About aladda_splunk

aladda_splunk · ‎03-28-2019

On #1 - You need to use the Splunk Cloud Forwarder App in addition to the standard Splunk UF bits to ensure the data makes it your Cloud deployment. See this for details- https://docs.splunk.com/Documentation/Forwarder/7.2.5/Forwarder/HowtoforwarddatatoSplunkCloud. The credentials package ensure data is delivered compressed and encrypted. See this for #5 - https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/Service/SplunkCloudservice#Additional_information_about_data_collection On #2 the Deployment Clients (UFs, IFs and HFs - in your case) phone home to the Deployment Server. the DS setup for Splunk Cloud is same as on-prem if you've had experience with the before. In either case, see this link for more details - https://docs.splunk.com/Documentation/Splunk/7.2.5/Updating/Aboutdeploymentserver

aladda_splunk · ‎01-05-2018

@bnorthway - Are you saying setting these settings to false is no longer a PS best practice or the other way around? fetch_remote_search_log = false remote_timeline_fetchall = false

aladda_splunk · ‎08-15-2016

Looking for help coming up with search to calculate the total duration there were events in a given time period - essentially a reflection (for the given use case) for how much time the user was actively doing something. So if user A logged in at 11 am, did 5 things between 11 and 11:01, nothing between 11:01 and 11:03 and then again between 11:03 and 11:04 did 10 things, 11:04 to 11:05 did 3 things, then in total the user was active for 3 out of the 5 mins. Only care about 1 minute granularity. I'm using transaction with maxpause of 60s to represent "inactivity" for a certain time period and then aggregate "duration" to get active_time | transaction USER_ID maxpause=65s | stats sum(duration) as dur | eval active_time = dur/60 Looking for other ideas and techniques to approach this.

aladda_splunk · ‎06-25-2016

Depends on what the hwf is used for. Is it doing just collection of data or also indexing i.e, indexandForward flag value on props.conf.

aladda_splunk · ‎06-23-2016

These would go on the Indexer(s) props.conf or the heavy forwarder if you have one between your universal forwarder and the indexer Couple of questions 1) Did you create a new source_type using these parameters or did you update an existing sourcetype. 2) If you created a new sourcetype then you'll need to update your forwarders inputs to use that 3) If you updated an existing sourcetype, do you have multiple versions of that sourcetype stanza in different apps? The cloud team could tell you that by running a command on the indexers I'd recommend trying new sourcetype and update one forwarder input to use that new sourcetype to see if it gives you what you're looking for. You can create sourcetypes from the UI in Splunkcloud. It pushes them down to the indexers automagically

aladda_splunk · ‎06-22-2016

Give this a try. Splunk appears to be picking up time format ok. You can try tweaking it as well to be certain [ trace_sourcetype] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true MAX_TIMESTAMP_LOOKAHEAD=36 LINE_BREAKER=(\n\r)*(?:\d+\/\d+\/\d+\s\d+\:\d+:\d+\s\w+\sTrace: m_username: CAR_CoBrand_eReceipt_API)

aladda_splunk · ‎04-20-2016

What do you get when you run a btool list on inputs? This command from you $SPLUNK_HOME/bin directory ./splunk cmd btool inputs list --debug | grep host

aladda_splunk · ‎03-02-2016

The overlay variable goes on the right and the other on the left. Don't think this has to do with the order of the calculations in the search. See this http://docs.splunk.com/Documentation/Splunk/6.1/Viz/Chartcontrols#Chart_overlay_example_.28dual_axis.29

aladda_splunk · ‎03-02-2016

You may want to try search time extractions, something like (assuming, the literal uri=" shows up first time in the entire raw string). rex=_raw "uri="(?[^"]+)" If you can paste some sample data with different variations of the uri, might be able to provide a more cleaner regex expression http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Rex

aladda_splunk · ‎02-25-2016

This might help. Toggle the # of days back in time by changing from -1 to however far back in time you want to go | eval aaa=relative_time(now(),"-1d") | eval bbb=strftime(aaa,"%d/%m/%Y")

aladda_splunk · ‎12-29-2015

Also check this answers post out - https://answers.splunk.com/answers/303931/db-connect-2-socket-error.html. Port 9998 already being bound is another reason the app results in blank page. You can fix that by modifying/adding to the rpcstart://default stanza in inputs.conf...something along these lines [rpcstart://default] javahome = /opt/splunk/jdk1.8.0_45/jre port = 9085

aladda_splunk · ‎10-21-2015

Thanks Clint! Will work on tweaking the inputs per the note above

aladda_splunk · ‎10-20-2015

Adding a monitor stanza to monitor some additional files. This is an inherited system where the current set-up pushes out a copy of the /etc/system/default/inputs.conf under /etc/system/local. I understand that this isn't the best practice, but looking to see how to fix this problem short of having to blow away the whole UF and reinstall or having to hardcode the host

aladda_splunk · ‎10-20-2015

Running into a strange scenario with host field resolution in combination with Splunk App for Stream. All the forwarders are pushed to end-points using chef and they currently copy over the inputs.conf from /etc/system/default into /etc/system/local adding a couple of monitor stanzas to the one in local to monitor additional files. This carries over the default stanza with host=$decideOnStartup into the inputs.conf under local as well [default] index = default _rcvbuf = 1572864 host = $decideOnStartup The monitor inputs however, do get the resolved (correct) host information, as per below. Once the Splunk App for Stream is pushed to the forwarders, the stream data though picks up the host as $decideOnStartup unless either the host is explicitly set in the inputs.conf under /etc/system/local or the forwarder is cleaned up, and no inputs.conf from /etc/system/default is copied over to /etc/system/local which then effectively means the forwarder creates one at startup with the resolved hostname under which then keeps things humming along. Question is, how are the monitor inputs able to resolve the host=$decideOnStartup to the correct host name, even when placed under /etc/system/local while the Stream input is not? Anyone seen this before and have suggestions on how to get past it, without having to either (a) manually set the host field or (b) redeploy the forwarders without a copy of the inputs.conf from /etc/system/default

Posts	14
Solutions	2
Karma Given	4
Karma Received	5
Member Since	‎10-20-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to edit my search to calculate total duration ...

Why is the Splunk App for Stream input tagging hos...

Re: New Splunk Cloud environment - Initial setup

Re: dispatch.finalizeRemoteTimeline taking a long ...

How to edit my search to calculate total duration ...

Re: How do I configure line breaking in props.conf...

Re: How do I configure line breaking in props.conf...

Re: How do I configure line breaking in props.conf...

Re: After installing a Splunk 6.4 universal forwar...

Re: Can I control which y-axis is on the left and ...

Re: Wildcard search not working on splunk search b...

Re: How to create a variable that contains a date ...

Re: Splunk dbconnect v2 not working

Re: Why is the Splunk App for Stream input tagging...

Re: Why is the Splunk App for Stream input tagging...

Why is the Splunk App for Stream input tagging hos...