Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About charltones
charltones
Explorer
Member since:
04-30-2013
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 3 |
| Karma Given | 3 |
| Karma Received | 4 |
| Member Since | 04-30-2013 |
Activity Feed
- Karma Re: Lookup table greater than 2GB - possible solutions? for jmallorquin. 06-05-2020 12:48 AM
- Karma How to replicate a Search Head Cluster's KV Store lookup data to an Indexer? for earakam. 06-05-2020 12:48 AM
- Karma KVStore with replication setup for gdavid. 06-05-2020 12:47 AM
- Got Karma for Install Google Maps on cluster - error with database file. 06-05-2020 12:47 AM
- Got Karma for Re: Install Google Maps on cluster - error with database file. 06-05-2020 12:47 AM
- Got Karma for Re: JSON field extraction when portion of the log is JSON format and some values are type array with comma delimeter. 06-05-2020 12:46 AM
- Got Karma for Re: JSON field extraction when portion of the log is JSON format and some values are type array with comma delimeter. 06-05-2020 12:46 AM
- Posted Re: Lookup table greater than 2GB - possible solutions? on Splunk Search. 06-06-2016 10:28 AM
- Posted Re: Lookup table greater than 2GB - possible solutions? on Splunk Search. 06-06-2016 10:26 AM
- Posted Lookup table greater than 2GB - possible solutions? on Splunk Search. 06-06-2016 04:03 AM
- Tagged Lookup table greater than 2GB - possible solutions? on Splunk Search. 06-06-2016 04:03 AM
- Tagged Lookup table greater than 2GB - possible solutions? on Splunk Search. 06-06-2016 04:03 AM
- Tagged Lookup table greater than 2GB - possible solutions? on Splunk Search. 06-06-2016 04:03 AM
- Posted Re: Install Google Maps on cluster - error with database file on All Apps and Add-ons. 08-13-2014 03:30 AM
- Posted Install Google Maps on cluster - error with database file on All Apps and Add-ons. 06-25-2014 05:47 AM
- Tagged Install Google Maps on cluster - error with database file on All Apps and Add-ons. 06-25-2014 05:47 AM
- Tagged Install Google Maps on cluster - error with database file on All Apps and Add-ons. 06-25-2014 05:47 AM
- Posted Re: Index time fields ignored in cluster on Getting Data In. 06-10-2014 09:56 AM
- Posted Re: JSON field extraction when portion of the log is JSON format and some values are type array with comma delimeter on Getting Data In. 06-07-2014 03:43 AM
- Posted Re: JSON field extraction when portion of the log is JSON format and some values are type array with comma delimeter on Getting Data In. 06-06-2014 05:33 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 |
06-06-2016
10:28 AM
Yes this is the route I started to go down, but I will very likely need to search across multiple partitions of the data set. The most sensible partition is to split the data by country, but I will probably need to search across multiple countries.
... View more
06-06-2016
10:26 AM
Looks like kvstore is the thing to use! Many thanks I wasn't aware of it until now. I've tried setting up DB Connect anyway, but this looks like a simpler route. I will give it a go.
... View more
06-06-2016
04:03 AM
I have a lookup file as CSV which contains > 27 million rows and is 2GB in size. When zipped it is 500MB.
I need to lookup search results to add fields from the lookup table. Splunk complains that the lookup file is too big (error in splunk logs).
What I'd like to know is what is the best option to work around this. Things I can think of:
1) Index the lookup data and do a join or subsearch
2) Put the lookup data in a database and query it using Splunk DB connect
3) Put the lookup data in a database and query it using REST or Python (perhaps using Redis to accelerate the DB queries)
Can you advise what the best route is?
... View more
08-13-2014
03:30 AM
1 Karma
I can answer my own question now, as I've just fixed this with help from Splunk support.
I had to do the following:
1) Install the google maps app on the search head and on the indexers - don't use the "cluster bundle" technique - actually log into the indexers and install the app that way.
2) Make the fix in this ticket http://answers.splunk.com/answers/135685/geoip-command-stops-working-after-upgrade-to-611-geoip-database-file-geolitecitydat-does-not-exist to the geopip config file on the search head only
3) Restart head and three indexers
... View more
06-25-2014
05:47 AM
1 Karma
I have a 6.1 Enterprise cluster - two heads, three indexers, heavy forwarder. I'm trying to install the Google Maps app. I've installed it on the search head and on the indexers via the cluster-bundle.
I've run into what seems like this problem: http://answers.splunk.com/answers/135685/geoip-command-stops-working-after-upgrade-to-611-geoip-database-file-geolitecitydat-does-not-exist
But the suggested fix doesn't work because the path to the database file on the indexers is different to that on the head - i.e. there is no single path I can put into geoip.conf in order to make the error go away.
... View more
06-10-2014
09:56 AM
I think the answer is that either:
This doesn't work - you can't have index time fields carried out by indexers in a cluster
or
It is because I was using a heavy forwarder - i.e. it believed the indexing work had already been done.
I didn't realise I was using a heavy forwarder, but I've fixed my problem by moving the indexing config to the forwarder instead and it is all behaving as expected now
... View more
06-07-2014
03:43 AM
Ah understood, in that case maybe a scripted input would be a better option?
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Setupcustominputs
You could write some python (or other script) to pre-process the input files and splunk would take the script output as its input.
... View more
06-06-2014
05:33 PM
1 Karma
I'm not sure that the second part is do-able with a regex. Taking a step back though, have you looked at the spath command (which parses JSON from parts of events). I did this:
| stats count | fields - count | eval jsonpart="{\"actionId\":47533796,\"clientIP\":\"127.0.0.1\",\"actions\":[\"Action1\",\"Action2\",\"Action3\"],\"user\":\"alia\"}" | spath input=jsonpart
where I mimic an event where one field contains the json. spath then does a great job of parsing the json bit. The array comes out as a multi valued field, the other fields are plain fields in the same event. Perhaps that will help?
... View more
06-06-2014
06:56 AM
1 Karma
Try this regex:
"([\w]+)":(\[[^\]]+\]|[^,}]+)
It optionally matches a:[b,c,d] or a:b
... View more
06-06-2014
01:50 AM
I have a cluster setup with search head, master, 3 indexers and a forwarder. The index config is pushed from the master (and I can see after splunk apply cluster-bundle) that it successfully turns up on each index node. The problem is that all the index time transforms I have entered are being ignored.
I have the same symptoms as this question (http://answers.splunk.com/answers/93776/push-configuration-files-in-cluster) but my fields are extracted at index time. I successfully applied the same config (or at least I thought it was the same) on a separate cluster and that worked fine. Can anyone point me in the right direction to debug why the transforms are not being applied?
Similar also to this issue: http://answers.splunk.com/answers/118649/index-time-props-and-transforms-not-working
Splunk Enterprise 6.1
... View more
