About Edub

Edub · ‎07-20-2011

A network socket process went bug-eyed today creating more than 7 million /var/log/messages events in 15min. The indexer threw an error stating "applying indexing throttle for..." This is a decent feature considering we didn't need all those identical events in the index, but I could not find documentation anywhere that describes when and how this function operates. What is limited and what is not being kept? When will it stop throttling? What parameters determine when it will throttle? How can I adjust them? etc ad-naseum Anyone have some links to some details? Thanks E.

Edub · ‎05-17-2011

I noticed the same thing. The search in the deployment monitor app is labeling anything in the metrics log that is "raw" or "rawSSL" as "Legacy Forwarder". Here is a small part of the search string that causes that: connectionType=="raw" or connectionType=="rawSSL","Legacy Forwarder") I guess the proper question is why Splunk sees that data as "raw". I'm think it is because it is a TCP input and not "cooked" by a forwarder. My guess is that this is a bug in that specific search being too broad with its definition of "Legacy Forwarder". All speculation and guesses based on about 20min of research... You can find that search by going to the Forwarders screen in the Deployment Monitor App and then opening the jobs screen (upper right link). It should be the top search. E.

Edub · ‎04-26-2011

Listen up Splunk guys. The permissions screens need a bulk change option or some check boxes to apply similar settings to multiple objects. Sharing a dashboard after creating all the extractions, searches, and views can be painful in the UI. E.

Edub · ‎04-13-2011

We never could get this to work. Then 4.2 came out and blocksignatures were completely broken. Hope that changes. E.

Edub · ‎04-08-2011

Have anyone else experience busted block signing in 4.2? Every install of 4.2 we have is not executing the block signature. We can't tell if it is just not signing the data or if the Show Source check is failing for another reason. E.

Edub · ‎03-23-2011

I am setting up search head pooling in a geographically diverse implementation. I have indexes and search heads in 3 different cities. All the Splunk units have access to each other over high speed links. I want to pool the search heads for HA and load management, but do not have a way to give them shared storage. It is not that difficult to make storage at one site available to the others, but if that storage is unavailable, then our search head HA is busted. I really need search head pooling without the use of shared storage. Could the search heads share info directly with each other instead of writing to shared storage? What other ways are there to enable search head pooling?

Edub · ‎02-08-2011

I need to transport an index and remount it in a new splunk instance for review. The index has block signing on and Show Source works fine to test integrity on the original splunk instance. The block signature db is also being transported and included on the new instance exactly as configured on the original. However, the block signature test fails. All searching activity works perfectly. Only block sign integrity is broken. Is there a special way I need to work with the block signature db to make this work? The background here is that a third party needs to review the data and confirm integrity, but can't be given direct access to the original instance. So we have them install Splunk Free and mount up a copy of the index. E.

Edub · ‎12-15-2010

If you want a single TCP Input listener (TCP:514), but to route events to separate indexes based on source IP, you will have to use a transform and a regex. Does anyone know if Meta:host can be used as a qualifier for a transform?

Posts	8
Solutions	1
Karma Given	0
Karma Received	25
Member Since	‎06-08-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Indexing Throttling

Splunk 4.2 and Broken Block Signatures

Search Head Pooling - Shared Storage Not Available

Transport Block Signature

Indexing Throttling

Re: Deployment monitor is seeing tcp input as a le...

Re: Default permissions for searches/tags/eventtyp...

Re: Transport Block Signature

Splunk 4.2 and Broken Block Signatures

Search Head Pooling - Shared Storage Not Available

Transport Block Signature

Re: Custom Index per IP Range