Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Paul1896
Paul1896
Path Finder
Member since:
10-13-2016
11-12-2020
Community Statistics
| Posts | 25 |
| Solutions | 1 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 10-13-2016 |
Activity Feed
- Posted Re: REST error in DMC Index Detail on Getting Data In. 09-21-2020 12:12 AM
- Karma Re: Create Jira Ticket using Splunk Alerts (via 3rd Party App) for guilmxm. 06-05-2020 12:50 AM
- Karma Re: How to capture Windows evtx files for richgalloway. 06-05-2020 12:50 AM
- Karma Re: What is the difference between Microsoft Azure Add on for Splunk and Add-on for Microsoft Cloud Services? for jconger. 06-05-2020 12:50 AM
- Karma Re: DBConnect: OSError: [Errno 2] No such file or directory validate java command: /usr/java/latest/bin/java. for teunlaan. 06-05-2020 12:50 AM
- Karma Re: How to install Splunk Universal Forwarder on multiple servers? for Richfez. 06-05-2020 12:48 AM
- Karma Re: UTF8Processor warning message for gavsdavs_GR. 06-05-2020 12:47 AM
- Posted Re: Create Jira Ticket using Splunk Alerts (via 3rd Party App) on All Apps and Add-ons. 04-02-2020 12:01 AM
- Posted Re: Can I collect application logs from Azure to Splunk? on Getting Data In. 03-09-2020 05:34 AM
- Posted Re: HttpInputDataHandler - Parsing error : No data on Monitoring Splunk. 01-21-2020 07:44 AM
- Posted Re: Problem with SAML cert: "ERROR UiSAML - Verification of SAML assertion using the IDP's certificate provided failed. Error: Failed to verify signature with cert :/opt/splunk/etc/auth/idpCerts/idpCert.pem" on Deployment Architecture. 12-12-2019 12:05 AM
- Posted Re: Ooops Page not found when I login on Security. 11-08-2019 06:11 AM
- Posted Re: Splunk Http Event Collector giving 404 error for cloud trial version on Getting Data In. 11-08-2019 05:52 AM
- Posted Deploymentserver behind AWS Loadbalancer - How to get original Client IPs? on Deployment Architecture. 09-19-2019 11:51 PM
- Tagged Deploymentserver behind AWS Loadbalancer - How to get original Client IPs? on Deployment Architecture. 09-19-2019 11:51 PM
- Tagged Deploymentserver behind AWS Loadbalancer - How to get original Client IPs? on Deployment Architecture. 09-19-2019 11:51 PM
- Tagged Deploymentserver behind AWS Loadbalancer - How to get original Client IPs? on Deployment Architecture. 09-19-2019 11:51 PM
- Posted Re: Why do I keep getting the 'Argument "action.email" is not supported by the handler' error message? on Alerting. 02-19-2019 06:17 AM
- Posted Re: data stop getting indexed for couple of hours on Getting Data In. 02-18-2019 12:58 AM
- Posted Re: data stop getting indexed for couple of hours on Getting Data In. 02-14-2019 05:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
04-02-2020
12:01 AM
As everybody knows the current Add-On version is not supported for version 7 & 8. I found this "idea" (https://ideas.splunk.com/ideas/DTID-I-1) in the splunk idea pool. Feel free to upvote it.
... View more
03-09-2020
05:34 AM
Hello larmesto,
is it possible to grab application logs which are stored in an azure event hub as well or only acitivity logs?
... View more
01-21-2020
07:44 AM
Figure out which configured HEC-Stanza generate the errors via "Monitoring Console --> Indexing --> Input --> HTTP Event Collector: Deployment" and check the configuration on source side.
The incoming requests from the affected source are not valid and can't be handled in a correct way by Splunk.
... View more
12-12-2019
12:05 AM
Have the same issue. Did you solve it on your side? @smitra_splunk
... View more
11-08-2019
06:11 AM
Hello,
check on the affected searchhead if following file exists:
$SPLUNK_HOME$/etc/apps/$AFFECTED_APP_NAME$/local/data/ui/nav/default.xml
If it doesn't exist copy the default.xml from another app into the directory and check if the problem still exists.
... View more
11-08-2019
05:52 AM
Have you configured a token and provide it in the right way while you're sending data to the HEC endpoint?
... View more
09-19-2019
11:51 PM
Hello, any idea how to get original client ip address of forwarder which are connected to a deploymentserver via an AWS classic loadbalancer? I didn't find any implementation possibility to use x-forwarder-for header which contains the original IP addresses. Is there any configuration possibility on splunk side regarding this?
... View more
02-18-2019
12:58 AM
Probably we've figured out the root cause. Last week we indexed 20 gb for this instance within one day and have a configured thruput of 256 kb. So it was only a delayed indexing and not a "outage" of the forwarder itself.
... View more
02-14-2019
05:35 AM
We're using Splunk 7.1.5
... View more
02-14-2019
05:35 AM
@ddrillic We're talking just about 220 files
... View more
02-12-2019
11:54 PM
Hey @woodcock thanks for your reply! We have a housekeeping in place and the monitor doesn't match the older logs which are already rotated. So in my understanding the size & total of files of/in the folder itself isn't important in case if your monitor just indexing a specified logfile in it. Please correct me if I'm wrong. We also facing the problem only from time to time and after a while or a reboot the logging works without any problems.
... View more
02-12-2019
05:11 AM
Hello,
we have problems with some log files which are randomly don't get indexed for a couple of hours. There is no log rotation during this time period and sometimes even no restart of the splunk forwarder is neccessary to start again with indexing.
Output splunkd.log filtered for affected "audit_log":
02-12-2019 12:09:57.358 +0100 DEBUG ChunkedLBProcessor - Chunked Line Breaker Processing has been disabled for for sourcetype::audit_log
02-12-2019 12:09:57.358 +0100 INFO UTF8Processor - Converting using CHARSET="UTF-8" for conf "source::/xxx/audit.log|host::xxx|Haudit_log|339419"
02-12-2019 06:33:16.783 +0100 INFO S2SSender - Abandoning channel with code=2, conf="source::/xxx/audit.log|host::xxx|audit_log|339419", unique_id=422585, last_touched=1549948674, last_touched_asctime="Tue Feb 12 06:17:54 2019", age=922281, ttl=300000
02-12-2019 06:17:54.985 +0100 INFO Metrics - group=per_sourcetype_thruput, series="audit_log", kbps=0.06303521503133032, eps=0.5483843194729626, kb=1.9541015625, ev=17, avg_age=0.6470588235294118, max_age=5
02-12-2019 06:17:54.503 +0100 DEBUG TcpOutputProc - Pushed eventId=61 on chanId=422585 to back of tcp client (tcp output) queue. source:source::/xxx/audit.log|host::xxx|audit_log|339419
... View more
01-28-2019
01:08 AM
Hello @seunomosowon unfortunately I also have the same problem with one mailbox now. Have you been able to implement a workaround? It would be so great to proceed further with other mails in the mailbox and ignore only which comes with a wrong charset
ERRORunknown encoding: big5
... View more
01-15-2019
12:16 AM
Thanks @dfronck , we'll update our version today and then check it again.
... View more
01-15-2019
12:15 AM
Hello @sim_tcr , did you get any response for your opened case? We have the same problem after migration and wanna solve it.
... View more
01-07-2019
01:58 AM
We have the same issue with Splunk 6.6.8. Is there any solution now?
... View more
12-06-2018
02:28 AM
One possibility to solve the problem of growing index time lag could be to use the KVstore function in future.
... View more
10-13-2016
11:25 PM
I also tried this one
| eval datefield=strftime(strptime(DATUM,"%d.%m.%Y") ,"%Y.%m.%d") | chart list(VOL_RO) by datefield,host useother=f | tail 15 | sort +datefield
2016.09.17 0 4189590 52690
2016.09.18 0 4234501 52681
2016.09.19 1668 4262328 52668
2016.09.20 0 4286605 50382
2016.09.21 1349 4222331 50392
2016.09.22 6790 4218210 50392
2016.09.23 380 5412165 50392
2016.09.24 0 5200690 993555
2016.09.25 0 5094012 938512
2016.09.26 1128 4230430 50854
2016.09.27 0 5987518 50378
2016.09.28 1253 4259481 50392
2016.09.29 597 4547325 50392
2016.09.30 0 4624354 50392
2016.10.01 0 0
At the moment this is the best solution, but it isn't the optimal result for me. If anyone have further ideas, it would be very nice!
Thanks a lot for your great help!
... View more
10-13-2016
10:52 PM
Hello inventsekar,
thanks for your fast answer!
Here is the result:
01.10.2016 0 0
17.09.2016 0 0 0
18.09.2016 0 0 0
19.09.2016 576 183 0
20.09.2016 0 0 0
21.09.2016 194 0 0
22.09.2016 317126 193 0
23.09.2016 30376 1127 0
24.09.2016 0 0 0
25.09.2016 0 0 0
26.09.2016 1725 18965 0
27.09.2016 21292 390 0
28.09.2016 26605 0 2895
29.09.2016 3324 21580 0
30.09.2016 85292 1352 0
... View more
10-13-2016
10:48 PM
You mean this way?
| eval epochtime=strptime(DATUM,"%d.%m.%Y") | sort epochtime | eval datefield=strftime(epochtime,"%d.%m.%Y") | chart list(VOL_DDC_OUT) by datefield,host useother=f | tail 15 | fields - epochtime
I get the same result back.
Perhaps the chart-command overwrite all sort-commands?
... View more
10-13-2016
10:45 PM
Hello cmerriman,
thanks for your answer and your help!
I reformated the date to Month/Day/year but now I only get the 01.10.2016 back.
Search:
| eval epochtime=strptime(DATUM,"%m.%d.%Y") | eval datefield=strftime(epochtime,"%m.%d.%Y") | chart list(VOL_DDC_OUT) by datefield,host useother=f | tail 15 | sort datefield
Result:
01.10.2016 0 0
I also tried:
| eval epochtime=strptime(DATUM,"%m.%d.%Y") | eval datefield=strftime(epochtime,"%m.%d.%Y") | chart list(VOL_DDC_OUT) by datefield,host useother=f | tail 15 | sort epochtime | fields - epochtime
and
| eval epochtime=strptime(DATUM,"%m.%d.%Y") | sort epochtime | eval datefield=strftime(epochtime,"%m.%d.%Y") | chart list(VOL_DDC_OUT) by datefield,host useother=f | tail 15 | fields - epochtime
I only get the one value back.
... View more
10-13-2016
10:40 PM
Hello Rich,
thanks for your fast answer! It is a very nice community.
I got the same result 😞
I also tried to sort between the two eval commands.
I still get the wrong sorting.
... View more
10-13-2016
07:21 AM
Hello,
I hope anyone can help me.
My search
eval epochtime=strptime(DATUM,"%d.%m.%Y") | eval datefield=strftime(epochtime,"%d.%m.%Y") | chart list(VOL_DDC_OUT) by datefield,host useother=f | tail 15 | sort datefield
I converted the string DATUM to a dateformat and I thought it will be handled as a dateformat, but it doesn't work correctly.
Output:
01.10.2016 0 0
17.09.2016 0 0 0
18.09.2016 0 0 0
19.09.2016 576 183 0
20.09.2016 0 0 0
21.09.2016 194 0 0
22.09.2016 317126 193 0
23.09.2016 30376 1127 0
24.09.2016 0 0 0
25.09.2016 0 0 0
26.09.2016 1725 18965 0
27.09.2016 21292 390 0
28.09.2016 26605 0 2895
29.09.2016 3324 21580 0
30.09.2016 85292 1352 0
Why is the first date 1.10.2016? It should be the last one. It looks like that the field "datefield" isn't a dateformat.
Can anybody help me that the sorting is working correctly.
Thank you very much!
... View more
