About junyuw

junyuw · ‎09-16-2020

Yes, in this case I think you will need to install the SAI TA on the SH as well to make the `infra_alerts` summary index available, and that index is where SAI stores the alerts created (though if the search head is properly set up and connected to the indexers this shouldn't be necessary) The actual data won't be actually stored on the SH as long as data forwarding is set up correctly. Reference: https://community.splunk.com/t5/Getting-Data-In/Should-a-summary-index-be-created-on-both-Search-Head-and/m-p/239317

junyuw · ‎11-06-2019

Hi, sorry to hear that entity discovery is not working properly. Could you please execute the following search in the search app (on the instance with SAI 2.0 deployed) and let us know if you see any error that shows up repetitively every minute? index=_internal sourcetype=splunk_app_infrastructure source="*sai_entity_manager.log*" Also can you please let us know if you have ITSI installed the same instance and what version? plus if that's a distributed environment or not? thanks

junyuw · ‎05-31-2018

Hi Adam, currently in SII filters with different dimension names have an implicit "AND" relationship between them, and filters with the same dimension name have an implicit "OR" relationship. Therefore to group both EC2 and ELB, a temporary solution would be to add LoadBalancerName as a tag to your EC2 instances with a value of your choice, eg. for-SII-group (a better solution could be to add common tags to both EC2 and ELBs, but ELB tag collection is still a work in progress) and use LoadBalancerName:for-SII-group, LoadBalancerName:[other ELBs you have] to filter both out and group them together.

junyuw · ‎12-08-2017

I have my UF and indexer set up and what I want to do is sending both metrics and event data from UF to indexer. from my understanding what I could do is set up two stanzas in inputs.conf of indexer like below [tcp://9997] connection_host = dns index = event_index sourcetype = syslog [tcp://9998] connection_host = dns index = metric_index sourcetype = syslog and the idea situation would be sending metric data to <indexer_ip>:9998 and event data to <indexer_ip>:9997 separately but the problem is it seems impossible to achieve this through configuring outputs.conf (I could send both data to both ports using the data cloning technique mentioned in doc, but that's not ideal) So is there a way to achieve this separation of data forwarding?

Posts	4
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎08-24-2017

Online Status	Offline
Date Last Visited	‎09-16-2020 08:08 PM

how does UF handle both metrics and event data

Re: SAI doesn't show any alert in Alerts tab

Re: Splunk App for Infrastructure 2.0 not showing ...

Re: Ability to filter by multiple resources

how does UF handle both metrics and event data