About michael_peters

michael_peters · ‎07-21-2016

That first link is dead now, here is the updated link: http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles

michael_peters · ‎06-22-2016

I posted the same question on stackexchange.com (http://stackoverflow.com/a/37737994/2871638) and the answer is that the script expects JSON input. This is supposed to take the JSON input from the meh.com API and output JSON.

michael_peters · ‎06-09-2016

I am working through the Splunk Developers guide v 2 by Kyle Smith aka @alacercogitatus https://answers.splunk.com/users/3659/alacercogitatus.html I am having issues getting the custom alerting to work. In particular the caa_file_write.py file is throwing the following errors in _internal: 06-09-2016 19:23:21.635 -0400 ERROR sendmodalert - action=file_write STDERR - File "/opt/sdg/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode host = SPLK-ET source = /opt/sdg/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 06-09-2016 19:23:21.635 -0400 ERROR sendmodalert - action=file_write STDERR - File "/opt/sdg/splunk/lib/python2.7/json/decoder.py", line 364, in decode host = SPLK-ET source = /opt/sdg/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 06-09-2016 19:23:21.635 -0400 ERROR sendmodalert - action=file_write STDERR - File "/opt/sdg/splunk/lib/python2.7/json/__init__.py", line 339, in loads host = SPLK-ET source = /opt/sdg/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 06-09-2016 19:23:21.635 -0400 ERROR sendmodalert - action=file_write STDERR - File "/opt/sdg/splunk/etc/apps/SDG/bin/caa_file_write.py", line 7, in host = SPLK-ET source = /opt/sdg/splunk/var/log/splunk/splunkd.log sourcetype = splunkd The file in question is: import sys, json, urllib2 def write_file(settings): f = open('myfile','w') f.write("%s"%json.dumps(settings)) f.close() if __name__ == "__main__": caa_config = json.loads(sys.stdin.read()) write_file(caa_config)

michael_peters · ‎03-31-2016

The initial query was not specific enough. As soon as I added a sourcetype at the front of this query it was fixed, any value below 9 actually shows up as the value and is coloured green: sourcetype="remedy_incidents" * NOT INC_CAL* Priority=2| convert timeformat="%F %T" ctime(Last_Modified_Date) AS "LastModified" ctime(Approval_Date) AS "ApprovalDate" ctime(Completion_Date) AS "CompletionDate" ctime(Submit_Date) AS "SubmitDate" ctime(Expected_Date) AS "ExpectedDate" ctime(Closed_Date) AS "ClosedDate" ctime(Resolved_Date) AS "ResolvedDate" ctime(Reported_Date) AS "ReportedDate" ctime(Responded_Date) AS "RespondedDate"| stats distinct_count(Incident_Number) as test| rangemap field=test low=0-9 elevated=10-50 Also most of the query can be removed and simplified to: sourcetype="remedy_incidents" * NOT INC_CAL* Priority=2| stats distinct_count(Incident_Number) as test| rangemap field=test low=0-9 elevated=10-50

michael_peters · ‎03-02-2016

Thanks for the answer, yes that will solve the issue but I don't want to run splunk as root. I would like to run it as user xx. That user has access to all those directories on all the servers.

michael_peters · ‎03-01-2016

I am preparing to upgrade to Splunk 6.3 and am setting up a dev environment. I have three Search heads in a pool running 6.0.3 all attached to an NFS mount. When I issue the following commands I have no issues on any of the search heads: xx@xx:/mnt/S2HPS$ ~/splunk/bin/splunk pooling display Search head pooling is enabled with shared storage at: /mnt/S2HPS xx@xx:/mnt/S2HPS$ ~/splunk/bin/splunk pooling validate Search head pooling validation passed However when I issue: sudo ./splunk/bin/splunk enable boot-start -user xx I get the following errors: ERROR IniFile - Cannot open file=/mnt/S2HPS/etc/pooling/pooling.ini for parsing: Permission denied ERROR SearchHeadPoolInfo - Error reading search head pool info: Error reading search head pool info /mnt/S2HPS/etc/pooling/pooling.ini: Permission denied ERROR UsernameMapper - Cannot create username mapping file: /mnt/S2HPS/etc/users/users.ini: Permission denied ERROR IniFile - Cannot open file=/mnt/S2HPS/etc/users/users.ini for parsing: Permission denied ERROR UsernameMapper - Error opening username mapping file: /mnt/S2HPS/etc/users/users.ini ERROR ConfObjectManagerDB - Cannot initialize: /mnt/S2HPS/etc/apps/learned/metadata/local.meta: Permission denied ERROR IniFile - Cannot open file=/mnt/S2HPS/etc/pooling/pooling.ini for parsing: Permission denied ERROR SearchHeadPoolInfo - Error reading search head pool info: Error reading search head pool info /mnt/S2HPS/etc/pooling/pooling.ini: Permission denied ERROR UsernameMapper - Cannot create username mapping file: /mnt/S2HPS/etc/users/users.ini: Permission denied ERROR IniFile - Cannot open file=/mnt/S2HPS/etc/users/users.ini for parsing: Permission denied ERROR UsernameMapper - Error opening username mapping file: /mnt/S2HPS/etc/users/users.ini ERROR ConfObjectManagerDB - Cannot initialize: /mnt/S2HPS/etc/apps/learned/metadata/local.meta: Permission denied ERROR IniFile - Cannot open file=/mnt/S2HPS/etc/pooling/pooling.ini for parsing: Permission denied ERROR SearchHeadPoolInfo - Error reading search head pool info: Error reading search head pool info /mnt/S2HPS/etc/pooling/pooling.ini: Permission denied ERROR UsernameMapper - Cannot create username mapping file: /mnt/S2HPS/etc/users/users.ini: Permission denied ERROR IniFile - Cannot open file=/mnt/S2HPS/etc/users/users.ini for parsing: Permission denied ERROR UsernameMapper - Error opening username mapping file: /mnt/S2HPS/etc/users/users.ini ERROR ConfObjectManagerDB - Cannot initialize: /mnt/S2HPS/etc/apps/learned/metadata/local.meta: Permission denied ERROR IniFile - Cannot open file=/mnt/S2HPS/etc/pooling/pooling.ini for parsing: Permission denied ERROR SearchHeadPoolInfo - Error reading search head pool info: Error reading search head pool info /mnt/S2HPS/etc/pooling/pooling.ini: Permission denied ERROR UsernameMapper - Cannot create username mapping file: /mnt/S2HPS/etc/users/users.ini: Permission denied ERROR IniFile - Cannot open file=/mnt/S2HPS/etc/users/users.ini for parsing: Permission denied ERROR UsernameMapper - Error opening username mapping file: /mnt/S2HPS/etc/users/users.ini ERROR ConfObjectManagerDB - Cannot initialize: /mnt/S2HPS/etc/apps/learned/metadata/local.meta: Permission denied I checked and I have at least read access as the user xx, and can issue a cat command to view the configuration files in the error. Should I be concerned given that I seem to have access to the NFS without any issues, except when setting up boot-start?

michael_peters · ‎09-28-2015

I am one of the Effect Tech SPLUNK architects that works and helps customize the Platform Advisor for BMC Remedy app. Although the app has not formally been tested with 6.2 I have gotten it to work without any issues with 6.2. I would test it in your dev 6.2 environment and if you have any questions please post them here and I will endeavor to answer them for you.

michael_peters · ‎08-07-2014

My question is a follow up question to my question earlier today. The rangemap command is displaying high and medium single values correctly, however for my low single values it displays N/A instead of say "3". My query is: * NOT INC_CAL* Priority=2| convert timeformat="%F %T" ctime(Last_Modified_Date) AS "LastModified" ctime(Approval_Date) AS "ApprovalDate" ctime(Completion_Date) AS "CompletionDate" ctime(Submit_Date) AS "SubmitDate" ctime(Expected_Date) AS "ExpectedDate" ctime(Closed_Date) AS "ClosedDate" ctime(Resolved_Date) AS "ResolvedDate" ctime(Reported_Date) AS "ReportedDate" ctime(Responded_Date) AS "RespondedDate"| stats distinct_count(Incident_Number) as test| rangemap field=test low=0-9 elevated=10-50 I've read the following questions and answers on splunk>answers: http://answers.splunk.com/answers/46854/using-rangemap-in-dashboard and http://answers.splunk.com/answers/34148/single-rangemap-displaying-low-instead-of-number Then I thought I had hit the jackpot with the following questions but it relates to 0 answers where I have a low answer of 3 and I am still getting N/A: http://answers.splunk.com/answers/49559/single-value-return-na-instead-of-0 So, neither of the above helped me.

michael_peters · ‎08-07-2014

Yes I do remember this now from my training. Thanks +1.

michael_peters · ‎08-07-2014

My search returns values and when I run it in search it colours the values correctly: stats distinct_count(Incident_Number) as test| rangemap field=test low=0-0 default=severe When I put this as a panel in a dashboard the values are not coloured at all. I am running 6.0, any ideas why? The full search is: * NOT INC_CAL* Priority=1| convert timeformat="%F %T" ctime(Last_Modified_Date) AS "LastModified" ctime(Approval_Date) AS "ApprovalDate" ctime(Completion_Date) AS "CompletionDate" ctime(Submit_Date) AS "SubmitDate" ctime(Expected_Date) AS "ExpectedDate" ctime(Closed_Date) AS "ClosedDate" ctime(Resolved_Date) AS "ResolvedDate" ctime(Reported_Date) AS "ReportedDate" ctime(Responded_Date) AS "RespondedDate"| stats distinct_count(Incident_Number) as test| rangemap field=test low=0-0 default=severe

michael_peters · ‎05-19-2014

I am getting the same. I would like to update my question and cannot.

michael_peters · ‎04-29-2014

In 6.0.1 to 6.0.3 the upload feature does work, and you do have to have unix like line "\n" endings. To make the file acceptable via komodo open the original csv then open a new file and copy and paste the text, just resaving will not work. For those interested the feature is enabled in Komodo by default and is found at: Preferences>New Files>Specify the end-of-line (EOL) inidicator for newly created files: I will upload a screenshot once I have more karma.

michael_peters · ‎04-09-2014

Note that the IOPS requirement for SPLUNK 6.0 is 1200 The reason to use bonnie++ for comparability with what SPLUNK does ie repeatability of results. There are better tools to use

michael_peters · ‎03-06-2014

Splunk 6.0.1 runs fine on Mac OS X 10.7.5. However the current 6.0.2 dmg does not install properly. Please refer to the following issue.

michael_peters · ‎03-06-2014

Install Splunk 6.0.1 instead: This issue was fixed by uninstalling Splunk 6.0.2 and installing 6.0.1 instead. There appear to be some bugs in the install dmg for 6.0.2: splunk-6.0.2-196940-macosx-10.7-intel.dmg

michael_peters · ‎03-06-2014

Install Splunk 6.0.1 instead. I took @Inguinn's advice and uninstalled Splunk 6.0.2 and installed 6.0.1. This solved the above issues on Mac OS X 10.7.5 There appear to be a few bugs with the 6.0.2 installer for mac.

michael_peters · ‎03-06-2014

I have just installed Splunk 6.0.2 on Mac OS X 10.7.5 and am getting the following error when starting splunk: bash-3.2# ./splunk start sh: btool: command not found sh: btool: command not found Splunk> Take the sh out of IT. Checking prerequisites... sh: btool: command not found Checking mgmt port [8089]: sh: btool: command not found open Checking conf files for typos... execve: No such file or directory There might be typos in your conf files. For more information, run 'splunk btool check --debug' Checking conf files for typos... execve: No such file or directory There was an error validating your search head pooling configuration. For more information, run 'splunk pooling validate' Checking conf files for typos... execve: No such file or directory There was an error preparing your conf files for search head pooling. For more information, run 'splunk btool find-dangling'. Checking conf files for typos... Done sh: btool: command not found sh: btool: command not found All preliminary checks passed. Starting splunk server daemon (splunkd)... Done bash-3.2# ./splunk btool check --debug execve: No such file or directory bash-3.2# find / -name "*execve*" The error has mainly to do with the btool command not being found as well as the execve directory. As you can see I have already executed a search for the directory and tried to run the commands suggested after starting splunk from the command line. Any help in resolving this would be great, I have already tried a re-install.

michael_peters · ‎03-06-2014

I am running splunk 6.0.2 on OS X 10.7.5 The serach head, indexer are all installed on the same box. I added the /var/log directory as well as /var/log/system.log file separately to be indexed. Both the above indexed fine however after a splunk restart, I am getting the following error in web_service.log 2014-03-06 07:44:25,317 ERROR [531889c8b91086a0590] eai:164 - Failed to fetch dynamic element content from the server for splunkSource:/search/jobs/oneshot [HTTP 204] Unexpected HTTP status code This corresponds to the following error in Splunk Web: Data inputs>>Files & Directories>>/var/log>>Index Failed to fetch data: Unexpected HTTP status code. I tried to create a new index but this has not solved the issue. I have also restarted splunk, both from the cli and Splunk Web.

Posts	18
Solutions	4
Karma Given	170
Karma Received	6
Member Since	‎05-04-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How do I get the custom alert example from the Spl...

Why am I getting permission denied errors running ...

rangemap shows N/A instead of value (3)

rangemap not working on dashboard but working when...

sh: btool: command not found

Error setting desitnation index

Re: fields.conf

Re: How do I get the custom alert example from the...

How do I get the custom alert example from the Spl...

Re: rangemap shows N/A instead of value (3)

Re: Why am I getting permission denied errors runn...

Why am I getting permission denied errors running ...

Re: Will this app work for Splunk 6.2?

rangemap shows N/A instead of value (3)

Re: rangemap not working on dashboard but working ...

rangemap not working on dashboard but working when...

Re: Trouble With Captchas on edit

Re: proper format for lookup table files

Re: Calculating IOPS from bonnie++ results

Re: when will OSX 10.7 / Lion supported ?

Re: Error setting desitnation index

Re: sh: btool: command not found

sh: btool: command not found

Error setting desitnation index