Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About raindrop18
raindrop18
Communicator
Member since:
11-19-2012
06-05-2020
Community Statistics
| Posts | 86 |
| Solutions | 0 |
| Karma Given | 27 |
| Karma Received | 4 |
| Member Since | 11-19-2012 |
Activity Feed
- Karma Re: How do I convert milliseconds to seconds on stats output? for Vijeta. 06-05-2020 12:50 AM
- Karma Re: put splunk heavy forwarders behind loadbalancer for somesoni2. 06-05-2020 12:49 AM
- Karma Re: put splunk heavy forwarders behind loadbalancer for gwalford. 06-05-2020 12:49 AM
- Karma Re: scaling HEC on heavy forwarders for nickhills. 06-05-2020 12:49 AM
- Karma Re: splunk index daily data volume for specific index for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How to override Splunk universal forwarder license acknowledgement? for muebel. 06-05-2020 12:48 AM
- Karma Re: Convert log time (epoch) to readable Date and time for jkat54. 06-05-2020 12:48 AM
- Karma Re: How to resolve error in my geostats search "Error in 'geostats' command: The argument 'over' is invalid"? for gcusello. 06-05-2020 12:48 AM
- Karma Re: How I can monitor my Splunk universal forwarder to make sure the forwarder is working as expected? for gcusello. 06-05-2020 12:48 AM
- Karma Re: How can I send logs from one universal forwarder to two different indexers depending on the logs type? for TStrauch. 06-05-2020 12:48 AM
- Karma Re: How to add a form for user input on a dashboard to only run panel searches for data from certain hosts? for gyslainlatsa. 06-05-2020 12:48 AM
- Karma Re: How to override Splunk universal forwarder license acknowledgement? for jkat54. 06-05-2020 12:48 AM
- Karma Re: How to configure a timechart alert to not trigger between a certain time frame (1:00am - 5:00am)? for sundareshr. 06-05-2020 12:48 AM
- Got Karma for Re: How can I send logs from one universal forwarder to two different indexers depending on the logs type?. 06-05-2020 12:48 AM
- Karma Re: How do I edit my search to get the distinct count for fields generated with eval? for richgalloway. 06-05-2020 12:47 AM
- Karma Re: How to combine multiple stats distinct counts into one search? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to combine stats count results? for justinatpnnl. 06-05-2020 12:47 AM
- Karma Re: How to search count by unique ID? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to filter out log volume data from certain hosts in my search? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How to combine the results of my two searches in one graph? for trsavela. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-18-2018
06:24 PM
on my indexer cluster I see lists it say "Here is a list of indexes with buckets exceeding the replication or search factor" and has a remove button.
- what are these, I have set my replication factor so where this excessive list came from
- also it's safe to remove them, this automatically can be done or manually need to be clean up and what the effect not doing that.
thanks!!
... View more
- Tags:
- splunk-enterprise
11-21-2018
12:09 PM
I have updated with rounding to 2 decimal point but the sparkling still not changed, also attached screenshot.
... View more
11-07-2018
02:35 PM
I have the following query, however, the sparkline didn't show the trend instead one single value everything else is a straight line. what did I miss
sourcetype=metrics name=http*://* rename "data.avg_response_time_ms" as avg_response_time_sec , "data.avg_error_rate" as avg_error_rate | eval avg_response_time_sec=avg_response_time_sec/1000 | eval avg_response_sec=round(avg_response_sec,2)| stats sparkline(avg(avg_response_time_sec),5m) as Trend by name,avg_response_time_sec ,avg_error_rate
... View more
- Tags:
- splunk-enterprise
10-19-2018
01:09 PM
I have this query and I'm trying to convert the response time from milliseconds to seconds but it's not working. What did I miss?
sourcetype="imetrics" name=http*://* | regex name!="http*://.*\d+$" | stats count by name,data.avg_response_time_ms,data.avg_error_rate | eval "data.avg_response_time_ms(ms)"='data.avg_response_time_ms(ms)'/1000 |sort -data.avg_response_time_ms
Note = the milliseconds written like this on the logs "1660.9425"
thanks.
... View more
- Tags:
- splunk-enterprise
07-26-2018
09:11 AM
I have followed this doc http://docs.splunk.com/Documentation/AddOns/released/Firehose/ConfigureanALB
setup AWS ALB for Splunk HEC and the document suggest to enable Stickiness, however, didn't say the duration of the stickiness, anyone has any suggestion for the duration ?
thanks!
... View more
- Tags:
- splunk-enterprise
04-23-2018
07:57 AM
thanks for the response, but still not filtering DEBUG. is there any difference for the logs ingested via http even collector (HEC)? this issue only I got on the logs ingested via HEC, other logs ingested via UF I don't see this issue.
... View more
04-20-2018
01:39 PM
this is newly ingested data.
... View more
04-20-2018
01:38 PM
2018-04-20 20:36:35 DEBUG NetworkClient:627 - Initiating connection to node -1 at myserver1.net:9092.\n
2018-04-20 20:36:35 DEBUG NetworkClient:767 - Initialize connection to node -1 for sending metadata request\n
2018-04-20 20:36:35 DEBUG NetworkClient:570 - Node -3 disconnected.\n
2018-04-20 20:36:35 DEBUG NetworkClient:627 - Initiating connection to node -1 at myserver1.net:9092.\n
2018-04-20 20:36:35 DEBUG NetworkClient:767 - Initialize connection to node -1 for sending metadata request\n
2018-04-20 20:36:35 DEBUG NetworkClient:570 - Node -2 disconnected.\n
... View more
04-20-2018
11:54 AM
yes I did 🙂
... View more
04-20-2018
10:32 AM
I have set the following on transforms.conf and props.conf but I still see DEBUG logs in my search. what did I miss
transforms.conf
#Remove: DEBUG
[null_kube_DEBUG]
REGEX = (DEBUG)
DEST_KEY=queue
FORMAT=nullQueue
props.conf
#### kube ################################
[source::kube.var.log.containers.*]
TRANSFORMS-null = null_kube_DEBUG
... View more
04-18-2018
06:01 AM
Ok. I will and let you know but the bottom line is HF can't expand horizontally as Indexer?
... View more
04-18-2018
05:07 AM
No firewall, I don't see any error. but on UF I see traffic is on waiting state. BTW I have close to 3k UF forward the logs to The HF. and HEC.
... View more
04-18-2018
04:52 AM
thanks J. the current server not indicate any cpu or memory issue, the metrics for that is low only network input out put is high as high traffic coming to the HF, I am using the HF as HEC also. most of the time out is on the logs pushed over HEC.
... View more
04-17-2018
08:22 PM
My logs volume increased and notice time out on my heavy forwarder, which is best way to add capacity increase the size of the server (more powerful server) or add multiple server. on the other word escaling horizontally vs vertically.
... View more
- Tags:
- splunk-enterprise
03-08-2018
05:44 PM
I am using aws addon for splunk and configure for s3 bucket and I have multiple folder on the bucket.
folder-A
folder-B
who to configure input for that?
... View more
- Tags:
- splunk-enterprise
02-16-2018
01:55 PM
I have installed base64 splunk app for decoding base64 filed but didn't decode the logs, I have used
|base64 field=myfiled action=decode mode=replace suppress_error=True
Is there anyone who has used this app and was able to decode it? Thanks for any feedback.
Dan
... View more
01-23-2018
10:45 AM
thanks much!!
... View more
01-23-2018
10:27 AM
how can I get Splunk index daily data volume size for a specific index?
thanks,
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
indexer clustering
12-27-2017
12:27 PM
thanks for response. that answer my question!!
... View more
12-27-2017
12:24 PM
thanks very help full information.
... View more
12-27-2017
11:41 AM
I have multiple heavy-forwarders and currently they are behind AWS route 53 DNS, and I am thinking if I get a benefit if I move the heavy forwarders behind loadbalancer. apperciate any feedback and if any related document about this highly appreciate it.
... View more
- Tags:
- splunk-enterprise
