Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Takajian
Takajian
Builder
Member since:
08-02-2010
06-05-2020
Community Statistics
| Posts | 148 |
| Solutions | 21 |
| Karma Given | 1 |
| Karma Received | 68 |
| Member Since | 08-02-2010 |
Activity Feed
- Got Karma for Re: ERROR [Errno 111] Connection refused while sending mail to:. 03-03-2021 05:34 PM
- Karma Re: Not getting any data for jbsplunk. 06-05-2020 12:46 AM
- Got Karma for Re: ERROR [Errno 111] Connection refused while sending mail to:. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk to take in data from MySQL. 06-05-2020 12:46 AM
- Got Karma for Re: ERROR [Errno 111] Connection refused while sending mail to:. 06-05-2020 12:46 AM
- Got Karma for How to import exported windows eventlog to eventviewer for indexing?. 06-05-2020 12:46 AM
- Got Karma for How to import exported windows eventlog to eventviewer for indexing?. 06-05-2020 12:46 AM
- Got Karma for How to change hostname of a universal forwarder on VMs(XenDesktop Agent). 06-05-2020 12:46 AM
- Got Karma for How to change hostname of a universal forwarder on VMs(XenDesktop Agent). 06-05-2020 12:46 AM
- Got Karma for How to change hostname of a universal forwarder on VMs(XenDesktop Agent). 06-05-2020 12:46 AM
- Got Karma for Re: How to only display fields with values in a table. 06-05-2020 12:46 AM
- Got Karma for Re: how can I force splunk read file line by line. 06-05-2020 12:46 AM
- Got Karma for Re: how can I force splunk read file line by line. 06-05-2020 12:46 AM
- Got Karma for SplunkIt throws an error "Could not import keysym for local pythonversion". 06-05-2020 12:46 AM
- Got Karma for Re: problem extracting timestamps. 06-05-2020 12:46 AM
- Got Karma for Re: The system is approaching the maximum number of historical searches that can be run concurrently. current=7 maximum=8. 06-05-2020 12:46 AM
- Got Karma for Re: The system is approaching the maximum number of historical searches that can be run concurrently. current=7 maximum=8. 06-05-2020 12:46 AM
- Got Karma for Re: The system is approaching the maximum number of historical searches that can be run concurrently. current=7 maximum=8. 06-05-2020 12:46 AM
- Got Karma for Re: The system is approaching the maximum number of historical searches that can be run concurrently. current=7 maximum=8. 06-05-2020 12:46 AM
- Got Karma for Re: How to assign index of an app to another.. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 3 |
07-06-2015
02:25 PM
Did you restart splunk and reflect configuration of props.conf and clean indexed data? The configuration will reflect for new index data, not past indexed data.
... View more
07-06-2015
02:25 PM
Are you using forwarder? Do you know where you should put props.conf in your deployment?
If you are using light weight forwarder or universal forwarder, you need to put the props.conf on index server.
If you are using other forwarder type(HF or regular forwarder), you will need to put the props.conf on forwarder, not index server. Please confirm if you put props.conf on appropriate location. You will also need to restart splunk to reflect the configuration.
... View more
01-14-2014
09:45 PM
3 Karma
There are two types of field extractions which are search time field extraction and index time field extraction. Your delimExtraction is for search time extraction, not index time. Therefore, you should put it on SH, not HF. Please note that your nullqueue setting is processed in index time, so it should be left on HF. Please try this and confirm if it solve the issue.
... View more
11-21-2013
04:15 AM
1 Karma
I would like to get resource information of Virtual Machine on Openstack? Has anybody ever tried this? I am not sure how can I get such information from Openstack. It may be done by API or command execution as scripted input or syslog although I am not sure. Any advice is appreciated.
... View more
- Tags:
- openstack
04-04-2013
02:51 AM
1 Karma
When I tried to generate 50GB, I got following error. Any idea to solve the issue?
python bin/gendata.py
Traceback (most recent call last):
File "bin/gendata.py", line 20, in
from pyro_server import *
File "/opt/splunk/etc/apps/splunkit-server/lib/pyro_server.py", line 19, in
import platform, readline
File "/opt/splunk/etc/apps/splunkit-server/lib/readline.py", line 5, in
from pyreadline.rlmain import Readline
File "/opt/splunk/etc/apps/splunkit-server/lib/pyreadline/init.py", line 9, in
import unicode_helper, logger, clipboard, lineeditor, modes, console
File "/opt/splunk/etc/apps/splunkit-server/lib/pyreadline/modes/init.py", line 2, in
import emacs,notemacs,vi
File "/opt/splunk/etc/apps/splunkit-server/lib/pyreadline/modes/emacs.py", line 15, in
import basemode
File "/opt/splunk/etc/apps/splunkit-server/lib/pyreadline/modes/basemode.py", line 12, in
from pyreadline.keysyms.common import make_KeyPress_from_keydescr
File "/opt/splunk/etc/apps/splunkit-server/lib/pyreadline/keysyms/init.py", line 20, in
raise ImportError(u"Could not import keysym for local pythonversion", x)
ImportError: (u'Could not import keysym for local pythonversion', ImportError('cannot import name windll',))
... View more
- Tags:
- SplunkIt
04-04-2013
02:33 AM
My application generates around 100,000 files per day. Although I tested to index them by monitoring files, it took almost a week. Anybody know cause of the issue and solution? I think it will be improved if number of active log files were not so many, but I have to do so in our environment.
... View more
- Tags:
- performance
03-10-2013
07:15 PM
Do you know from replication function point of view?
... View more
03-10-2013
07:14 PM
I would like to know about replication function. If master node look for peer which have enough disk space or remove oldest replicated buckets and so on.
... View more
03-08-2013
06:07 AM
Please let me know if my question is not clear.
... View more
03-04-2013
05:22 PM
I am thinking to use data duplication function in clustering environment. I understand there are search factors and replication factors to replicate data. When one of peers goes down, I assume the other peers replicate data according to replication policy ( search factors and replication factors ). My question is what happen when one of peer goes down and the other peer's storage is full?
... View more
- Tags:
- indexer
03-04-2013
05:17 PM
I am thinking to use data duplication function in clustering environment. As I do not need to duplicate summary index, I would like to configure which index to duplicate in clustering environment. Does somebody know if it is possible? If possible, please let me know how to configure?
... View more
- Tags:
- configure
02-14-2013
11:22 PM
3 Karma
I think your 'restrict search times = "type=t1"' is not correct. Could you try following?
index=i1 OR index=i3 OR ( index=i2 AND type=t1 )
As you recognized, the other index does not have type field. You will need to specify each index and field explicitly.
... View more
02-14-2013
11:11 PM
5 Karma
From version 5.0, there are three type of modes to search events. The default mode is smart. It will remove timeline and get result faster. If you want to see timeline, please select verbose mode. You can also refer to following docs.
Hope this help.
http://docs.splunk.com/Documentation/Splunk/latest/Search/Changethesearchmode
... View more
12-04-2012
02:00 AM
Do you know there is configuration which you want to attache the email alert? You will need to select PDF attachment when you configure saved search alert. Please take look at following manual and confirm your configuration. Hope this help.
http://docs.splunk.com/Documentation/Splunk/5.0/Alert/Setupalertactions
... View more
12-04-2012
01:51 AM
4 Karma
The license usage of splunk 5.0 is compatible with 4.3, not 4.2. The search to check license usage will be following. Could you try it? I think your search result may be including summary indexed data volume.
index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool
The following site is also helpful. Please take loot at it.
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume
... View more
12-04-2012
01:47 AM
2 Karma
You need Hadoop Command utility to make Hadoop connector work. Did you install it? Following manual could be helpful.
http://docs.splunk.com/Documentation/HadoopConnect/latest/DeployHadoopConnect/Dependencies
... View more
10-16-2012
02:25 AM
Do you want to filter the fields which value is NULL? Then, does following search meet your requirement?
.. | table ErrorField1 ErrorField2 | where ErrorField1 NOT null AND ErrorField2 NOT NULL
... View more
10-12-2012
07:51 PM
2 Karma
You need to configure props.conf in order to force splunk index data with single line.
The configuration will be following.
[your_sourcetype]
SHOULD_LINEMERGE = false
You can also refer to the manual as bellow.
http://docs.splunk.com/Documentation/Splunk/5.0/Data/Indexmulti-lineevents
... View more
10-12-2012
04:48 PM
1 Karma
Can you use "table" command to display specified field value?
... | table ErrorField1 ErrorField2
... View more
10-11-2012
06:59 PM
Now I understand it clearly.I have never done such a deployment. But I do not think splunk disconnect connection periodically according to forwarded events. If you setup multiple VIP for each intermediate forwarder as one by one, it would not be problem. But it will not much your requirment. Sorry it will not help.
... View more
10-11-2012
06:38 PM
I think you can also use intermediate splunk forwarder instead of F5 load balancer. The intermediate splunk forwader will solve your concern. Do you have reason to user F5, not intermediate forwarder?
... View more
10-11-2012
06:31 PM
I think we can do silent installation of Universal forwarder. The installation command can be executed like as bellow.
msiexec.exe /i splunkuniversalforwarder_x86.msi DEPLOYMENT_SERVER="deploymentserver1:8089" AGREETOLICENSE=Yes /quiet
You can also refer to more detail on the manual as bellow. Hope this help.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/DeployaWindowsdfviathecommandline
... View more
10-11-2012
06:26 PM
I think load balancer need to persist splunk user. Splunkweb on search head issue cookie to splunk user, so load balancer will be able to persist splunk user with cookie as sticky key. And I think you will need to setup search head pooling to share configuration on each search heads. Hope this help.
... View more
08-08-2012
04:51 PM
1 Karma
eval command is useful to combine filed. Can you try following command and confirm if this work for your case?
... | eval same_name=mvappend(field1, field2)
... View more
08-08-2012
04:37 PM
You are editing the configuration file "transforms.conf". I think you also need to edit the configuration file "props.conf". The stanza [ns_firewall_extract_1] or [ns_firewall_extract_2] are required to combine to the attribute in props.conf.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
