About vumanhtai

vumanhtai · ‎07-06-2020

Hi Splunk Team Why is the age of the data larger than the frozenTimePeriodInSecs time without being deleted My config index is as follows frozenTimePeriodInSecs = 38880000 Thanks

vumanhtai · ‎07-03-2020

Hi Splunk Team! Why my index paloalto, panorama only hold 23 days and 14 days like the image below My index cluster configuration is as follows How do i fix it? Has my current data for 1 year been deleted? Thanks!

vumanhtai · ‎06-30-2020

Hi anilchaithu my search : | tstats count from datamodel=pan_firewall source index has the data for mentioned time period. i don't use summariesonly=t in search Thanks!

vumanhtai · ‎06-30-2020

Hi Splunk team The image below is information about my datamodel. Summary Range 31622400 second (s) But why do I search for a period of May, the result returns 0 events? How can i fix it? Thank all!

vumanhtai · ‎06-24-2020

Hi Splunk Team! I recently received messages like the following how do i fix it Thanks!

vumanhtai · ‎04-28-2020

Hi jwiedow 1 HF wants to check 1 node among many nodes running the same website, it will have to use the hosts file, so at the same time it is impossible to check multiple nodes because the hosts file cannot be changed at the same time.

vumanhtai · ‎04-28-2020

Hi jwiedow Currently 10 webapp server have 1 VIP IP and monitored through HF. So when the issue happen we dont know which particular node is the cause. Also, all 10 servers are installed UF. The question is: Can I make each server monitor its own website with its own UF? Thank you

vumanhtai · ‎04-27-2020

Hi Splunk Team! i want to running app website monitoring in splunkforwarder how can i dot it ThankS!

vumanhtai · ‎03-24-2020

thank you kamlesh_vaghela's answer helped me solve this problem

vumanhtai · ‎03-24-2020

Thank you so much!

vumanhtai · ‎03-24-2020

Hi Splunk Team! i have a query: index=mail sourcetype=webmail | stats values(time) as time values(severity) as severity values(email) as email values(status) by session_ID Results as shown in a picture i want to show result of values (severity) greater than 2 values? how can i do it? Thanks!

vumanhtai · ‎02-28-2020

Hi Splunk Team! I want to use the website monitor app to monitor the URL with my ssl how do i config app? thank all

vumanhtai · ‎11-24-2019

Hi Splunk Team in splunk monitor consonle i see that Data Age vs Frozen Age (days) like this: 1996/450 as per my understanding event older than frozen age (450) will be delete but in hear the data age (1996) Please help me explain this issue and how to delete the data older than Frozen time. Thank you

vumanhtai · ‎11-07-2019

this app when i install directly in the indexer, it run correcly and i see log monitor website but when i push this app from master node to indexer , it not run and i don't see log monitor website

vumanhtai · ‎11-07-2019

Hi DavidHourani my app : website_monitoring There is no log monitor for my websites

vumanhtai · ‎11-07-2019

Hi DavidHourani i see my app in folder slaves-app of peer node. but app not working

vumanhtai · ‎11-06-2019

Hi Splunk Team When i used the app on peer node: App run corretly. After I follow this guide to manage the app from master, it didnt run: command used from master node: #/opt/splunk/bin/splunk apply cluster-bundle https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Updatepeerconfigurations

vumanhtai · ‎10-13-2019

Thank ivanreis

vumanhtai · ‎10-13-2019

Hi Splunk Team When I enter a dasborad, the search will start running. So why is there a schedule search. What is the effect of schedule search when I disable it? How do I disable all schedule searches because I find the schedule search is using too much CPU and my indexer is overloaded? Thanks All

vumanhtai · ‎10-06-2019

thank you

vumanhtai · ‎10-06-2019

Hi Splunk Team I see this message on my entire datamodel, how can I fix it? "This object has no explicit index constraint. Consider adding one for better performance." How can fix it Thanks

vumanhtai · ‎10-02-2019

Hi Gcusello I see this message on my entire datamodel, how can I fix it? "This object has no explicit index constraint. Consider adding one for better performance."

vumanhtai · ‎10-02-2019

Thank You so much! Can you give me your contact information? I have run out of working hours and I want to contact you at another time.

vumanhtai · ‎10-02-2019

hello Splunk Team i want to config Heavy Forward to receive and index then send data to my cluster index? Thank ALL

vumanhtai · ‎09-12-2019

Hi gcusello i have a multisite Cluster index i want to optimized index. the option pipelineSetWeightsUpdatePeriod, I thought up deleting it for default use. Thank You

Posts	72
Solutions	1
Karma Given	2
Karma Received	3
Member Since	‎11-24-2017

Online Status	Offline
Date Last Visited	‎07-14-2020 11:42 PM

Why is the age of the data larger than the frozenT...

Data Age in splunk

Search in datamodel

Intelligence Downloads

website monitoring

stats values

Website monitoring with SSL

Data Age / Frozen Age (days): How to delete the da...

master-app and slaves-app

Schedule Search

Why is the age of the data larger than the frozenT...

Data Age in splunk

Re: Search in datamodel

Search in datamodel

Intelligence Downloads

Re: website monitoring

Re: website monitoring

website monitoring

Re: stats values

Re: stats values

stats values

Website monitoring with SSL

Data Age / Frozen Age (days): How to delete the da...

Re: master-app and slaves-app

Re: master-app and slaves-app

Re: master-app and slaves-app

master-app and slaves-app

Re: Schedule Search

Schedule Search

Re: alert in datamodel

alert in datamodel

Re: Heavy Forward

Re: Heavy Forward

Heavy Forward

Re: edit file server.conf