Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vicky05ssr
vicky05ssr
Explorer
Member since:
10-13-2017
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 10-13-2017 |
Activity Feed
- Karma Re: Is there a way to list all the Services and its KPI's in ITSI Box for PowerPacked. 06-05-2020 12:49 AM
- Karma Re: Why do I see several search peer errors such as "peer has status="Down"" when my peers are running? for wcooper003. 06-05-2020 12:48 AM
- Karma How to fix "Encountered the following error while trying to update: In handler 'users': Could not get info for role that does not exist: dbx_user"? for glancaster. 06-05-2020 12:47 AM
- Karma Re: How to fix "Encountered the following error while trying to update: In handler 'users': Could not get info for role that does not exist: dbx_user"? for glancaster. 06-05-2020 12:47 AM
- Karma Re: How do you adjust simple xml table column width in Splunk 6.x? for anwarmian. 06-05-2020 12:47 AM
- Karma Re: Certificate Errors for forwarder for worshamn. 06-05-2020 12:46 AM
- Posted Re: Is there a way to list all the Services and its KPI's in ITSI Box on Splunk ITSI. 06-28-2018 11:32 PM
- Posted skipping indexing of internal audit events on Deployment Architecture. 06-27-2018 02:51 AM
- Tagged skipping indexing of internal audit events on Deployment Architecture. 06-27-2018 02:51 AM
- Tagged skipping indexing of internal audit events on Deployment Architecture. 06-27-2018 02:51 AM
- Tagged skipping indexing of internal audit events on Deployment Architecture. 06-27-2018 02:51 AM
- Posted Is there a way to list all the Services and its KPI's in ITSI Box on Splunk ITSI. 05-16-2018 01:43 PM
- Tagged Is there a way to list all the Services and its KPI's in ITSI Box on Splunk ITSI. 05-16-2018 01:43 PM
- Tagged Is there a way to list all the Services and its KPI's in ITSI Box on Splunk ITSI. 05-16-2018 01:43 PM
- Posted Re: servers-attribute of distsearch.conf not visible on Knowledge Management. 01-12-2018 01:47 AM
- Posted servers-attribute of distsearch.conf not visible on Knowledge Management. 01-11-2018 12:12 AM
- Tagged servers-attribute of distsearch.conf not visible on Knowledge Management. 01-11-2018 12:12 AM
- Tagged servers-attribute of distsearch.conf not visible on Knowledge Management. 01-11-2018 12:12 AM
- Tagged servers-attribute of distsearch.conf not visible on Knowledge Management. 01-11-2018 12:12 AM
- Posted Re: Why is my REST API call to pass the Job SID to another curl command inside the same shell not working as expected? on Getting Data In. 12-21-2017 11:10 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-27-2018
02:51 AM
I have 3 Indexers in a cluster and recently I changed the indexing path from defalut to different mount point. Initially everything was working fine, recently after 2 days I am getting a pop-up on searchead stating error pasted below:
1.
Search peer Sample_Indexer03 has the following message: Audit event generator: Now skipping indexing of internal audit events, because the downstream queue is not accepting data. Will keep dropping events until data flow resumes. Review system health: ensure downstream indexing and/or forwarding are operating correctly.
2.
Search peer Sample_Indexer03 has the following message: Index Processor: The index processor has paused data flow. Too many tsidx files in idx=_introspection bucket="/media/data/hot/_introspection/db/hot_v1_11" , waiting for the splunk-optimize indexing helper to catch up merging them. Ensure reasonable disk space is available, and that I/O write throughput is not compromised. Learn more.
From Internal logs I could see the below errors:
3.
ERROR SplunkOptimize - (child_18426__SplunkOptimize) optimize finished: failed, see rc for more details, dir=/media/data/hot/_introspection/db/hot_v1_11, rc=-13 (unsigned 243), errno=2
host = Sample_Indexer03 source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
4.
ERROR SplunkOptimize - (child_18426__SplunkOptimize) merge failed for path=/media/data/hot/_introspection/db/hot_v1_11 rc=-13 wrc=-13 errno=2 file=/media/data/hot/_introspection/db/hot_v1_11/1530062373-1530062373-7514170618120332262.tsidx hint=invalid magic]
I have checked other 2 Indexers and all are fine except this one. The settings done was sameon all 3. Also there isn't any space issue as such.
Any help would be appreciated.
... View more
05-16-2018
01:43 PM
In normal Splunk Enterprise we can list all the savedsearch using rest command like below
| rest /servicesNS/-/MYAPP/saved/searches
So I wanted a rest command similar to above to list all the Services made in the ITSI App.
Please someone provide me the query.
... View more
01-12-2018
01:47 AM
Thanks for your reply. I did try that, but no entries for servers in the output of above cmd. I have put the output of the above cmd below and also the settings from the GUI.
The GUI shows the settings, but the conf file doesn't have it stored anywhere.
GUI proof:
CMD output :
`[splunk@test_serverSH bin]$ ./splunk btool distsearch list --debug
/opt/splunk/etc/system/default/distsearch.conf [bundleEnforcerBlacklist]
/opt/splunk/etc/system/default/distsearch.conf [bundleEnforcerWhitelist]
/opt/splunk/etc/system/default/distsearch.conf [distributedSearch]
/opt/splunk/etc/system/default/distsearch.conf authTokenConnectionTimeout = 5
/opt/splunk/etc/system/default/distsearch.conf authTokenReceiveTimeout = 10
/opt/splunk/etc/system/default/distsearch.conf authTokenSendTimeout = 10
/opt/splunk/etc/system/default/distsearch.conf bestEffortSearch = false
/opt/splunk/etc/system/default/distsearch.conf connectionTimeout = 10
/opt/splunk/etc/system/default/distsearch.conf disabled = false
/opt/splunk/etc/system/default/distsearch.conf peerResolutionThreads = 0
/opt/splunk/etc/system/default/distsearch.conf receiveTimeout = 600
/opt/splunk/etc/system/default/distsearch.conf sendTimeout = 30
/opt/splunk/etc/system/default/distsearch.conf serverTimeout = 10
/opt/splunk/etc/system/default/distsearch.conf servers =
/opt/splunk/etc/system/default/distsearch.conf shareBundles = true
/opt/splunk/etc/system/default/distsearch.conf statusTimeout = 10
/opt/splunk/etc/system/default/distsearch.conf useSHPBundleReplication = true
/opt/splunk/etc/system/default/distsearch.conf [replicationBlacklist]
/opt/splunk/etc/system/default/distsearch.conf conf = (system|(apps/))/(default|local)/server.conf
/opt/splunk/etc/system/default/distsearch.conf framework = apps/framework/...
/opt/splunk/etc/system/default/distsearch.conf sampleapp = apps/sample_app/...
/opt/splunk/etc/system/default/distsearch.conf user_specific_meta = users(/_reserved)?///metadata/local.meta
/opt/splunk/etc/system/default/distsearch.conf [replicationSettings]
/opt/splunk/etc/system/default/distsearch.conf allowDeltaUpload = true
/opt/splunk/etc/system/default/distsearch.conf allowSkipEncoding = true
/opt/splunk/etc/system/default/distsearch.conf allowStreamUpload = auto
/opt/splunk/etc/system/default/distsearch.conf concerningReplicatedFileSize = 50
/opt/splunk/etc/system/default/distsearch.conf connectionTimeout = 60
/opt/splunk/etc/system/default/distsearch.conf maxBundleSize = 1024
/opt/splunk/etc/system/default/distsearch.conf maxMemoryBundleSize = 10
/opt/splunk/etc/system/default/distsearch.conf replicationThreads = 5
/opt/splunk/etc/system/default/distsearch.conf sanitizeMetaFiles = true
/opt/splunk/etc/system/default/distsearch.conf sendRcvTimeout = 60
/opt/splunk/etc/system/default/distsearch.conf [replicationSettings:refineConf]
/opt/splunk/etc/system/default/distsearch.conf replicate.app = true
/opt/splunk/etc/system/default/distsearch.conf replicate.authorize = true
/opt/splunk/etc/system/default/distsearch.conf replicate.collections = true
/opt/splunk/etc/system/default/distsearch.conf replicate.commands = true
/opt/splunk/etc/system/default/distsearch.conf replicate.eventtypes = true
/opt/splunk/etc/system/default/distsearch.conf replicate.fields = true
/opt/splunk/etc/system/default/distsearch.conf replicate.literals = true
/opt/splunk/etc/system/default/distsearch.conf replicate.multikv = true
/opt/splunk/etc/system/default/distsearch.conf replicate.props = true
/opt/splunk/etc/system/default/distsearch.conf replicate.segmenters = true
/opt/splunk/etc/system/default/distsearch.conf replicate.tags = true
/opt/splunk/etc/system/default/distsearch.conf replicate.transactiontypes = true
/opt/splunk/etc/system/default/distsearch.conf replicate.transforms = true
/opt/splunk/etc/system/default/distsearch.conf [replicationWhitelist]
/opt/splunk/etc/system/default/distsearch.conf other = (system|(apps/(?!pdfserver))|users(/_reserved)?//)/(bin|lookups)/...
/opt/splunk/etc/system/default/distsearch.conf refine.conf = (system|(apps/)|users(/_reserved)?//)/(default|local)/.conf
/opt/splunk/etc/system/default/distsearch.conf refine.metadata = (system|(apps/)|users(/_reserved)?//)/metadata/.meta
/opt/splunk/etc/system/default/distsearch.conf searchscripts = searchscripts/...
/opt/splunk/etc/system/default/distsearch.conf [tokenExchKeys]
/opt/splunk/etc/system/default/distsearch.conf certDir = $SPLUNK_HOME/etc/auth/distServerKeys
/opt/splunk/etc/system/default/distsearch.conf genKeyScript = $SPLUNK_HOME/bin/splunk, createssl, audit-keys
/opt/splunk/etc/system/default/distsearch.conf privateKey = private.pem
/opt/splunk/etc/system/default/distsearch.conf publicKey = trusted.pem
[splunk@test_serverSH bin]$ `
... View more
01-11-2018
12:12 AM
Hello I need a small clarification over distsearch.conf.
As per the documentation, to connect the SH with Indexer. One can configure in SH using any of the 3 ways : CLI, GUI & Conf file. The doc nicely describes it, Thanks for that.
In my case, the splunk env was already setup in my organisation. Now I am not aware which way was followed for adding search peer to search head.
Now in the SH GUI the "settings-->Distributed search-->Search peers" server entry is visible, and also the SH fetches the data from Indexer nicely. But my problem is I am not able to find out in which conf file that server settings are stored.
I tried to locate the distsearch.conf inside whole of splunk dir, but I could not find the server settings in anywhere. Further I tried to debug with btool cmd in SH and was surprised to see, even in that the servers settings are not visible.
Summarizing the Problem : The setting is visible in GUI, but no clue in which conf file that setting is getting stored.
... View more
12-21-2017
11:10 PM
Thank you for your response, Sir. But what I could see is the Curl Command 1 seems to be executed , but the response for Curl Command 2 is still blank.
Endpoint
curl cmd 1 : search/jobs
curl cmd 2: search/jobs/'$sid_id'/results'
I created a new set of shell with a different end point this time (curl cmd 3: search/jobs and curl cmd 4: search/sid/summary) Curl Command 3 and Curl Command 4 both seems to be executed.
So Now I feel its evident there is something to do with results endpoint
... View more
12-15-2017
03:42 AM
Hello All,
I am trying to execute a savedsearch query through REST API call and passing the Job SID to another curl command for displaying the results, inside the same shell.
The First curl command for running the saved search gets executed well, but the later one for displaying the results is not getting executed. Need help on this please.
My Shell...
data=$(curl -u admin:splunk@sh -k https://localhost:8089/services/search/jobs -d search="search index=_internal xxxxxxx")
sid_id=$(grep -oPm1 "(?<=)[^<]+" <<< "$data")
echo Sid value is ::"$sid_id"
result=$(curl -k -u admin:splunk@sh 'https://localhost:8089/services/search/jobs/'$sid_id'/results')
echo $result
Output of above shell when ran on putty is below:
[root]$ ./Test.sh
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 90 0 90 0 223 780 1933 --:--:-- --:--:-- --:--:-- 0
Sid value is ::1513337238.971
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
