cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
miguelangelclem
Explorer
Member since: ‎03-23-2020
‎08-31-2020
Community Statistics
Posts 6
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎03-23-2020
Activity Feed
View All

Monitoring *nix : CPU, iostat, vmstat, etc. Only g...

by in All Apps and Add-ons
‎07-08-2020 03:49 AM
‎07-08-2020 03:49 AM
Hi all, Recently I noticed that some information regarding *nix machines is missing. If in the search I put "source=cpu", i only have events from two machines. It shows much more machines if I put "source=ps" or "source=df". I have looked so many *.conf files, looking for a list to configure what machines are monitorized, or where I can blacklist/whitelist IPs to monitor. I have reviewed all the "inputs.conf" files that I found, and I don't see anything anomalous. In addition, I have did some tests with "sh cpu.sh --debug", and this is the message "Not found any of commands [sar mpstat] on this host, quitting" Please, can you tell me where and how I have to configure this? Thanks in advance. ... View more

Re: Alert not triggering

by in Splunk Enterprise Security
‎04-17-2020 12:23 AM
‎04-17-2020 12:23 AM
Yes, I am expecting that. I have found the problem and was the email configuration as @harishalipaka tell me. The alerts didn't appear because i had not set the action, and the email wasn't sending for a misconfiguration in server. Thanks! ... View more

Alert not triggering

by in Splunk Enterprise Security
‎04-16-2020 03:12 AM
‎04-16-2020 03:12 AM
Hi all, I have created an alert with this simple query: index=foo host="bar" action=fail | stats count by user | search count>40 It is scheduled every hour and the trigger setting is Number of Results greater than 0 I have tried adding table and fields commands but it still doesn't work Why could this happen? ... View more

Re: Where I have to configure limits.conf in a dis...

by in Splunk Enterprise Security
‎03-27-2020 06:44 AM
‎03-27-2020 06:44 AM
Nice, @manjunathmeti. Thanks a lot. ... View more

Re: Where I have to configure limits.conf in a dis...

by in Splunk Enterprise Security
‎03-27-2020 06:15 AM
‎03-27-2020 06:15 AM
Thanks! One more question... My problem is that when I run a search in the raw data I see fields than I don't see in the extracted fields, and i can't search for a specific value in these fields. I think that changing the limit.conf file, I will be able to search for a specific value in this fields. Is it correct? Thanks again, @manjunathmeti ! ... View more

Where I have to configure limits.conf in a distrib...

by in Splunk Enterprise Security
‎03-27-2020 05:49 AM
‎03-27-2020 05:49 AM
Hi all, I have a distributed multisite architecture, with a single Search Head, 2 indexers and, 2 Forwarders a Cluster Master, all in 7.3.3 I have to change some values in limits.conf to increase the number of extracted fields. Where I have to change the value? In all machines? Only in the Cluster Master? Only in the Search Head? In the Search Head and in the indexers? I have read a lot of threads, and a lot of docs, but this is not explicitly documented, or i have not found it. Thanks in advance and sorry if this is a "noob" question, it's my first time 🙂 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎08-31-2020 09:51 AM
Karma given to