Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About GaryChan1
GaryChan1
Engager
Member since:
02-24-2018
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 02-24-2018 |
Activity Feed
- Karma Re: Adding more rows in the trellis single-value colored format for tomasmoser. 06-05-2020 12:49 AM
- Posted Re: Index over-consumption of Disk on Deployment Architecture. 11-04-2019 08:53 PM
- Posted Re: Index over-consumption of Disk on Deployment Architecture. 10-24-2019 05:30 PM
- Posted Index over-consumption of Disk on Deployment Architecture. 10-23-2019 11:36 PM
- Tagged Index over-consumption of Disk on Deployment Architecture. 10-23-2019 11:36 PM
- Posted Re: How to add the logs of EMC unity storage to splunk? on Deployment Architecture. 08-01-2018 10:06 PM
- Posted Re: Adding more rows in the trellis single-value colored format on All Apps and Add-ons. 07-31-2018 01:12 AM
- Posted Re: Why are the time stamps on email alerts incorrect in the web GUI? on Alerting. 03-12-2018 03:57 AM
- Posted Re: Why are the time stamps on email alerts incorrect in the web GUI? on Alerting. 03-11-2018 11:04 PM
- Posted Why are the time stamps on email alerts incorrect in the web GUI? on Alerting. 02-24-2018 03:14 PM
- Tagged Why are the time stamps on email alerts incorrect in the web GUI? on Alerting. 02-24-2018 03:14 PM
- Tagged Why are the time stamps on email alerts incorrect in the web GUI? on Alerting. 02-24-2018 03:14 PM
- Tagged Why are the time stamps on email alerts incorrect in the web GUI? on Alerting. 02-24-2018 03:14 PM
- Tagged Why are the time stamps on email alerts incorrect in the web GUI? on Alerting. 02-24-2018 03:14 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
11-04-2019
08:53 PM
Thank you. It took a little while but I've reclaimed some of my disk space now.
Gary
... View more
10-24-2019
05:30 PM
Hi broberg,
I think wineventlog and windows are the default indexes created by the Splunk_TA_Windows addon. The indexes.conf only contains the following:
[windows]
homePath = $SPLUNK_DB/windows/db
coldPath = $SPLUNK_DB/windows/colddb
thawedPath = $SPLUNK_DB/windows/thaweddb
[wineventlog]
homePath = $SPLUNK_DB/wineventlog/db
coldPath = $SPLUNK_DB/wineventlog/colddb
thawedPath = $SPLUNK_DB/wineventlog/thaweddb
[perfmon]
homePath = $SPLUNK_DB/perfmon/db
coldPath = $SPLUNK_DB/perfmon/colddb
thawedPath = $SPLUNK_DB/perfmon/thaweddb
Via settings > indexes, I have the following configured:
windows index: https://imgur.com/NqaO8vr
wineventlog index: https://imgur.com/ZuKj6aZ
... View more
10-23-2019
11:36 PM
Hi all,
I noticed my Splunk instance wasn't indexing data this afternoon. I looked at the server and one of the disks that hosts some of my indexes was full.
I looked at the individual size of each index on disk and two of them are consuming disk space far in excess of the limits that I have set on the index properties.
Index : wineventlog
Max size: 200 GB
Max bucket size: 10000 MB
Current Size: 199.25 GB
Size of index on disk: 430 GB
Index : windows
Max size: 200 GB
Max bucket size: 10000 MB
Current Size: 75.65 GB
Size of index on disk: 231 GB
As a temporary fix I've increased the size of the VHD (the instance is virtualized) but ideally I'd like to reduce the size of the data on disk. Any pointers on how I should tackle this?
Thanks
Gary
... View more
- Tags:
- splunk-enterprise
08-01-2018
10:06 PM
Hi @ahmedzard - did you end up working this out? I'm looking to do the same.
... View more
07-31-2018
01:12 AM
Hey @I868162 - did you find a way to add more than 20 per page in the end?
... View more
03-12-2018
03:57 AM
This is the props.conf for the Splunk_TA_windows app:
https://pastebin.com/9m0rnE8U
I just realised I made an absolute mess of the title on this post. For clarification, timezone in web GUI is correct. The same search configured as an alert that is sent via email has the timezone offset.
... View more
03-11-2018
11:04 PM
Is that located in $SPLUNK_HOME/etc/system/local/ normally? If so, I don't have one.
... View more
02-24-2018
03:14 PM
Hi,
When I do a search in the web GUI, the time stamps on the results are correct. If I save that search as and set up an email alert for it, the time stamps in the table on the email are incorrect. They are offset by 10.5 hours, which is the same as my timezone (+10.5).
I've asked this question on a different forum and one suggestion was to check to timezone settings for the user that owns the searches (in the web GUI). I have checked this and can confirm that it is correct.
Is there somewhere else I should be looking?
Thanks,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
