About brentsinawski

brentsinawski · ‎12-11-2020

Thanks! I have a deployment server. Should I change index.conf to point to the new location prior to copying all of the data to the new location? Or should i copy the data first then change index.conf? Thanks again!

brentsinawski · ‎12-10-2020

Hi All, In my environment we have 6 indexers and one searchead which all are running server 2012. We are running out of space on the physical indexers which are limited by physical drives. I have a san connection to all of the indexers. How would i move just the coldDBs to a separate drive? Leaving warm to stay on the original drives? eg. I have [Linux] homePath = volume:hot\Linux\db coldPath = volume:cold\Linux\colddb thawedPath = $SPLUNK_DB\Linux\thaweddb tstatsHomePath = volume:tstatsHomePath\Linux\datamodel_summary maxTotalDataSizeMB = 7500000 frozenTimePeriodInSecs = 31536000 I would like coldPath = F:\Linux\Colddb and move the current coldDBs over to the new drive and be searchable. How would I accomp

brentsinawski · ‎07-24-2013

Can't believe I couldn't figure that out. Your a life saver. Thank you very much!! Worked perfectly.

brentsinawski · ‎07-24-2013

Hi everyone, I am trying to create a table that lists multiple policy id's that shows all ports being used according to that policy ID. If I do a "| dedup policy_id | table policy_id dst_port src_port I get only one dst_port and one src_port. I'm looking to do a list of all the policy id with every port that policy id has used in a specific time. Hard to explain I guess. I'm looking for policy_id src_port dst_port 836 5622 5488 80 66 488 224 etc. Any help would be extremely appreciated. Thank you!!

brentsinawski · ‎06-12-2012

Just in case anyone else is ever having a problem like this. My problem was resolved when I changed the admin account to the default system timezone. I don't know why this worked but after some research it is a known problem.

brentsinawski · ‎05-02-2012

Hello, I am having a problem receiving emails from splunk. Splunk is running on windows server 2008. I was able to telnet to the smtp server and send email from my splunk server. The alerts I created show that they have been firing correctly in the scheduler.log. When I look in python.log the last result was from two months ago from when I was testing splunk. Any Idea where I should go from here? Thank you in advance.

brentsinawski · ‎02-24-2012

Hello, I am trying to set up a deployment server in splunk. I'm only testing on one server at the moment just to see how this works. What I am trying to do is change a .conf file in a universal forwarder. The deployment server and universal forwarder client both are windows server 2008. I added the .conf file to the repository but I don't know how to make it go to the path C:\Program Files\SplunkUniversalForwarder\etc\system\local path. Its a simple .conf file that tells what wmi information to collect. Thank you very much in advance. Brent.

brentsinawski · ‎12-16-2011

Hello, We are using splunk for our alerting, log collection and performance information on about 80 servers so far. We have about 180 more to go before we are finished setting up the universal forwarders on all of the windows boxes. My question is the hardware layout. Our plan is to use two separate hardware servers for indexers (one indexer per location PA and NY) and use one additional server as a dedicated search head\deployment server. Is this the best way to set it up for quick searches? Or is there a better way of doing it? We expect to recieve about 12GB's a day when all is said and done. Thanks for you advice!!

brentsinawski · ‎11-11-2011

Thanks for the help!

brentsinawski · ‎11-11-2011

Thanks, that worked perfectly.

brentsinawski · ‎11-10-2011

Yeah I am recieving data from the UF just not everything I'm wanting. By the end of the year we will be using Splunk to monitor over 300 servers so we are just testing and configuring right now. I will give that a try. Thank you,

brentsinawski · ‎11-10-2011

I have a question about how to get a universal forwarder to send the data I would normally recieve from WMI. I am trying to get remote performace monitoring from the universal forwarders. I currently have 3 servers with universal forwarders installed on them and one indexer. After the initial install I can't seem to change any setting with the universal forwarders. Should I add the servers to the event log collection with WMI? And if i were to do that would the data be sent through the Universal Forwarders? All of the servers are Windows based.

Posts	12
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎10-06-2011

Online Status	Offline
Date Last Visited	‎12-16-2020 12:26 AM

Moving a cold database to different drive.

How to get multiple values in a table

SMTP problems

Deployment Server .conf changes

Deployment hardware question.

Universal forwarder and WMI

Re: Moving a cold database to different drive.

Moving a cold database to different drive.

Re: How to get multiple values in a table

How to get multiple values in a table

Re: SMTP problems

SMTP problems

Deployment Server .conf changes

Deployment hardware question.

Re: Universal forwarder and WMI

Re: Universal forwarder and WMI

Re: Universal forwarder and WMI

Universal forwarder and WMI