About ypeng_splunk

ypeng_splunk · ‎11-11-2019

MC showed the major cause was ChillOrFreeze in indexer. But, the total data stored in smartstore was way below the maxGlobalDataSizeMB.

ypeng_splunk · ‎11-11-2019

Hi David, this is a great session. Today, one Splunk instance identified some issues with smartstore on top of on-prem object storage. It worked normal since smartstore was enabled several months ago. Most of the time, the indexing rate per indexer is about 8-10MB/s. But, while there was a spike (not sure how much yet), indexer processor was stuck and consuming 100% CPU on indexer. All pipelines were blocked and couldn't be recovered. Indexing rate dropped to 2MB/s. They restarted the indexer. It went back to normal with index rate of 16MB/s. Around 20min before the congestion, Some errors like "DatabaseDirectoryManager - failed to open bucket/waif for bucket to be local through CacheManager" started to be reported by indexer. Their hot buckets are on SSD without RAID. Any thought on this case?

ypeng_splunk · ‎01-07-2019

I remember it was alright when I did the same based on v7.2.0 weeks ago. Today, I got the same issue reported by one of my friends for v7.2.3. Just add more info here. I will built a docker cluster soon to see what's going on.

ypeng_splunk · ‎01-07-2019

Any solution from the ticket?

ypeng_splunk · ‎08-03-2018

Sample log below: Successful example: 2018-08-03 08:06:42 10.200.11.15 POST /owa/auth.owa &ClientId=72385290B62F418BBC3DCD378E57E295&CorrelationID=;&cafeReqId=6f706bbd-5b80-4ae3-905f-0f7c664a8bdd;&encoding=; 443 aaa@thecompany.com 192.168.0.33 Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/67.0.3396.99+Safari/537.36 https://mail.thecompany.com/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fmail.thecompany.com%2fowa%2f%23authRedirect%3dtrue 302 0 0 31 10.200.11.222 Failed example 2018-08-03 08:05:49 POST /owa/auth.owa &ClientId=9C05E320E354474888FB8B127316369F&CorrelationID=;&cafeReqId=3a08858c-7442-4740-9dfa-01606bf56ddd;&encoding=; 443 aaa@thecompany.com 192.168.0.33 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:61.0)+Gecko/20100101+Firefox/61.0 https://mail.thecompany.com/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fmail.thecompany.com%2fowa%2f%23authRedirect%3dtrue 302 0 0 27 10.200.11.233 Advanced logging is enabled on exchange as the mail servers are behind a F5. X-Forwarded-For is configured to pass the clientip. It looks some logs don't have the s_ip fields. Not sure why? Instead of tuning the field extraction right away, I believe there should have some easier way to do the adaption. Any comments are welcome. Thanks.

ypeng_splunk · ‎03-07-2018

then post the search.

ypeng_splunk · ‎03-07-2018

Pls post the savedsearches.conf

ypeng_splunk · ‎03-07-2018

Hey folks, I am doing some regex stuff by rex command and find some tricky behavior. Error: I tried to use \ to escape the backslash in three places. Not sure which one doesn't work. But, this regex works on regex101. OK, let's try some other ways in the search to make it accepted by my Splunk as below: This time, it works perfectly. Here is the confusing point. Why does "\" work at the beginning, but doesn't work for the second and third backslash. \x5c can be a good replacement. But, why "\\" works to escape single \ ? Any idea is appreciated.

Posts	8
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎03-07-2018

Online Status	Offline
Date Last Visited	‎12-02-2020 03:45 AM

field extraction mismatch when doing IIS log from ...

Tricky behavior of escaping backslash in regex

Re: SmartStore Behaviors

Re: SmartStore Behaviors

Re: Monitoring Console (MC) not recognizing Search...

Re: Monitoring Console (MC) not recognizing Search...

field extraction mismatch when doing IIS log from ...

Re: cron schedule on past 7 days search

Re: cron schedule on past 7 days search

Tricky behavior of escaping backslash in regex