About dmcintosh1972

dmcintosh1972 · ‎08-08-2022

Hi FYI limits.conf [metrics:tcpin_connections] aggregate_metrics = true this setting will aggregate the data being received on the Intermediate forwarders so does not report the individual servers.

dmcintosh1972 · ‎08-01-2022

thanks for your help, not sure if i need to enable something. to log more metrics? from UF i only see the group fields per_host_thruput, instance. The group=tcpin_connections are only logged under my cloud indexers and the hostnames covered are the cloud infrastructure and the IUF's, now other UF servers.

dmcintosh1972 · ‎08-01-2022

Hi can anyone think of a way to get Splunk versions reported from universal forwarders when in a Intermediate forwarder environment. I have tried searches like index=_internal sourcetype=splunkd group=tcpin_connections but it only returns the agent version of the intermediate layer, not the UF versions behind it. Are there any commands that can be deployed via to each UF to collect that information?

dmcintosh1972 · ‎07-26-2022

you could set up different inputs with a relevant source type on the input field of the form. or if you are planning to use a single input with multiple tables coming in you can set up props and transforms in the app to modify the sourcetype value based on your logs. look for an identifying field with 100% log coverage, use that in a regex to identify your records and modify the sourcetype.

dmcintosh1972 · ‎02-10-2020

Hi Please give me any feedback . ideas as to whether I am following the best action. I have a database table that is occasionally updated / add to. I would like to start using this information in searches as a lookup. What is the best action to take here? I had thought of running a search and outputting he data to a KVstore lookup I have tried this but as any record in the table could be updated I am not clear on how to use the Key_field / _key value to pick up the updates. I have also seen examples using a csv lookup and using joins to merge the old / new data then writing out a new file. Which method is best for picking up changes that may occur in any field from the database. The records do have a fixed identity field which may help. Anyone able to recommend best method with an example?

dmcintosh1972 · ‎07-26-2019

I have created a lookup. fairly basic 2 columns, column 1 has an ID the second a search string. ID searchstring 1 source =xyz My users get the ID from a separate system and rather than remember the search string or lookup the string themselves they would like to run the search through itself using the search id. e.g. | inputlookup table where ID=1 | fields searchstring | run searchstring as a splunksearch Is this possible? Thanks

dmcintosh1972 · ‎06-16-2019

Hi Has anyone created a splunk app that has an input generated by a powershell script? I have a script that runs that I am trying to improve the error handling. My questions is how are you handling capturing errors, do you error to the splunkd.log or write out to a new log file in var/log/splunk? I would appreciate any thoughts or examples of capturing errors and writing them out to splunk logs. Thanks

dmcintosh1972 · ‎03-19-2019

I now understand export= none and export = system. thanks

dmcintosh1972 · ‎03-19-2019

I have a props.conf I want to make it available to all search apps on the searchhead. what location should it be placed into on the search deployer to make it available?

dmcintosh1972 · ‎02-06-2019

Thanks, I had considered adding a 4th but was looking to fix this particular set of searches to it. If I am reading the doc correctly I could consider setting a couple to adhoc_searchhead = true then monitor for skipped searches occurring on the remaining 1 (or 2 if I and another) searchheads.

dmcintosh1972 · ‎02-06-2019

Hi I am looking at setting up alerting in splunk, at the moment I don't know the expected frequency or volumes of alerts, are there any performance issues I should consider. We have a 3 node search cluster, 4* indexers. Are the searches spread across the searchheads? is it possible to fix them to a single Searchhead? Appreciate any advice.

dmcintosh1972 · ‎12-12-2018

Hi prakash007 thanks for reply, I however do have the default namespace set, after login it redirects to the correct app however. once you are logged in if you go to https://HOSTNAME:8000/en-GB/app/search/search you are not redirect to the default namespace app. instead you get an error, because I have the app set as invisible.

dmcintosh1972 · ‎12-11-2018

Hi We have an application the allows users to click on a link taking them to splunk. The problem is that the link is hard coded in the application and only allows users to go to: https://HOSTNAME:8000/en-GB/app/search/search In our environment we have set the default search app as not visible and the users default app is set to one we created. https://HOSTNAME:8000/en-GB/app/MYAPP/search Does anyone know if there are any query string parameters I can append to the default app url that would redirect to my preferred app? (this option is available in the external app we are using)

dmcintosh1972 · ‎01-30-2018

I would like to remove a prefix from a field where certain criteria are met but leave the prefix on on fields where criteria isnt met. e.g uniqueIdentifier = admjdoe | rex mode=sed field=uniqueIdentifier "s/^adm//g" output = jdoe uniqueIdentifier = administrator | rex mode=sed field=uniqueIdentifier "s/^adm//g" output = inistrator Obviously I don't want to remove the adm from administrator, and as the field includes names it should also correctly handle names like admaneil (adm aniel) etc I need to have some kind of if uniqueIdentifier = administrator then don't apply the sed command. Thanks

Posts	14
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎08-09-2016

Online Status	Offline
Date Last Visited	‎08-08-2022 09:08 AM

How to get Splunk UF versions in Intermediate forw...

kvstore lookups from database.

allow user to run search contained in lookup

Powershell App Script Handling Error

What should be the deploy location for props.conf ...

Splunk Alerting rate

How to have Splunk URL parameters to redirect url ...

How to use rex and sed to remove field prefix?

Re: How to get Splunk UF versions in Intermediate ...

Re: Get Splunk UF versions in Intermediate forward...

How to get Splunk UF versions in Intermediate forw...

Re: Parsing fields from Azure Log Analytics KQL Gr...