About vcarbona

vcarbona · ‎09-23-2021

I have SAI 2.0.2 installed on my SHC and the SAI Addon on the indexer cluster. Went ahead and installed the full IT Essentials on the SHC and installed the SA_IndexCreation on the indexer cluster per the instructions. So far I only see 2 entities in IT Essentials. The ironic thing is that SAI app is showing much more. Anything I missed? Perhaps SAI and IT Essentials for Work apps are in conflict with one another?

goranmpsi · ‎10-15-2020

Did you ever find out why is this happening? I have the same issue.

vcarbona · ‎10-14-2019

I'd like to leverage collectd to gather not just metrics for SAI but also statsd data from custom apps. I'm using the write_splunk plugin to write SAI metrics using a UF UDP port. The problem comes in where I would also like to accept UDP data from the statsd collectd plugin and also send that data into the UF via UDP but route to another index. I basically am looking for a good way to not populate both SAI data and custom app metrics into the same em_metrics index.

rmmiller · ‎11-19-2019

coalesce is for dealing with null values when you have to deal with them. Also, like is for SQL-like comparisons, which you aren't really doing here. CloudTrail inputs can be a little tricky. Are you sure they are being ingested correctly?

vcarbona · ‎04-30-2019

Wouldn't this only work if the user manually specified the index name in the search query? Users would have to specify it if the index were only allowed and not the default.

jatin_patel · ‎01-14-2019

Hi Damien, Optionally set your JAVA_HOME environment variable to the root directory of your JRE installation.If you don't set this , the input will look for a default installed java executable on the path. where is the default path "the input will look for a default installed java executable on the path"? -Jatin

MuS · ‎07-28-2015

Okay another lesson learned; the [tcp://0.0.0.0:9999] will not work it has to be set to an IP and then it works. Using [tcp://192.168.56.101:9999] and telnet to 192.168.56.101 port 9999 sending a foo I can see the event in the main index.

lakromani · ‎06-04-2019

Does not work. wrong lable , correct label . | rest /services/licenser/slaves | table label, updated

vcarbona · ‎05-04-2015

We've done a few things since then to control this issue: 1) Set our ulimit to 10240 on all indexers (But this didn't in itself resolve the problem yet helped out with the load) 2) We've also added the following line to the offending forwarder's outputs.conf under the [tcpout] stanza and restarted the forwarder: forceTimebasedAutoLB = true This latter solution has helped out tremendously so far in forcing data to be load balanced. It appears the default behavior is to stream it to one indexer until the "batch" of data is done. The setting appears to force it to another indexer. Thanks for asking by the way! Almost forgot I posted the question awhile back 🙂

vcarbona · ‎07-08-2014

Actually "ignored file (crc conflict, needs crcSalt)" does appear, it just has a different error. I run it as "index=_internal component=TailingProcessor ERROR salt". It shows up as an ERROR alert level. The "File did not match whitelist ..." appears when I set TailingProcessor to DEBUG level.

bravon · ‎12-08-2014

showZeroValue = 1 http://blogs.splunk.com/2013/10/28/new-features-for-perfmon-in-splunk-6/

esalesapns2 · ‎11-13-2019

I'm having the same issue in 7.3.2. System is logging in US/Eastern, Splunk is UTC. My props is based on source. Applied it on HF, and Indexer, no change to time setting.

hazekamp · ‎05-26-2011

vcarbona, You are correct in that summary indexes typically contain aggregated data and not actual events. If you desire a smaller subset of actual events consider creating an index to route specific events based on some criteria. I would not recommend changing any of the default behavior for the stash sourcetype as this is likely to have adverse affects.

aalbaker · ‎05-17-2019

i'm new to splunk i'm having the same issue above , i have tried [sqlserver_errorlog] CHARSET = UTF-16LE NO_BINARY_CHECK = true on my UF and indexer with no luck. however, i think i might updating wrong props.conf what is the right path for props.conf on both UF and indexer please. Thank you in advance

skender27 · ‎10-06-2015

Hi, here what I did for 6.1 version: first copy your my_logo.png in this folder: /opt/splunk/share/splunk/search_mrsparkle/exposed/img/skins/default then create (if it doesn't exist) web.conf under: etc/system/local with this stanza: [settings] updateCheckerBaseURL = 0 login_content = basically you can put any html syntax here. hope it works for all you, Skender K.

Stephen_Sorkin · ‎08-08-2010

A quick workaround in 4.1.x is to add the flag "-count 0" which will allow up to a -maxout of 50000.

Posts	30
Solutions	4
Karma Given	27
Karma Received	24
Member Since	‎08-06-2010

Online Status	Offline
Date Last Visited	‎07-29-2022 11:52 AM

Installed IT Essentials for Work: Not seeing all e...

Getting weird search error in SAI 2.0: The search ...

Can write_splunk collectd plugin be configured to ...

Still seeing connection_host typos on universal fo...

Indexer recv-q high and certain sources lagging. H...

TailingProcessor File Status without port 8089?

Summary index syslog events doing line merge

Remote and Local CLI search only returns 100 event...

Installed IT Essentials for Work: Not seeing all e...

Re: Getting weird search error in SAI 2.0: The sea...

Can write_splunk collectd plugin be configured to ...

Re: AWS Failed logins and coalesce command

Re: Is it possible to search and identify the top ...

Re: Does the JDK vendor matter for Kafta modular i...

Re: Still seeing connection_host typos on universa...

Re: License Master - Is there an internal query or...

Re: Indexer recv-q high and certain sources laggin...

Re: TailingProcessor File Status without port 8089...

Re: Perfmon and zero value data

Re: TZ offset in props.conf not working

Re: Summary index syslog events doing line merge

Re: SQL Server ERRORLOG

Re: Change Logo on Login Screen

Re: Remote and Local CLI search only returns 100 e...

Join the Conversation