Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pweijian
pweijian
Explorer
Member since:
05-12-2017
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 05-12-2017 |
Activity Feed
- Got Karma for Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0?. 06-05-2020 12:49 AM
- Got Karma for Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0?. 06-05-2020 12:49 AM
- Got Karma for Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0?. 06-05-2020 12:49 AM
- Got Karma for After editing the web.conf to add root_endpoint to settings stanza, why is there a lot of HTTP redirection?. 06-05-2020 12:48 AM
- Got Karma for After editing the web.conf to add root_endpoint to settings stanza, why is there a lot of HTTP redirection?. 06-05-2020 12:48 AM
- Posted Re: Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 05-24-2018 01:24 AM
- Posted Re: Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 05-07-2018 06:57 PM
- Posted Re: Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 05-03-2018 03:24 AM
- Posted Re: Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 05-02-2018 03:09 AM
- Posted Re: Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 05-01-2018 07:47 AM
- Posted Re: Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 05-01-2018 07:41 AM
- Posted Re: Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 04-30-2018 08:27 PM
- Posted Re: Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 04-30-2018 08:26 PM
- Posted Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 04-30-2018 03:07 AM
- Tagged Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 04-30-2018 03:07 AM
- Tagged Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 04-30-2018 03:07 AM
- Tagged Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 04-30-2018 03:07 AM
- Tagged Why is there an All Time (real-time) Alert Trigger in Splunk Enterprise 7.1.0? on Alerting. 04-30-2018 03:07 AM
- Posted After editing the web.conf to add root_endpoint to settings stanza, why is there a lot of HTTP redirection? on Security. 05-12-2017 01:17 PM
- Tagged After editing the web.conf to add root_endpoint to settings stanza, why is there a lot of HTTP redirection? on Security. 05-12-2017 01:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 3 | |||
| 2 |
05-24-2018
01:24 AM
Hi agamemnon23, Splunk support has confirmed this issue as a bug and have added this issues into the known issue for Version 7.1.0. There is no workaround for this issue in Version 7.1.0. and they will fix this problem in Release 7.1.2. You can refer to bug number SPL-154136 in http://docs.splunk.com/Documentation/Splunk/7.1.0/ReleaseNotes/KnownIssues
... View more
05-07-2018
06:57 PM
Hi agamemnon23, I have some updates from Splunk support. He is suspecting that this is a potential bug and he has filed an internal ticket for Splunk engineering team to look into this issue. Will keep you posted if there is more update from them.
... View more
05-03-2018
03:24 AM
Hi agamemnon23, I have met up with Splunk support team in live troubleshooting session and the conclusion is that the complex search query is causing the issue we are facing. And this is only happening on Splunk 7.1.0.
To illustrate more...for search query, (index="test_index"), this will only trigger one alert per result. But for search query, (index="test_index" | table _raw), the repeating alert trigger problem will reappear.
I will keep you posted if I got further updates from Splunk regarding this issue.
... View more
05-02-2018
03:09 AM
Hi mmodestino, thank you. I have filed a support case and will be meeting up with Splunk support team on WebEx for live troubleshooting.
... View more
05-01-2018
07:47 AM
Hi amitm05,
From my understanding, All Time (real-time) search alert only searches new events coming into the indexer. Once the event is indexed, it should not show up in the search result of the all time real-time search query. This is working well in previous version of Splunk before I tried the new release of Splunk Version 7.1.0.
I have tried to remove all my alert action and just adding the "Add in Triggered Alerts" action. Once an event trigger the alert, I keep receive constant stream of triggered alerts result under the triggered alert page. Each triggered result is showing the same set of results.
... View more
04-30-2018
08:27 PM
I have tried on both free license and paid license both are having the same problem.
... View more
04-30-2018
08:26 PM
Hi xpac, thanks for your suggestion. I did tried that and scheduled search is working fine. But my use-case would need to real-time search as I need alerts to be send out immediately when an event is detected.
... View more
I have been using Splunk Enterprise 7.0.3 to do real-time search alert trigger without any issues previously. Recently, I attempt to upgrade Splunk Enterprise to 7.1.0 and found some weird problem with the alert trigger.
This is the setup I have:
1. Using amqp-ta plugin to consume messages from RabbitMQ into IndexA.
2. An alert trigger running on All Time (real-time) search on IndexA to find newly indexed events.
3. The alert is trigger per result.
4. Each alert has 2 actions: Custom Action to write a result to another RabbitMQ Exchange and also log the event to another index.
Problem:
Whenever a new event is being added to IndexA, it will trigger repeatedly trigger the alert action. All the alert action search result is showing the same event that was added. This trigger will continue infinitely until I disable the Alert.
I'm not sure if there are any changes to the architecture of Real-time search alert trigger from 7.0.3 to 7.1.0. Any help would be greatly appreciated!
... View more
Hi,
I'm running Splunk version 6.5.3 and is looking to change my Splunk web URL to from http://:8000 to http://:8000/splunk, so I modify the web.conf file under /etc/system/local and added root_endpoint to settings stanza:
[settings]
root_endpoint = /splunk
However after restarting Splunk service, my browser will redirect http://:8000/splunk to http://:8000/en-US/splunk/en-US. When I checked the splunkd_ui_access.log, it seems like there is a number of redirection of my http request.
127.0.0.1 - - [13/May/2017:04:10:48.785 +0800] "GET /splunk HTTP/1.1" 303 345 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko" - - 0ms
127.0.0.1 - - [13/May/2017:04:10:48.786 +0800] "GET /splunk/en-US/ HTTP/1.1" 303 126 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko" - - 73ms
127.0.0.1 - - [13/May/2017:04:10:48.862 +0800] "GET /en-US/splunk/en-US HTTP/1.1" 404 1350 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko" - - 10ms
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
