About davpx

davpx · ‎03-15-2019

You can barely run a single instance on 4 cores reliably. Definitely not two. At 10GB/day, unless you need HA, you really shouldn't need more than one instance/server but you absolutely must get more cores. If cost is a concern, see about reducing some of that memory usage. No way you need 200GB for this small of a deployment and RAM is expensive.

davpx · ‎03-15-2019

Quick and dirty example of the average of both over time. sourcetype=Perfmon* (object="Memory" counter="Committed Bytes") OR (object="LogicalDisk" counter="% Free Space") | timechart avg(Value) as Value by counter

davpx · ‎01-25-2019

You can try using sendCookedData=false as in https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd#Forward_a_subset_of_data

davpx · ‎01-25-2019

Download the app yourself and unpack to etc/apps if you have this much permission. Otherwise, it seems you have splunk admin permissions, download locally and upload via manage apps.

davpx · ‎01-25-2019

You should ask simon@balz.me who created this.

davpx · ‎01-25-2019

You should upgrade. There are known bugs for tailing files in versions this old.

davpx · ‎01-25-2019

You have a lot of traffic for your deployment. Increase disk space.

davpx · ‎01-25-2019

The owner of the search needs to have list_storage_passwords capability.

davpx · ‎01-24-2019

Because there is but only a single capability to grant access to all secrets stored on the system and it traverses system wide. Splunk really needs to work on their permissions structure.

davpx · ‎01-24-2019

This was fixed in 7.0.8 and recent releases of 7.2. To workaround this in earlier versions, either add the indexes to your search head or go grab an authorize_roles.xml from a 6.x version and deploy it to your SHC manually in etc/apps/search/local/data/ui/manager https://docs.splunk.com/Documentation/Splunk/7.0.8/ReleaseNotes/Fixedissues#Splunk_Web_and_interface_issues

davpx · ‎11-10-2018

Why are you using such odd ports? Nuance practices like these will get you in a lot of trouble.

davpx · ‎04-04-2018

TIME_PREFIX = timestamp:\s+ TIME_FORMAT = %s in props.conf

davpx · ‎04-04-2018

Try running these again with a set time window instead of a real-time search and compare again.

davpx · ‎04-04-2018

Some inputs can return the shortname and some return the FQDN. Check to ensure your forwarder's inputs.conf hostname under [default] matches the name in server.conf and that any other inputs do not specify a host explicitly.

davpx · ‎04-04-2018

Try something like index=wineventlog EventCode=521 OR EventCode=4617 | timechart span=1h count by host or index=wineventlog EventCode=521 OR EventCode=4617 | timechart span=1h sum(eval(EventCode=521)) as 521 sum(eval(EventCode=4617)) as 4617 by host

davpx · ‎04-04-2018

Does something like this help? index=blah sourcetype=sourcetypeA OR sourcetype=sourcetypeB | stats count(my_field) as count by sourcetype

davpx · ‎04-04-2018

Yes, check this out. https://answers.splunk.com/answers/188709/how-to-display-dashboard-panels-dynamically.html

davpx · ‎03-09-2018

I downvoted this post because refusing to accept a correct answer leaves unanswered spam on the board.

davpx · ‎03-09-2018

Right and _time is actually in epoch format under the covers but it sounds like you got it resolved.

davpx · ‎03-09-2018

Your target server is missing from your command or have you redacted it?

davpx · ‎03-09-2018

Fast vs Smart vs Verbose is only for UI searches. The functionality you describe does not exist.

davpx · ‎03-09-2018

_time is actually epoch translated for you in the UI, an easy way to strip the translation is to rename _time to something else or use an alias, | eval epoch=_time

davpx · ‎03-09-2018

It would seem Splunk does not have permissions to write. Confirm the user Splunk runs as has ownership of the installation and that there are no storage issues. chown -R splunk:splunk /mnt/*

davpx · ‎03-07-2018

sourcetype="pfaduit" success NOT SLO NOT OIDC adapterid=* |stats sum(responsetime) as "Total transaction time" by tid | stats avg("Total transaction time") as "Average transaction time"

davpx · ‎02-16-2018

EventCode=4625 user="*" | bucket _time span=5m | stats count by user _time | where count>3

Posts	66
Solutions	7
Karma Given	15
Karma Received	15
Member Since	‎08-23-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: Question regarding Search head clustering

Re: How to use different 'object' and 'counter' o...

Re: Send Windows Logs to thrid party without Splun...

Re: splunk install app from an insecure URL

Re: Alert Manager functionality not working in sea...

Re: Splunk 6.6.1 stops monitoring files

Re: why is /opt/splunk/var/run/splunk/cluster/sear...

Re: Splunk Email createSSLContextSettings error

Re: Why does every credential for every app show u...

Re: How come our indexes are missing in our search...

Re: Search Head cant see data in Indexers

Re: How to use TIME_PREFIX to extract Timestamp fo...

Re: Why are events included in one Search Head but...

Re: Why am I seeing host multiple times in search

Re: How to aggregate events per host per hour?

Re: How can I count same field from different sour...

Re: How can i make a dropdown disappear based on a...

Re: How to customize stats using simple math?

Re: View time result of search as epoch

Re: Error while deploying an app from the deployer

Re: Running Alerts in Verbose or Fast mode

Re: View time result of search as epoch

Re: Why is Splunk Service not starting with 'authD...

Re: How to get average of all the summed values?

Re: How can I limit the results to only users that...