About efaundez

efaundez · ‎01-14-2021

Good afternoon Is there documentation of the splunk recommendations with blob storage? , Recommended bucket stages (hot, warn, cold, frozen)? Any information is appreciated.

efaundez · ‎12-28-2020

Good afternoon I'm looking for this pdf, does anyone know where I can download it from? Regards.

efaundez · ‎12-23-2020

How can you see the search.log of a bd output? Good evening, it is required to validate the information of a certain db ouput that of the environment, no matter how much I search, I only find the information of the execution time and results, but I would like to look more in detail as what is done in the jobs inspector, since currently there is an error in the environment and it does not appear in the internal either. Search Results might be incomplete. If this occurs frequently, please check on the peer. This error message I'm trying to search, but it only appears in ad-hoc searches and saved searches. Is it possible to search for these errors that appear inside a search.log file, via splunk query? PS: I only have web access to the splunk and I want to validate that a development to carry out presents problems due to these communication errors in the environment.

efaundez · ‎11-24-2020

Good afternoon, thanks for your answer, that had not occurred to me, I will validate and let you know how I'm doing.

efaundez · ‎11-24-2020

Good afternoon Currently I have a dashboard that shows the events in a table and then they are exported to a .csv file Can I add the date and time in the file name? I attach the example. <html> <a class="btn btn-primary" role="button" href="/api/search/jobs/$export_sid_task$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=SDESK-all_tasks<date>_<time>.csv&outputMode=csv">Download CSV</a> </html> Greetings.

efaundez · ‎11-16-2020

after making the modifications in the indexes.conf a bundle was applied.

efaundez · ‎11-16-2020

Good afternoon During an activity, the in index stanza in the indexes.conf file was commented to perform an event cleaning since it was validated that the index had been declared 2 times in different FSs. When reviewing the history, it is validated that there is no data. Login to the indexer server to validate which of the 2 FS has the created directories and I validate that the one commenting had the buckets, therefore modify the indexes.conf file and comment on the one that was duplicated. When validating the history of the data, the index only has the files that are coming from different sources, but the data that is stored is not being read. How can I restore the data back to the index? Currently it only has a history of the HOT / WARM and little data in the COLD. Greetings.

efaundez · ‎10-20-2020

Good afternoon We have had constant problems with this APP which every time it gave an error, the application was restarted and the data was re-indexed, in this case it is used for monitoring twitter, the app key has been acquired but still continues presenting errors. Detail of inputs.conf and errors from _internal is attached [rest://twitters] activation_key = 3Cxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx auth_type = oauth1 endpoint = https://stream.twitter.com/1.1/statuses/filter.json http_method = GET index = twitter index_error_response_codes = 1 log_level = INFO oauth1_access_token = 1298721659038257158-F18lXXXXXXXXXXXXXXXXXXXXXX oauth1_access_token_secret = 3GhF21OVmif1mbVXXXXXXXXXXXXXXXXXXXXXX oauth1_client_key = QxIyiALfbXXXXXXXXXXXXXXXXXXXXXX oauth1_client_secret = PFDQMVpImp2XXXXXXXXXXXXXXXXXXXXXX request_timeout = 86400 response_type = text sequential_mode = 0 sourcetype = tweetsloc streaming_request = 1 url_args = track=VirginMobile_cl,fibra,3play,iptv,internet hogar ^stall_warnings=true ###### ERRORS ######## (item.split('=',1) for item in url_args_str.split(delimiter))) for chunk in self.iter_content(chunk_size=chunk_size, decode_unicode=decode_unicode): for line in r.iter_lines(): raise ChunkedEncodingError(e) self.__target(*self.__args, **self.__kwargs) self.run() url_args = dict((k.strip(), v.strip()) for k,v in File "/local1/splunk_HF2/etc/apps/rest_ta/bin/requests/models.py", line 754, in generate File "/local1/splunk_HF2/etc/apps/rest_ta/bin/requests/models.py", line 795, in iter_lines File "/local1/splunk_HF2/etc/apps/rest_ta/bin/rest.py", line 494, in <genexpr> File "/local1/splunk_HF2/etc/apps/rest_ta/bin/rest.py", line 495, in do_run File "/local1/splunk_HF2/etc/apps/rest_ta/bin/rest.py", line 687, in do_run File "/local1/splunk_HF2/lib/python2.7/threading.py", line 754, in run File "/local1/splunk_HF2/lib/python2.7/threading.py", line 801, in __bootstrap_inner ChunkedEncodingError: ('Connection broken: IncompleteRead(0 bytes read)', IncompleteRead(0 bytes read)) Exception in thread Thread-1: INFO:restmodinput:rest://twitters : Entered Polling Loop INFO:restmodinput:rest://twitters : Executing HTTP Request Traceback (most recent call last): ValueError: need more than 1 value to unpack Any support is appreciated. greeting

efaundez · ‎10-09-2020

Sorry for the delay, validate that the python as a process in the OS was taken and it was like that for more than 2 days, the _internal was checked and there was no information of any error or that splunk will show that there is a script input it cannot be executed for XXX reason . To solve this, the input via web was deactivated (in an HF server) and then it was enabled, and after that it was validated that the indexing is done correctly.

efaundez · ‎10-05-2020

Good afternoon Currently we have a UF that is configured with 50 inputs, of which 49 work well and only 1 does not index events and also reports any errors. Review the information on the internal validating that the splunkd does not inform any evidence that it can help to validate why this input is not working. But what you see is what you do next query index = _introspection component = PerProcess "event that does not index ..." I have current information, the script runs every 1 minute and gives me the next information. component: PerProcess date: {[-] args: python /path/file.py XXXXXXXX elapsed: 111505.2300 fd_used: 5 mem_used: 8,555 normalized_pct_cpu: 0.00 page_faults: 0 pct_cpu: 0.00 pct_memory: 0.01 pid: 22673 ppid: 7990 process: python2.7 process_type: other read_mb: 0.000 status: W t_count: 1 written_mb: 0.000 } datetime: 10-05-2020 15: 36: 26.387 -0300 log_level: INFO Review the too many events that you index and don't use these metrics .... why when the event I stop indexing this information splunk differently,... and I don't understand why they too many fuels that are working correctly in the tienen this information. Any help is appreciated.

efaundez · ‎09-23-2020

Good afternoon Thanks for your answer, indeed I want to separate that the access via web through port: 8000 is only through one interface and to be able to configure the second interface for replication and communication of the cluster.

efaundez · ‎09-23-2020

Hello people, we are trying to set up a cluster using 2 differents interfaces where> inteface A --> web access interface B --> all the other communications How can i do this? i have been trying to use SPLUNK_BINDIP with mngmtHostPort but it doesnt work at all

efaundez · ‎09-04-2020

good morning Is there a way to validate the time of the current splunk servers? Let me explain, during these days there will be a time change so the servers should update their time automatically, but I have seen over time that not all servers are correctly patched, for example a universal forwarder sends certain data and the sourcetype was configured like current_time, this would cause events to arrive either late or early. Currently I have this query to validate the time of the servers but I do not know if it is correct. | metadata type = hosts index = _internal | search host = splunk * | eval recent_time = Now () - recentTime | eval r_time = strftime (recentTime, "% m /% d /% and% H:% M:% S") | table host r_time Any information is appreciated Regards

efaundez · ‎08-20-2020

Good afternoon Does anyone know what the procedure would be to migrate a standalone splunk to a cluster splunk. splunk standalone 1 SH + 2 IDX Future cluster 3 SHC + 6 IDX How to migrate the information from the indexers and leave them operational in the future cluster any support is appreciated Regards

efaundez · ‎05-05-2020

Good afternoon I can validate in the MC which index have events and which do not, but is it possible to know which index is not being consulted by users? this would let you know that data is not being used and possibly delete it. Your support is appreciated

efaundez · ‎05-04-2020

Good afternoon I know that there is official information regarding the maximum number of concurrent searches, scheduled searches, according to the number of CPUs and servers that the cluster has. Could someone help clarify these values for me, if I currently have 6 indexer with 36 cores each and 6 search head with 28 physical cores. I know that apparently the values for the scheduled searches would take 50% of these values. Your support is appreciated.

efaundez · ‎03-31-2020

Hello, sorry for the delay, with respect to what I mention the idea is to be able to know which are the least consulted indexes, by users. I know that internally, all the queries made by users to the cluster indexes could be searched, but in an estimate of 30 days, there should be indexes that do not have a lot of load, that is, the user does not use it frequently. This search will allow us to know if this information is really important or useful, since if not, we plan to eliminate this index. Cheers

efaundez · ‎03-26-2020

good afternoon I would like to know which is the index that has had less access at the data query level. regards

efaundez · ‎03-11-2020

it worked, thank you for your response. Best regards

efaundez · ‎03-11-2020

Good afternoon Currently you try to index data to an index summary, but these events do not contain a timestamp so the indexing remains with the date the query was run. This for splunk is a problem because there is no timestamp the data is indexed with the same timestamp and the query is truncated when you try to find it. is there any method that allows you to add to a certain number of events plus seconds or minutes? Best regards

Posts	71
Solutions	0
Karma Given	18
Karma Received	1
Member Since	‎09-21-2017

Online Status	Offline
Date Last Visited	‎03-23-2022 04:08 PM

Recommendation for splunk blob storage azure.

anyone have the pdf Splunk Dist Search Distributed...

I can't see the search.log of a bd output in the j...

add datetime using href when exporting results.

history of the missing index

ERROR ExecProcessor REST Modular API

missing data from script input.

How to configure two interfaces in splunk?

servers time validation

splunk standalone to cluster

Recommendation for splunk blob storage azure.

anyone have the pdf Splunk Dist Search Distributed...

I can't see the search.log of a bd output in the j...

Re: add datetime using href when exporting results...

add datetime using href when exporting results.

Re: history of the missing index

history of the missing index

ERROR ExecProcessor REST Modular API

Sorry for the delay, validate that the python as a...

missing data from script input.

Re: How to configure two interfaces in splunk?

How to configure two interfaces in splunk?

servers time validation

splunk standalone to cluster

validate that index is not being queried in splunk

sizing cluster

Re: is it possible to know which is the index that...

is it possible to know which is the index that has...

Re: add seconds or minutes every 50000 events

add seconds or minutes every 50000 events