Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gfriedmann
gfriedmann
Communicator
Member since:
06-11-2010
06-05-2020
Community Statistics
| Posts | 68 |
| Solutions | 2 |
| Karma Given | 11 |
| Karma Received | 36 |
| Member Since | 06-11-2010 |
Activity Feed
- Karma Re: Multiple LDAP servers for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: Parsing Timestamps from Windows and Cisco devices from Props.conf for rforsythe. 06-05-2020 12:45 AM
- Karma Re: Custom fields not always showing up for kbains. 06-05-2020 12:45 AM
- Karma Re: Search Filters (srchFilter) when a user is in multiple groups/roles for Stephen_Sorkin. 06-05-2020 12:45 AM
- Karma Re: User added and user removed for Ron_Naken. 06-05-2020 12:45 AM
- Karma Re: multiple indexes role-based access control for Ron_Naken. 06-05-2020 12:45 AM
- Karma Re: Trying to use lookup table instead of tagging hosts for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: UDP Drops on Linux for zscgeek. 06-05-2020 12:45 AM
- Karma Re: How to list saved searches for dwaddle. 06-05-2020 12:45 AM
- Karma Re: Deployment server strategies for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: Are Windows Eventlogs from windows forwarder lacking timezone for gkanapathy. 06-05-2020 12:45 AM
- Got Karma for Splunk web UI partially in different language. 06-05-2020 12:45 AM
- Got Karma for Splunk and Hyper-threading - Has anyone run benchmarks?. 06-05-2020 12:45 AM
- Got Karma for Splunk and Hyper-threading - Has anyone run benchmarks?. 06-05-2020 12:45 AM
- Got Karma for Re: Splunk and Hyper-threading - Has anyone run benchmarks?. 06-05-2020 12:45 AM
- Got Karma for Re: Splunk and Hyper-threading - Has anyone run benchmarks?. 06-05-2020 12:45 AM
- Got Karma for Re: Splunk and Hyper-threading - Has anyone run benchmarks?. 06-05-2020 12:45 AM
- Got Karma for Re: Splunk and Hyper-threading - Has anyone run benchmarks?. 06-05-2020 12:45 AM
- Got Karma for Re: Splunk and Hyper-threading - Has anyone run benchmarks?. 06-05-2020 12:45 AM
- Got Karma for Has anyone already figure out how to deal with timestamps from windows DNS debug logs?. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 2 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 0 |
09-15-2011
09:20 AM
Use LDAP port 3268 (Global catalog) or the SSL enabled equivalent. You may have to trim your user DN search path or add additional search paths to find the users.
... View more
08-25-2011
09:41 AM
I currently run a combination search head/deployment server on an Intel Xeon 4 core server.
The following command indicates that i am serving 959 deploy clients at the moment.
splunk list deploy-clients | grep -c hostname:
959 is a whole lot more than numbers I've been seeing elsewhere.
It seems to be working okay. There are no crazy delay in the search head. Commands come back quickly.
idle load average: 0.29, 0.40, 0.43
How do i know if the deployment server is over subscribed? Would there be errors in a log-file somewhere?
... View more
06-24-2011
04:50 PM
I ran into inconsistent behavior with 4.2.2 when the indexers had an old copy of a lookup table defined and referenced. The search head had the updated copy. It was a bit of a pain to troubleshoot. The difference ended up becoming apparent if the lookup was applied after the main search results instead of fueling the main search itself.
... View more
06-24-2011
04:26 PM
Do you use multiple search heads? Maybe they are load-balanced?
Also, could you be searching in different views? I think this might be user metadata that is saved on a per view (page) basis. Sometimes it is easy to search with the flashtimeline in the search app and also search in another app with a similar page.
... View more
06-24-2011
04:22 PM
I resolved this. I should have posted my config. My limits.conf was missing the [search] stanza header before these configuration items.
... View more
06-24-2011
04:20 PM
1 Karma
I have added an automatic lookup based on host value. This lookup creates the field "bettername". I want all users to notice this new field to leverage.
You may have noticed that host, source, and sourcetype are listed as "selected fields" by default on the left blue column.
How can i add my new "bettername" as a default selected field? Is there a way of doing this from the .conf files?
I think the advanced XML method involved the FieldPicker module.
... View more
06-23-2011
03:16 PM
What are the intricacies for a script based lookup in a distributed environment? For example, dnslookup.
... View more
06-23-2011
12:30 PM
How did you verify the checkin interval?
... View more
06-23-2011
12:30 PM
I will try.
... View more
06-22-2011
01:55 PM
I can use the same syntax to override the setting in system/local/deploymentclient.conf and it works as expected.
but in apps/foo/local/deploymentclient.conf , it still shows up as desired when i type "splunk show config -name deploymentclient", but the checkins continue at 60 second intervals.
... View more
06-22-2011
01:54 PM
I am having trouble getting the deploymentclient.conf setting phoneHomeIntervalInSecs to be followed.
Using a universal forwarder on windows the default checkin seems to be 60 seconds. I tried to specify 5 minutes in /apps/foo/local/deploymentclient.conf , but it still checks in every 60 seconds.
Does anyone know if this must be set in system/local/deploymentclient.conf or if it expected to work if specified in any /etc/app/foo/local/deploymentclient.conf ?
... View more
- Tags:
- deployment-server
06-22-2011
01:47 PM
I am having trouble getting this setting to implement. Using a universal forwarder on windows the default checkin seems to be 60 seconds. I tried to specify 5 minutes in /apps/foo/local/deploymentclient.conf , but it still checks in every 60 seconds.
Do you know if this must be set in system/local/deploymentclient.conf , or is it expected to work if specified in any /etc/app/ directory?
... View more
06-15-2011
03:50 PM
1 Karma
Actually, splunk upgrade doesn't auto-start splunk as root.
After running
sudo rpm -U splunk-4.2.2...rpm
Then start splunk as the splunk user like this
sudo su - splunk -c "splunk start --answer-yes --accept-license --no-prompt"
... View more
06-15-2011
03:37 PM
I am using the RPM package for splunk. I also utilize the "run splunk as splunk user" option.
But there is a problem. I have to install an RPM as root. When i upgrade using the RPM, it stops splunk, upgrades the files, and then restarts splunk as root. After this, the file permissions are all messed up, with newly created files being owned by root.
How do others deal with this? Might it be fine to upgrade an RPM install using the .tgz package?
... View more
- Tags:
- installation
- linux
- rpm
06-15-2011
03:37 PM
You also may want to "chown -R splunk:splunk /opt/splunk" while the system is down.
... View more
06-06-2011
01:26 PM
I found the related problem that was causing a problem. The file i was collecting from did not update the file modified time. For some reason MAX_DAYS_HENCE=2 props.conf default setting was comparing the timestamp against the file-modified time and not the indexing time. I was expecting MAX_DAYS_HENCE= value to apply to the current indexing time and the parsed timestamp... not the file modified time vs the parsed timestamp.
... View more
06-03-2011
01:37 PM
2 Karma
I am running into the "approaching max search limit per cpu" warning message on my search head.
I have 1 search head and 2 indexers. The indexers are much more powerful. The search head is 4 CPU, and the indexers are 24 CPU (after multi-threading).
The current search head is using the default settings of base_max_searchers(4) + cpus(4) * max_searches_per_cpu(4). This = 20
Do you have any justified recommendations for changing the limits for a search-head only host?
... View more
06-01-2011
12:40 PM
It was applied on the indexers. I still get inconsistent timestamp extractions. I am deploying universal Forwarder soon, maybe it will help with consistency.
... View more
05-18-2011
02:16 PM
1 Karma
Dude. Awesome format. Rock!
... View more
