Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About abrarfakhri
abrarfakhri
Path Finder
Member since:
08-01-2014
06-05-2020
Community Statistics
| Posts | 15 |
| Solutions | 1 |
| Karma Given | 14 |
| Karma Received | 1 |
| Member Since | 08-01-2014 |
Activity Feed
- Karma Which version of Splunk is suitable for Oracle Linux? for vodacomdf. 06-05-2020 12:49 AM
- Karma Is it possible to route data to idle indexers ? for splunk_force_as. 06-05-2020 12:48 AM
- Karma Re: Is it possible to route data to idle indexers ? for sowings. 06-05-2020 12:48 AM
- Karma Re: Why does Splunk continuously attempt to find a user in LDAP after the user has been removed from Active Directory? for Jeremiah. 06-05-2020 12:48 AM
- Karma Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run? for a212830. 06-05-2020 12:47 AM
- Karma Re: How to change the ownership of dashboards to a specific user in the system? for somesoni2. 06-05-2020 12:47 AM
- Karma Large lookup caused the bundle replication to fail. What are my options? for rbal_splunk. 06-05-2020 12:47 AM
- Karma Re: Large lookup caused the bundle replication to fail. What are my options? for rbal_splunk. 06-05-2020 12:47 AM
- Got Karma for Has anyone encountered this issue - Hosts dashboard in NIX app only shows 1 host even though I have 3. 06-05-2020 12:47 AM
- Karma rc=-1 err=-96 Connection error with Check Point OSPEC LEA app 2.0.2 for jbsplunk. 06-05-2020 12:46 AM
- Karma How to disable the host extraction for syslog sourcetype for mataharry. 06-05-2020 12:46 AM
- Karma "Unable to distribute to peer" -- adjustable timeout? for batzel. 06-05-2020 12:46 AM
- Karma big lookup file replication too slow for mataharry. 06-05-2020 12:45 AM
- Karma Re: big lookup file replication too slow for yannK. 06-05-2020 12:45 AM
- Posted What Splunk enterprise versions are supported? on All Apps and Add-ons. 04-11-2019 09:08 AM
- Tagged What Splunk enterprise versions are supported? on All Apps and Add-ons. 04-11-2019 09:08 AM
- Tagged What Splunk enterprise versions are supported? on All Apps and Add-ons. 04-11-2019 09:08 AM
- Posted Does Synthetic App work with newer versions of Splunk 7.x? on All Apps and Add-ons. 02-20-2019 09:37 AM
- Tagged Does Synthetic App work with newer versions of Splunk 7.x? on All Apps and Add-ons. 02-20-2019 09:37 AM
- Tagged Does Synthetic App work with newer versions of Splunk 7.x? on All Apps and Add-ons. 02-20-2019 09:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
04-11-2019
09:08 AM
It wasn't clear whether 7.x versions are support in this add-on so I thought I'd ask. What has been the community's experience while using this add-on?
... View more
02-20-2019
09:37 AM
Does Synthetic App work with newer versions of Splunk 7.x?
I see last version updated back in 2014. Are there plans to extend support to newer version?
If anyone else is using another 3rd party software sending data back to Splunk we'd love to hear about it.
... View more
05-19-2017
03:35 PM
I don't get it, what is the purpose of the Technology Inventory Technology AddOn (TA) (BETA)? Before I install and use it, I need to know more about it.
Please provide documentation around it.
... View more
02-08-2016
02:23 PM
I still hope someone would be able to answer this question...
... View more
02-04-2016
01:16 PM
Guessing that operation value can be either Read, Created etc.
You can easily get "Read" by changing the query as follows:
host = 10.0.0.3 "D:\\Data\\public\\human" operation="Read" | transaction user, _time | table user, operation, directory, _time
Also, without knowing exactly what result set you're trying to get, my suggestion is not to use transaction but it is an expensive command.
You can use stats.
host = 10.0.0.3 "D:\\Data\\public\\human" operation="Read" | stats operation, directory, _time by user
... View more
02-03-2016
03:30 PM
somesoni2, I appreciate your response. But, this is not what I was looking for. If I am reading this right, I think what the above queries provide is the maximum thruput that the HF is achieving today. What I am looking for is the maxmimum thruput the HF can achieve given the limitation of 2 cores and 4GB memory.
This would be similar to asking "How many concurrent searches can a SH achieve?" Well, the answer is dependent on the # of cores.
Hope that clarifies the question a bit more.
Looking forward to your response!
... View more
02-03-2016
12:47 PM
To be more specific, the maximum thruput should be measured in max events per sec, max kbps, max load etc.
Here is the current readout from metrics.log:
02-03-2016 15:11:51.891 -0500 INFO Metrics - group=thruput, name=index_thruput, instantaneous_kbps=762.769461, instantaneous_eps=1963.774257, average_kbps=862. 173209, total_k_processed=4834560107.000000, kb=23645.852539, ev=60877.000000, load_average=2.830000
... View more
02-03-2016
12:40 PM
Fellow Splunkers!
I've spent a lot of time on both the answers and splunkbase sites but can't seem to find a simple formula for this.
I am trying to determine the maximum *nix heavy forwarder capacity with 2 cores and 4GB physical memory. I know this is not up to standard but I am guessing there must be a simple formula we can apply to determine thruput.
... View more
01-26-2016
06:30 PM
I didn't attempt to install b/c I wasn't sure if the app supports clustered envs.
I am on 6.3.0 SH Cluster. To help you out, I can install and let you know if I face any issues.
Also if you need any help testing or coding the app, let me know.
... View more
01-26-2016
12:31 PM
@Runals, what are the plans to release the next version of this app? Will it support clustered envs? Will it support 6.2 and 6.3.* versions of Seach head (with or without clustering)?
... View more
05-07-2015
09:19 AM
Correction: I just have a deployment server without NIX add-on....
... View more
05-06-2015
10:45 PM
1 Karma
I have 3 hosts listed in Categories under "all_hosts". Yet my Hosts dashboard only shows 1 host.
I am very curious how Splunk builds this data set? Where does it get the info from and how does it store it locally?
I tried searching CLI but couldn't locate the data except for dropdown.csv which is accounted for.
I followed instructions from here to setup:
http://docs.splunk.com/Documentation/UnixApp/latest/User/DeploytheSplunkAppforUnixandLinuxinadistributedSplunkenvironment
I just have a deployment server w/ NIX add-on. The rest of the configuration is as shown on URL above.
splunk_app_for_nix version: 5.0.1
SA-nix version: 5.0.1
Splunk_TA_nix version: 5.1.2
Regards,
Abrar
... View more
05-06-2015
07:54 PM
So this means we should make all the config changes on one search-head. Then manually tar gzip / gunzip on the other search-heads in the cluster - correct?
I think putting the newly configured app dir can be placed back on cluster master and we can deploy the bundle.
Can someone with more expertise at this confirm which of the above scenarios is preferred?
Also, confirm which of the following will need to be redeployed:
SA-nix
splunk_app_for_nix
Splunk_TA_nix
Regards,
Abrar
... View more
08-05-2014
10:17 AM
We figured it out. The variable time-taken was not being set in the configurations of the IIS sites. We will get it switch ON to begin collecting the info.
... View more
08-01-2014
03:04 PM
We have multiple version of IIS but looks like an older version is missing the last field (time_taken). We still need to determine time_taken in order to monitor the slowness of the web server etc.
I was thinking of using the GET and POST methods with a combination of transaction to calculate it.
Any ideas?
... View more
- Tags:
- iis
- time
- time_taken
