About petercow

petercow · ‎12-04-2018

Use the Splunk TA For Microsoft Cloud Services. It has a tab for proxy configuration. Works fine on a HF.

petercow · ‎01-05-2018

So are you saying you get the regex error when you get the bad line-breaking?

petercow · ‎01-03-2018

Check the _internal index for sourectype "splunkd" where you're indexing. Look for 'ERROR' or 'WARN' for that sourcetype.

petercow · ‎01-03-2018

Yes, but it's going to make things like clustering problematic.

petercow · ‎12-28-2017

1) yes 2) Yes - see below 3) You can have the syslog server also be the splunk server (in which case you don't need the forwarder), but for reasons of scalability, etc., I would have them be 2 separate servers.

petercow · ‎12-27-2017

1) configure the sources to have your server be their logging destination (each kind of device does that differently, but the result is the same). 2) install a Splunk Universal forwarder on that box, to monitor the syslog file being generated from step 1.

petercow · ‎06-09-2017

Agreed. Have it on my SHC too, and still see have Notification.

petercow · ‎05-27-2016

The Splunk Server can receive data on its own. No forwarder required. (and actually, you shouldn't use it).

petercow · ‎05-27-2016

I presume you don't want to change the timezone on your server, but rather, for Splunk to recognize that the data is coming from a server in a different timezone. On the indexer(s), in props.conf [host::myBostonServer] TZ = US/Eastern

petercow · ‎05-02-2016

Not sure, but probably. 🙂

petercow · ‎04-29-2016

Splunk keeps track of what was already indexed in the 'fishbucket' directory, $splunkforwarder$/var/log/splunk/fishbucket If you upgrade by installing 'on top' of your existing forwarder, its contents will be preserved, so no re-indexing will take place.

petercow · ‎04-21-2016

That's fine. I was guessing you wanted to use the '2nd' time-stamp, but you didn't specify. Your TIME_PREFIX = ^ tells Splunk that the timestamp is immediately at the beginning of the event. Make a regex that it starts at the 2nd.

petercow · ‎04-21-2016

If you want to use the 'first' timestamp as your MAXTIMESTAMPLOOKAHEAD to a smaller value.

petercow · ‎04-20-2016

If you are using a serverclass.conf that you had hand-crafted, and used things like blacklists, I've seen (and IO think it was when we went to 6.3.x), the deployment server not be able to parse things correctly -even though it doesn't complain about the file. Try this. start with a clean deploymentclient.conf and use the GUI to make a change. Presuming that it works, examine the 'new' syntax, and change your file to match what it does.

petercow · ‎01-07-2014

Not so. In a distributed environment, the knowledge bundles need to get distributed. Until they are, your results may be "inconsistent".

petercow · ‎08-28-2013

There isn't. I filed an enhancement request more than a year ago on this.

petercow · ‎06-27-2013

Sorry - that doesn't answer the question. It's like the old joke, Patient: "Doctor, it hurts when I do that." Doctor: "Don't do that." I've submitted an RFE to be able to disable the warnings.

petercow · ‎06-19-2013

I don't want to use indexer acknowledgement in my cluster environment. I also, don't want the warnings that I'm not using it filling up my logs. How can I disable the warning?

Posts	18
Solutions	2
Karma Given	17
Karma Received	12
Member Since	‎05-09-2011

Online Status	Offline
Date Last Visited	3 weeks ago

How to turn off indexer-acknowledgement warning?

Re: Using a proxy for Azure Monitor Add-on For Spl...

Re: Inconsistent linebreaker behavior

Re: Inconsistent linebreaker behavior

Re: Can we add indexers with smaller storage?

Re: Log Collection and forward to SPLUNK

Re: Log Collection and forward to SPLUNK

Re: Licensed Splunk Enterprise 6.5.0: How do I pre...

Re: Splunk Forwarder and Splunk Enterprise 6.4.1 o...

Re: How to change time zone on data collection nod...

Re: For a clean installation of a Splunk forwarder...

Re: For a clean installation of a Splunk forwarder...

Re: Another "DateParserVerbose - Failed to parse t...

Re: Another "DateParserVerbose - Failed to parse t...

Re: Why does Forwarder Management on the Splunk 6....

Re: How do I reload csv lookup files?

Re: Test Email in Splunk

Re: How to turn off indexer-acknowledgement warnin...

How to turn off indexer-acknowledgement warning?