Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Myelin
Myelin
Explorer
Member since:
01-23-2014
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 01-23-2014 |
Activity Feed
- Got Karma for What is the correct upgrade order- Forwarders first or last?. 06-05-2020 12:46 AM
- Got Karma for Possible to stream data into Splunk (like Graphite)?. 06-05-2020 12:46 AM
- Posted Re: How to change the user Splunk runs scripts as? on Security. 02-10-2016 08:27 AM
- Posted How to change the user Splunk runs scripts as? on Security. 02-10-2016 08:14 AM
- Tagged How to change the user Splunk runs scripts as? on Security. 02-10-2016 08:14 AM
- Tagged How to change the user Splunk runs scripts as? on Security. 02-10-2016 08:14 AM
- Tagged How to change the user Splunk runs scripts as? on Security. 02-10-2016 08:14 AM
- Tagged How to change the user Splunk runs scripts as? on Security. 02-10-2016 08:14 AM
- Posted Re: Possible to stream data into Splunk (like Graphite)? on All Apps and Add-ons. 05-20-2014 06:59 AM
- Posted Possible to stream data into Splunk (like Graphite)? on All Apps and Add-ons. 05-19-2014 02:41 PM
- Tagged Possible to stream data into Splunk (like Graphite)? on All Apps and Add-ons. 05-19-2014 02:41 PM
- Tagged Possible to stream data into Splunk (like Graphite)? on All Apps and Add-ons. 05-19-2014 02:41 PM
- Tagged Possible to stream data into Splunk (like Graphite)? on All Apps and Add-ons. 05-19-2014 02:41 PM
- Tagged Possible to stream data into Splunk (like Graphite)? on All Apps and Add-ons. 05-19-2014 02:41 PM
- Tagged Possible to stream data into Splunk (like Graphite)? on All Apps and Add-ons. 05-19-2014 02:41 PM
- Posted Re: Splunk summary data missing on Knowledge Management. 02-06-2014 01:11 PM
- Posted Re: Splunk summary data missing on Knowledge Management. 02-05-2014 03:50 PM
- Posted Splunk summary data missing on Knowledge Management. 02-05-2014 03:20 PM
- Tagged Splunk summary data missing on Knowledge Management. 02-05-2014 03:20 PM
- Tagged Splunk summary data missing on Knowledge Management. 02-05-2014 03:20 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
02-10-2016
08:27 AM
The scripts are in fact in the $SPLUNK_HOME/bin/scripts directory and these are shell scripts.
... View more
02-10-2016
08:14 AM
We've been using the functionality in Splunk to have it kick off a script when certain search criteria is met. However, we noticed Splunk is executing those scripts as root. How can we change the user it runs scripts as? Note, that Splunk itself is not running from the root user, but a Splunk user.
... View more
05-20-2014
06:59 AM
Is there page on how to setup streaming inputs? I tried doing this and could not get it to work- here were my steps:
Setup new TCP input in Splunk on port XXXX
On another Linux box ran this command:
echo "local.random.diceroll 4 date +%s " | nc ${INDEXER} ${PORT XXXX}
The above command was my attempt at sending a simple piece of data directly to Splunk, but I cannot find it anywhere in Splunk after sending it. Perhaps that command is wrong?
... View more
05-19-2014
02:41 PM
1 Karma
We're in the early stages of using Graphite to collect various metrics and people have begun using Grafana as the graphing/analytics tool on top of it. My question is why can't we use Splunk to do this?
The issue seems to be that Graphite allows you to just stream data to it instead of parsing logs. So my question is- Is it possible to stream data to Splunk instead of needing to feed it logs? And if so, how do I do that?
Thanks.
... View more
02-06-2014
01:11 PM
We finally solved this issue. Even though we restarted Splunk through the CLI and the entire box itself- this had no effect. I went into the WebUI -> Manager -> Indexes. In here I disabled the summary_forwarders index and restarted Splunk as it instructed. I then enabled the summary_forwarders index. After this ALL of the summary_* indexes are now populated and back filling all the past data.
... View more
02-05-2014
03:50 PM
Checked the DM app. Nothing is Disabled there and the schedules look normal. I should have noted this is 4.3.2 (we are working on an upgrade!).
When I look at the job history I see all kinds of searches running successfully in the DM app, including "All forwarders - regenerator summary index" which seems to have all the data we're looking for, and references index=summary_forwarders. So it looks like the searches are actually working fine as well...
But once again searching: index="summary_forwarders" returns nothing.
... View more
02-05-2014
03:20 PM
We're missing all of Splunk's summary data (index=summary_forwarders/summary_indexers, etc). It was working previously and has since stopped- so we know when it broke, but the only changes on that date were networking changes and all other parts of Splunk seem to be working fine (including other indexes). When I look on one of the indexers at the hot buckets for (for example) summary_forwarders I see two old warm buckets and a new one is never created.
We've tried a lot of the basics- restart Splunk, restart the boxes, but there is no change, and have been looking around for clues at all kinds of confs..
Any thoughts on what the problem could be or where to look? We've been banging our heads against the desk for a week on this and it's starting to hurt! I've checked the splunkd log and see where our last hot bucket gets rolled to warm, but never see any entry or error about trying to create the next bucket in sequence.
... View more
01-23-2014
08:42 AM
1 Karma
Hello. In our currently Splunk deployment we have a mix 4.2.* and 4.3.* boxes and are planning an upgrade to Splunk 6. Should the forwarders be upgraded before or after the Indexers, Search Heads, Deploy box.
For example should our path be: 1) Forwarders from 4.2 -> 4.3 2) Indexers, Search Heads, Deploy Server 4.2 -> 4.3 3) Forwarders from 4.3 -> 6.0 4) Indexers, Search Heads, Deploy Server 4.3 -> 6.0
OR
1) Indexers, Search Heads, Deploy Server 4.2 -> 4.3 2) Forwarders from 4.2 -> 4.3 3) Indexers, Search Heads, Deploy Server 4.3 -> 6.0 4) Forwarders from 4.3 -> 6.0
... View more
Labels
