

Re: Splunk parsing date incorrectly

Re: Extracting field values using a negative match

multiple management ports

Re: Received unrecognized signature --splunk-cooke...

Re: Why some Fields are extracted and some are not

Re: Extract filed from delimited log file

Received unrecognized signature --splunk-cooked-mo...

Re: Can I chain fields together between two differ...

Re: Does Splunk support FIPS 140-2

Re: TIME_FORMAT, it's May, not January

Re: load compressed files

load compressed files

Re: Splunk For *nix on AIX - **Support added in ap...

Re: certificated mismatch

certificated mismatch

Can I Monitor IBM MQ with Splunk ?

Re: splunk result has fields unwanted

Re: IndexScopedSearch Error Details

Re: IndexScopedSearch Error Details

Re: IndexScopedSearch Error

Re: Can the Export function export csv file in BIG...

Join the Conversation