Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About shakeel253
shakeel253
Explorer
Member since:
09-07-2017
06-05-2020
Community Statistics
| Posts | 38 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 09-07-2017 |
Activity Feed
- Got Karma for Create Splunk Storage (Disk Space) Capacity Alarm (Alert). 06-05-2020 12:49 AM
- Got Karma for Splunk Alert for disk space usage. 06-05-2020 12:49 AM
- Posted How to remove all splunk monitoring from splunk on a windows platform? on Getting Data In. 02-13-2018 05:29 AM
- Tagged How to remove all splunk monitoring from splunk on a windows platform? on Getting Data In. 02-13-2018 05:29 AM
- Tagged How to remove all splunk monitoring from splunk on a windows platform? on Getting Data In. 02-13-2018 05:29 AM
- Posted Re: Setting up Alert if jboss service went down on Alerting. 12-28-2017 05:41 AM
- Posted Re: Setting up Alert if jboss service went down on Alerting. 12-27-2017 06:07 AM
- Posted Re: Splunk query that alert if services on a Jboss server went down on Splunk Search. 12-26-2017 01:37 PM
- Posted Re: Setting up Alert if jboss service went down on Alerting. 12-26-2017 06:44 AM
- Posted Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert on Alerting. 12-20-2017 02:00 PM
- Posted Re: Setting up Alert if jboss service went down on Alerting. 12-20-2017 05:21 AM
- Posted Re: Splunk query that alert if services on a Jboss server went down on Splunk Search. 12-13-2017 12:25 PM
- Posted Re: Splunk query that alert if services on a Jboss server went down on Splunk Search. 12-13-2017 10:05 AM
- Posted Re: Splunk query that alert if services on a Jboss server went down on Splunk Search. 12-13-2017 08:13 AM
- Posted Re: Splunk query that alert if services on a Jboss server went down on Splunk Search. 12-13-2017 07:09 AM
- Posted Splunk query that alert if services on a Jboss server went down on Splunk Search. 12-12-2017 11:47 AM
- Tagged Splunk query that alert if services on a Jboss server went down on Splunk Search. 12-12-2017 11:47 AM
- Posted Re: Splunk Alert for disk space usage on Monitoring Splunk. 12-12-2017 11:32 AM
- Posted Splunk Alert for disk space usage on Monitoring Splunk. 12-11-2017 09:07 AM
- Tagged Splunk Alert for disk space usage on Monitoring Splunk. 12-11-2017 09:07 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-13-2018
05:29 AM
I recently integrated Splunk forwarding service with Tableau and when I set up the monitoring, I did .\splunk to add a monitor (file location) but Splunk seems to be monitoring more files then I asked for. How can I remove all monitoring without having to stop Splunk on a windows platform?
... View more
12-28-2017
05:41 AM
@MousumiChowdhury
firstoff thank you for assisting me with this, having said that bin directory is not inside /opt/splunk/etc/apps/search, so i had to manually create the bin folder and gave it splunk ownership and copy the tomcat script inside bin.
2) This is how the indexes.conf
[root@ip-xx.xxx.xx.xxx local]# cat indexes.conf
[tomcatindex]
coldPath = $SPLUNK_DB/tomcatindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/tomcatindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/tomcatindex/thaweddb
[tomcatindex]
coldPath = /opt/splunkforwarder/etc/apps/search/bin/./tomcatscript.sh
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = /opt/splunkforwarder/etc/apps/search/bin/./tomcatscript.sh
maxTotalDataSizeMB = 512000
thawedPath = /opt/splunkforwarder/etc/apps/search/bin/./tomcatscript.sh
3)[root@ip-xx-xxx-xx-xx local]# cat inputs.conf
[monitor:///opt/tomcat/logs/catalina.out]
disabled = false
index = tomcat
[monitor:///opt/splunkforwarder/bin/tomcatscript.sh]
disabled = false
index = tomcatindex
[monitor:///opt/splunkforwarder/etc/apps/search/bin/./tomcatscript.sh]
disabled = false
index = tomcatindex
After making these changes, i have restarted splunkforwarder and search for the index, but i do not see the index still, what am i missing?
... View more
12-27-2017
06:07 AM
@MousumiChowdhury i still dont see the new custom index in splunk search. I will describe how my splunk is setup, maybe, i am missing something.
1) tomcatscript.sh is inside /opt/splunkforwarder/bin
!/bin/bash
if [ -z "$(ps -ef | grep java | grep tomcat)" ]
then
echo "Tomcat is NOT running"
else
echo "Tomcat is running"
fi
2) inputs.conf inside /opt/splunkforwarder/etc/apps/search/local
[monitor:///opt/tomcat/logs/catalina.out]
disabled = false
index = tomcat
[monitor:///opt/splunkforwarder/bin/tomcatscript.sh]
disabled = false
index = tomcatindex
3)indexes.conf inside /opt/splunkforwarder/etc/apps/search/local
[tomcatindex]
coldPath = $SPLUNK_DB/tomcatindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/tomcatindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/tomcatindex/thaweddb
when i do a search on splunk host="abcvm" but the only index i see is "os". I also did a restart as well for the splunkforwarder but didnt see the newly created index. Maybe i am doing something wrong, would appreciate if you could direct me, thank you
... View more
12-26-2017
01:37 PM
@niketn so i have my tomcat server running and when i ran below query, i get output with the host name, current date and time as well as downtime 999. Is that the expected output?
I was under the impression if the tomcat/jboss services are running then there would be no output since there is no downtime for those services. We should only get result when downtime (jboss/tomcat) is more then 5 min
| tstats latest(_time) as _time WHERE (host="hostsvm") AND source="/opt/tomcat/logs/catalina.out" by host
| eval "downTime (in Min)"=round((now()-_time)/60,0)
| append [
| makeresults
| eval host="hostsvm", "downTime (in Min)"="999"]
| dedup host
| where 'downTime (in Min)'>5
... View more
12-26-2017
06:44 AM
@Mousumichowdhury i created a shell script and placed it inside /opt/splunkforwarder/bin with executable permission. I also made an entry inside inputs.conf, below is the how the entry looks like inside inputs.conf
[default]
host = svm
/opt/splunkforwarder/bin/tomcatscript.sh
how do you create an index?
... View more
12-20-2017
02:00 PM
@somesoni2 @saurabhtcs when i used the query, if i shutdown the host, nothing comes up when i ran the query. It only shows result for last 24hrs. I started/stopped the host and ran this query but it didnt give desired result. The desire result which i want is, if the host is shutdown, the query has been setup as alert and should be able to inform user that host is shutdown or not responding with the updated timestamp
| tstats count latest(_time) where index=* host="abssvm" by host | rename earliest(_time) as earliest_time, latest(_time) as latest_time | eval status= if(latest_time > relative_time(now(),"-5min"),"Active","Inactive") | convert ctime(latest_time) | search status="Inactive" | fields - count
... View more
12-13-2017
12:25 PM
two issues when i changed the source and ran the query
1) It is picking jboss server for other environment, for example, i need jboss for ABC environment but not for DEF environment, but its picking up all the server from ABC environment and DEF environment.
2)The second issue is that the query should only give me result when it detects is the jboss server is down, but it is still showing me result
... View more
12-13-2017
10:05 AM
The OS we are using is Linux (Amazon Linux EC2 instance or Redhat). We use Jboss server log to identify if its starting or shutdown, the absolute path for that is /opt/jboss-eap/standalone/log/server.log.
Another way we check if Jboss service is running by checking Jboss pid
ps aux | grep jboss
... View more
12-13-2017
08:13 AM
@niketnilay Exactly what fsrodriguez mentioned, that is what i need.
... View more
12-13-2017
07:09 AM
hey Niketniley, looks the the query will do the job, but i am getting below mentioned error. I tried putting a space between search "downTime (in Min)">5 but its not helping
Comparator '>' is missing a term on the right hand side
The search job has failed due to an error. You may be able view the job in the Job Inspector.
... View more
12-12-2017
11:47 AM
We have multiple aa-dev-server that are running jboss, below query sends me alert when jboss service is down. The issue is, I have a limitation on my splunk account where i am limited to only few real time alert. Is there a query where if i could use the "" it picks all host="aa-dev-jboss-" but send email and specifies which host jboss server went down or provide a table which server did
host="aa-dev-jboss-1" source=ps jboss | stats latest(_time) as latest by host
... View more
12-11-2017
09:07 AM
1 Karma
I have a query that monitors DiskSpace usage and sends out alert if the diskspace goes up more then 80 percent. My Splunk account has a limit on realtime alert and i have more then 1 mongo servers so I tried using host "mongo*" since they are Mongo1, mongo2 ..
so this way I have just 1 alert for all the mongo server.
The alert works corrects but I get lot of emails about different servers.; I need a configuration or a query where I get just 1 alert which shows all the mongo servers that surpass 80 percent threshold instead of 10 different email.
Can someone help???
below is the query that I am using
host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80
... View more
12-07-2017
10:04 AM
I have 3 servers App-1, App-2 and App-3. The three application are running on Jboss. I need a query that Alerts me, if on any servers Jboss Service goes down.
Any help with this will be appreciated.
Thank You
... View more
10-19-2017
05:33 AM
I have a certain limit on my Splunk Account on how much Splunk I can use, I recently installed Splunk forwarder to some of the servers and now I am exceeding Splunk License usage.
My question is what changes should I make on the server so I can stop forwarding logs?
... View more
10-18-2017
06:47 AM
thank you for the response, but i need a Splunk Query which can be changed to Alert
... View more
10-18-2017
05:52 AM
1 Karma
The OS I am currently using is Redhat, i need help with the query that sends an alert if the DiskSpace goes over 70 percent
host="MONGO" sourcetype=df
... View more
10-13-2017
05:51 AM
The above query didnt give me required results.
This is the query i am running, if you closely look the highlighted time stamp, the results are being replicated, what can i add to the query that it wont replicate date_mday
host=TABLEAU "(SEVIS,,,) pool-3-thread-1 : INFO com.tableausoftware.model.workgroup.service.VqlSessionService - Storing to repository" | stats count
10/13/17
5:03:05.749 AM
2017-10-13 01:03:05.749 -0400 (ABCDE,,,) pool-3-thread-1 : INFO com.tableausoftware.model.workgroup.service.VqlSessionService - Storing to repository: SEVIS_UserVerification_Program/extract repoExtractId:17936 size:12999 (twb) + 1709242 (guid={0E61DCE4-54DC-4855-B7D2-ADED09CD280F}) = 1722241
date_mday = 13 date_month = october date_year = 2017 eventtype = nix-all-logs host = TABLEAU index = main linecount = 1 punct = --::.-(,,,)---:....._-:/::()+(={ source = D:\Software\Tableau\Tableau Server\data\tabsvc\logs\backgrounder\backgrounder-1.log sourcetype = backgrounder-0.log splunk_server = ip-12-123-1-123 unix_category = all_hosts unix_group = default
10/13/17
12:39:41.996 AM
2017-10-12 20:39:41.996 -0400 (ABCDE,,) pool-3-thread-1 : INFO com.tableausoftware.model.workgroup.service.VqlSessionService - Storing to repository: SEVIS_UserVerification_Program/extract repoExtractId:17935 size:13010 (twb) + 1709226 (guid={423E7580-4F13-44FC-8A20-B14A3056FD77}) = 1722236
date_mday = 12 date_month = october date_year = 2017 eventtype = nix-all-logs host = TABLEAU index = main linecount = 1 punct = --::.-(,,,)---_:.....-:/::()+(={ source = D:\Software\Tableau\Tableau Server\data\tabsvc\logs\backgrounder\backgrounder-0.log sourcetype = backgrounder-0.log splunk_server = ip-12-123-1-123 unix_category = all_hosts unix_group = default
... View more
09-27-2017
06:37 AM
I recently setup Splunk Dashboard integrated with Tableau, when i run below mentioned query it gives me a count of successful extract for today.
host=TABLEAU splunk_server="ip-XX-XXX-X-XXX" "(XXXX,,,) pool-3-thread-1 : INFO com.tableausoftware.model.workgroup.service.VqlSessionService - Storing to repository: AAAAA_AAAAAAPrgExtensions/extract" | stats count.
But recently when the query ran it shows two results for same extract when it should be 1, also,if you see both the events closely even though it has a date of 09/27/2017 but inside it displays date_mday = 27 for the second query result date_mday = 26. What can i add to the query where it does not duplicate and display Today results
9/27/17
7:30:04.734 AM
2017-09-27 03:30:04.734 -0400 (XXXX,,,) pool-3-thread-1 : INFO com.tableausoftware.model.workgroup.service.VqlSessionService - Storing to repository: XXXXXXPrgExtensions/extract repoExtractId:17503 size:12572 (twb) + 758672090 (guid={XXXXXXX) = 758684662
date_mday = 27 date_month = september date_year = 2017 eventtype = nix-all-logs host = TABLEAU index = main linecount = 1 punct = --::.-(,,,)---:....._-:/::()+__(={ source = D:\Software\Tableau\Tableau Server\data\tabsvc\logs\backgrounder\backgrounder-1.log sourcetype = backgrounder/backgrounder-3 splunk_server = ip-XX-XXX-X-XXX unix_category = all_hosts unix_group = default
9/27/17
12:50:47.694 AM
2017-09-26 20:50:47.694 -0400 (XXXXX,,,) pool-3-thread-1 : INFO com.tableausoftware.model.workgroup.service.VqlSessionService - Storing to repository: XXXXXX/extract repoExtractId:17494 size:12521 (twb) + 758649674 (guid={XXXXXXXX5}) = 758662195
date_mday = 26 date_month** = september date_year = 2017 eventtype = nix-all-logs host = TABLEAU index = main linecount = 1 punct = --::.-(,,,)---:....._-:/::()+__(={ source = D:\Software\Tableau\Tableau Server\data\tabsvc\logs\backgrounder\backgrounder-1.log sourcetype = backgrounder/backgrounder-3 splunk_server = ip-10-168-2-185 unix_category = all_hosts unix_group = default
... View more
09-13-2017
06:46 AM
We use Tableau and there are some jobs (extracts) that run over night. some of the jobs are success and some fail. Tableau dashboard gives us this number, I wanted a splunk query that gives me total number of jobs that ran successfully/failed
... View more
09-12-2017
10:07 AM
We have integrated Tableau with Splunk, I am setting up a Splunk dashboard which will give any user information on the dashboard of which extract ran successfully/Failed during the pass 24 hours. I need a Splunk Query which can give me that information.
... View more
09-12-2017
09:29 AM
the query worked, thankyou for your help
... View more
09-12-2017
05:37 AM
Using below query,
index=* sourcetype="Perfmon:Free Disk Space" counter="% Free Space" host=tableaufqt
| timechart avg(Value) AS PctFree BY host
| eval PctUsed = 100 - PctFree
i got the diskspace
2017-09-11 12:30:00 48.86669237574543
now what should i add to the query that if it goes pass 70%, it sents out an alert?
... View more
09-11-2017
11:40 AM
when i take the line 4 out, i still do not see any results
index=YouShouldAlwaysSpecifyAnIndex sourcetype="Perfmon:Free Disk Space" counter="% Free Space" host=tableaufqt host=TABLEAU
| timechart avg(Value) AS PctFree BY host
| eval PctUsed = 100 - PctFree
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
