Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About romantercero
romantercero
Path Finder
Member since:
12-09-2011
06-05-2020
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 4 |
| Member Since | 12-09-2011 |
Activity Feed
- Karma Re: Extract time range from previous searches and graph results for sideview. 06-05-2020 12:46 AM
- Karma Re: Warm buckets not reaching their MaxDataSize before rolling for dart. 06-05-2020 12:46 AM
- Karma Re: inputcsv stopped working after upgrade 4.2.2->4.3.4 for sthomas. 06-05-2020 12:46 AM
- Karma Re: Image on a single value panel for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: Too many search jobs found in the dispatch directory for Ellen. 06-05-2020 12:46 AM
- Karma Re: event splitting for jbsplunk. 06-05-2020 12:46 AM
- Karma Re: Rex on an extracted field for Lucas_K. 06-05-2020 12:46 AM
- Karma Re: Rex on an extracted field for Lucas_K. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk is not running, and it must be for this operation. To start splunk, run "splunk start". on HP-UX. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk Server: RHEL or Win2008. 06-05-2020 12:46 AM
- Got Karma for Re: Does enabling Splunk Free force all incoming data into a particular index?. 06-05-2020 12:46 AM
- Got Karma for Re: Role of the following Queues. 06-05-2020 12:46 AM
- Karma Re: How can I include greater/less than signs in a search in my app's simple xml view for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: Wildcard support in tag definitions? for Lowell. 06-05-2020 12:45 AM
- Posted Re: Splunk is not running, and it must be for this operation. To start splunk, run "splunk start". on HP-UX on Installation. 07-10-2013 11:41 AM
- Posted Re: Splunk is not running, and it must be for this operation. To start splunk, run "splunk start". on HP-UX on Installation. 05-22-2013 12:29 AM
- Posted Splunk is not running, and it must be for this operation. To start splunk, run "splunk start". on HP-UX on Installation. 05-21-2013 11:44 PM
- Tagged Splunk is not running, and it must be for this operation. To start splunk, run "splunk start". on HP-UX on Installation. 05-21-2013 11:44 PM
- Posted Image on a single value panel on Splunk Search. 03-12-2013 06:45 PM
- Tagged Image on a single value panel on Splunk Search. 03-12-2013 06:45 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-10-2013
11:41 AM
What do you mean its not allowing you to change it? Its a text file that you type in.
... View more
05-22-2013
12:29 AM
1 Karma
Got it : /
It seems there are some issues with ssl right out of the box. I added:
enableSplunkdSSL = false
and it works now!
... View more
05-21-2013
11:44 PM
I'm trying to install the splunk forwarder on HP-UX 11.31. It seems to go fine, but every time I try to use the cli to troubleshoot it i get:
$ splunk status
splunkd is running (PID: 27310).
splunk helpers are running (PIDs: 27311).
$ splunk version
Splunk Universal Forwarder 5.0.2 (build 149561)
$ splunk list monitor
Splunk is not running, and it must be for this operation. To start splunk, run "splunk start".
(02)
Any thoughts?
Thanks!
... View more
- Tags:
- hpux
03-12-2013
06:45 PM
This must be really simple but I can't figure out a simple way to include a png file along with the result of a search on a panel.
Can some one point me to a quick example?
Thanks!
... View more
- Tags:
- value
10-09-2012
12:02 PM
That's interesting. I had though of index time extractions but stopped after realizing that other fields extracted at this time would most probably not be available for me to base an extraction on them. I think you found another way to tackle this issue. Thanks!
... View more
10-09-2012
11:59 AM
I found that additional info regarding the rolling over of warm and hot buckets can be gleaned from splunkd.log after turning on debug mode.
... View more
10-05-2012
12:35 PM
Ok, followup question: How would I save my "field=host (? \D+)" extraction in the field extractions sections on the management page? It's not working. I have a few hunches about why but no workaround so far 😕 any toughs?
... View more
10-05-2012
10:39 AM
I was actually trying rex field=host "(? \D+)" as that had worked in the past but it was not working when the data was not in the _raw field. I tried your suggestion and YES! It worked 🙂 I tried what I was doing before and that also works now : / maybe a I had a typo somewhere and retyping everything must have fixed it.
Thanks!
... View more
10-04-2012
05:02 PM
Hi,
I'm trying to extract the cluster name of my servers using the host name. So we have something like host=clusterx01.abc.com, host=clusterx02.abc.com, host=clusterx03.abc.com. I would like to extract the "cluster" part and leave out everything after that out. This would normally be easy if the hostname was in the _rawfield but it's not, and setting the rex field to host is not working. Also, erex is not helping. It keeps inclding the first zero in the hostname.
Any thoughts on how I can use rex on a field that is created on index time?
Thanks!!
... View more
- Tags:
- field-extraction
- rex
09-07-2012
11:01 AM
The gist of this is to include an if statement and place a sub search on the true or false clause of the if. The sub search uses the sendmail command to send you the results.
... View more
09-07-2012
10:59 AM
You can do this with a sub search. Check this out:
index="_internal" group="per_source_thruput" | search series!="_audit" | search series!="_internal" | eval GB=(kb/1024)/1024 | stats sum(GB) as Hourly_Indexed_GB | eval test=if(Hourly_Indexed_GB > 20.3 ,[| search index="_internal" group="per_source_thruput" | search series!="_audit" | search series!="_internal" | eval GB=(kb/1024)/1024 | stats sum(GB) as GB | table GB | sendemail to="email@somewhere.com" format=html subject=Splunk_License_warn server=Your_Mail_Server sendresults=true],"0" )
... View more
08-22-2012
06:17 PM
1 Karma
Your dead on. I also have not been able to find an explanation of what all of those queues do. Not even in the architect training course. I've narrowed most down but I'm still missing an explanation for the typing, stashparsing, parsing, aeq and audit queues
These are the ones I've been able to pinpoint so far with respect to their place in the data pipeline:
Inputs: tcpin, splunktcpin, fschangemanager, exec
Parsing: parsing???, stashparsing???
Merging: agg
Typing: Typing??
Indexing: index
So the issue of course is that you see a specific queue spike up and block but since its function is not documented you don't know the reason so you have to investigate elsewhere whats going on. Sometimes you don't find out until the issue get so bad that you see a direct correlation between a spike in a queue and an acute symptom in one of Splunk's many functions.
Why isn't this documented properly?
... View more
05-25-2012
05:12 PM
I'm seeing the same behavior after upgrading. I just received my first license warning. Did you ever resolve this?
... View more
05-15-2012
10:01 AM
Yeah, its what I ended up doing. Do you know what reasons are the ones that make a bucket roll over early?
Thanks!
... View more
05-10-2012
11:11 AM
Hi,
My main index is stored in two locations depending on whether its a cold bucket or a hot/warm bucket. I set aside 400 GB of fast storage for the hot/warm buckets so with a maxDataSize of 10GB (auto_high_volume) plus 10 hot buckets I should set maxWarmDBCount to 30 right?
(30 warm buckets * 10GB) + (10 hot buckets * 10GB) = 400GB
The problem is that hot buckets are not reaching their 10GB limit so I end up having 30 warm buckets varying in size and consequently the 400GB are really never completely used up and is only half full with many 5GB buckets.
How can I make sure that buckets don't get rolled over until they reach the MaxDataSize limit?
Thanks!
... View more
05-09-2012
04:42 PM
Yeah, I've had this happen. How many GB is each indexer handling daily? A safe number is 100GB.
... View more
05-07-2012
11:35 AM
I'm also looking for an answer to this issue. Did you find anything?
thanks!
... View more
05-04-2012
11:43 AM
1 Karma
The free version of Splunk comes with various indexes out of the box and the documentation does not mention any limits on the number of indexes you create or where the information gets sent to. I've actually created some myself on the free version.
This might help:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree
... View more
05-04-2012
11:36 AM
Hi,
All I've read indicates that data hot off the indexing pipeline is put directly into the hot buckets.
yes it's possible to split an index into a location for hot-warm and cold storage. We actually do this, storing our hot/warm buckets on local drives and cold buckets on a network volume. After we did this we did see an increment in performance in terms of events per seconds read during searching and events indexed per second.
You can configure the different locations in indexes.conf like so:
[main]
homePath=/local/myindex/db
coldPath=/remote/myindex/colddb
thawedPath=/remote/myindex/thawed
Making the switch over on a live index is another issue though 😛
Good luck!
... View more
05-03-2012
12:03 PM
Wow, the pdf server is not supported on windows? Man its was a pain to get it working on our RHLE search heads... I thought on windows it just might be a matter of pressing next a few times and "I agree" before having it working.
... View more
05-03-2012
09:54 AM
1 Karma
You should be advised that running Splunk in a virtual environment is not recommended. Splunk needs fast access to the hardware and the VM will only add more layers between splunk and the hardware. Having said that, we run Splunk off RHEL and the only issues I've had that have been dependent on the OS have been with the PDF server. Everything else is pretty much a breeze. Other than that RHEL has given us no issues what so ever.
Maybe some one can comment on Windows.
... View more
05-02-2012
05:48 PM
Hi,
I'm trying to find out how frequently the data on splunk is accessed vs its age. For this I though I could craft a search that searches trough the audit index and maybe retrieves the time range of the searches the users have made so far. The problem is that I'm not finding that level of detail on the audit index. Any thoughts on where I can get this information from? This issue does not merit using the API.
Thanks!
... View more
03-28-2012
03:20 PM
I have noticed that some forwarders are not sending all of the log files. The log files are rotated hourly and I can see in the forwarder's log that it notices the log rotation and sends the file over. But once in a while it will not send it over and I can see that there is no corresponding event for that hour in the splunkd.log file on the forwarder stating that it has noticed a change in the log:
03-26-2012 15:25:25.044 +0000 INFO BatchReader - Removed from queue file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 15:49:11.554 +0000 INFO BatchReader - Removed from queue file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 16:00:00.449 +0000 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 16:00:00.449 +0000 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 17:00:00.754 +0000 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 17:00:00.754 +0000 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 17:45:30.230 +0000 INFO BatchReader - Removed from queue file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 18:00:00.148 +0000 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 18:00:00.148 +0000 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 19:10:42.208 +0000 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 19:10:42.208 +0000 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 21:00:55.261 +0000 INFO BatchReader - Removed from queue file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 21:00:55.262 +0000 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 21:00:55.262 +0000 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 22:02:56.527 +0000 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/opt/ea/nova/nucleus/serv/nucleus.log'.
03-26-2012 22:02:56.527 +0000 INFO WatchedFile - Will begin reading at offset=0 for
file='/opt/ea/nova/nucleus/serv/nucleus.log'.
You can see that there are no events for 20:00 and I can see the missing gap in the timeline when I do a search.
Any thoughts? 😕
Thanks!
... View more
02-27-2012
06:05 PM
Other than props.conf, is there any other file that controls how multi-line events are split or kept together? We are having some strange issues where an event is bundled together with lines that correspond to another event on one day and then the next day having that same event type split up incorrectly in to many chunks of lines. No configuration changes have taken place in between these two occurrences so this is really odd.
Thanks!
... View more
- Tags:
- e
- props.conf
- xml
