Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About trumpjk
trumpjk
Explorer
Member since:
11-27-2012
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 11-27-2012 |
Activity Feed
- Karma Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? for lycollicott. 06-05-2020 12:48 AM
- Karma Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? for lycollicott. 06-05-2020 12:48 AM
- Karma Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? for lycollicott. 06-05-2020 12:48 AM
- Karma Dynamically Change Email Recipient? for ytamura. 06-05-2020 12:46 AM
- Karma Re: Dynamically Change Email Recipient? for ytamura. 06-05-2020 12:46 AM
- Karma Re: Splunk for F5 Security showing logs but no dashboard data for daijik. 06-05-2020 12:46 AM
- Posted Re: Why is My Splunk 7.0.2 Install Missing HTTP Event Collector Option? on Getting Data In. 02-15-2018 07:30 AM
- Posted Why is My Splunk 7.0.2 Install Missing HTTP Event Collector Option? on Getting Data In. 02-14-2018 10:42 AM
- Tagged Why is My Splunk 7.0.2 Install Missing HTTP Event Collector Option? on Getting Data In. 02-14-2018 10:42 AM
- Tagged Why is My Splunk 7.0.2 Install Missing HTTP Event Collector Option? on Getting Data In. 02-14-2018 10:42 AM
- Tagged Why is My Splunk 7.0.2 Install Missing HTTP Event Collector Option? on Getting Data In. 02-14-2018 10:42 AM
- Tagged Why is My Splunk 7.0.2 Install Missing HTTP Event Collector Option? on Getting Data In. 02-14-2018 10:42 AM
- Posted Re: Dynamically Change Email Recipient? on Reporting. 03-06-2017 12:51 PM
- Posted Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? on Monitoring Splunk. 12-21-2016 10:50 AM
- Posted Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? on Monitoring Splunk. 12-21-2016 10:36 AM
- Posted Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? on Monitoring Splunk. 12-21-2016 09:42 AM
- Posted Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? on Monitoring Splunk. 12-21-2016 08:52 AM
- Posted Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? on Monitoring Splunk. 12-21-2016 07:20 AM
- Posted Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? on Monitoring Splunk. 12-21-2016 06:39 AM
- Posted Re: Why am I unable to retrieve data prior to the date our archive directory disk was filled? on Monitoring Splunk. 12-19-2016 11:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-15-2018
07:30 AM
Yes it is there. Here is what is in the inputs.conf:
[http]
disabled=1
port=8088
enableSSL=1
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0
ssl settings are similar to mgmt server
sslVersions=*,-ssl2
allowSslCompression=true
allowSslRenegotiation=true
NOTE: Disabled was set to 0, I changed to 1 but made no difference.
... View more
02-14-2018
10:42 AM
I would like to setup HEC but do not see the option under Settings -> Data Inputs. What do I have to do to enable HEC? The server I am trying to configure this on is the indexer, not clustered but set up to do a distributed search.
... View more
12-21-2016
10:50 AM
Thanks for your help.
... View more
12-21-2016
10:36 AM
What setting controls the size?
I currently have: maxTotalDataSizeMB = 700000
... View more
12-21-2016
09:42 AM
10:53:28.564 AM
12-19-2016 10:53:28.564 -0500 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/export/splunk/var/lib/splunk/defaultdb/db/db_1481231014_1473455015_2404'
eventtype = nix-all-logs eventtype = splunkd-log host = splog.jhuapl.edu index = _internal source = /export/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
10:53:28.198 AM
12-19-2016 10:53:28.198 -0500 INFO BucketMover - will attempt to freeze bkt='/export/splunk/var/lib/splunk/defaultdb/db/db_1481231014_1473455015_2404' because maxTotalDataSize=524288000000 bytes, currentSize=524476821504 bytes
... View more
12-21-2016
08:52 AM
rozenTimePeriodInSecs only appears in one place and is set to 18396000
... View more
12-21-2016
07:20 AM
db_1481231014_1473455015_2404
... View more
12-21-2016
06:39 AM
It is just interesting that data was frozen that should not have been frozen. I am in the process of restoring frozen buckets to get the data back. Doesn't seem to be an easy way for me to restore data between certain dates, more of a manual process.
... View more
12-19-2016
11:40 AM
Yes, coldToFrozenDir. Data in question should not be frozen as frozenTimePeriodInSecs = 18396000 which is approx 212 days. the disk issue happened on 12/12. When I search I get no data older than 12/12.
... View more
12-19-2016
11:30 AM
I stopped splunk. Renamed the archive directory, mounted an NFS share to the specified archive_directory in indexes.conf, copied files from the renamed archive directory to the correct location, restarted splunk.
... View more
12-19-2016
11:06 AM
I am running searches on a Splunk server and am unable to retrieve data prior to the date our disk filled. I corrected the space issues but when I execute a search, it stops at the point where the filesystem filled and does not retrieve data prior to that date when there was not a space issue. The space issue was caused by the archive directory residing on the same disk as the live indexes. This was corrected. Any suggestions?
... View more
11-22-2013
01:05 PM
I figured out my problem. I modified format of syslog then edited props.conf to add "%z" to TIME_FORMAT in props.conf:
TIME_FORMAT = %b %d %H:%M:%S %z
... View more
11-22-2013
11:07 AM
Prior to upgrading to Splunk 6 I had my props.conf configured to specify TZ's for certain host. Since upgrading to splunk 6 I noticed some entries are displaying and ordering in EST and others are still in GMT. Source of the entries are the same, syslog and in this instance I am not using splunkforwarder I am using syslog to forward to indexer. Props.conf I edited is in $SPLUNK_HOME/etc/system/local
... View more
09-06-2013
08:46 AM
I have systems that forward logs via syslog-ng to my splunk server. Systems are in different TZ's mix of EDT and GMT my splunk server/indexer is in EDT. I have the TZ offset displayed in log entries being sent to splunk server. Two questions will splunk read TZ offset and display indexed entries in EDT without me having to put an entry for each host in the props.conf? If splunk will do automatically is there a certain postion the TZ offset has to be in? Current format: Sep 6 15:38:14 hostname +00:00
... View more
- Tags:
- timezone
07-31-2013
09:31 AM
I can't get this to work even with making changes suggested by Daiji. Has anyone else gotten the app to work? Using ASM 11.3
... View more
01-08-2013
08:16 AM
I was able to add a template to the syslog-ng.conf file to modify date/time stamp to include timezone offset. This solved my problem. Thanks for your help.
... View more
01-07-2013
11:51 AM
To clarify: I edited the props.conf on the indexer. The remote host(s) is forwarding syslog to indexer via syslog-ng. Indexer is receiving logs. I have over 200 systems forwarding via syslog and not all are using same TZ. SOme are EST and some are GMT
... View more
01-07-2013
10:40 AM
I have an entry in props.conf for TZ conversion i.e:
[host::SOMEHOST]
TZ = UTC
If the host is running the universal forwarder the splunk indexer with handle the conversion and display entry using local time.
If I forward logs from host via syslog the indexer does not do the time conversion.
Any suggestions?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
