About nowplaying

nowplaying · ‎08-05-2014

We successfully implemented DFS replication in place of the shared mounted path. We have 3 Search Heads all configured with search head pooling enabled. Each SH has this configured in $SPLUNK_HOME$/etc/system/local/server.conf [pooling] state = enabled storage = c:\Splunk We ran into an issue where saved search alerts were being run from multiple search heads so we dedicated a single SH as our "job" server. 2 of the search heads have the pipeliner scheduler disabled with this configuration setting in $SPLUNK_HOME/etc/system/local/default-mode.conf [pipeline:scheduler] disabled = true The only other configuration necessary is setting up DFS replication. Each search head is configured to replicate the c:\Splunk directory to the other 2 search heads. This setup has worked very well for us for about a year now. One thing to note though, the C:\Splunk\var\run\splunk\dispatch directory is extremely active. It's constantly updating, creating, and deleting files. Because of this, on a very active system with lots of users, DFS may have issues keeping up with all the changes.

nowplaying · ‎06-05-2013

As the title states, has anyone tried this for Windows Search Head Pools? Our file server is across the WAN from our search heads and I fear we'll experience performance issues using a UNC path for the knowledge bunch. Curious if anybody has tried DFS replication for knowledge bundle syncing across search heads?

nowplaying · ‎08-01-2011

I'm generating a stats table to count the occurrence of errors in our production app logs and presenting a top 10 errors to our engineering team daily. They would like to have a time stamp included in the table so they can determine relevance. The time stamp needs to be the time stamp of the last error message seen for each count. I'm not sure how to present this time in a stats table or if it's even possible. The idea is if a high volume error occurred but it's not a error that continuously occurs they would like to discount it when viewing the daily report. Hope this makes sense. If you have a better idea on how to present this data I'm all ears.

nowplaying · ‎05-16-2011

That's perfect. After I saw jbsplunk's post I figured I would regex based on time but wasn't sure where to start. \d\d:[12345]0:\d\d should give me enough data to work with. A 1 minute data sampling every 10 minutes.

nowplaying · ‎05-16-2011

We have an application log that generates event timings. This log far exceeds our Splunk license if we consumed it for the entire day. A small segment of data from this log is all we really need on an hourly basis. I was wondering if there's a way to configure a forwarder to take a sampling of data from this log at a specific interval?

nowplaying · ‎12-21-2010

I've come across this problem before but can't find it in the answers site. I have a timechart within in an advanced dashboard which I'm charting a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value. How do I increase the this default limit to show all the my hosts. Thanks

nowplaying · ‎11-12-2010

I'm using the SplitModeFormatter module to force a graph into Split mode but when doing so it presents a Multi-series mode picker on the chart. Is there a way to hide this picker? Or is there another way to force a graph into Split mode. Looks like there's a splitseries layout option but wasn't sure where to put this in my Advanced XML. http://www.splunk.com/base/Documentation/latest/Developer/AdvChartingConfig-LayoutData#Example Thanks

nowplaying · ‎11-09-2010

I'm building my first Advanced XML dashboard and need some guidance. I'm using Notepad++ to build my dashboard and then copying it into a new view. But when I try to save the view I get this error at the top of the page: Encountered the following error while trying to update: In handler 'views': Not valid XML: Not really helpful for debugging since it doesn't tell me where the syntax error is in my xml. I looked in /opt/splunk/var/log/splunk but don't see anything that's logging my error. Just wondering how to troubleshoot my error and best practices for building advanced XML dashboards. Thanks

Posts	8
Solutions	0
Karma Given	0
Karma Received	10
Member Since	‎11-09-2010

Online Status	Offline
Date Last Visited	‎07-20-2022 05:32 PM

Using DFS File replication for Knowledge Bundle sy...

Time Stamp in Stats table - event relevance

Data sampling from a large log file

"Other" in timechart- How do I increase default li...

SplitModeFormatter module

Debugging Advanced XML

Re: Using DFS File replication for Knowledge Bundl...