Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ankurborah
ankurborah
Path Finder
Member since:
08-11-2017
01-03-2023
Community Statistics
| Posts | 13 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 08-11-2017 |
Activity Feed
- Posted Splunk Observability Cloud integration with Multiple AWS accounts on Splunk Cloud Platform. 01-03-2023 04:57 AM
- Posted Re: Splunk not receiving data from forwarders on Splunk Enterprise. 06-13-2022 12:26 AM
- Posted Re: Splunk not receiving data from forwarders on Splunk Enterprise. 06-12-2022 10:27 PM
- Posted Why is Splunk not receiving data from forwarders? on Splunk Enterprise. 06-12-2022 09:43 PM
- Posted Re: Indexing stopped on Splunk Search. 05-18-2022 10:08 AM
- Posted Re: Indexing stopped on Splunk Search. 05-18-2022 03:01 AM
- Posted Re: Indexing stopped on Splunk Search. 05-18-2022 02:43 AM
- Posted Indexing stopped: Why is there an error on SH message box? on Splunk Search. 05-18-2022 02:32 AM
- Posted Re: Splunk DB Connect: Why does table get locked for output on All Apps and Add-ons. 07-01-2019 03:48 AM
- Posted Splunk DB Connect: Why does table get locked for output on All Apps and Add-ons. 07-01-2019 03:00 AM
- Tagged Splunk DB Connect: Why does table get locked for output on All Apps and Add-ons. 07-01-2019 03:00 AM
- Tagged Splunk DB Connect: Why does table get locked for output on All Apps and Add-ons. 07-01-2019 03:00 AM
- Tagged Splunk DB Connect: Why does table get locked for output on All Apps and Add-ons. 07-01-2019 03:00 AM
- Tagged Splunk DB Connect: Why does table get locked for output on All Apps and Add-ons. 07-01-2019 03:00 AM
- Tagged Splunk DB Connect: Why does table get locked for output on All Apps and Add-ons. 07-01-2019 03:00 AM
- Posted Why my Splunk crashed. Find below crash log . Need help. on Monitoring Splunk. 02-08-2019 01:27 AM
- Tagged Why my Splunk crashed. Find below crash log . Need help. on Monitoring Splunk. 02-08-2019 01:27 AM
- Tagged Why my Splunk crashed. Find below crash log . Need help. on Monitoring Splunk. 02-08-2019 01:27 AM
- Tagged Why my Splunk crashed. Find below crash log . Need help. on Monitoring Splunk. 02-08-2019 01:27 AM
- Posted Re: Basic drilldown to pass multiple values on Dashboards & Visualizations. 09-21-2017 02:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-03-2023
04:57 AM
Hi All, Is it possible to monitor AWS services belongs to multiple AWS accounts under same organization in Splunk Observability Cloud integration for Infrastructure Monitoring. Regards, Ankur
... View more
Labels
- Labels:
-
using Splunk Cloud
06-13-2022
12:26 AM
Windows patch updates happened every month on 26th on all hosts(400+). Only this host stopped reporting on 1 Jun 2022. Then tried with restart 5th Jun.
... View more
06-12-2022
10:27 PM
It was working till yesterday. Also, we are monitoring similar types of os for other hosts. There is no upgrade or downgrade of the issue hosts in the last 2 months.
... View more
06-12-2022
09:43 PM
Splunk not receiving data from forwarders. Host os Windows Server 2012 R2.
1. Restart Splunk forwarder not working, getting some error message on CMD prompt.
2. Re-install Splunk forwarder, data start indexing for a few minutes and stopped again
3. Checked Splunk forwarder service, all the time it is running state
Getting below error(smaple part of the error) when restart forwarder:
No spec file for: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk-TA-acn_hostservice360-windows_adc_win-x86-64_iis\local\app.conf Checking: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk-TA-acn_hostservice360-windows_adc_win-x86-64_iis\local\inputs.conf Checking: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk-TA-acn_hostservice360-windows_adc_win-x86-64_iis\local\props.conf No spec file for: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk-TA-acn_infra360host_adc_win-x86-64\local\app.conf Checking: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk-TA-acn_infra360host_adc_win-x86-64\local\inputs.conf Invalid key in stanza [WinHostMon://Host OperatingSystem] in C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk-TA-acn_infra360host_adc_win-x86-64\local\inputs.conf, line 172: showZeroValue (value: 1). Did you mean 'source'? Did you mean 'source type'? Invalid key in stanza [WinHostMon://Host Processor] in C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk-TA-acn_infra360host_adc_win-x86-64\local\inputs.conf, line 179: showZeroValue (value: 1). Did you mean 'source'?
... View more
Labels
- Labels:
-
using Splunk Enterprise
05-18-2022
10:08 AM
Thanks for the help GC, Able to find the issue. This issue was caused due to the deployment server added as a search peer and it was not able to take the load as it was trying to replicate all the searches and files, hence i had to remove the configuration, which fixed the issue.
... View more
05-18-2022
03:01 AM
My mistake. It is not indexer it is one of the serach_head. correct error message is below: Search peer <search_head> has the following message: Problem replicating config (bundle) to search peer ' <ip_deployment_server>:8089 ', Upload bundle="/opt/splunk/var/run/236039B4-5D5D-4138-A083-DE21022C7678-16566.bundle" to peer name=<deployment_server> uri=https://192.210.0.6:8089 failed; error="Read Timeout".
... View more
05-18-2022
02:43 AM
Arhitecture is: 4 Indexers,3 SH's, Cluster master, deployment server, deployer and a few HF's. Not understand "why are you managing them by Deployment Server?"
... View more
05-18-2022
02:32 AM
Getting below error message on SH message box:
Search peer <Indexer_host> has the following message: Problem replicating config (bundle) to search peer ' <ip_deployment_server>:8089 ', Upload bundle="/opt/splunk/var/run/236039B4-5D5D-4138-A083-DE21022C7678-16566.bundle" to peer name=<deployment_server> uri=https://192.210.0.6:8089 failed; error="Read Timeout".
... View more
Labels
- Labels:
-
other
07-01-2019
03:48 AM
Thanks for reply. I am using Splunk DB Connect > Data Lab > Outputs to write Splunk query results to DB table. We have DB team they mentioned that table is get locked after we develop the splunk solution to write into DB. Application that accessing the DB table is using get methods(read only) so they need the table should be unlock status always.
... View more
07-01-2019
03:00 AM
I am using Splunk DB connect app for SqlServer DB. The connection is working fine.
I am able to feed search result to DB table e.g xyz. I have a scheduler that executes every 2 minutes.
Now the problem is xyz table locked frequently and this table is accessed by another front-end application.
Is it possible that while Splunk is writing into DB table it gets locked for that duration or any other reason for table locking?
... View more
02-08-2019
01:27 AM
[build 5a7a840afcb3] 2019-02-08 05:52:35
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 38428 running under UID 501.
Crashing thread: IndexerService
Registers:
RIP: [0x00007FE4F199D635] gsignal + 53 (libc.so.6 + 0x32635)
RDI: [0x000000000000961C]
RSI: [0x0000000000009644]
RBP: [0x00007FE4F1CF9D98]
RSP: [0x00007FE4E89FDA38]
RAX: [0x0000000000000000]
RBX: [0x00007FE4DFE2E000]
RCX: [0xFFFFFFFFFFFFFFFF]
RDX: [0x0000000000000006]
R8: [0x000000000000000A]
R9: [0x00007FE4E89FE700]
R10: [0x0000000000000008]
R11: [0x0000000000000202]
R12: [0x00007FE4DFE3D000]
R13: [0x00007FE4E89FDBF0]
R14: [0x00007FE4E89FDBE0]
R15: [0x00007FE4E89FDD20]
EFL: [0x0000000000000202]
TRAPNO: [0x0000000000000000]
ERR: [0x0000000000000000]
CSGSFS: [0x0000000000000033]
OLDMASK: [0x0000000000000000]
OS: Linux
Arch: x86-64
Backtrace (PIC build):
Linux / AUSYDSPLUNK6 / 2.6.32-431.29.2.el6.x86_64 / #1 SMP Tue Sep 9 21:36:05 UTC 2014 / x86_64
Last few lines of stderr (may contain info on assertion failure, but also could be old):
2018-12-05 08:48:24.365 +1000 Interrupt signal received
Dying on signal #15 (si_code=0), sent by PID 22929 (UID 501)
2018-12-05 08:48:42.042 +1000 splunkd started (build 00895e76d346)
2018-12-05 10:47:05.323 +1000 Interrupt signal received
Dying on signal #15 (si_code=0), sent by PID 22929 (UID 501)
2018-12-05 10:47:30.058 +1000 splunkd started (build 00895e76d346)
2018-12-13 15:17:05.613 +1000 Interrupt signal received
Dying on signal #15 (si_code=0), sent by PID 62597 (UID 0)
2018-12-13 15:18:09.431 +1000 splunkd started (build 5a7a840afcb3)
terminate called after throwing an instance of 'ThreadException'
what(): IndexerService: about to throw a ThreadException: pthread_create: Resource temporarily unavailable; 32492 threads active
/etc/redhat-release: CentOS release 6.5 (Final)
glibc version: 2.12
glibc release: stable
Last errno: 12
Threads running: 32491
Runtime: 4890866.005744s
argv: [splunkd -p 8089 start]
Regex JIT disabled due to SELinux
using CLOCK_MONOTONIC
Thread: "IndexerService", did_join=0, ready_to_run=Y, main_thread=N
First 8 bytes of Thread token @0x7fe4e9c47010:
00000000 00 e7 9f e8 e4 7f 00 00 |........|
00000008
First 512 bytes of Timeout object @0x7fe4e9c47140:
00000000 b8 91 79 f5 e4 7f 00 00 00 00 00 00 00 00 00 00 |..y.............|
00000010 f0 db 9f e8 e4 7f 00 00 00 00 00 00 00 00 00 00 |................|
00000020 00 00 00 00 00 00 00 00 dd 81 57 00 00 00 00 00 |..........W.....|
00000030 2d 06 ae 04 00 00 00 00 e2 03 00 00 00 00 00 00 |-...............|
00000040 dd 81 57 00 00 00 00 00 65 56 b7 04 00 00 00 00 |..W.....eV......|
00000050 de 03 00 00 00 00 00 00 e8 03 00 00 00 00 00 00 |................|
00000060 f0 91 79 f5 e4 7f 00 00 b8 71 c4 e9 e4 7f 00 00 |..y......q......|
00000070 0e 00 00 00 00 00 00 00 49 6e 64 65 78 65 72 53 |........IndexerS|
00000080 65 72 76 69 63 65 00 00 bf 81 66 ce 6d ee 70 3f |ervice....f.m.p?|
00000090 dd 81 57 00 00 00 00 00 3c 32 d8 04 00 00 00 00 |..W.....<2......|
000000a0 01 00 00 00 00 00 00 00 00 d6 11 7e 03 00 00 00 |...........~....|
000000b0 d2 d3 8f e6 3f 53 d2 3d 00 00 00 00 00 00 00 00 |....?S.=........|
000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000e0 31 00 00 00 00 00 00 00 c0 e3 c1 e9 e4 7f 00 00 |1...............|
000000f0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000100 00 00 00 00 00 00 00 00 50 dd 9f e8 e4 7f 00 00 |........P.......|
00000110 00 e7 9f e8 e4 7f 00 00 00 00 00 00 00 00 00 00 |................|
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000140 00 00 00 00 00 00 00 00 80 72 c4 e9 e4 7f 00 00 |.........r......|
00000150 01 00 00 00 00 00 00 00 00 e7 9f e8 e4 7f 00 00 |................|
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000190 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001f0 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................|
00000200
_when = 5734877.078513709, _initialInterval = 0.994
x86 CPUID registers:
0: 0000000F 756E6547 6C65746E 49656E69
1: 000306F2 09080800 FEDA3203 1F8BFBFF
2: 76036301 00F0B5FF 00000000 00C10000
3: 00000000 00000000 00000000 00000000
4: 1C000000 00000000 00000000 00000000
5: 00000000 00000000 00000000 00000000
6: 00000000 00000000 00000000 00000000
7: 00000000 00000000 00000000 00000000
8: 00000000 00000000 00000000 00000000
9: 00000000 00000000 00000000 00000000
A: 00000000 00000000 00000000 00000000
B: 00000000 00000000 000000FD 00000009
C: 00000000 00000000 00000000 00000000
😧 00000000 00000000 00000000 00000000
E: 00000000 00000000 00000000 00000000
F: 00000000 00000000 00000000 00000000
80000000: 80000008 00000000 00000000 00000000
80000001: 00000000 00000000 00000021 2C100800
80000002: 65746E49 2952286C 6F655820 2952286E
... View more
09-21-2017
02:53 AM
Thanks Oshi. Its working for me too.
... View more
08-11-2017
09:31 AM
I have to use a date filed fields.updated to filter records the I have to filter based on matching Year-Month as below.
index=Jira_ticket_idx*|rename fields.updated as NewDate|eval NewDate=strptime(strftime(strptime(NewDate, "%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d"),"%Y-%m-%d")|eval _time=NewDate|where like(_time,"%2017-08%")|timechart count
Need experts help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-03-2023
08:21 AM
|
