About schoi

schoi · ‎09-25-2015

For question #2, yes this is expected -- you will now need to be logged in as a role with the 'web_debug' capability (enabled for admin role only by default) -- see http://my-splunk/en-US/debug/info under "EAI object refresh"

schoi · ‎02-18-2015

Both settings take effect -- so if either of those conditions are met, buckets will start to freeze.

schoi · ‎01-28-2015

This will technically work, however, it is not recommended to overload the cluster master as a search head for performance reasons. If this is a "test demo" environment, go for it.

schoi · ‎01-06-2015

Actually, based on @jlin's comment "It seems like events are getting deleted somehow" ... the datagen by default starts the log file with data from 1 year ago. Can you check your default/system value for "frozenTimePeriodInSec"? if it's changed from the default out of the box value, to something lower than 1 year, your data will be frozen as you index, which could account for the decrementing % indexed value. splunkd.log should tell you if data is getting frozen

schoi · ‎01-06-2015

Basically, the indexing test will: 1. generate a static file and put it under splunkit-server/data/static/syslog_#g.log 2. put the count of the lines (events) in splunkit_server/bin/datagenRecord.log 3. monitor splunkit-server/data/static/ 4. figure out that indexing is complete when the # of events in the splunkit_idxtest index matches the value of #2. So things can go wrong if: - you have python gendata.py script(s) still running (ie: data is still being written to splunkit-server/data/static/*) - you have a wrong # in splunkit_server/bin/datagenRecord.log Check to make sure that (1) no extraneous gendata scripts are running, (2) splunkit-server/data/static/ only contains the generated data file you want, (3) splunkit_server/bin/datagenRecord.log has the # of lines of the single file in splunkit-server/data/static/ You can also check what is in these logs: - splunkit_server/bin/datagenRecord.log - splunkit_server/bin/indexRecord.log - splunkit_server/log/indextest.log

schoi · ‎04-05-2013

Hi Takajian, We've removed the pyreadline dependency in version 2.0.1 of SplunkIt - let us know if that doesn't work for you. Thanks!

schoi · ‎08-04-2012

for future ref, switching from openjdk to the oracle version seems to have solved the DISPLAY issue above (reason unclear)

schoi · ‎11-04-2011

The Search Test part of SplunkIt currently requires a browser (default Firefox), since we purposely wanted searches to go through SplunkWeb. However, if your use case is to run searches via CLI, then you'd need to write your own splunkit/user/search/ test which does not call SplunkItTest.java. It should be straight-forward to issue CLI commands (see splunkit/server/server.py for examples.) We'll put the ability to run the Search Test via CLI on a future version of SplunkIt; in the meantime let me know if you need help on this sooner.

schoi · ‎09-30-2011

Hi Lowell, This is a great use case for SplunkIt - if you have results for the different file systems, and assuming you'd like to share them, could you send an email to splunkit @splunk? Thanks!

Posts	9
Solutions	3
Karma Given	2
Karma Received	4
Member Since	‎05-20-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Re: Lines are joined together after upgrading to 6...

Re: Two attributes defined in indexes.conf on cold...

Re: Is it possible to use a single search-head as ...

Re: Why is the indextest script hanging and never ...

Re: Why is the indextest script hanging and never ...

Re: SplunkIt throws an error "Could not import key...

Re: Display not working for splunkit-user with Spl...

Re: Splunkit Firefox Requirement

Re: How do I disable index throttling when running...