About ford1863

ford1863 · ‎08-21-2014

Hi All, When I installed the splunk universal forwarder on my linux server and restarted the splunk service, there run an error like below:'Invalid key in stanza [monitor:///tmp/nohup_1.out] in /opt/splunkforwarder/etc/system/local/inputs.conf, line 5: disable (value: 0)'. Was it a normal message? I need your help! Thanks, Henry

ford1863 · ‎12-11-2012

Hello, How can I delete some specific event in Splunk? For example, one log loaded in splunk with 50 events, and I want to delete one or two events in them.

ford1863 · ‎03-18-2012

It's done, thanks a lot!

ford1863 · ‎03-13-2012

When I package my app and move to other splunk server, the custom dashboard and report was not found.

ford1863 · ‎03-11-2012

Hi all, Now I build an apps for cisco syslog, and how can I use it to other splunk server in an universal mode? Regards Henry

ford1863 · ‎01-19-2011

Can splunk support file in GBK? According to Wikipedia, GBK is an extension of the GB2312 character set for simplified Chinese characters, used in the People's Republic of China.

ford1863 · ‎01-08-2011

Now I configured server A and B with installing splunk, and index some local logs on server A. I want to forward these logs to server B, and wrote some configure files in /opt/splunk/etc/system/local. props.conf: [<sourcetype>] TRANSFORMS-routing=send_to_windows transforms.conf: [send_to_windows] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=windowsgroup outputs.conf: [tcpout:windowsgroup] disable=fasle server=x.x.x.x:x The server A is configured as Splunk forwarder mode.The piont is there's no logs receiving on server B.

ford1863 · ‎09-06-2010

I have configured remote WMI in my Splunk to see the eventlogs on Windows servers. But when I index and search the eventlogs on remote servers, I found the CPU load of the remote server would reached to a peak in a short time. How can I do to aviod this situation, and whether there are some other ways to collect eventlogs on remote servers more efficient?

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-16-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Why am I getting error message 'invalid key in sta...

How to delete specific event?

How to bulid a new apps as an universal apps?

Can splunk support GBK?

How to forward indexed data to another splunk rece...

How can I collect eventlogs into my Splunk?