Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nicolay_koecher
nicolay_koecher
Explorer
Member since:
05-04-2015
06-05-2020
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 05-04-2015 |
Activity Feed
- Got Karma for After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this?. 06-05-2020 12:47 AM
- Got Karma for After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this?. 06-05-2020 12:47 AM
- Posted How many servers do I need to implement a Splunk 6.4.x indexer cluster? on Deployment Architecture. 06-14-2016 04:53 AM
- Tagged How many servers do I need to implement a Splunk 6.4.x indexer cluster? on Deployment Architecture. 06-14-2016 04:53 AM
- Tagged How many servers do I need to implement a Splunk 6.4.x indexer cluster? on Deployment Architecture. 06-14-2016 04:53 AM
- Tagged How many servers do I need to implement a Splunk 6.4.x indexer cluster? on Deployment Architecture. 06-14-2016 04:53 AM
- Posted Splunk Template for Xenapp on All Apps and Add-ons. 02-15-2016 05:43 AM
- Tagged Splunk Template for Xenapp on All Apps and Add-ons. 02-15-2016 05:43 AM
- Posted Re: After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? on Dashboards & Visualizations. 09-30-2015 02:31 AM
- Posted After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? on Dashboards & Visualizations. 09-29-2015 05:29 AM
- Tagged After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? on Dashboards & Visualizations. 09-29-2015 05:29 AM
- Tagged After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? on Dashboards & Visualizations. 09-29-2015 05:29 AM
- Tagged After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? on Dashboards & Visualizations. 09-29-2015 05:29 AM
- Posted Re: After updating the Splunk App for NetApp Data ONTAP from version 2.0.3 to 2.1.0, why is there no Latency data in graphs? on All Apps and Add-ons. 09-29-2015 12:11 AM
- Posted After updating the Splunk App for NetApp Data ONTAP from version 2.0.3 to 2.1.0, why is there no Latency data in graphs? on All Apps and Add-ons. 09-28-2015 12:49 AM
- Tagged After updating the Splunk App for NetApp Data ONTAP from version 2.0.3 to 2.1.0, why is there no Latency data in graphs? on All Apps and Add-ons. 09-28-2015 12:49 AM
- Tagged After updating the Splunk App for NetApp Data ONTAP from version 2.0.3 to 2.1.0, why is there no Latency data in graphs? on All Apps and Add-ons. 09-28-2015 12:49 AM
- Tagged After updating the Splunk App for NetApp Data ONTAP from version 2.0.3 to 2.1.0, why is there no Latency data in graphs? on All Apps and Add-ons. 09-28-2015 12:49 AM
- Posted Re: Template for Citrix XenApp error from GetXAApplicationReport6x.ps1 every time - all servers on All Apps and Add-ons. 07-20-2015 06:09 AM
- Posted Re: Template for Citrix XenApp error from GetXAApplicationReport6x.ps1 every time - all servers on All Apps and Add-ons. 07-17-2015 01:07 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-14-2016
04:53 AM
Hello,
Environment overview:
2 Data Centers
1 Datecollector
1 Splunk enterprise 6X Server working as a search head, Indexer
in each DC
Now I plan to implement a Splunk 6.4.x Indexer cluster. How many servers do I need?
1 As Master node
1 as Search Head
2 Peer Nodes
Is this correct?
Can I install the Master Node and Search Head on the Same Server?
And what about the replication factor (I have 2 Peers) - so the Replication Factor is 2?
Thanks for your support
... View more
02-15-2016
05:43 AM
Hi Team,
I need some basic info regading Splunk App for Xenapp. How much Data will be indexed per Server per day. Are there any suggestions or recomendations from Splunk?
Regards Nico
... View more
09-30-2015
02:31 AM
Hello,
changing the height works fine for single values (Numbers), but it won´t work with text. I use text and stylesheed (single_decorations.css) to change the text color. Now I can change the height but tbe text and symbols are still big. How can I change this.
Here´s one of my queries:
index="printing" source="FRAINPSP1819" "local system"| rex field=source "(?FRAINPSP.{4})" |dedup _time |stats max(prn_count) | rename max(prn_count) as Local1|appendcols [search index="printing" source="FRAINPSP1820" "local system"| rex field=source "(?FRAINPSP.{4})" |dedup _time |stats max(prn_count) | rename max(prn_count) as Local2] | eval DiffLocal=(Local2-Local1) | eval status=if(DiffLocal=="0" ,1,100) | eval stext=if(status=1,"ok","Error") | fields stext status | rangemap field=status low=1-1 severe=100-100 default=low**
greetings NIK
... View more
09-29-2015
05:29 AM
2 Karma
Hello Splunk Team,
I've currently updated Splunk from version 6.2.5 to 6.3. Now the letters and numbers in my dashboard are extremely big. How can I change this to normal style?
Thanks for your suggestions.
greetings NIK
... View more
09-29-2015
12:11 AM
Hi,
thanks for your answer - but,
in searchstring --> Controller View --> AVG Latency, there is no "summariesonly=true"
| `tstats` avg(read_latency_average), avg(write_latency_average), avg(other_latency_average), from netapp_perf_volume groupby _time span=2m, host | search [search `SystemHostname("frainnad1n1")`] | eval psrsvd_sm_read_latency_average=psrsvd_sm_read_latency_average/1000 | eval psrsvd_sm_write_latency_average=psrsvd_sm_write_latency_average/1000 | eval psrsvd_sm_other_latency_average=psrsvd_sm_other_latency_average/1000 | timechart avg(read_latency_average) AS "Read Latency", avg(write_latency_average) AS "Write Latency", avg(other_latency_average) AS "Other Latency" by host
Result: no result found.
Prior to update to ver 2.1.0 - search is running fine.
Any other ideas
greetings NIK
... View more
09-28-2015
12:49 AM
Hello Team,
My Environment - Splunt Enterprise 6.3 Netapp Ontap 2.0.3
After updating the Splunk App for NetApp data ONTAP to version 2.1.0, there is no data in filer View AVG Latency, AGV CPU and Total IOPs Rate. Older Data is still available.
Any suggestions?
greetings NIK
... View more
07-20-2015
06:09 AM
Hello,
any suggestions? - still have the same Issue.
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" l\GetXAApplicationReport6x.ps1:26 char:42
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + $ProcessName = (Split-Path -leaf ( $c[0] -replace '"','' ))
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" -replace ". ...
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd"
cheers Nicolay
... View more
07-17-2015
01:07 AM
Hello,
yes I did that - just do be sure I copied the folder again. Got still the same Error:
copied:template-for-citrix-xenapp_111
on my zdc its also xml broker
- TA-XA6x-XML
--TA-XA6x-ZDC
on my worker
TA-XA6x-Server
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" At C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershel
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" l\GetXAApplicationReport6x.ps1:26 char:42
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + $ProcessName = (Split-Path -leaf ( $c[0] -replace '"','' ))
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" -replace ". ...
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd"
07-17-2015 10:00:49.024 +0200 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.244.224.81_8089_s0101954.de.db.com_S0101954_32D414DA-67CA-42A2-AFA2-4F581659353C
07-17-2015 10:00:49.026 +0200 INFO DC:HandshakeReplyHandler - Handshake done.
... View more
07-16-2015
12:46 AM
Hello jconger,
I Installed the Splunk XenApp template 1.1.1on my Linux box. And the following error in splunkd.log is displayed:
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand
What can I do to solve this issue.
The next Thing is not all Perf is displayed (e.g. Memory Metrics, System Metrics and Disk Metrics are empty. CPU, Page file and Network metrics are shown.
Thanks for your support
Cheers Nicolay
... View more
06-09-2015
02:25 AM
Hello,
For security reasons, I have to monitor processes, especially the IExplore Process. Open connections are important as well as Username and Port. How can I monitor processes in Splunk?
regards Nico
... View more
05-29-2015
06:00 AM
Hello
I have sone trouble with regex
I want build a table or a chart wirh the following content:
I started with this regex command:
^(?:[^ \n]* ){5}(?P<prn_upd>\w+\s+\w+)
2015-04-25 15:07:17.273 Total number of printers deleted: 2
but this shows only the text printers deleted not the quantity - can anybody help me in this?
lastly the table should look like this:
Date Printer created quantity
date Printer deletet quantity
date printers obsoleted
date printers updated
date errors
this is the origin logfile:
2015-04-25 11:07:30.008 Total number of printers created: 0
2015-04-25 11:07:30.008 Total number of printers deleted: 2
2015-04-25 11:07:30.008 Total number of printers obsoleted: 0
2015-04-25 11:07:30.008 Total number of printers updated: 0
2015-04-25 11:07:30.008 Total number of printers with errors: 0
... View more
- Tags:
- regex
05-27-2015
04:13 AM
Hello,
In my environment I use Splunk and netapp ontap app. The index is on a separate nfs Vol 400GB in size. My current usage is about 78%.
I limited the file /opt/splunk/etc/apps/Splunk/etc/apps/Splunk_TA_ontap/local/indexes.conf to
[default]
maxTotalDataSizeMB = 200000
frozentimePeriodInSecs = 2592000
What thakes precedence?
I also limited /opt/splunk/etc/apps/Splunk/etc/apps/sa-Utils/default/tsidx_retention.conf
maxTotalDataSizeMB = 100000
retentionTimePeriodInSecs = 188697600
same question --> What takes precedence?
Any useful suggestions in how to limit this?
thanks
Nico
... View more
05-07-2015
06:08 AM
Hi,
allready put the folders there - but still got no data. What else do I have to setup?
cheers Nico
... View more
05-07-2015
04:35 AM
Hi,
I already installed xendesktop 7 app like discribed in install.pdf - but where exactly do I have to put the below folders.
TA-XD7-Broker goes to Xendesktop
TA-XD7-VDA goes on all DesktopServers
thanks for your support
... View more
05-07-2015
02:38 AM
Hello,
I´ve 3 indexer running, now I plann to setup one search head to query all 3, how can this be done. 2 Linux Indexer 1 Windows box.
thanks
... View more
- Tags:
- searchhead
