Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About preotesoiu
preotesoiu
Path Finder
Member since:
02-01-2016
06-29-2022
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 02-01-2016 |
Activity Feed
- Got Karma for Re: How to add colour feature in dashboard which the value is in the time format. 06-29-2022 10:45 PM
- Posted Re: Is there a way to export a CSV file that contains a header row even if there is no results from search? on Splunk Dev. 06-28-2022 11:36 AM
- Posted Re: Is there a way to export a CSV file that contains a header row even if there is no results from search? on Splunk Dev. 06-28-2022 10:13 AM
- Posted Re: How to add colour feature in dashboard which the value is in the time format on Splunk Enterprise. 06-28-2022 09:48 AM
- Got Karma for Rolling cold data to tape. 06-05-2020 12:48 AM
- Posted Re: How do you detect a Universal Forwarder (UF) vs Enterprise from CLI? on Getting Data In. 11-01-2018 01:56 PM
- Posted Re: Error Connecting to HTTP Event Collector on Getting Data In. 10-31-2017 01:14 PM
- Posted Re: Error Connecting to HTTP Event Collector on Getting Data In. 10-31-2017 01:10 PM
- Posted Re: What search can I use to identify logs with future timestamps? on Getting Data In. 08-21-2017 05:07 PM
- Posted Re: How can I see the total GB used for each server by sourceype? on Splunk Search. 08-21-2017 04:52 PM
- Posted Re: How to calculate the license usage for specific sourcetype on Splunk Search. 08-21-2017 08:54 AM
- Posted Search to show license usage at heavy forwarder level on Getting Data In. 08-08-2017 11:19 AM
- Tagged Search to show license usage at heavy forwarder level on Getting Data In. 08-08-2017 11:19 AM
- Tagged Search to show license usage at heavy forwarder level on Getting Data In. 08-08-2017 11:19 AM
- Tagged Search to show license usage at heavy forwarder level on Getting Data In. 08-08-2017 11:19 AM
- Posted Re: Rolling cold data to tape on Getting Data In. 07-28-2017 01:01 PM
- Posted Re: Rolling cold data to tape on Getting Data In. 07-27-2017 06:29 PM
- Posted Rolling cold data to tape on Getting Data In. 07-27-2017 05:35 PM
- Tagged Rolling cold data to tape on Getting Data In. 07-27-2017 05:35 PM
- Tagged Rolling cold data to tape on Getting Data In. 07-27-2017 05:35 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 |
06-28-2022
11:36 AM
can't test in my env right now, but look into adding some conditions to the append that are true only if the search before the append returns null values. I think this way you might eliminate the row. Not sure about the field names, I think you might need to know them in advance. Perhaps leverage a lookup table and foreach command... just some ideas...
... View more
06-28-2022
10:13 AM
have not tried it but look into using | append [makeresults | eval "header_field"=header_field, ....]
... View more
06-28-2022
09:48 AM
1 Karma
you have to edit the xml, see below as example, adjust the colours as need it <dashboard theme="dark"> <label>test collor pallete</label> <row> <panel> <table> <search> <query>| makeresults | eval result1="-100", result2 = "23"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <format type="color" field="result1"> <colorPalette type="expression">if(like(value,"%-%"),"#65A637", "#FF0000")</colorPalette> </format> <format type="color" field="result2"> <colorPalette type="expression">if(like(value,"%-%"),"#65A637", "#FF0000")</colorPalette> </format> </table> </panel> </row> </dashboard>
... View more
11-01-2018
01:56 PM
Hello,
Splunk Enterprise is installed in a folder called "splunk" while Splunk universal forwarder is installed into a folder called "splunkforwarder".
Also running "splunk version" command should return the correct response. In my case, this is the response I get when running "version" command:
$ /opt/splunkforwarder/bin/splunk version
Splunk Universal Forwarder 7.1.4 (build 5a7a840afcb3)
hope it helps
... View more
10-31-2017
01:14 PM
also I believe the path is a bit different for splunk cloud:
When creating requests to Splunk Cloud, you must add a prefix to the URI of the hostname according to your subscription. For self-service Splunk Cloud plans, pre-pend the hostname with input-. For all other Splunk Cloud plans, pre-pend the hostname with http-inputs-. In the previous example, the cURL statement would look like the following for self-service Splunk Cloud instances:
curl -k https://input-:8088/services/collector -H 'Authorization: Splunk ' -d '{"event":"Hello, World!"}'
And for all other Splunk Cloud instances:
curl -k https://http-inputs-:8088/services/collector -H 'Authorization: Splunk ' -d '{"event":"Hello, World!"}'
... View more
10-31-2017
01:10 PM
your curl command must contain the hostname or IP address
curl -k https://yourhostname:8088/services/collector ...
or perhaps you can try below curl command:
curl -k -u "userID:TOKEN" "https://your_server_name:8088/services/collector/event" -d '{"event": "Hello, world!"}'
if works well you would see below response
{"text":"Success","code":0}
... View more
08-21-2017
05:07 PM
You can deploy meta_woot app and one of the capabilities of this app is to identify host with future time stamps. Have a look at the app, might help with what you need.
... View more
08-21-2017
04:52 PM
I believe you will need to look into the interesting fields generated when running index=_internal source=*license_usage.log type=Usage and if not mistaken you will find a field called st that refers to the original source type.
... View more
08-21-2017
08:54 AM
this search could perhaps do the trick as well:
index=_internal source=*license_usage.log type=Usage h=yourhost | stats sum(b) AS bytes by st | eval MB= round(bytes/1024/1024,3) | fields st MB | rename st as Sourcetype | sort -MB
... View more
08-08-2017
11:19 AM
Hello,
I have a search similar with below which provide a total of 2868 GB usage for last 24 hrs.
index=_internal source=*license_usage.log type=Usage splunk_server=indexer_server* | stats sum(b) AS bytes by splunk_server | eval GB= round(bytes/1024/1024/1024,3) | fields splunk_server GB | rename splunk_server as host | sort -GB | addtotals row=f col=t labelfield="Total Indexed GB"
Also, I have such search for calculating thruput for HF and it has a total of 75.4 GB for last 24 hrs.
index="_internal" source="*metrics.log" group=per_host_thruput series=heavy_forwarder_server* | stats sum(kb) AS kb by series | eval GB= round(kb/1024/1024,3) | fields series GB | rename series as HF | addtotals row=f col=t labelfield="Total thruput GB"
All data comes through HF, it is cooked and sent upstream to the indexers.
Data comes in two way:
1. via Syslog - HF layer monitor the files and sends data to indexers.
2. via universal forwarders from downstream endpoints
Any suggestion on why such difference between license usage and thruput at Heavy Forwarders level?
Gabriel
... View more
07-28-2017
01:01 PM
much appreciated! I have what I need for now to start testing...
G
... View more
07-27-2017
06:29 PM
Thanks.
We are doing several TB daily ingestion.
By the way, do you know if the script will take care of replicated buckets or if that is something we need to consider?
... View more
07-27-2017
05:35 PM
1 Karma
Hello,
We are planning for a solution to archive cold data to tape and I was wondering which one of these solutions will be better (coldToFrozenDir or coldToFrozenScript).
Initial plan was to use coldToFrozenDir into a separate volume and then have Tivoli Storage Manager to move it to tape but reading through Splunk documentation it appears that coldToFrozenScript is preferred when rolling to tape.
Have you implemented such a solution and what would be the conditions that have to be met in order to have a successful implementation?
... View more
10-31-2016
06:57 AM
created a scripted input to monitor the filesystem using Linux commands and then you have a report/alert for that particular index.
... View more
10-31-2016
06:54 AM
Hi there,
DMC has a set of alerts, I believe this one might solve your issue?
" DMC Alert - Search Peer Not Responding".
or you build an alert based on below:
index=_internal host="search_head_host" "Connection to host=*:9997 failed" sourcetype=splunkd component=TcpOutputFd
and pipe it to any other logic that you need (based on your environment) to create and generate an alert.
... View more
06-03-2016
09:00 AM
just a side note here, when we have performed the upgrade we had to execute a rolling restart after that.
... View more
02-05-2016
06:49 AM
yes, saw that yesterday. thank you.
G
... View more
02-01-2016
11:14 AM
Hello,
In December 2015, Splunk issued a minor upgrade (6.3.2) which is fixing bugs.
Currently we have Splunk 6.3.1 installed and I'm trying to determine the major differences between these two minor releases in order to asses if an upgrade is necessary.
What are the main advantages of using 6.3.2 instead of 6.3.1?
Thanks
... View more
