Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About TONYBYERS
TONYBYERS
Path Finder
Member since:
05-15-2013
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 7 |
| Member Since | 05-15-2013 |
Activity Feed
- Got Karma for Getting the timezone from the operating system for a universal forwarder. 06-05-2020 12:47 AM
- Got Karma for Re: Getting the timezone from the operating system for a universal forwarder. 06-05-2020 12:47 AM
- Got Karma for Upgrading a univeral forwarder to a heavy weight forwarder. 06-05-2020 12:46 AM
- Got Karma for Re: db-connect 1.1 not forwarding data. 06-05-2020 12:46 AM
- Got Karma for Clustering and reassigning primaries issue. 06-05-2020 12:46 AM
- Got Karma for Splunk On Splunk - Give access to the License Usage views to non-admin users. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk On Splunk - Give access to the License Usage views to non-admin users. 06-05-2020 12:46 AM
- Posted Re: Getting the timezone from the operating system for a universal forwarder on Getting Data In. 12-19-2014 11:47 AM
- Posted Re: Getting the timezone from the operating system for a universal forwarder on Getting Data In. 12-16-2014 11:48 AM
- Posted Re: Getting the timezone from the operating system for a universal forwarder on Getting Data In. 12-15-2014 06:52 AM
- Posted Re: Getting the timezone from the operating system for a universal forwarder on Getting Data In. 12-12-2014 11:52 AM
- Posted Getting the timezone from the operating system for a universal forwarder on Getting Data In. 12-11-2014 08:17 AM
- Tagged Getting the timezone from the operating system for a universal forwarder on Getting Data In. 12-11-2014 08:17 AM
- Tagged Getting the timezone from the operating system for a universal forwarder on Getting Data In. 12-11-2014 08:17 AM
- Posted Re: Splunk On Splunk - Give access to the License Usage views to non-admin users on All Apps and Add-ons. 05-21-2014 06:36 AM
- Posted Re: Splunk On Splunk - Give access to the License Usage views to non-admin users on All Apps and Add-ons. 05-20-2014 12:50 PM
- Posted Splunk On Splunk - Give access to the License Usage views to non-admin users on All Apps and Add-ons. 05-20-2014 07:51 AM
- Tagged Splunk On Splunk - Give access to the License Usage views to non-admin users on All Apps and Add-ons. 05-20-2014 07:51 AM
- Tagged Splunk On Splunk - Give access to the License Usage views to non-admin users on All Apps and Add-ons. 05-20-2014 07:51 AM
- Posted Re: Clustering and reassigning primaries issue on Deployment Architecture. 12-11-2013 03:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 |
12-19-2014
11:47 AM
Thanks once again for your help - the problem turned out to be user error - in other words, I hadn't read the documentation correctly and had misconfigured props.conf
... View more
12-16-2014
11:48 AM
I am getting very odd behaviour here and it is more complex that I originally thought. What I am going to do is open a case with Splunk support - even though I believe you work for Splunk, I need this tracked. Thanks for reaching out to me and trying to fix it. Tony
... View more
12-15-2014
06:52 AM
1 Karma
I saw that in the documentation but I don't think it works that way. If there is no timezone information in the event and nothing in the props.conf on the forwarder then there will be no timezone information sent from the forwarder. If there was then the last statement in the documentation would be redundant "Splunk Enterprise uses the time zone of the server that indexes the event. ". Or I am misreading the documentation?
Thanks
... View more
12-12-2014
11:52 AM
Thanks. I was hoping the that I could get the timezone information from the OS so I do not have to have a specific build for each timezone
... View more
12-11-2014
08:17 AM
1 Karma
Some log events do not have timezone information in it so I need to set the timezone in the props.conf on the forwarder. This works fine however we have many universal forwarders in multiple timezone and it would be useful to have one standard build. Is it possible to get the forwarder to get the timezone information from the underlying OS?
... View more
05-21-2014
06:36 AM
1 Karma
I've got it working by adding the following capabilities to the role.
license_tab
license_edit
... View more
05-20-2014
12:50 PM
I tried that before and it didn't work. I've just tried it again to make sure and I get the same lack of data.
... View more
05-20-2014
07:51 AM
1 Karma
I am trying to create a non-admin user to be able to use SoS, specifically the license usage. SoS in installed in the search head where the license manager resides. I have created a role with access to _internal and _audit and that role also has read and write to the SoS and SideViews. It inherits from the 'users' role.
The user just gets "no results found" on the dashboard. If I give inherit admin and power users roles it works however I want to give minimum permissions. I am sure I'm missing a capability somewhere but I can't seem to work out which one.
I can see these being imported in to the role:
change_own_password
get_metadata
get_typeahead
input_file
list_inputs
output_file
request_remote_tok
rest_apps_view
rest_properties_get
rest_properties_set
schedule_rtsearch
search
Any ideas ?
Splunk : 6.0.3
SoS : 3.1.0
SideViews: 3.2.2
Thanks
... View more
12-11-2013
03:06 PM
Steve,
Thanks for your help. Any reason to upgrade to 6!
... View more
12-10-2013
01:09 PM
Thanks Steve,
That looks like it a new feature on 6.0 and is exactly what we need. Howver we are on 5.0.5, do you know of a workaround for 5.0.5?
Cheers
Tony
... View more
12-05-2013
12:57 PM
Splunk 5.0.5 by the way.
... View more
12-05-2013
12:51 PM
1 Karma
We have 2 peers that each forwarder load balances between so there is roughly 50% of the primary data on each one. The load on the peers is thus evenly spread. The replciation factor of 2 so each peer works as a back up for the other.
Doing a search I can see that split on the "splunk server" field is roughly 50 - 50 which is exactly what I want to see.
During routine maintenance one of the peers is brought offline (splunk offline command) . While it is down the primaries are reassigned to the other peer as you would expect. Looking at "splunk server" from a search I can see 100% of the data on the remaining peer so the resilancy works. The problem is that when the peer is brought back online there is still 100% of the primary data on peer that was left up. This means that one peer is getting hammered while the other does nothing. Is there any way to force splunk to reassign 50% of the primaries back to the peer that was down? I am aware that the data is on the peer but it is now a replicate and does not participate in the searches.
... View more
11-08-2013
09:22 AM
Thanks Stefan.
... View more
11-07-2013
03:42 PM
What is the best way to remove an index from a clustered environment?
On our DEV env I have removed it from indexes.conf on master and done an 'apply'. So it has disappeared from the cluster dashboard and from the indexes dashboard on the peers however the index directory structure is still there on the peers. Can I just delete them ( rm -rf ) or do I need to do anything else?
Splunk version is 5.0.2 and 5.0.5
Thanks
... View more
11-06-2013
08:13 AM
1 Karma
I've figured out what has happened. The input.conf for dbx had been changed and the monitoring of the spool directory removed. Added this back in, restarted the forwarder and data is being sent. The solution is always right in front of your eyes.
[batch://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt =
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool
... View more
11-06-2013
07:07 AM
I have a problem with db-connect not forwarding data from a heavyweight forwarder. From dbx.log:
2013-11-06 08:23:12.489 dbx9169:INFO:TailDatabaseMonitor - Processed count=240000 results...
2013-11-06 08:23:12.502 dbx9169:INFO:TailDatabaseMonitor - Processed count=241000 results...
2013-11-06 08:23:12.520 dbx9169:INFO:SpoolOutputChannel - Moving temporary file /opt/splunk/heavyforwarder/splunk/var/run/tmp/dbx/kv_4356646782255266682.dbmonevt with size=2328610 to destination /opt/splunk/heavyforwarder/splunk/var/spool/dbmon/kv_1383747792520965798.dbmonevt
For some reason data is not being sent from the spool directory and it just remains there. outputs.conf is correct and I can see dbx.log and splunkd.log from the search head so it is sending data ok. The index being used for dbx exists on the peers. There are no error in any log. So now I'm stuck. Any ideas?
... View more
- Tags:
- dbx
09-19-2013
06:08 AM
1 Karma
I need to upgrade a forwarder from a universal to a heavy weight one. Now I could just blow away my instance and start again however that would mean that all the data from the files would be resent. I don't want to change the inputs.conf with followTail as these are not under my control. So could just copy my old fish bucket to the new installation and it would work?
... View more
- Tags:
- forwarder
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
