Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About apakhomov
apakhomov
Path Finder
Member since:
12-20-2012
06-05-2020
Community Statistics
| Posts | 21 |
| Solutions | 2 |
| Karma Given | 10 |
| Karma Received | 4 |
| Member Since | 12-20-2012 |
Activity Feed
- Karma Re: After upgrading to 6.5.0, KV Store will not start for jcrabb_splunk. 06-05-2020 12:48 AM
- Karma Re: How I can change date format in time picker? for mcseem. 06-05-2020 12:47 AM
- Karma Re: Splunk Architecture for two servers for woodcock. 06-05-2020 12:47 AM
- Karma Re: Limit choices in default TIMEPICKER for jhubbard74. 06-05-2020 12:47 AM
- Got Karma for How to attach external documents to Dashboards.. 06-05-2020 12:47 AM
- Got Karma for How to attach external documents to Dashboards.. 06-05-2020 12:47 AM
- Karma Progress bar jumping for rlautman. 06-05-2020 12:46 AM
- Karma Re: Offline Google Maps for ziegfried. 06-05-2020 12:46 AM
- Karma Re: Create new index without restarting Splunk indexer? for Linegod. 06-05-2020 12:46 AM
- Karma Re: Create new index without restarting Splunk indexer? for sloshburch. 06-05-2020 12:46 AM
- Got Karma for Offline Google Maps. 06-05-2020 12:46 AM
- Got Karma for Offline Google Maps. 06-05-2020 12:46 AM
- Karma Re: Moving the horizontal scrollbar on a Dashboard for Hazel. 06-05-2020 12:45 AM
- Karma Re: btool relocation error for yannK. 06-05-2020 12:45 AM
- Posted Re: How I can change date format in time picker? on Getting Data In. 02-21-2018 03:21 PM
- Posted Re: How I can change date format in time picker? on Getting Data In. 12-25-2017 02:26 AM
- Posted Re: How I can change date format in time picker? on Getting Data In. 07-08-2016 04:03 PM
- Posted Re: How to exclude from monitoring empty files? on Getting Data In. 07-15-2015 10:55 PM
- Posted Re: How to exclude from monitoring empty files? on Getting Data In. 07-15-2015 07:48 AM
- Posted Re: How to exclude from monitoring empty files? on Getting Data In. 07-15-2015 12:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 2 |
02-21-2018
03:21 PM
I made the same steps on the new installation. And it works. Maybe you expect some other... See time format on the followed screenshots.
en-US:
link text
ru-RU:
link text
... View more
12-25-2017
02:26 AM
Hello, Ablay
Maybe your browser has English locale by default? Try connect by direct link with setted locale. For example: http://splunkserver.local:8000/ru-RU/
... View more
07-08-2016
04:03 PM
Mcseem, thank you!
For locale correction, I created 3 symbolic links:
ln -s /opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/locale/en_US /opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/locale/ru_RU
ln -s /opt/splunk/share/splunk/search_mrsparkle/exposed/js/contrib/jquery.ui.datepicker/jquery.ui.datepicker-ru.js /opt/splunk/share/splunk/search_mrsparkle/exposed/js/contrib/jquery-ui-1.10.4/i18n/jquery.ui.datepicker-ru.js
ln -s /opt/splunk/share/splunk/search_mrsparkle/exposed/js/contrib/jquery.ui.datepicker/jquery.ui.datepicker-ru.js /opt/splunk/share/splunk/search_mrsparkle/exposed/js/contrib/jquery-ui-1.10.4/i18n/jquery.ui.datepicker-ru-RU.js
After that I restarted the Splunk service.
And now time stamp and timepicker displays date, time and calendar correctly for the Russian locale.
Best regards, Artem.
... View more
07-15-2015
10:55 PM
Universal forwarder start to reindex files when I commented the ignoreOlderThan parameter. I saw it today. The bitter experience with another task.
Best regards, Artem.
... View more
07-15-2015
07:48 AM
ok, thank you for the useful information.
Best regards, Artem.
... View more
07-15-2015
12:15 AM
Hello, sorry for the delay.
It is fantastic solution and I marked this as a solution. But unfortunately I can't to change the source files (even empty).
Best regards, Artem.
... View more
07-02-2015
01:58 AM
Hello,
Monitor folders have many empty files. These files may be filled in the future. So I can't add them to a blacklist.
As result the log file splunkd.log has huge amount messages:
INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='<filename>'.
I don't want to reduce the log level.
Is it possible to exclude from monitoring empty files to reduce the message count in the log?
--
Best regards, Artem.
... View more
- Tags:
- file-monitoring
06-26-2015
09:55 AM
Thank you very much! Your answers are very helpful for me!
Best regards, Artem.
... View more
06-26-2015
07:44 AM
Could you write more details - why not?
Best regards, Artem.
... View more
06-26-2015
07:29 AM
I found document on connect a search head with a search pear (indexer) without an indexer cluster:
http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/Configuredistributedsearch
So now actual only last questions:
Could I use the indexer to perform search requests too?
And how to distribute an user settings (if I can use indexer to perform search requests) - mount the Knowledge bundle (../splunk/etc) from one server to another?
Best regards, Artem.
... View more
06-26-2015
07:05 AM
Thanks, you support my suppose. Also I found an indirect confirmation in the documentation. Splunk recommends use one search head for one indexer if we have from 2 till 250 GB daily indexing volume with up to 16 users.
I also suppose I can forward the users on search head and on indexer directly to use indexer for perform search requests too.
Unfortunately in the documentation I can't find how to use dedicated search head without an indexer cluster. Need I make cluster with one indexer?
And how to distribute an user settings (if I can use indexer to perform search requests) - mount the Knowledge bundle (../splunk/etc) from one server to another?
Best regards, Artem.
... View more
06-26-2015
06:16 AM
Sorry I didn't write in the first post:
A volume to store the indexed data can be connected only to one server - indexer in the first post. So the indexer can be only one.
Best regards, Artem.
... View more
06-26-2015
05:31 AM
Hello All,
I have two high-performance servers for Splunk in different segments.
The first server will receive data and send to second one (indexer).
Additional restrictions:
A volume to store the indexed data can be connected only to the first server. So the indexer can be only one.
But I don't want to dedicate the first server only as a forwarder.
Question:
Is it possible to use the first server also to optimize search performance?
I suppose that I can use the first server as an indexer, the second one as a forwarder and a search head. But if we have only one indexer, will we get a performance improvement from the dedicated search head?
Best regards, Artem.
... View more
06-17-2015
03:19 AM
2 Karma
Hello All,
I created the user manual for the dashboard and wanted to place the file on the Splunk server and to place a link for it on the dashboard.
I was surprised when I didn't find appropriate information in the Splunk docs.
I spent some time and found the following solution:
Copy the file to the appserver/static folder (for example I use the search app and the file name usermanual.pdf):
/opt/splunk/etc/apps/search/appserver/static/docs/usermanual.pdf
In the dashboard xml file place the following module:
<![CDATA[
User Manual
]]>
I hope this information will be useful for someone else.
Best regards, Artem.
... View more
09-03-2013
07:51 AM
Please, check the case of letters. StateA and stateA are different conditions for the system.
... View more
09-03-2013
05:39 AM
However I would better suppose to extract the fields toState and formState. After extracting you will be able to use search string:
toState=stateB fromState=stateA
... View more
09-03-2013
05:13 AM
Hello,
You can use backslashes for that. The search string is:
"toState: \"stateB\",\", fromState: \"stateA\""
Best regards,
Artem.
... View more
07-08-2013
06:18 AM
I was wrong. TA-sepapp11 must be installed.
Correct strings for the inputs.conf:
[udp://514]
sourcetype = sep11:log
I had problem with parsing logs. The logs was written in Russian. The Splunk for Symantec app has parser only for the English logs.
Best regards, Artem.
... View more
07-05-2013
12:53 AM
I contacted with Google Russia, about the solution Google Maps Enterprise, but by phone I got answer "please, write email" and I didn't get answer on the email. I tried to contact with Google several times, but without success. Last time by phone I got answer "If our specialist didn't respond you, I can't help you". Also I can't find contacts email from Google Europe. The Google service is amazing.
Best regards, Artem.
... View more
06-20-2013
08:30 AM
Hello,
I browsed directories ./SplunkforSymantec/default/ and ./SplunkforSymantec/appserver/addons/TA-sepapp11/default/
The files in those directories almost identical.
So If I want to install SplunkforSymantec on the single Splunk instance and want to get data by syslog, I don't have to install TA-sepapp11. Is it right?
I only need to create./SplunkforSymantec/local/inputs.conf with content:
[udp:516]
sourcetype=sep11:log
I doubt about the string:
sourcetype=sep11:log
In the file ./SplunkforSymantec/appserver/addons/TA-sepapp11/default/inputs.conf I see:
## A default listener
#[udp:516]
#sourcetype=sep11:log
# Leave as sep; subsequent transforms will revise to correct sub-sourcetype. Anything
# searchable with sourectype of sep is an error
So, what is correct: "sep11:log" or "sep"
... View more
06-13-2013
11:01 PM
2 Karma
Hello,
Is it possible to use Google Maps App in a network without internet connection?
I see that client uses internet connection and a Splunk instance doesn't have any cache of maps. As I guess I need to build local Google but I don't find any solution for that 🙂
Best regards, Artem.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
