About paul_1994

paul_1994 · ‎04-19-2016

Not to ask another question but have you looked at the CA siteminder App? https://splunkbase.splunk.com/app/842/ I have not investigated it completely, but I am just now taking a peak on how to look at our logs. Also do you have the data indexed at the moment and created your field extractions?

paul_1994 · ‎04-28-2014

There still has been no word on this.. Also you can follow the same question on this thread.. http://answers.splunk.com/answers/113524/splunk-on-windows-server-2012-r2

paul_1994 · ‎05-16-2013

I had a request to provide the alert below and I am trying to figure out the best way to tackle it. run this query every 5 minutes and response time >2000 for more than 10 occurrences then raise email to below group also if possible please plot the timechart with this query index=xxx_logs service_name=cix* operation=GetTypeFrom* Transaction_time>2000 | timechart max(Transaction_time) by operation Thanks in Advance! Update: I created an alert to run every 5min and to alert if threshold reaches over 10 occurrences.

paul_1994 · ‎04-26-2013

Yay.. thanks I was able to use this solution.

paul_1994 · ‎04-26-2013

For some reason I could not get this working for me.. Are these the categories? eval pct=NSException / FinishLaunching Also if my categories are more like this " NSexception 222: helpme" will the above still work? Thanks!

paul_1994 · ‎04-26-2013

I have two queries that I am running and I want to take the results / Count of these queries and divide them. I have seen several variances but I am still having issues trying to get my search correct. Here is an example of my queries: index=norlogs sourcetype="devicelog" category="NSException, on wi-fi:" index=norlogs sourcetype="devicelog" category="FinishLaunching" I would like to divide the first query by the last query and display a percentage. What would be the best way to accomplish this. This is working but I am not getting percentages index=norlogs sourcetype="devicelog" category="NSException"| stats count as TotalA | appendcols [search index=norlogs sourcetype="devicelog" category="FinishLaunching" | stats count as TotalB] | eval Total=TotalB/TotalA

paul_1994 · ‎04-21-2013

Thanks for the suggestion I will try it out. But what about an easy way to do field extraction through props and transform

paul_1994 · ‎04-19-2013

I have this interesting xml data from dynatrace that I am trying to do field extraction on and I am not sure where to start. Has anyone had any experience importing dynatrace data into splunk and how.

paul_1994 · ‎04-19-2013

There are two things that i would try restart the splunkd service if you haven't already. This should recognize the serverclass.conf file and enable the deployment server. The other thing I would try is to deploy / setup an empty app that does nothing. Also from the client perspective I think as long as you have the deploymentclient.conf deployed the client will say enabled. I hope this helps

paul_1994 · ‎03-13-2013

Here was my workaround for now. I moved these configs out of etc\system\local and created another app. This seems to be working for now.

paul_1994 · ‎03-13-2013

version 4.3.5

paul_1994 · ‎03-13-2013

Is there a metedata for etc\system\local? files.. There is a etc\system\metadata in which both files are there ( default & local)

paul_1994 · ‎03-13-2013

I was using IFX and regex to extarct fields from my log but I keep getting this error in the Splunkd Log 03-13-2013 05:45:49.662 -0700 WARN AdminManager - Handler 'props-extract' has not performed any capability checks for this operation(requestedAction=edit, customAction="acl", item="iis-xpox : REPORT-iismpos"). This may be a bug. 03-13-2013 05:11:42.920 -0700 WARN AdminManager - Handler 'props-extract' has not performed any capability checks for this operation(requestedAction=list, customAction="acl", item="mpos-devicelog : EXTRACT-xpox-devicelog") This error pops up everytime I try to change the permissions on the extraction. This was placed in etc\system\local\props.conf [xpox-devicelog] EXTRACT-category-message = [^\]\n]*\]\s+(?P<category>\[([^ ]+|\w+\s+\w+|\w+\s+\w+\s+\w+\s+\w+|)\])\s+(?P<message>.+) Any help appreciated

paul_1994 · ‎03-13-2013

I just ran into this issue too. Can anyone explain why this happens.. FOr me i added a extraction to props.conf and I get this error when trying to change permission on the new extraction

paul_1994 · ‎03-08-2013

I have this TCP input that is coming into my system and the fields are fixed width and sometimes the fields are blank. I need help with my props and transforms so I can read the data correctly and the have fields properly extracted Has anyone had any experience with this. Also from the stream not all the fields have data they are just blank but the spacing remains the same.

paul_1994 · ‎02-27-2013

Did you ever get an awnser to your deployment issue? I just ran into the same error after using a shared bundles

paul_1994 · ‎01-30-2013

Thank you sir! This is what I needed explained.

paul_1994 · ‎01-29-2013

I have a distributed Environment consisting of 2 SH and 2 indexers. I would like to keep around 30 days of logs on my tier 1 storage and the rest on my tier 3 storage ( \some\share). I am not sure how to configure my indexes.conf File to do so. Current Index.conf: [com_iislogs] coldPath = $SPLUNK_DB\com_iislogs\colddb homePath = $SPLUNK_DB\com_iislogs\db thawedPath = $SPLUNK_DB\com_iislogs\thaweddb maxTotalDataSizeMB = 450000 maxDataSize = auto_high_volume How do I setup anything after 30 days or a certain size to move the data to \some\share thanks

paul_1994 · ‎01-21-2013

Hmm it seems you learn something everyday. I was not aware you could run multiple instances on a windows server. But I would take heed to the warning that this is not a supported configuration. Have you changed the web port on the second instance? http://docs.splunk.com/Documentation/Splunk/latest/Admin/Changedefaultvalues Example: splunk set web-port 9000 splunk set splunkd-port 9089 The article above may be able to help ya

paul_1994 · ‎01-18-2013

I am not sure if you can try this but can you temporarily s stop the first indexer to see if the traffic will go there? Also are you seeing anything funny in the Splunkd log? From there if you still not seeing anything I would turn on debug for tcp input and then tail the Splunkd log. I hope this helps.

paul_1994 · ‎01-17-2013

I am not sure what you are trying to say. A heavy forwarder would accept a TCP connection just fine. Can you give an example of your setup and what you are trying to load balance? Are you asking if it would load balance the connection to the indexers?

paul_1994 · ‎01-17-2013

I would ask the same question why do you need splunk running under a service account and not the local system? Are you doing some type of remote collection? I have this same issues but this is when I need to access a cifs share and I need to provide access rights. so I run the splunk forwarder under a domain account.

paul_1994 · ‎01-17-2013

THis is something you may want to open a support ticket on. That log entry may not be the issue? Did the crash produce a dump file? If so I would run splunk diag and then add that file to your ticket. splunk\bin\ splunk diag

paul_1994 · ‎01-17-2013

The only suggestion I would have would be to see if you can query the data from search, to see if it is indeed collecting inside of the index. I have not used this app before, but I wanted to see if I could get you looking for the data via indexes.

paul_1994 · ‎01-17-2013

What would happen if both indexers were down. Does the data just queue? Or does it gets lost and I will miss all data coming in from the UF's? If so what is the best way to make sure I don't lose any new data?

Posts	39
Solutions	1
Karma Given	9
Karma Received	4
Member Since	‎05-17-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Creating threshold alerts.

Joining two queries and getting a percentage

Splunk and Dynatrace

Props and field extraction not working

Fixed Width data streamsfield extractions

Rolling over data to a a Share

Shutting down splunk Indexers For Upgrade

Web Intelligence application NO data in Distribute...

Forwarder and More

Re: How to monitor and search for the errors in Si...

Re: Splunk on SCOM support Windows 2012 R2

Creating threshold alerts.

Re: Joining two queries and getting a percentage

Re: Joining two queries and getting a percentage

Joining two queries and getting a percentage

Re: Splunk and Dynatrace

Splunk and Dynatrace

Re: Deployment Server - Verifying that server is w...

Re: Props and field extraction not working

Re: Props and field extraction not working

Re: Props and field extraction not working

Props and field extraction not working

Re: Splunk could not update permissions for resour...

Fixed Width data streamsfield extractions

Re: Distributed Search with Search head Pooling, D...

Re: Rolling over data to a a Share

Rolling over data to a a Share

Re: 3 credentials on one Splunk

Re: Load Balacing

Re: Load Balacing

Re: 3 credentials on one Splunk

Re: Splunk Crash

Re: Splunk not showing events from all domain cont...

Re: Shutting down splunk Indexers For Upgrade