About SarahBOA

SarahBOA · ‎01-28-2020

I had the same issue, and to be clear the pass4SymmKey from the SHC and the SHCDS need to match: The SHCDS under the [general] stanza in server.conf must match the SHC members under the [shclustering] stanza in server.conf. It wasn't clear which stanza was needing to be updated for each and I found this to be what needed to happen.

SarahBOA · ‎01-26-2017

We used tstats and we only run it on part of the data. We really wanted a list of which hosts send what sourcetype and source to what index. We run it on a small sampling of the data and collect it weekly and add it to our own lookup/csv to keep track.

SarahBOA · ‎01-11-2017

When THP is enabled in our environment, we notice immediately (we are not in charge of our servers and this happens occasionally with OS patches etc). A few things that we watch/notice: 1. Our environment is very heavy on searches. If we timechart the CPU of all of our indexers in a line graph, they follow a very nice pattern - spikes on the 0, 15, 30, 45 minutes due to more searches running on those minutes. The lines on the graph are close together and look almost like someone has used a rainbow pen to draw a single line. When THP is enabled, there is variation to this and the graph just doesn't look the same - the lines for each indexer are distinct and don't necessarily follow the same pattern. On average, CPU is a bit higher, but it is really the timechart of the CPU graph that is telling. 2. We have some scheduled searches that run every minute or every 5 minutes. We timechart the avg() or perc90() of the run time of those searches and when THP is on, that will be higher by a noticeable amount. The timechart of the avg() allows us to account for the variations in load. You can check for THP by looking at the internal logs and the ulimit parameter. Splunk only does this when it is starting up, so you will need to look at the ulimit after the THP has been turned off and splunk has restarted.

SarahBOA · ‎10-24-2014

Make sure all default.xml files in every app have app level permissions. We had another default.xml file in a different app set with global permissions. Once we changed all default.xml files to have app level permissions, we did see the changes we had made to the permissions show up in the UI and the correct roles were able to edit it.

SarahBOA · ‎04-16-2014

We are experiencing a few issues with our windows forwarders and one of them sounds like it might be the same. We have this issue where we get splunk internal logs constantly, but monitored files are only sent on shutdown of the universal forwarder. This problem appears to be that the splunk forwarder was trying to "restart" too quickly. When we tried to restart the forwarder we received an error message that the process was taking too long - but it appeared stopped in the windows serverice listing so we started it up again. No error message was received on startup. We then received the internal logs as expected, but didn't receive the application log file we were monitoring. We then stopped the forwarder (received the error message again) and waited about 5 minutes. After 5 minutes we started the forwarder and both the splunk internal logs and the monitored log files were continuously coming through. It appears that the stop, pause for a longer time, then start appeared to fix this issue. This did not fix the issue where the splunkd logs only came through when the agent was stopped and the monitored logs never came through.

SarahBOA · ‎01-16-2014

We were using version 4.3.6, once we upgraded to 5.0.4 the rest point then returned insdie the GUI.

SarahBOA · ‎06-18-2013

Prior to upgrading to Splunk version 4.3.6, we were able to disable a particular app and then re-enable it without it requiring a restart. After the upgrade, we are now required to restart the splunk instance after disabling or enabling the app. Nothing in the app has changed between the last restart and the disabling, so why am I being required to restart the instance? We need to be able to re-enable the app without a restart. Thanks, Sarah

SarahBOA · ‎03-05-2013

I am getting the warning message "Unable to fetch REST endpoint '/services/search/jobs' from 'https://127.0.0.1:8089' " when running the following search in the search bar in the Splunk GUI: | rest /services/search/jobs. I know the endpoint exists because I can go to the page https://theserver:8089/services/search/jobs. The Jobs manager page using the link loads very slowly....takes about 1 minute to load, but does return. We have a distributed search environment and search head pooling as well.

SarahBOA · ‎01-17-2013

To solve the issue, I editted the fill_smmary_index.py file and removed the splunk_server=local from the dedup_search variable. That seems to have solved it and I am no longer getting duplicate records put into my index.

SarahBOA · ‎01-14-2013

We are trying to use the fill_summary_index.py script to backfill times when the data isn't populated. I am finding that the -dedup t option does not work and I am getting duplicate data in my summary index. My command: ./splunk cmd python fill_summary_index.py -app ecomm_splunk_administration -dedup t -name sumidx_webserver_count_1minute -et -11m@m -lt -4m@m -owner summaryadmin -index webserver_summary_fivemin -auth nbkgild:mypassword When I look at the output, I see the following: *** For saved search 'sumidx_webserver_count_1minute' *** Executing search to find existing data: 'search splunk_server=local index=webserver_summary_fivemin source="sumidx_webserver_count_1minute" | stats count by search_now' waiting for job sid = '1358203822.191' ... finished All scheduled times will be executed. *** Spawning a total of 6 searches (max 1 concurrent) *** The issue I see, is the search splunk_server=local. My splunk environment is a distributed server environment and therefore, my summary index is not on the local search head. How can I stop it from searching only the local server? and instead use the servers in the distributedsearch.conf file? Thanks, Sarah

SarahBOA · ‎01-02-2013

This app looks as though it would also get me what I need.

SarahBOA · ‎12-18-2012

I would like to get a table which has a column containing my views and then another column which contains the saved/in-line searches that are used in each view. I would like to be able to do the reverse as well; get a list of saved searches and see what views they are used in. I can get a list of the saved searches using the REST API, is there anyway to get the views? and if so, can I get the xml from the views? Is this something that I will need to write a bash script in order to do? Thanks, Sarah

SarahBOA · ‎12-12-2012

Hi - I have tried using both timechart and stats a combination of bucket and stats. I want to display the count of items before I display the time and in both of these cases, using the fields and the table commands to specify order does not work. If I change the column from _time to Time and use an strftime I can then display the count column first, but this causes and issue with the drill down. Is it possible to display the _time column NOT in the first column? Thanks, Sarah

SarahBOA · ‎12-06-2012

We are also looking for why this happens and how to make it stop. We are able to go in and clean out the vsid's from the savedsearches.conf file, but we have to do this over and over. When is this vsid created? Is it created when a user creates a panel by saving an existing search? Is there any way to block the message from appearing?

SarahBOA · ‎11-26-2012

The TextField is only pushed downstream when one of the Pulldowns above it is changed. So if we want to include the TextField value in our search, we have to enter the text and after the text has been entered, change one of the Pulldowns. We have tried using both the Splunk Submit button and Sideview Button. Working on posting anonymized code...same code can be found in this post though: http://splunk-base.splunk.com/answers/66080/sideview-pulldown-having-downstream-effect

SarahBOA · ‎11-21-2012

We are also experiencing this issue. The JSChart does not have the resize, but the FlashChart does. We are using Splunk4.3.3 Build 128297, have SideView Utils on each page, and experience this in both Firefox 16.0.2 and IE 7.0.5. None of our charts have the enableResize set on them (although I tried setting it to true and that did not work).

SarahBOA · ‎11-20-2012

It appears that my assumption in #2 is incorrect. The JobStatus module is running when the main search is running. The issue is that the main search is kicked off every time a Pulldown changes. Since each Pulldown that has a search behind it is reloaded, the main search is actually being run several times. So it is really another effect of issues #1.

SarahBOA · ‎11-20-2012

Interesting....so that is why I had to create the intentions again....will test out the adding of gimp and adding a second PostProcess.

SarahBOA · ‎11-20-2012

Yes, we could definitely use that! Then we could also send the user to a different view and not the flashtimeline, correct?

SarahBOA · ‎11-20-2012

I have switched both pages to SideViewUtils (replaced all of the ConvertToIntention modules) and am still experiencing this issue. I believe the difference to be that the postProcess is appended to the ConvertToDrillDown inside of the SimpleResultsTable, but not inside of the JSChart.

SarahBOA · ‎11-15-2012

I was unable to upload to pastebin (site is blocked for me), so I opened a new splunk-base question at: http://splunk-base.splunk.com/answers/66080/sideview-pulldown-having-downstream-effect Thanks!

SarahBOA · ‎11-15-2012

I have several Sideview Utils Pulldowns on my page. A few are filled by static options, one is filled by a HiddenSavedSearch and two are done using PostProcess. Each value that is chosen in the drill down is used within a search that populates a chart or grid. I have two behaviors going on that I would like to correct: Every change of a value on a pulldown causes all pulldowns whose values are filled using a search to reload (includes the pulldowns that run a saved search and the ones that are running post process). (e.g., with code below: if I change the selected value on my Category Pulldown, the Application Sub-Application and Pipeline pulldowns are reloaded as well). Every load or reload of a drop down list causes the job status module to show the search running. I only want the job status module to run when the submit button is clicked and the final search, which uses the pulldown values, is run. (e.g., with code below, when the search that populates the Application pulldown runs, it shows as running in the JobStatus module as well) Thanks, Sarah <view autoCancelInterval="120" isPersistable="true" isSticky="true" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="false" template="dashboard.html"> <label>OS Category</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="SideviewUtils" layoutPanel="appHeader"/>  <module name="StaticContentSample" layoutPanel="viewHeader"> <param name="text"><h2>OS Category</h2></param> </module> <module name="Pulldown" layoutPanel="mainSearchControls"> <param name="name">CATEGORY</param> <param name="label">Category</param> <param name="float">left</param> <param name="staticOptions"> <list><param name="label">*</param><param name="value">*</param></list> <list><param name="label">CRITICAL</param><param name="value">CRITICAL</param></list> <list><param name="label">ERROR</param><param name="value">ERROR</param></list> </param> <module name="Pulldown"> <param name="name">DATACENTER</param> <param name="label">Location</param> <param name="float">left</param> <param name="staticOptions"> <list><param name="label">*</param><param name="value">*</param></list> <list><param name="label">AZ</param><param name="value">AZ</param></list> <list><param name="label">NJ</param><param name="value">CA</param></list> </param> <module name="Pulldown"> <param name="name">POD</param> <param name="label">Pod</param> <param name="float">left</param> <param name="staticOptions"> <list><param name="label">*</param><param name="value">*</param></list> <list><param name="label">POD1</param><param name="value">POD1</param></list> <list><param name="label">POD2</param><param name="value">POD2</param></list> </param> <module name="Pulldown"> <param name="name">SLICE</param> <param name="label">Slice</param> <param name="float">left</param> <param name="staticOptions"> <list><param name="label">*</param><param name="value">*</param></list> <list><param name="label">SLICE1</param><param name="value">SLICE1</param></list> <list><param name="label">SLICE2</param><param name="value">SLICE2</param></list> <list><param name="label">SLICE3</param><param name="value">SLICE3</param></list> <list><param name="label">SLICE4</param><param name="value">SLICE4</param></list> </param> <module name="Pulldown"> <param name="name">PLATFORM</param> <param name="label">Platform</param> <param name="float">left</param> <param name="staticOptions"> <list><param name="label">*</param><param name="value">*</param></list> <list><param name="label">Windows</param><param name="value">Borneo</param></list> <list><param name="label">Linux</param><param name="value">NGEN</param></list> <list><param name="label">Mac</param><param name="value">NextGen</param></list> </param> <module name="HiddenSavedSearch" layoutPanel="mainSearchControls" autoRun="true"> <param name="savedSearch">get_errvol_applications</param> <module name="Pulldown"> <param name="name">APP</param> <param name="label">Application</param> <param name="float">left</param> <param name="staticFieldsToDisplay"></param> <param name="postProcess">search PLATFORM="$PLATFORM$" | fields APP | dedup APP | eval temp=lower(APP) | appendpipe [ head 1 | eval APP="*" | eval temp="*"] | sort temp | fields APP </param> <param name="valueField">$name$</param> <module name="Pulldown"> <param name="name">PIPELINE</param> <param name="label">Pipeline</param> <param name="float">left</param> <param name="staticFieldsToDisplay"></param> <param name="postProcess">search PLATFORM="$PLATFORM$"APP=$APP$ | fields PIPELINE | dedup PIPELINE | appendpipe [ head 1 | eval PIPELINE="*" ]| sort PIPELINE</param> <param name="valueField">$name$</param> <module name="HiddenSavedSearch" layoutPanel="mainSearchControls"> <param name="savedSearch">get_errvol_subapps</param> <module name="Pulldown"> <param name="name">SUBAPP</param> <param name="label">Sub-Application</param> <param name="float">left</param> <param name="staticFieldsToDisplay"></param> <param name="searchFieldsToDisplay"> <list> <param name="label">SUBAPP</param> <param name="value">SUBAPP</param> </list> </param> <module name="Pulldown" layoutPanel="mainSearchControls"> <param name="name">OPTION</param> <param name="label">Options</param> <param name="float">left</param> <param name="staticOptions"> <list><param name="label">Office</param><param name="value">OFFICE</param></list> <list><param name="label">Host</param><param name="value">orig_host</param></list> <list><param name="label">Module</param><param name="value">MODULE</param></list> <list><param name="label">Message Description</param><param name="value">MSG_DESC_SHORT</param></list> </param> <module name="TextField" layoutPanel="mainSearchControls"> <param name="name">OPTVALUE</param> <param name="float">left</param> <param name="label">Value</param> <module name="AutoRefresh"> <param name="invervalInSeconds">300</param> <module name="TimeRangePicker" layoutPanel="mainSearchControls"> <param name="searchWhenChanged">False</param> <param name="selected">Last 15 Minutes</param> <module name="Button"> <param name="allowSoftSubmit">False</param> <param name="allowAutoSubmit">False</param> <param name="label">Submit</param> <module name="Search"> <param name="search">index=summary_fivemin report="1min_OS" $OPTION$=$OPTVALUE$* NOT CATEGORY="----" APP=$APP$ PLATFORM="$PLATFORM$" DATACENTER=$DATACENTER$ CATEGORY=$CATEGORY$ PIPELINE=$PIPELINE$ SUBAPP=$SUBAPP$ | eval orig_host=mvindex(split(orig_host, "."), 0) | lookup environment SERVERNAME as orig_host OUTPUT POD, SLICE | search POD=$POD$ SLICE=$SLICE$ | stats sum(count) as COUNT, CATEGORY APP MSG_DESC_SHORT | table COUNT CATEGORY APP MSG_DESC_SHORT</param> <module name="JobStatus"> <param name="resultsLink"> <param name="popup">True</param> <param name="viewTarget">report_builder_define_data</param> <param name="transformedResultsViewTarget">report_builder_format_report</param> </param> <module name="Paginator" layoutPanel="panel_row2_col1"> <param name="entityName">results</param> <module name="SimpleResultsTable" layoutPanel="panel_row2_col1"> <param name="fields">COUNT, CATEGORY, APP, MSG_DESC_SHORT</param> <param name="entityName">results</param> <param name="drilldown">row</param> <module name="Search"> <param name="search">`olIndex` sourcetype=app_list | lookup errvol_modules COMPONENT_NAME OUTPUT MODULE | fields - eventtype | eval orig_host=host | fillnull value="----" PLATFORM APP CATEGORY DATACENTER PIPELINE JVM COMPONENT_NAME SUBAPP MODULE | eval MSG_DESC_SHORT=if(len(MSG_DESC)>99,substr(MSG_DESC,1,100)+"...",MSG_DESC) | search $OPTION$=$OPTVALUE$* PLATFORM=$PLATFORM$ DATACENTER=$DATACENTER$ SUBAPP=$SUBAPP$ PIPELINE=$PIPELINE$ POD=$POD$ SLICE=$SLICE$ APP=$click.fields.APP$ CATEGORY=$click.fields.CATEGORY$ MSG_DESC_SHORT="$click.fields.MSG_DESC_SHORT$"</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </view>

SarahBOA · ‎11-08-2012

Not quite sure either of those will work: 1. Downstream - Issue is that I need the values from the pulldowns in the main search. So if my understanding of upstream/downstream is correct, I have to have the main search downstream of the pulldowns (using SV Search module) and then the JobStatus downstream of the search...which means it will always be downstream of the pulldowns as well and will show their loading searches. 2. Using SearchControls - one of the pieces of the JobStatus module that I want to see is the progress indicator so the user knows when the search starts and completes.

SarahBOA · ‎11-07-2012

This worked wonderfully to stop the AutoSubmit issues! I will add a secondary issue though; my JobStatus module still shows the loading of my pulldowns. So I see it go back and forth between 0% and 100% several times (and no results populate the table as I have the AutoSubmitturned off so the final search isn't run). Is there anyway to make the jobstatus module only run when the Button is pressed? I have AutoRun="true" on the first pulldown, then several more pulldowns and textfields then I have a timePicker with Button, then Search, then JobStatus module all nested.

SarahBOA · ‎10-15-2012

eventtype won't work unfortunately. Due to permissions on the splunk instance and server etc, we need to be able to pull the list (which will be changed by non-splunk admin users) in from a csv file.

Posts	25
Solutions	2
Karma Given	7
Karma Received	14
Member Since	‎10-12-2012

Online Status	Offline
Date Last Visited	‎06-15-2021 06:00 PM

Restart required when disabling/enabling app

Unable to fetch REST endpoint

fill_summary_index dedup issue

List of saved/in-line searches within a view

Move _time column

Sideview Pulldown having Downstream effect

Re: How to set a new pass4SymmKey password on a se...

Re: how can i list all indexes and sourcetypes?!

Re: How to validate or prove that disabling THP im...

Re: default.xml permission

Re: Why does forwarding stop until i restart splun...

Re: Unable to fetch REST endpoint

Restart required when disabling/enabling app

Unable to fetch REST endpoint

Re: fill_summary_index dedup issue

fill_summary_index dedup issue

Re: List of saved/in-line searches within a view

List of saved/in-line searches within a view

Move _time column

Re: Unable to get viewstate information

Re: issue in TextField

Re: Why am i not able to resize my jschart in my D...

Re: Sideview Pulldown having Downstream effect

Re: HiddenPost Process appended to ConvertToDrillD...

Re: HiddenPost Process appended to ConvertToDrillD...

Re: HiddenPost Process appended to ConvertToDrillD...

Re: Override downstream autoRun?

Sideview Pulldown having Downstream effect

Re: Override downstream autoRun?

Re: Override downstream autoRun?

Re: Search set of strings from lookup and list cou...

Are you a member of the Splunk Community?