About kdoonan

kdoonan · ‎09-04-2015

What error do you get when you try to run it and do you have it in the same part of the search?

kdoonan · ‎09-04-2015

Hi Guimilare, You could try multiplying one part by -1 index=someindex | eval amount=IF(category=="debit", -1 * amount, amount) | stats sum(amount) as Result by category | addcoltotals labelfield=category label=Total

kdoonan · ‎03-26-2015

Thanks Harshil, That's pretty much what we're doing at the moment. It works alright until you need to change something in server.conf across everything.

kdoonan · ‎03-26-2015

I'm trying to keep the server.conf in a consistent state over a few clustered indexes, but I'm having a bit of trouble trying to generating pass4SymmKey (in any of the stanzas) and sslKeysfilePassword (in the sslConfig stanza). The problem I have is this: Chef updates server.conf with cleartext pass4SymmKey Restart splunk Password is now encrypted Next chef run, the password is updated again to the clear text version and the cycle repeats I've got around this for now by just not restarting Splunk whenever server.conf is updated, but it seems like a bit of a hack. Ideally I'd be able to generate at least pass4SymmKey so that I'd know if it had changed. Reading some other answers, there has been talk that it is encrypted/decrypted using splunk.secrets, but I've been unable to find out how to do so. Does anyone have any ideas or thoughts on this?

kdoonan · ‎02-24-2015

The stickiness wouldn't be set (since it only works with HTTP requests and not TCP). I guess that would mean the forwarder could potentially send events to a different indexer each time. Is there any issue with that?

kdoonan · ‎02-24-2015

Hey all, We have many different forwarders installed on different hosts and we are migrating to a cluster of indexers. I've read about load balancing on the forwarders and from what I gather, if indexer acknowledgement is not turned on then there's a chance that the forwarder could try to forward to an inactive node? To get around this, I was thinking about using an AWS ELB with a short session stickiness (say 30-60 seconds) and a tcp health check on the indexer port (so that if an indexer node goes down, it stops receiving traffic from the ELB). So I have a few questions: Are my assumptions about forwarder load balancing with indexer acknowledgement turned off correct? Has anyone tried something similar with an ELB and were there any issues with it? Is there a good reason why I shouldn't enable indexer acknowledgment on all my forwarders? I've read that it has some performance impact, but how much impact? Thanks in advance.

kdoonan · ‎08-01-2014

Eg, if you specify the master as master.domain.local? This may be a silly question but will it cause any issues? The idea being that if the master goes down, we can relaunch it and just change the DNS to point to the new server. Some follow on questions: If we do this and change the DNS, will the nodes resolve the change automatically? If there are 2 master servers running, but only 1 of them is being sent data, will it cause any issues? Eg, if we do relaunch the server and then the original one recovers. Thanks

Posts	7
Solutions	1
Karma Given	5
Karma Received	5
Member Since	‎08-01-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Updating server.conf with Chef, how can I generate...

Forwarding events to an indexer cluster using an A...

In a clustered deployment, can you reference the m...

Re: How can I subtract two results from stats?

Re: How can I subtract two results from stats?

Re: Updating server.conf with Chef, how can I gene...

Updating server.conf with Chef, how can I generate...

Re: Forwarding events to an indexer cluster using ...

Forwarding events to an indexer cluster using an A...

In a clustered deployment, can you reference the m...