About christopher_hod

christopher_hod · ‎04-28-2015

You could also look into changing the logging to use rotatelogs, but I'm assuming they won't give you direct access to the httpd.conf. If that's the case I would look into Ducky's suggestion

christopher_hod · ‎10-23-2014

Is it possible you could be using a lookup instead? This way it's never actually indexed (so never needs to be deleted). Also, if it doesn't really need to be gone and you just want to see the latest version in searches, look at dedup

christopher_hod · ‎05-19-2014

If you choose a schedule type of "cron" you can give it more complex patterns. For example, if you wanted the report to run once per hour at 17 minutes after the hour, then choose "cron" and use this string: 17 * * * * If you wanted it to run every 15 minutes: */15 * * * *

christopher_hod · ‎06-05-2013

I can confirm that hitting http[s]://[splunkweb_host]:[splunkweb_port]/debug/refresh?entity=admin/views fixed this problem for me

christopher_hod · ‎01-23-2013

There's no need to install a separate UF on an indexer. While you could, it's probably not what you really want and will probably wind up confusing things. I was more concerned about the confusing part for this debugging exercise.

christopher_hod · ‎01-17-2013

So the output of hardware.sh (from the Unix app) is something like this: KEY VALUE CPU_TYPE Intel(R) Xeon(R) CPU E5630 @ 2.53GHz CPU_CACHE 12288 KB CPU_COUNT 16 HARD_DRIVES sda (PERC H700) 816 GB; sdb (PERC H800) 18625 GB; NIC_TYPE Broadcom NetXtreme II Gigabit NIC_COUNT 1 MEMORY_REAL 16426668 kB MEMORY_SWAP 4096564 kB Is there an easy way to get the key/value pairs into fields properly?

christopher_hod · ‎01-17-2013

That's why I used the "|head 1" in my answer below. You could also use the latest() function. FYI, if you want to use a pie chart, you're only going to want one value per filesystem. You could also do one pie chart per filesystem, but that's more complex

christopher_hod · ‎01-15-2013

For starters, use |convert to normalize those values instead of that eval. I would also drop that table command. And you probably only want the most recent value, but you want all filesystems. Finally, you need to actually chart the data. So what we're left with is something like this: host="myhost" sourcetype="df" | head 1 | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert memk(Used) | chart avg(Used) AS Used by Filesystem

christopher_hod · ‎10-09-2012

The short answer is that Splunk only accounts for volumes using the volume configuration. To explain further, there are two things that could be on your disk that are taking up space that Splunk is not accounting for: 1) Files that are not current indexes. This could include any file that is on the filesystem or possibly old indexes that were removed from the config and not cleaned up 2) Indexes that use somethign other than volume:local to define where they live. So, for example, it might use $SPLUNK_DB/mydb as the location. While this might point to the same filesystem, it won't be counted against your maxVolumeDataSizeMB quota. Make sure to check all indexes.conf on your system for indexes of the second kind. Some apps will define their own indexes and, in my experience, most will use $SPLUNK_DB. Just change the definition by copying the indexes.conf to the local dir and using the correct volume setting.

christopher_hod · ‎08-07-2012

Try making the end look like this: downloading /[^/]+/[^/]+/(?P [\w.])$"

christopher_hod · ‎07-19-2012

The scenario: I have a scripted input that gives me a list of files in a directory. On a regular basis I want to run a search that will see how many times each of those has been served by the webserver. I also want to include in the report any files that have not been hit in the report. Assume the subsearch for the list of files is just: [search sourcetype=dirlist | fields filename ] And that it's searching against normal apache access logs.

christopher_hod · ‎04-27-2012

I'm curious what the advantage to running the 64-bit forwarder is. I assume it won't ever need enough memory that it will matter. So are there any advantages? If there aren't then it would make things easier if we could just push out one version to all forwarders (the 32 bit version)

christopher_hod · ‎04-24-2012

I had the same thing and realized I had managed to move the deploymentServer app out of the way (which holds my serverclass.conf). So make sure you have one of those under $SPLUNK/etc/apps somewhere. Also, make sure you've only got one splunk instance installed.

christopher_hod · ‎03-29-2012

I'm not sure what you mean by wildcarding in this context. But this is a splunk message board and I can only comment on how splunk interacts with rsyslog. As far as source goes, if you're using syslog, you're not going to get much more than source=syslog anyway. If you want more specific sourcetypes, I can give you examples of that.

christopher_hod · ‎03-29-2012

We use rsyslog. All networking equipment send it's logs to a central syslog server(*) that then uses this rule: $template DynaFile,"/var/log/syslog/system-%FROMHOST%.log",500000 We then grab them with an inputs.conf that looks like this: [monitor:///var/log/syslog] index = syslog sourcetype = syslog host_regex = /var/log/syslog/system-(.*).log* (*) It's actually a VIP that goes to a load balancer, but that's not really important to this discussion.

christopher_hod · ‎02-02-2012

I'm also getting this message and I have an enterprise license. Any word on how to either fix this or disable the message entirely?

Posts	16
Solutions	1
Karma Given	40
Karma Received	17
Member Since	‎12-14-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Extract fields from hardware sourcetype in unix ap...

Find files that are not being accessed

32 vs 64 bit forwarder

Re: how to index a log file with the same name acr...

Re: If a text file indexed in Splunk is completely...

Re: Alert schedule -- not on the hour

Re: Splunk On Splunk 3.0 generates tons of dispatc...

Re: Deployment Server listening - but not respondi...

Extract fields from hardware sourcetype in unix ap...

Re: Disk Space Pie Charts from "df" Script in UNIX...

Re: Disk Space Pie Charts from "df" Script in UNIX...

Re: MIsmatch between df and Splunk size of volume

Re: Regex question

Find files that are not being accessed

32 vs 64 bit forwarder

Re: Deployment Server listening - but not respondi...

Re: Does rsyslog work well with Splunk

Re: Does rsyslog work well with Splunk

Re: Splunk 4.3 splunk enterprise upgrade message