Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About archspangler
archspangler
Path Finder
Member since:
08-05-2014
04-17-2023
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 28 |
| Karma Received | 3 |
| Member Since | 08-05-2014 |
Activity Feed
- Posted Upgraded ITSI to v4.15.1 and now default analyzer is displaying all N/A and all services are grayed out on Splunk ITSI. 04-14-2023 12:50 PM
- Karma Splunk SSL Error with Python for daniel333. 06-05-2020 12:51 AM
- Karma Direction on how to troubleshoot this perfmon issue? for daniel333. 06-05-2020 12:50 AM
- Karma Re: 「500 Internal Server Error」について for cweiliou_splunk. 06-05-2020 12:50 AM
- Karma Re: Does anyone have a good link for the 2018 .conf breakout sessions? for skoelpin. 06-05-2020 12:50 AM
- Karma Deployer sends restart with /opt/splunk/bin/splunk restart, systemctl loses status for ronlevytn. 06-05-2020 12:50 AM
- Got Karma for Does anyone have a good link for the 2018 .conf breakout sessions?. 06-05-2020 12:50 AM
- Karma InsecureRequestWarning in splunkd.log for anoopambli. 06-05-2020 12:49 AM
- Karma RHEL/CentOS 7 & systemD not honoring ulimits for jethompson_splu. 06-05-2020 12:49 AM
- Karma Re: Splunk Add-On for Microsoft IIS Default Settings for guarisma. 06-05-2020 12:49 AM
- Karma Re: Splunk Add-On for Microsoft IIS Default Settings for timpacl. 06-05-2020 12:49 AM
- Karma Splunk Add-On for Microsoft IIS Default Settings for timpacl. 06-05-2020 12:49 AM
- Karma Splunk Add-on for NetApp Data ONTAP: After install, why do I receive several SSL errors "[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure"? for cdstealer. 06-05-2020 12:48 AM
- Karma Re: NetApp logs not showing on the Splunk App for NetApp for cemiam. 06-05-2020 12:48 AM
- Karma Re: EMC Isilon App and Add-on for Splunk Enterprise: How to configure the app and add-on in distributed environment? for frankwayne. 06-05-2020 12:48 AM
- Karma Re: Splunk Add-on for NetApp Data ONTAP: After install, why do I receive several SSL errors "[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure"? for hsesterhenn_spl. 06-05-2020 12:48 AM
- Karma Re: After upgrading to 6.5.0, KV Store will not start for jcrabb_splunk. 06-05-2020 12:48 AM
- Got Karma for After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?. 06-05-2020 12:48 AM
- Got Karma for Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?. 06-05-2020 12:48 AM
- Karma Re: Why are my ulimits settings not being respected on ubuntu/debian after a server reboot? for pj. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
04-14-2023
12:50 PM
Upgraded ITSI to v4.15.1 and now default analyzer is displaying all N/A for the health scores and all services are grayed out. KPI's under the services are collecting data and they look okay. What are some good SPL queries to narrow down the issue? -Archie
... View more
Labels
- Labels:
-
installation
-
troubleshooting
-
using ITSI
10-12-2018
05:07 AM
We have configured the "Splunk App for Infrastructure" per the documentation. We see some data in our metrics index but the host field is the name of my Splunk HEC receiver? Is this expected?
The "Splunk App for Infrastructure" doesn't see any entities at this point, I think it's because of the host field maybe?
Our infra looks like this.. Linux UF with collectd/write_splunk plugin ---> HEC HF ---> Index Cluster
Here is the query that I am using to try to find my data.
| mstats avg(_value) prestats=t WHERE index=mymetrics AND metric_name="*" span=1m by metric_name,host
I can see metrics with the following command.
| mcatalog values(metric_name) WHERE index=mymetrics
What am I missing, I am very new to the metrics indexes.
-Archie
... View more
10-09-2018
08:57 AM
I am looking for the full schedule, not the recommended track agenda.
Thanks anyway.
... View more
10-09-2018
05:20 AM
1 Karma
Anyone have a good link for the 2018 .conf breakout sessions?
The following appears to be a dead link:
https://conf.splunk.com/conf-online.html
The dead link is found on this page (.conf Online.):
https://conf.splunk.com/learn.html
The 2018 schedule would be helpful for those who need to complete a trip report from .conf 2018
... View more
- Tags:
- .conf
10-04-2018
02:58 PM
Is there any documentation on the write_splunk collectd plugin?
-Archie
... View more
12-15-2017
11:07 AM
We want to have multiple ITSI instances. (Dev, Prod, other internal customers). All of the data is on our Index cluster; along with the indexes for ITIS. My fear is that all of the ITSI instances would be pointed to the same index cluster and I am afraid that one ITSI instance will overwrite some data the other need.
Unless each ITSI instance is writing it's own unique data into the common indexes.
... View more
12-05-2017
10:27 AM
Is it possible to have multiple ITSI search heads all configured to forward events to a common "Indexer farm"?
-Archie
... View more
07-10-2017
01:15 PM
Thanks for the information. Version 2.1.6 corrected the issues that I was having. I can now add my 7-mode filers.
-Archie
... View more
06-20-2017
10:50 AM
The subject states "NetApp logs not showing on the Splunk App for NetApp". The Perf data and syslog event data is collected differently.
Have you configured splunk to listen for syslog messages from your filers?
Have you configured your c-mode\7-mode filers to send syslog events to your splunk syslog listener?
If you run splunkd as non-root user; splunk cannot create the listener port under 1024. You will need to use a port above 1024 or use iptables to NAT the port..
https://answers.splunk.com/answers/1653/cant-add-udp-input-because-of-error-udp-port-514-is-not-available-why.html
... View more
06-20-2017
08:47 AM
I am getting the same error with 6.6.1 and Splunk_TA_ontap 2.15. I can successfully poll my C-mode filers but I cannot poll any of my 7-mode controllers. (SSLV3_ALERT_HANDSHAKE_FAILURE)
I logged a case with Splunk Support to see what the say.
... View more
06-16-2017
12:19 PM
I guess I am confused why in the release notes of the Netapp TA they talk about a VMWare Data Collection node?
... View more
06-16-2017
05:41 AM
The release notes at https://splunkbase.splunk.com/app/3418/#/overview
States " Additionally the ready to deploy OVA for deploying a Data Collection Node has been shipped separately as a standalone download on Splunkbase"
I am having trouble locating the OVA download on Splunkbase.
Can someone post the URL?
Thanks!
... View more
12-01-2016
07:12 AM
I agree, I am seeing the same thing.
... View more
11-30-2016
07:34 AM
I tried both the inputs.conf, and web.conf (different stanzas) and it appears to have zero effect on the default of 12 seconds messages that we were seeing.
However, I made the following change to the server.conf and the warning messages stopped in the splunkd.log.
[httpServer]
busyKeepAliveIdleTimeout = 20
... View more
11-29-2016
05:04 AM
1 Karma
I modified this setting on my deployment server but it appears that the setting is ignored.
-bash-4.1$ splunk btool inputs list| grep busyKeepAliveIdleTimeout
busyKeepAliveIdleTimeout = 20
But i still see messages logged in splunkd.log on the deployment server.
11-29-2016 08:00:27.956 -0500 WARN HttpListener - peer=x.x.x.x idle for more than busyKeepAliveIdleTimeout=12 seconds, disconnecting. Consider raising the timeout value.
host = xxxxxx source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
... View more
11-28-2016
08:05 AM
1 Karma
What conf file controls the below message? I noticed the following warning message after upgrading my deployment server to 6.5.1
I cannot find in the documentation what configuration file controls this timeout.
peer=x.x.x.x idle for more than busyKeepAliveIdleTimeout=12 seconds, disconnecting. Consider raising the timeout value.
-Archie
... View more
09-26-2016
04:51 AM
This application would be much better if it didn't dump the entire Job Backup Session history every time the scheduled tasks runs. Our JOBTSK* files have about 180K events in each file. Of the 180K events there are only a handful of new lines each time it runs; why re-index a new source for this sourcetype every schedule task run for the addition of a few line? This actually applies to all the sourcetype in this TA. This just doesn't seem very efficient and friendly to a Splunk license model.
... View more
08-04-2016
02:21 PM
Worked for me as well.
... View more
07-16-2015
07:54 AM
How do I wildcard any windows drive letter in the inputs.conf stanza below?
inputs.conf
[monitor://[A-Z]:\Data\Disk1\*\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
Causes the below error...
07-16-2015 10:53:57.601 -0400 WARN TailingProcessor - Input stanza path, '[A-Z]:\\Data\\Disk1\\*\\MSSQL\\Log\\ERRORLOG*' is not absolute. This is a configuration error and may not work / break things. Change this path to an absolute path.
... View more
