Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kundeng
kundeng
Path Finder
Member since:
12-02-2013
06-08-2021
Community Statistics
| Posts | 38 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 4 |
| Member Since | 12-02-2013 |
Activity Feed
- Got Karma for Re: How to delete local changes to knowledge objects in a search head cluster?. 10-12-2021 04:10 PM
- Posted shc captain flapping, constant election going on every several minutes. on Deployment Architecture. 06-08-2021 02:28 PM
- Posted Re: Need a best practice guide on entity management in ITSI on Splunk IT Service Intelligence. 07-28-2020 07:32 AM
- Posted Need a best practice guide on entity management in ITSI on Splunk IT Service Intelligence. 07-27-2020 12:54 PM
- Got Karma for Re: Recieving error "Access is denied" when trying to deploy 'splunk apply shcluster-bundle'?. 06-05-2020 12:47 AM
- Got Karma for Re: How to delete local changes to knowledge objects in a search head cluster?. 06-05-2020 12:47 AM
- Got Karma for Does the anomalies command work at all?. 06-05-2020 12:46 AM
- Posted Re: systemd start restart for splunk not working as expected on Deployment Architecture. 04-28-2020 06:55 AM
- Posted Re: systemd start restart for splunk not working as expected on Deployment Architecture. 04-27-2020 07:00 AM
- Posted Re: Http Event Collector ignores JSON timestamp on Getting Data In. 04-26-2020 02:02 PM
- Posted Re: Process of Indexed Extraction Configuration on Getting Data In. 04-24-2020 07:31 PM
- Posted Re: Systemd broken on new install on Installation. 09-17-2019 01:03 PM
- Posted Re: Query about Architect Exam (recertification) on Training + Certification. 09-07-2019 12:34 PM
- Posted Re: Can you help me find a more detailed explanation on the Splunk modular input manager UI XML than exists in Splunk Documentation? on Getting Data In. 11-05-2018 09:05 AM
- Posted Re: Can you help me find a more detailed explanation on the Splunk modular input manager UI XML than exists in Splunk Documentation? on Getting Data In. 10-29-2018 10:28 AM
- Posted Can you help me find a more detailed explanation on the Splunk modular input manager UI XML than exists in Splunk Documentation? on Getting Data In. 10-29-2018 07:52 AM
- Tagged Can you help me find a more detailed explanation on the Splunk modular input manager UI XML than exists in Splunk Documentation? on Getting Data In. 10-29-2018 07:52 AM
- Tagged Can you help me find a more detailed explanation on the Splunk modular input manager UI XML than exists in Splunk Documentation? on Getting Data In. 10-29-2018 07:52 AM
- Tagged Can you help me find a more detailed explanation on the Splunk modular input manager UI XML than exists in Splunk Documentation? on Getting Data In. 10-29-2018 07:52 AM
- Posted Re: Modular Input Custom UI on Splunk Search. 10-29-2018 07:41 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
06-08-2021
02:28 PM
index=_internal sourcetype=splunkd NOT info (log_level="WARN" OR log_level="ERROR" OR log_level="CRIT" OR log_level="FATAL") splunksh* component=SHCMasterHTTPProxy log_level=WARN 06-08-2021 17:11:11.735 -0400 WARN SHCMasterHTTPProxy - Low Level http request failure err=failed method=POST path=/services/shcluster/captain/artifacts/dummy/remove_all captain=splunkshc-prod05.med.umich.edu:8089 rc=0 actual_response_code=500 expected_response_code=200 status_line="Internal Server Error" transaction_error="<response>\n <messages>\n <msg type="ERROR">Peer 3AB94F34-364E-450C-81AC-D6E4A2E6018A does not exist. Cannot remove artifacts/sids from all</msg>\n </messages>\n</response>\n" It happens on all nodes, but more frequent when 2 out of 5 are captains: xxa.med.umich.edu:8089 52 xxb.med.umich.edu:8089 3253 xxc.med.umich.edu:8089 45 xxd.med.umich.edu:8089 107 xxe.med.umich.edu:8089 3799
... View more
Labels
- Labels:
-
captain
-
search head clustering
07-28-2020
07:32 AM
Thanks! Let me try to understand what you said. * About services. I agree for something this simple, 1 service with multiple KPIs should suffice. I proposed multiple services because of some other reasons. One of them is silo-ed departments. The OS team or WEB team is completely separate from each other. They demand clear delineation of "their stuff". In your experience, when would you go with multiple services with dependencies between them? * Let's go with 1 service for a simplified case. I remember being taught the natural business key of an entity is the combinations of title+alias+information. That's why it is Theoretically possible to have 2 entities with the same title. See this: https://docs.splunk.com/Documentation/ITSI/4.5.0/Entity/EntityImportConflicts for an example that can lead to 2 entities with the same title, e.g 2 servers with the same host name on different data centers. My question is when you would go with treating potential entities from different sources as being essential one entity and when you will separate them? * Let me apply your strategy of unifying entities that applies to my case, please correct me if I'm wrong: I created previously at least 1 entity per forwarder instance with Title-><hostname>, instead in my entity importing search, I should add a tmpentity field--- eval tmpentity=hostname and make tmpentity the Title, and also include tmpentity as part of the alias fields. For importing entities from any other data sources, if I decide that they should be just referring to and enriching an existing entity, instead of creating a different entity, I would: eval tmpentity=<a field that takes the same set of values as existing entity>, and use tmpentity will be used as the conflict resolution field so for the web log, tmpentity=host will suffice. what about the OS log, where entity is called "web-host" in the "host" field. should I do eval tmpentity=if(host="web-host", "web01", host)? In my service definition / entity associations, I will then always use tmpentity field for filtering. I should also then always include "eval tmpentity=..." in my base KPI searches. I appreciate any comments.
... View more
07-27-2020
12:54 PM
Hi I am still confused about ITSI entity management and best practices after taking the training. Can someone enlighten me on this? Here is an example to motivate my confusions. Suppose I plan to create 2 services that monitor health of a web server, the first one called A focuses on IT metrics such as error rates, response times etc; the second one called B focuses on the VM OS performances such as cpu and memory etc. As I have imported all splunk forwarders as entities. The server is already there as an entity E1 which has an alias hostname=web01. Now, in the IIS/apache logs, the server can be found by "host=web01"; In the OS performance logs, the server can be found by "host=web-host'; My question is what is best practices to manage entities in this case. 1. Should I have created 2 other entities with different aliases? That is the second one E2 which has alias "hostname=web01" and E3 which has alias "host=web-host". 2. Or should I somehow normalize the data such that there is only 1 entity. If so, how?
... View more
Labels
- Labels:
-
using ITSI
04-28-2020
06:55 AM
Hi,
what is not true? Can you be specific? Thanks.
What I meant is when I have that specific settings (restart=always), "splunk stop" won't stop splunk.
It seems that you have created some kind of polkit changes to get round systemd enabled splunk asking for password. I am sure it is possible for certain distributions of Linux and will definitely look into it. Note that is not an official solution from splunk as far as I know, having dealt with many splunk consultants whose suggestions are always "don't enable it".
My frustration is that I haven't seen any other software so frustrating like splunk in terms of start/stop. The best direction going forward is for splunk to fix the damn issue, as we are paying them big bucks. No?
... View more
04-27-2020
07:00 AM
I have researched this issue for a very long time. So far there isn't a perfect solution still:
linux system with only systemd (and auto routing to /etc/init.d script) support, but without actual sysV
Restart= on-failure will cause splunk to stop but not restart when an internal splunk start is invoked, in situtations like rolling-restart etc.
The only way to get it to reliably restart is to set
Restart= always
Ironically, this seems to be also the recommended setting in splunk's systemctl config with splunkd binary support.
The downside is that you will not be able to control start/stop using splunk binary.
using splunk splunkd systemctl support.
This was default in 7.2 and then removed as default >=7.3 I was told by PS not to enable due to other issues. One issue is of course that you need (can get around) root password to start/stop.
... View more
04-26-2020
02:02 PM
Hi,
I'm assuming you used raw+ props to get what you want.
Are you able to do event protocol+ NO props to get proper time-stamping? I thought that is what HEC was designed for among other things, i.e. to simplify and speed-up data landing without data having to go through the parsing pipeline etc.
If you CAN control the formatting from the sender side, you need to change time to epoch time, and then you can just use HEC event protocol.
... View more
04-24-2020
07:31 PM
Did you fix this issue? Does HEC support explicit indexed_extractions of CSV or JSON files when it is set to raw mode?
... View more
09-07-2019
12:34 PM
I did pass the architect exam today but my experience was not very good. Here are a few things that you need to know:
MAC OS Mojave is not working with the test system (as of 09/07/2019), and thus you need to find a windows PC. I was fortunate to have a spare windows laptop otherwise I would have to reschedule it.
The exam software jumps in and out of its existence without any prompt on windows, which is scary. All windows will suddenly close and then reopen etc. So be patient.
The test result is not shown on your screen, when you click "existing the survey". So you don't know whether you really have finished the test or not. I waited for about 5 minutes to get an email that informs me how to check the result.
The proctor never showed up when the exam begins, and then in the middle of the exam, he opened up chat window to tell me that my head is not completely in the video recording.
All in all, none of these should affect your performance, if you have studied for the exams. But I would say the test experience does need improving.
... View more
11-05-2018
09:05 AM
Can any splunk guru provide an example of a manager UI that dynamically shows or hides a set of fields?
... View more
10-29-2018
10:28 AM
Thanks. I did. However I needed functionality that is currently not provided by the add-on builder.
... View more
10-29-2018
07:52 AM
Hi,
Where is the documentation for customizing modular input manager UI? I understand there are some examples but I don't understand how it really works, especially some of the XML keys and elements need explanations.
Can somebody post a more detailed explanation of the XML elements/props than in the example here?
https://docs.splunk.com/Documentation/Splunk/7.1.3/AdvancedDev/ModInputsCustomizeUI
Some of my questions are:
How is fieldset used when rendering the UI?
How is the key used?
What is group_set?
Explanations of the spl-ctrl_* element.
The embedded language looks like python. Is it python? What is Form_defaults?
... View more
10-29-2018
07:41 AM
Hi, I have the same question. Is there not an official documentation somewhere?
... View more
10-26-2018
03:33 PM
I think I figured it out.
The splunk documentation is wrong.
http://docs.splunk.com/Documentation/Splunk/7.2.0/AdvancedDev/ModInputsStream#Streaming_example_.28XML_mode.29
The setting to force using input-layer timestamp should be
DATETIME_CONFIG = NONE (or CURRENT)
... View more
10-25-2018
04:20 PM
splunk modular input xml streaming mode allows specifying timestamp explicitly for each event. But it is not working for me.
Instead, splunk tries to find the event in the raw data and use index time if it is unavailable.
For example, my XML looks like this, and it would take 20150324111100 as the timestamp instead of 1540488716
I have also configured props.conf according to a hint in the documentation and it doesn't work either.
http://docs.splunk.com/Documentation/Splunk/7.2.0/AdvancedDev/ModInputsStream#Streaming_example_.28XML_mode.29
Modify $SPLUNK_HOME/etc/apps/myapp/default/props.conf
[my_config]
SHOULD_LINEMERGE = false
2018-10-25 13:31:56,858 INFO the xml file looks like
<stream><event stanza="hl7_modular_input://test"><index>main</index><time>1540488716</time><sourcetype>hl7</sourcetype><data>MSH|^~\&|EPIC|GMC||GMC|20150324111100|RECRN|ADT^A10|725308|T|2.3|||||||||
EVN|A10|20150324111100||ADT_EVENT|Model User^RECOVERY^NURSE^^^^^^OHSA^^^^^GMC1|20150320125007|
PID|1||3100068670^^^EPI^MR||OPTIME^TESTAVS||19950320|M|||^^^^^US^P|||||||6100212816|636-99-9512|||||||||||N||
PD1|||GRANT MEDICAL CENTER^^1013100|||||||||||||||
PV1|1|O|GSAG^OR ^OR^GMC1^^^^^^^DEPID|EL|||13020^LOMBARDI^ADOLPH^V^^^^^STARPROV^^^^STARPROV|||Surgery|PACG^^^GMC1^^^^^^^DEPID|||Phys/Clinic|||13020^LOMBARDI^ADOLPH^V^^^^^STARPROV^^^^STARPROV|OP SURGERY|6100212816|SELF||||||||||||||||||||||^^^GMC1^^^^^^^|^^^^^^^^^^|20150320125007||||||22150790003
PV2||GENERAL||||||20150320130000|||||||||||||n|N|||||||||||||||||||||||||||
ZPV||||||||||||20150320125007|||||||||
AL1|1|Drug Class|45202^NO KNOWN ALLERGIES^||||||
GT1|1|100046657|OPTIME^TESTAVS^^||^^^^^US|||19950320|M|P/F|SLF|636-99-9512|||||||||||||||||||||||||||||||||||||
</data></event></stream>
... View more
08-22-2018
10:29 AM
This is not cool, now I have to do this.
SELECT TO_TIMESTAMP('1970-01-01 00:00:00.0'
,'YYYY-MM-DD HH24:MI:SS.FF'
) + NUMTODSINTERVAL(r.TIMESTAMPfield, 'SECOND') AS event_date, r.* FROM r where ID> ? ORDER by ID
... View more
08-18-2017
10:27 AM
2 Karma
splunk should provide a simpler way for this on their GUI.
... View more
05-25-2016
08:08 AM
doesn't seem to really answer the question. I'm debugging someone's custom alert, and I don't want to change his code yet. So where are stderr stored, maybe it IS lost?
... View more
05-13-2016
07:45 AM
Did you solve this issue? I have the exact problem. dbx version is 1.1.6.
... View more
03-03-2016
11:31 AM
Did you find the answer to your question?
... View more
