Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About klaxdal
klaxdal
Contributor
Member since:
08-12-2014
01-21-2026
Community Statistics
| Posts | 106 |
| Solutions | 10 |
| Karma Given | 19 |
| Karma Received | 36 |
| Member Since | 08-12-2014 |
Activity Feed
- Posted Delayed response times running on Splunk Enterprise 10.x on Splunk Enterprise. 01-21-2026 07:41 AM
- Got Karma for Re: reinstalling splunk enterprise - RESOLVED. 01-21-2025 04:48 AM
- Got Karma for Re: reinstalling splunk enterprise - RESOLVED. 09-11-2024 06:45 PM
- Got Karma for Re: reinstalling splunk enterprise - RESOLVED. 11-17-2023 04:39 AM
- Got Karma for Re: reinstalling splunk enterprise - RESOLVED. 08-23-2023 04:31 AM
- Got Karma for Re: reinstalling splunk enterprise - RESOLVED. 01-19-2023 12:36 PM
- Posted Re: Microsoft Azure App for Splunk on All Apps and Add-ons. 11-01-2022 09:21 AM
- Got Karma for Re: Splunk Add-on for AWS Hangs. 07-16-2021 07:41 AM
- Got Karma for Re: Splunk install for Linux Centos. 05-18-2021 02:35 PM
- Posted Re: Splunk install for Linux Centos on Installation. 05-18-2021 01:35 PM
- Posted Re: Splunk install for Linux Centos on Installation. 05-18-2021 11:29 AM
- Got Karma for Re: reinstalling splunk enterprise - RESOLVED. 07-28-2020 10:06 AM
- Got Karma for Re: reinstalling splunk enterprise - RESOLVED. 07-21-2020 07:03 AM
- Karma When will Splunk Enterprise 8.0.1 be released? for isbjorn. 06-05-2020 12:50 AM
- Karma Splunk 8.0 Website Monitoring python fail for eduardo1989. 06-05-2020 12:50 AM
- Karma AWS Addon Not Showing Personal Health for paimonsoror. 06-05-2020 12:50 AM
- Karma authentication to o365 stopped working for mcbradford. 06-05-2020 12:50 AM
- Karma Some events missing from data model - only if accelerated for helge. 06-05-2020 12:50 AM
- Got Karma for Re: AWS Cloud Watch Metrics into Splunk Cloud. 06-05-2020 12:50 AM
- Karma Archive Splunk buckets to AWS S3? for sarnagar. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-21-2026
07:41 AM
Since upgrading to Splunk Enterprise 10.x the response times are through the roof - anyone else seeing the same ?
... View more
Labels
- Labels:
-
metrics
-
troubleshooting
05-18-2021
01:35 PM
1 Karma
Is this an upgrade or initial install ? if upgrade try rpm -ivh <package name > —force
... View more
01-31-2020
11:23 AM
Could you not use Rsyslog - if I understand the question - you want the syslog to create unique host information ?
$template RemoteHost,"/var/syslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog.log"
Then apply this template to messages coming from remote hosts :
$RuleSet remote
. ?RemoteHost
Then have Splunk then monitor the entire /var/syslog/hosts/
... View more
01-09-2020
06:01 AM
Currently experiencing wicked high CPU and memory utilization after installing the add on . Currently run Splunk 8.0.1 on Centos 7 ( fully updated)
Anyone having similar issues ?
... View more
12-27-2018
04:27 AM
See the follwing :
Blockquote
Splunk strongly recommends against using the CloudWatch Logs inputs to collect VPC Flow Logs data (source type: aws:cloudwatchlogs:vpcflow) since the input type will be deprecated in upcoming releases. Configure Kinesis inputs to collect VPC Flow Logs instead. The add-on includes index-time logic to perform the correct knowledge extraction for these events through the Kinesis input as well.
Blockquote
https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs
... View more
12-21-2018
08:44 AM
I run it on a CentOS search head without issue - as kmorris said the restriction seems to be if one wants to collect the local windows logs ( assumes WIndows search head )
... View more
12-21-2018
08:42 AM
1 Karma
I would recommend HEC - Kinesis Firehose - I have implemented both .
As I understand it - the Heavy Forwader method with soon be deprecated.
... View more
11-27-2018
05:14 PM
I had it working 7.1.1 and yes its free . BTW 7.2.1 breaks it 🙂
... View more
08-02-2018
08:27 AM
I am having the same issue - did you resolve it ?
... View more
05-01-2018
11:44 AM
Hi all - any help would be appreciated ,
Within the Splunk App for AWS there are a series of alerts - these used to fire ( both triggered and email ) recently , the alerts haven't been firing with exception of two - RI Instance expiration and config -
The only change within the system was an upgrade to version 7.x
Any ideas ? Where to start ?
Thanks
... View more
03-31-2018
07:26 AM
1 Karma
I encountered a similar issue - removed everything in the /local - restarted splunk and it stopped hanging .
From there reconfigured my inputs and all was well -
... View more
03-29-2018
05:46 AM
The heavy forwarder facilitates the connection / data parsing but does not 'index'
Additionally the data is not read from AWS by the search head but rather the search head is looking at the indexed data . There are some components which require the search head to forward data to the indexer .
... View more
03-02-2018
11:04 AM
First thing I would check is- ensure your set up is allowing traffic on port 9997 - from the web console Settings >Forwarding and Receiving > Configure Receiving > Add port 9997
... View more
01-19-2018
09:59 AM
I personally change the ulimits on all splunk servers ( for consistency )
I also use the initd method to ensure ulimits are 'stickey'
** note you will need to full restart the server ( reboot ) for the changes to take effect as they are in the initd running /opt/splunk/bin/splunk restart wont put the required change in place .
... View more
01-17-2018
10:48 AM
Try setting it in the Splunk initd
https://answers.splunk.com/answers/223838/why-are-my-ulimits-settings-not-being-respected-on.html
... View more
01-08-2018
09:55 AM
1 Karma
@ basu42002 ,
Can you explain how you set this up?
Thanks
... View more
12-21-2017
11:59 AM
Thanks so much for your help !
... View more
12-21-2017
06:37 AM
I am trying to adjust the Availability panel within the Status History to show month over month availability percentages - it currently only shows the aggregate e.g. displays one value as opposed to breaking out availability month -to -month
Here is the current search :
sourcetype="web_ping" title="" NOT (date_hour>=1 date_hour<120) NOT (date_hour>=4 date_hour<420) NOT (date_hour>=21 date_hour<2120) | fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0) | fillnull value=1 success | chart count as total, sum(success) as successes | eval availability=round(100(successes/total),2) | fields availability
Any help would be greatly appreciated !
... View more
- Tags:
- splunk-enterprise
08-23-2017
09:55 AM
Same here
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-21-2026
07:37 AM
|
Karma from
