Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About BenAveling
BenAveling
Path Finder
Member since:
08-08-2013
06-05-2020
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 6 |
| Member Since | 08-08-2013 |
Activity Feed
- Karma Re: Do pool warnings cause violations? for lukejadamec. 06-05-2020 12:46 AM
- Karma Re: High availability: Splunk cluster across two datacenters - redux for sbaryakov. 06-05-2020 12:46 AM
- Got Karma for Do pool warnings cause violations?. 06-05-2020 12:46 AM
- Got Karma for Do pool warnings cause violations?. 06-05-2020 12:46 AM
- Got Karma for Do pool warnings cause violations?. 06-05-2020 12:46 AM
- Got Karma for Re: Can realtime alerting actions be run only once per event?. 06-05-2020 12:46 AM
- Got Karma for High availability: Splunk cluster across two datacenters - redux. 06-05-2020 12:46 AM
- Got Karma for Re: Syslog data from UDP. Maximum message size?. 06-05-2020 12:45 AM
- Posted Re: sendemail turns dates into 0NaN-NaN-NaN NaN:NaN:NaN on Reporting. 01-20-2014 08:51 PM
- Posted sendemail turns dates into 0NaN-NaN-NaN NaN:NaN:NaN on Reporting. 01-15-2014 07:18 PM
- Tagged sendemail turns dates into 0NaN-NaN-NaN NaN:NaN:NaN on Reporting. 01-15-2014 07:18 PM
- Tagged sendemail turns dates into 0NaN-NaN-NaN NaN:NaN:NaN on Reporting. 01-15-2014 07:18 PM
- Posted Re: Realtime search is very slow on Splunk Enterprise. 11-20-2013 03:47 PM
- Posted High availability: Splunk cluster across two datacenters - redux on Deployment Architecture. 10-31-2013 11:15 PM
- Tagged High availability: Splunk cluster across two datacenters - redux on Deployment Architecture. 10-31-2013 11:15 PM
- Tagged High availability: Splunk cluster across two datacenters - redux on Deployment Architecture. 10-31-2013 11:15 PM
- Posted Re: Syslog data from UDP. Maximum message size? on Getting Data In. 10-17-2013 05:42 PM
- Posted Re: Occasional error in converting time stamps on Getting Data In. 10-17-2013 04:55 PM
- Posted Re: When is it appropriate to set followTail to 'true'? on Getting Data In. 10-02-2013 10:40 PM
- Posted Re: When is it appropriate to set followTail to 'true'? on Getting Data In. 10-02-2013 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 3 |
01-20-2014
08:51 PM
Doesn't help. In fact, adding fieldformat _time=... on its own is enough to turn _time into 0NaN-NaN-NaN NaN:NaN:NaN, even without the sendmail. 😕
... View more
01-15-2014
07:18 PM
If I enter "*|timechart count by host", my search returns _times like this: "2014-01-14 09:00:00".
If I enter "*|timechart count by host|sendemail ...", all the _times become "0NaN-NaN-NaN NaN:NaN:NaN".
Why is this happening?
... View more
11-20-2013
03:47 PM
As per Sean's answer, real time searches never 'finish'. But they should display all the available results about as quickly as Relative searches. What they don't do is tell you that they have found all the available results - because they are still searching.
This can be particularly confusing if you use Time range picker -> All time (real-time) without realising that it is 'special' - it does not show past events, only events that occur after the search started - you'll see that the number of events matched is only, for eg, "28 of 28 events matched" - 28 is the number of events that have matched since your search started. If you were expecting more results, it can seem that it is slow, when in fact, it has actually finished.
Officially, this is a feature, even though it may not feel like one. See: http://docs.splunk.com/Documentation/Splunk/6.0/Search/Specifyrealtimewindowsinyoursearch#Real-time_searches_over_.22all_time.22
... View more
10-31-2013
11:15 PM
1 Karma
What is the best practice for distributed data across 2 or more data-centers?
The objective is geographic redundancy. i.e. To survive the loss of 1 data-center.
The ideal would seem to be:
forwarder send events to the nearest data center - or load share across multiple data-centers
indexed data is replicated so that each data center has a complete set of data (or for >2 data centers, data is replicated in such a way that a single data center only has one copy of each block of data)
This doesn't seem to be supported, at least as of R6.0.
Instead, the options seem to be:
have a single cluster with a replication factor high enough that every block is guaranteed to exist at >1 data center.
have one cluster per data-center and forward all events to all data centers
Option 1 isn't practical because the replication factor needs to be > the number of indexers at any one data center - to be sure that at least one copy is off site.
Option 2 isn't great either, because you lose the benefits of clustering.
What then is the best practice recommendation?
... View more
10-17-2013
05:42 PM
1 Karma
This sounds like a UDP problem, not a splunk problem.
For me, anything up to 65507 bytes is received (and truncated to 10000 bytes). Anything longer just gets lost.
If you have perl, maybe try sending to the following script and seeing what happens:
my $usage = qq{Usage:
perl udp_server.pl port
};
use strict;
use IO::Socket;
my $port=shift or die "port not specified\n\n$usage";
my $response = IO::Socket::INET->new(Proto=>"udp",LocalPort=>$port)
or die "Can't make UDP server: $@";
my $message=0;
while(1){
print "Listening on $port...\n";
my ($datagram,$flags);
$response->recv($datagram,100000,$flags) or warn "recv failed: $!\n";
print "Got message ",++$message," from ", $response->peerhost,", flags ",$flags || "none",": $datagram\n", "length: ",length $datagram,"\n";
}
... View more
10-17-2013
04:55 PM
This doesn't look like a timezone problem.
If it was, the calculation would be out by a round number of hours.
Consider:
perl -e "print scalar gmtime(1382037457.102446000)"
Thu Oct 17 19:17:37 2013
splunk gives
10/19/13 6:38:12.700 AM
perl -e "print scalar gmtime(1381940863.218676000)"
Wed Oct 16 16:27:43 2013
splunk gives
10/17/13 @ 2:55:00.000 PM (PST)
I'm wondering if splunk could be picking up the wrong number when it goes looking for seconds-past-epoch; either using a different number from the same event, or a number from a different event entirely.
You said this is from a .csv file. Is there any chance that any of your fields have embedded commas that are confusing it, or that the end of line is being mangled? Are you able to share the misbehaving lines?
... View more
10-02-2013
10:40 PM
I can see why writing a reliable follow tail is inherently hard.
But isn't it a problem that always exists, regardless of whether or not the follow tail flag is ticked?
i.e. If you don't have a way to know if you've read a record before then your options are to discard it, and possibly lose data, or to index it, and possibly duplicate data.
If so, then would it be fair to say that follow-tail=true means that records that are potential duplicates are discarded and that follow-tail=false means that records that are potential duplicates are indexed?
... View more
10-02-2013
12:46 AM
In splunk 6, the screen "Add new Data inputs » Files & directories » Add new" says of Follow Tail that "This only applies to the file the first time Splunk sees it. After that, Splunk's internal file position records keep track of it."
Does this mean that the problems described above no longer exist?
... View more
09-25-2013
07:29 PM
Rather than have splunk index the ftp'd file, you could perhaps have a script running after each ftp to extract just unique events into a new file and have splunk monitor that.
... View more
09-17-2013
09:38 PM
1 Karma
If you aren't still on splunk 4.2, per-result alerting now allows you to suppress based on a field.
So you could suppress based on service - i.e. suppressing alerts on one service needn't mean suppressing alerts on other services.
See http://docs.splunk.com/Documentation/Splunk/5.0.4/Alert/Defineper-resultalerts
... View more
09-17-2013
06:16 PM
You could use a tag to select all records that have a particular value in different fields, but you'd need to tag and search for all the values you're interested in, and you'd still have the question of how to group the records.
To get the desired result, probably better to use something like this:
... | eval id = if(sessionid !="",sessionid ,uid) | transaction id
or this:
... | eval id=coalesce(sessionid ,uid) | transaction id
You can't just use "rename sessionid as uid", or "eval uid=sessionid", because rename and eval would overwrite the original values of uid.
... View more
09-16-2013
08:58 PM
Hi Ayn, you're right, I should have been "search b". Cut & paste error in the search, but what I said it returns is correct.
As written above, it returns nothing.
Corrected to:
search... | rename a as b | transaction b
it returns:
a=1
It turns out that rename and eval do not merge, they overwrite, with null if 'a' doesn't exist.
To get the desired result you need to use something like
... | eval a_or_b = if(a!="",a,b) | transaction a_or_b
or
... | eval a_or_b=coalesce(a,b) | transaction a_or_b
... View more
09-15-2013
11:56 PM
That doesn't seem to work for me. Transaction returns the entry with the renamed field or the eval'd field, but not the unrenamed field. It's as if the renaming has clobbered something.
i.e. given
a=1
and
b=1
Then
search... | rename a as b | transaction a
returns only
a=1
... View more
09-15-2013
11:22 PM
Does the 3rd index have ip? If so, what happens when you try to build a transaction on ip and user_name?
... View more
09-08-2013
08:36 PM
If you change the timezone for the user it should affect the display of all data, old and new. But it won't change what is stored, either for old or new data.
If you change the central timezone, or the timezone for a particular stream of log data, then that should change the timezone of any new data that is not explicitly stamped with a timezone. Events that already contain their own timezone will not be affected, nor will old events, if I understand what you are asking.
... View more
09-06-2013
12:12 AM
I assume the log files are rotating? Do you know where in your log files the missing messages would have been?
... View more
08-13-2013
05:41 PM
I think you mean ".../splunk enable boot-start"
And yes, I don't understand why this doesn't happen as part of the install - at the least it should be an option.
... View more
08-12-2013
09:07 PM
I haven't gone over the limit since the first time, 4 days back.
Licensed daily volume 500 MB
Volume used today 38 MB (7.522% of quota)
Events indexed: 9,039,679
Most of those events were on the 1st day.
... View more
08-12-2013
05:36 PM
4 days later, nothing has happened yet.
Seems that the message is wrong/buggy.
... View more
08-08-2013
08:14 PM
No issues today.
Licensed daily volume 500 MB
Volume used today 35 MB (7.07% of quota)
When you say the answer is "yes", do you mean "yes, the pool warning is only talking about the license warning", or "yes, the pool warning is going to turn into a 2nd permanent warning"?
The page you linked to, and the answers to some other questions suggest that the pool warning is harmless, and is just bad UI design. But it isn't quite clear.
I guess I'll find out tomorrow.
... View more
08-08-2013
06:17 PM
3 Karma
I have:
Current 1 pool warning reported by 1 indexer Correct by midnight to avoid violation Learn more Permanent 1 license window warning reported by 1 indexer 11 hours ago
The license warning I understand. I indexed too much data for the license. OK, my bad.
I don't understand the pool warning. If it is just telling me about the permanent license warning (violation), then why is it telling me to "Correct by midnight to avoid violation"?
Is the pool warning about the license warning going to cause a 2nd permanent warning (violation)?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
