Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About glitchcowboy
glitchcowboy
Path Finder
Member since:
01-03-2012
06-05-2020
Community Statistics
| Posts | 40 |
| Solutions | 6 |
| Karma Given | 5 |
| Karma Received | 33 |
| Member Since | 01-03-2012 |
Activity Feed
- Karma Re: Splunk DB Connect 2: What should the serviceClass be for my custom jdbc database (Unidata)? for sjohnson_splunk. 06-05-2020 12:47 AM
- Karma Re: Is there a limit on the number of files a forwarder can monitor? for cwacha. 06-05-2020 12:46 AM
- Karma Re: Splunk App for Unix Home/Metrics Empty for araitz. 06-05-2020 12:46 AM
- Karma Re: Halp! My data is being rolled to frozen and I don't know why! for bosburn_splunk. 06-05-2020 12:46 AM
- Got Karma for Re: chopping up lastlog. 06-05-2020 12:46 AM
- Got Karma for CreateInputs.jar crashes. 06-05-2020 12:46 AM
- Got Karma for When does Splunk roll internal logs?. 06-05-2020 12:46 AM
- Got Karma for When does Splunk roll internal logs?. 06-05-2020 12:46 AM
- Got Karma for When does Splunk roll internal logs?. 06-05-2020 12:46 AM
- Got Karma for When does Splunk roll internal logs?. 06-05-2020 12:46 AM
- Got Karma for When does Splunk roll internal logs?. 06-05-2020 12:46 AM
- Got Karma for Re: Why Fear the PDF export?. 06-05-2020 12:46 AM
- Got Karma for Re: Splunkd daemon is not responding: ('The read operation timed out',). 06-05-2020 12:46 AM
- Got Karma for Re: Splunkd daemon is not responding: ('The read operation timed out',). 06-05-2020 12:46 AM
- Got Karma for Re: MySql Add On for an Splunk App. 06-05-2020 12:46 AM
- Got Karma for Alert emails at every splunk restart. 06-05-2020 12:46 AM
- Got Karma for Alert emails at every splunk restart. 06-05-2020 12:46 AM
- Got Karma for Re: How do I exclude everything but certain events at my heavy forwarder?. 06-05-2020 12:46 AM
- Got Karma for Re: How do I exclude everything but certain events at my heavy forwarder?. 06-05-2020 12:46 AM
- Got Karma for Re: chopping up lastlog. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 5 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 1 |
03-07-2016
07:25 AM
Will Splunk ever fix this?
... View more
02-19-2015
02:06 PM
I'd like this timechart to be stacked with each vertical stack having in/out for each service_desc. Another way to say it would be that
I want three stacks/columns for each time span. Each column will have 2 values : in_kbps and out_kbps. Any hints?
sourcetype=service_perfdata service_desc="traffic-dc-asa-fw-*"
|rex field=inBandwidth "(?<in_kbps>\d+\.\d+)Kbs"
|rex field=outBandwidth "(?<out_kbps>\d+\.\d+)Kbs"
|eval in_kbps=in_kbps/1024|eval out_kbps=out_kbps/1024
|timechart avg(in_kbps) avg(out_kbps) by service_desc
... View more
05-22-2014
09:25 AM
Wild guess (without a sample)
SOAs\.(?<domain>[\w\.\d-]+)\.
... View more
05-22-2014
09:13 AM
I've got a dynamically filled CheckboxPulldown and I'd like some of the items to be deselected (if they appear).
Is it possible?
... View more
04-02-2014
01:19 PM
1 Karma
On some of my systems, it works fine,
On the newer system, it crashes
/usr/IBM/WebSphere/AppServer/java/bin/java -jar CreateInputs.jar -startpath /usr/IBM/WebSphere/AppServer/profiles/ -hostname ahost -whitelist '.log$|.txt$'
Add /usr/IBM/WebSphere/AppServer/profiles/ ...
Add /usr/IBM/WebSphere/AppServer/profiles/ ...
Add /usr/IBM/WebSphere/AppServer/profiles/ ...
Add /usr/IBM/WebSphere/AppServer/profiles/Dmgr01/logs/ffdc
Exception in thread "main" java.lang.NullPointerException
at java.io.File. (File.java:233)
at CreateInputs.addLogStanzasAction(CreateInputs.java:530)
at CreateInputs.addLogStanzas(CreateInputs.java:524)
at CreateInputs.main(CreateInputs.java:252)
Any help is appreciated.
... View more
04-02-2014
09:21 AM
My SearchHead's Splunk_TA_nix was an empty folder. Thus, the KV_MODE was gone.
Replaced Splunk_TA_nix and 'index=os|extract reload=t' and I'm in business.
... View more
04-02-2014
08:42 AM
Wait... If I paste that search in (sans the word 'search'), I get no data, but if I put |multikv| in near the beginning it works. Is there some sort of auto-multikv supposed to be going on here?
... View more
04-02-2014
08:37 AM
well, any metric!
So I go to Hosts, select a host, and then the process stats has an inspector link.
This search has completed and found 1 matching event. However, the transforming commands in the highlighted portion of the following search:
search index=os sourcetype=top host=XYZ | stats max(pctCPU) as pctCPU max(pctMEM) as pctMEM last(cpuTIME) as cpuTIME by COMMAND, USER | eval CMD=COMMAND | fields CMD, USER, pctCPU, pctMEM, cpuTIME
over the time range:
4/2/14 10:30:37.000 AM – 1/1/01 12:00:00.000 AM
generated no results.
... View more
04-02-2014
08:11 AM
Using Splunk App for Unix 5.0.1
I set up a basic category with a couple groups in it with a couple hosts each.
Search Head has SA-nix, Splunk_TA_nix, and splunk_app_for_nix installed.
Indexers have SA-nix and Splunk_TA_nix installed.
UF's have Splunk_TA_nix installed, with inputs enabled.
On the SH I go to metrics, then click on a group and I get nothing "No results found..."
If I search, (e.g.: index=os sourcetype=cpu) I get all the data I want.
Settings/index/sourcetypes are all default, nothing fancy
Why are my home screen/metrics screens are empty?
... View more
03-26-2014
08:10 AM
By The Way, I left this one to run for quite a while and forgot about it. It chewed up 10G in /opt/splunk/var/run/splunk/dispatch and caused me a small headache. So don't leave it run too long:)
Interesting data though! thanks!
... View more
01-09-2014
09:06 AM
Had to modify rex for my db's from /logs/splunk_logs to /mydatadir/\w+
Extraordinary, thanks!
... View more
06-07-2013
01:02 PM
4 Karma
Is this what you're looking for?:
index=os sourcetype=lastlog|multikv|table host,LATEST,FROM,USERNAME
... View more
05-16-2013
02:41 AM
1 Karma
It took me several days to find it (with the expert leading of mlanghor).
Turns out that the unix app was disabled on the indexers, so they didn't know about the props.conf settings used to parse the netstat.sh input.
The key troubleshooting tip was:
$SPLUNK_HOME/bin/splunk cmd btool props list --debug netstat
On a test indexer I built just for troubleshooting this, it returns data about the netstat props config. On my production indexer, I got a blank stare (no output).
... View more
05-14-2013
01:15 PM
I've got the nix app running on my search head, and 300 or so nix Forwarders sending data in. On some of the forwarders, the netstat.sh output gets broken into one event per line in a search, but the others have a single event per netstat.sh run.
This is consistent whether the OS is AIX or RHEL.
Has anyone ever seen this before?
... View more
- Tags:
- nix
- splunk_ta_nix
03-25-2013
10:27 AM
Perfect, thanks! I'm sure running ext3 on top of btrfs isn't terribly quick, but on my laptop it'll fly. Where'd I put that imaginary SSD now???
... View more
10-26-2012
06:03 AM
5 Karma
I need to limit the disk usage on splunk's internal logs. (/opt/splunkforwarder/var/log/splunk). I've set the $SPLUNK_HOME/etc/log.cfg on the forwarder for ALL entries like this:
xxxxx.XX.maxFileSize=10000000 # default: 25MB (specified in bytes).
xxxxx.XX.maxBackupIndex=2
But I still have 5 metrics.log files and they're all 25MB after a splunk restart.
Any idea when they rotate and/or how to force it?
... View more
09-27-2012
07:12 AM
Here's a scriptlet if that helps (it'll also grab sh_history, csh_history, etc):
It's not looking at /etc/passwd, but at the filesystem, which should work.
for file in $(find /home|grep -E "\.\w*sh_history$"; find /root|grep -E "\.\w*sh_history$")
do
echo "[monitor://$file]">>inputs.conf
echo "sourcetype = shell_history">>inputs.conf
done
Obviously I haven't answered your first question -- still thinking on that one.
... View more
09-27-2012
06:07 AM
1 Karma
Go to MySQLConnector App, Manage Database Connections, Privileges, and then open up the privileges for the DB connection to allow it to be visible to other apps.
Referenced: http://splunk-base.splunk.com/answers/58375/can-mysql-connector-do-this
... View more
09-27-2012
06:00 AM
No, it wasn't a misguided MTU, because it happened at every splunk restart, not MTU/MTA restart. I never found the cause, but eventually it just went away
... View more
09-14-2012
12:40 PM
How could I get this per index? I'd like total on each index (series)
... View more
09-12-2012
01:12 PM
2 Karma
I set this up on a new full instance of splunk and it works, given this input from some client:
# echo "[cnn.com]" > /dev/tcp/splunkindexerip/9999
# echo "[http://hi.net]" > /dev/tcp/splunkindexerip/9999
# echo "[google.com]" > /dev/tcp/splunkindexerip/9999
# echo "[foxnews.com]" > /dev/tcp/splunkindexerip/9999
# echo "[startitup.com]" > /dev/tcp/splunkindexerip/9999
# echo "[samsonite.com]" > /dev/tcp/splunkindexerip/9999
# echo "[nascar.com]" > /dev/tcp/splunkindexerip/9999
props.conf
[source::tcp:5555]
TRANSFORMS-set = setnull,keep,keep2,keep3
transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[keep]
REGEX = \[cnn.com\]
DEST_KEY = queue
FORMAT = indexQueue
[keep2]
REGEX = \[google.com\]
DEST_KEY = queue
FORMAT = indexQueue
[keep3]
REGEX = \[nascar.com\]
DEST_KEY = queue
FORMAT = indexQueue
The output was what you were hoping for, only cnn, google, and nascar show up.
Is the Heavy Forwarder actually indexing before it passes the data on?
... View more
09-12-2012
09:39 AM
Perhaps this is a stupid question, but is it asking you for your splunk.com credentials rather than local splunk credentials?
... View more
09-12-2012
08:07 AM
2 Karma
I have the following savedsearch that sends an alert for an old event every time I restart splunk (indexer/search head). Any ideas why this is or how to make it stop
[Some CRITICAL Alert]
action.email = 1
action.email.inline = 1
action.email.sendpdf = 1
action.email.to = anemail@overthere.com
alert.digest_mode = False
alert.expires = 12h
alert.severity = 5
alert.suppress = 0
alert.suppress.period = 30s
alert.track = 1
cron_schedule = * * * * *
dispatch.earliest_time = rt
dispatch.latest_time = rt
displayview = flashtimeline_excel
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_view = flashtimeline_excel
search = eventtype="XYZ-Eventtype"
vsid = xxxxxxx
... View more
09-06-2012
02:24 PM
Nope, there are other 'logs' directories in other places in the /files directory tree (e.g. /files/abc/stuff/logs/XYZ.out) which I don't want to report.
... View more
09-06-2012
12:40 PM
I have some complicated Extended Regexes that give the right files when used with a find /|grep -E "regex" but do not work in inputs.conf.
Here's an example:
[monitor:///files]
whitelist = \/(qqq|abc)\/\w+\/wls[0-9]+\/user_projects\/domains\/\w+\/servers\/\w+\/logs\/\w+\.out
Which would match any of these files when used with a find /|grep
/files/qqq/foo/wls1234/user_projects/domains/bar/servers/foofoo/logs/foobar.out
/files/abc/BAR/wls1234/user_projects/domains/GOO/servers/foofoo/logs/FBAR.out
/files/abc/FBAR/wls1234/user_projects/domains/GAR/servers/foofoo/logs/GBAR.out
BUT in inputs.conf, it matches a LOT more under /files
In simple english, I need to match:
/files/(abc or qqq)/*/wls*/user_projects/domains/*/servers/*/logs/*.out
... View more
- Tags:
- inputs.conf
- regex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
