About sciurus

sciurus · ‎12-27-2013

If it's receiving back HTML, are you sure you're pointing it to the Splunk log port (default 9997), not the management (default 8089) or user interface (default 8000)? I'm not sure why you'd get HTML back from the log port.

sciurus · ‎12-27-2013

I don't know anything about smitty. Try extracting the .tgz to /opt/splunkforwarder, then running /opt/splunkforwarder/bin/splunk, without doing anything via smit.

sciurus · ‎12-26-2013

Start with the assumption that it's compatible, and something else is broken. Check basic TCP - can you see the connection in netstat? Is it successfully connecting? If so, check splunkd.log, if not, check routes and firewalls, etc. If it ISN'T compatible, then you've got something which is being rejected by the v6 server - in which case it will show in logs somewhere. If it IS compatible but it's being rejected due to a configuration issue, that will also show up, etc. Also deploy-poll is different to forwarding, so troubleshoot that separately.

sciurus · ‎12-26-2013

Splunk seems to only have a .tgz for AIX, what are you using for your installation source? A .tgz should just need to be extracted to /opt/splunkforwarder.

sciurus · ‎12-26-2013

Is the [ and ] part of the actual value, or are you adding that in to the question? If it's part of the value, timeformat probably needs to know.

sciurus · ‎12-26-2013

At a guess, it wants the path to "Splunk" as an application, not splunk.exe as a binary, so /opt/splunk/, or c:\program files\splunk. It's likely that the app is expecting SPLUNK_HOME to be set, so you could try running this (Windows): C:\>set SPLUNK_HOME=c:\Program Files\Splunk or on unix, setSplunkEnv will setup all variables: root@server:~# . /opt/splunk/bin/setSplunkEnv

sciurus · ‎12-26-2013

I'm guessing here, but it sounds like most of your results either don't have location information, or the map app can't parse the location, and so it ignores the line. It could also be a limit in the app, sure it wasn't 8192 results?

sciurus · ‎12-26-2013

See this link: http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/ViewsearchjobpropertieswiththeJobInspector Specifically, dispatch.evaluate: The time spent parsing the search and setting up the data structures needed to run the search. This component also includes the time it takes to evaluate and run subsearches. This is broken down further for each search command that is used. In general, dispatch.evaluate.<command_name> tells you the time spent parsing and evaluating the <command_name> argument. For example, dispatch.evaluate.search indicates the time spent evaluating and parsing the search command argument.

sciurus · ‎12-05-2013

You should only be using syslog outputs when sending to a non-Splunk server. If you're going to a Splunk indexer, use a configuration more like: [tcpout] defaultGroup = output_fwd [tcpout:output_fwd] server = 1.2.3.4:9997 useACK = true syslog-udp will definitely lose data, and syslog-tcp will probably lose the last few messages before the TCP session closes (because it's impossible for Splunk to know what has actually been received), and then buffer it until a new TCP session is established.

sciurus · ‎12-05-2013

If you're running anti-virus, that might be causing it. To get "The operation completed successfully" when opening a file suggests some strange condition that "shouldn't happen", exactly the sort of thing that AV scanners like to cause. They also love to lock files at inopportune times, which can cause open's to fail.

sciurus · ‎12-05-2013

Security is applied at the index layer, any attempts to impose security at search time will ultimately fail if someone is determined. If the data must be hidden, then it must be done at the index level. Having said that though, if you still want to do it at search time then I would guess you make a pre-defined search or dashboard that extracts a set of fields they're "allowed" to see, and hope they don't fiddle with it or find a way to access _raw.

sciurus · ‎12-05-2013

I recently had this discussion, but it was more around using regional heavy forwarders that feed in to a central indexer. We had existing heavy forwarders for syslog collection, so had to decide whether or not to send universal forwarder data towards them, or direct to the indexer. Pros of using HF / cons of not using HF: Traffic can be uncompressed / unencrypted towards the HF, saving CPU, the HF can then compress and/or encrypt it for bandwidth and security, as it's got dedicated CPU The HF can drop and route events The HF can re-write data, such as credit cards, before sending it to the IDX The HF can cook the data before sending it to the IDX Pros of not using HF / cons of using HF: Each UF has the same output configuration, making it easier to manage (deployment server mitigates this) If a HF goes down (planned or unplanned), logs from the UFs still arrive The general philosophy of Splunk seems to be it's better to go direct If you have 1000 UFs doing auto load-balancing between two IDXs, the split will be very close to 50/50 as they all switch around. If you have 4 or 5 HFs, it's entirely possible you could end up with all of them pointing to one IDX and hammering it before they switch out. Can it be done? Yes. Should it? That's entirely up to you, and hopefully this helps you ask the right questions for your scenario.

sciurus · ‎12-04-2013

The checksum is an implementation detail (and therefore subject to change), however it appears to be the top half of an MD5 hash of the bundle file ($SPLUNK_HOME/var/run/*/*.bundle) 12-05-2013 18:43:01.040 +1100 INFO DeployedApplication - Checksum mismatch 16438968627284953542 <> 14029372552826739163 for blah blah blah 14029372552826739163 = C2B2580188DA59DB # md5sum deployment-client-1386229056.bundle c2b2580188da59db6c3a817dc763a82e deployment-client-1386229056.bundle The bundle itself is a tarball of the app directory, and it's generated when you start Splunk, or run "splunk reload deploy-server". So to answer your question, it takes in to account whatever tar uses, which should include timestamps, permissions, etc, but not host specific information. I haven't attempted it myself, but you should be able to push an app from DS1 to the deployment-apps directory on DS2/3 using targetRepositoryLocation (not repositoryLocation) value in serverclass.conf, and have it remain identical. Unfortunately it won't detect the change without a restart of Splunk, or a manual "reload deploy-server".

sciurus · ‎12-04-2013

If you configure your environment in such a way that you can push out a new DS (ie, make a deployment-server app which has nothing but a deploymentclient.conf), then you could: Setup a temporary DS with all the apps and serverclass.conf Use the original DS to deploy a new deploymentclient.conf file, pointing clients to the temporary one Upgrade the original DS Use the temporary DS to deploy a new deploymentclient.conf file, pointing clients (or a subset of clients, to test) to the newly upgraded one. That depends on having the setup in place, firewalls, etc, etc though.

sciurus · ‎12-04-2013

Make sure to check your spam/junk folder. Additionally, the email will be sent from splunkbase AT splunk.com, so try adding that to the approved senders list.

sciurus · ‎12-02-2013

It's a bit unclear if this is the article you mean or not. The slideshare appears to still be up: http://www.slideshare.net/Splunk/architecting-your-splunk-deployment There is also the documentation on splunk.com around scaling the installation: http://docs.splunk.com/Documentation/Splunk/latest/Installation/CapacityplanningforalargerSplunkdeployment

sciurus · ‎12-02-2013

Sounds logical. The listening socket wasn't closed after the process fork'd, so it hung around in the child processes. I would take a guess that the child processes didn't stop because they're expected to be short lived processes, so the "stop" procedure is to simply wait for them to finish their work and return. That assumption breaks down if they have an unexpected burst of work.

sciurus · ‎12-02-2013

Are you sure it's not in the source data? You could also change the regex's to use \s+ instead of literal spaces.

sciurus · ‎12-02-2013

Extract using math: divide by 2^n to shift the value right by n bits modulo by 2 to get the low bit |stats count | eval bitfield = 5 | eval numfield1=(bitfield % 2) | eval numfield2 = floor(bitfield / 2) % 2 | eval numfield3 = floor(bitfield / 4) % 2 or... Extracting with a CSV: |stats count | eval bitfield = 5 | lookup bitlookup.csv bitfield OUTPUT bitnames | makemv delim="|" bitnames $ cat bitlookup.csv bitfield,bitnames 0,b0 1,b1 2,b2 3,b1|b2 4,b4 5,b1|b4 6,b2|b4 7,b1|b2|b4 8,b8 9,b1|b8 10,b2|b8 11,b1|b2|b8 12,b4|b8 13,b1|b4|b8 14,b2|b4|b8 15,b1|b2|b4|b8

Posts	19
Solutions	11
Karma Given	2
Karma Received	12
Member Since	‎05-29-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: Index from old Splunk Heavy Forwarder

Re: Forward installtion issus on AIX 5.3 5700 bu...

Re: Index from old Splunk Heavy Forwarder

Re: Forward installtion issus on AIX 5.3 5700 bu...

Re: Convert string to date

Re: Specifying the path to Splunk for splunkdj

Re: Why these two this value does not match, diffe...

Re: How to read job inspector

Re: Will Heavy Forwarder buffer logs, when sending...

Re: Error Spamming Splunkd.log Error Process_Searc...

Re: Anonymize certain fields during search time fi...

Re: intermediary heavy forwarder tier

Re: multiple deployment servers - checksum mismatc...

Re: Safest way to upgrade a deployment server?

Re: Error in getting validation mail

Re: Article for Architecting and Sizing Splunk

Re: Orphaned Processes blocking Splunkd port

Re: Spaces are being replaced by tabs

Re: Bitfield lookup