Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ktc78
ktc78
Explorer
Member since:
11-06-2017
08-03-2023
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-06-2017 |
Activity Feed
- Posted Re: How to increase limit of "The pipeline size limit"? on Splunk Search. 08-03-2023 01:02 AM
- Posted Re: How to increase limit of "The pipeline size limit"? on Splunk Search. 07-30-2023 11:24 PM
- Tagged Re: How to increase limit of "The pipeline size limit"? on Splunk Search. 07-30-2023 11:24 PM
- Posted How to increase limit of "The pipeline size limit"? on Splunk Search. 07-30-2023 07:49 PM
- Posted Re: Does wiredtiger support kvstore acceleration? on Splunk Enterprise. 04-23-2023 04:56 PM
- Posted Does wiredtiger support kvstore acceleration? on Splunk Enterprise. 04-21-2023 12:32 AM
- Got Karma for Re: how to export csv with BOM ?. 02-07-2021 11:18 PM
- Posted Re: how to export csv with BOM ? on Getting Data In. 11-06-2019 05:34 PM
- Posted Re: Excel Export is not working for user role on All Apps and Add-ons. 02-18-2018 05:34 PM
- Posted Re: Excel Export is not working for user role on All Apps and Add-ons. 11-07-2017 05:04 PM
- Posted Excel Export is not working for user role on All Apps and Add-ons. 11-07-2017 12:00 AM
- Tagged Excel Export is not working for user role on All Apps and Add-ons. 11-07-2017 12:00 AM
- Tagged Excel Export is not working for user role on All Apps and Add-ons. 11-07-2017 12:00 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-03-2023
01:02 AM
Below is official answer I got from splunk support team --- Message --- The limit is a hidden setting. We don't recommend our customers to modify it, as searches with hundreds of search commands can cause crashes. To prevent crashes, in 8.2.3 we changed the limit to 340. In 9.0.0, we made some more fundamental changes to address the root cause of the crashing, so the limit is set to 1000. We would recommend upgrading your Splunk Enterprise instances to 9.0.0 or later. [Ref] https://docs.splunk.com/Documentation/Splunk/9.0.0/ReleaseNotes/Fixedissues#:~:text=Searches%20with%20hundreds%20of%20search%20commands%20can%20crash%20the%20main%20Splunk%20server,%20add%20explicit%20limit%20of%201000%20commands%20to%20prevent%20that
... View more
07-30-2023
11:24 PM
Thanks you cklunck for your kind reply! I'm sure that's why I can't find any conf files nor articles about that... Anyway I'm afraid I haven't read that restrictions in splunk release notes at all 😞
... View more
- Tags:
- artic
07-30-2023
07:49 PM
Hi all, I just upgraded splunk enterprise from 8.1.2 to 8.2.6.1 And I found some of big searches return below message when I run them "Error in 'SearchPipeline': The pipeline size for this search exceeds a search command limit : 340" I've never seen this message on 8.1.2 before Could you please guide me 'which conf file stanza should be modified to increase pipeline limit?'
... View more
Labels
- Labels:
-
other
04-23-2023
04:56 PM
Sure I will I just shared this issue on comminity for non-support version of 3.1.2 that I tested Thank you for your advice
... View more
04-21-2023
12:32 AM
I'm running Splunk Enterprise 8.1.2 & its storage engine is 'mmapv1' And I tested to migrate 'wiredTiger' ... but I'm afraid acceleration cannot work Belows are steps I've done on test env. 1. I made test splunk env. - just same with my officially operating splunk system And import some of kvstore collections into test splunk (with same collections.conf & transform.conf) [TEST.kvstore] field.date = number field.id = number field.type = string field.version = string accelerated_fields.test = {"id":-1, "date":-1} 2. On test splunk (with no changes has been made yet - mmap1), everything worked well I got similar lookup search time than original's 3. And then I changed storage engine to 'wiredTiger' https://docs.splunk.com/Documentation/Splunk/8.2.9/Admin/MigrateKVstore?ref=hk This member: backupRestoreStatus : Ready ... port : 8191 replicaSet : DB79F8EF-3560-4A6C-B38E-FF06F1D54661 replicationStatus : KV store captain standalone : 1 status : ready storageEngine : wiredTiger 4. Finally I checked lookup search time on wiredtiger engine "But lookup search time took much more than I expected" ㆍmmapv1 : 52 sec ㆍwiredtiger : 90 sec So I checked what's wrong with test splunk and I found 'no kvstore accelerations' (There it was... but disappeared after migration to wiredtiger) Before (mmapv1) After (wiredtiger) I even tried to import new kvstore collection but also failed (no acceleration was made) Does wiredtiger supports kvstore acceleration? If so, which configuration should I use?
... View more
Labels
11-06-2019
05:34 PM
1 Karma
jeffland's code works perfectly for previous splunk version
but in case of splunk v8.0.0,
I'm afraid python 3.7 is used
splunkhome/lib/python3.7/site-packages/splunk/rest/__init__.py
and raised error like below
Unrecoverable error in the server.
Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpwsgi.py", line 184, in trap
return func(*args, **kwargs)
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpwsgi.py", line 277, in __next__
return next(self.iter_response)
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/lib/encoding.py", line 99, in encoder
for chunk in body:
File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/__init__.py", line 716, in readall
data = "".join((codecs.BOM_UTF8, data))
TypeError: sequence item 0: expected str instance, bytes found
Can I have code for python3.7?
Best regards,
Kang
... View more
02-18-2018
05:34 PM
Dear spl109,
Thank you so much for your solution and It seems to be working fine!
Anyway I modified UTF8 type export function script & using well without Excel export tool now
(without broken character)
I modified below file
.../lib/python2.7/site-packages/splunk/rest/init.py
Commented below
response = self.response
while 1:
data = response.read(blocksize)
if not data:
break
yield data
And added below
response = self.response
import codecs
counter = 0;
while 1:
data = response.read(blocksize)
if not data:
break
if counter == 0:
data = "".join((codecs.BOM_UTF8, data))
counter += 1
yield data
Then csv export goes well without broken charater
I really appreciate your kind advice!
... View more
11-07-2017
05:04 PM
thanks you so much for your valuable advice
I'll try your way first
Anyway it would be nice if I have another solution without changing role permission 🙂
... View more
11-07-2017
12:00 AM
Hello,
I'm using splunk version 6.6.3 (build e21ee54bc796) on my Ubuntu 14.04.5 server
After installing Excel export tool (ver 2.0.4) I found something weird
With admin permission, all things working perfect
but with user role, it gives below message after clicking 'Excel Export' button
IE : "View more information about your request (request ID = 5a016640a87f8d68407590) in Search" -> No info found with given link
FireFox : "Firefox cannot find file Firefox는 http://168.219.245.248:8000/ko-KR/custom/excel_export/excel/1510041258.937?filename=dgfdfgd&count=10000"
I also give full APP R/W permission to everyone already
Did I miss something wrong?
I really donno what makes the difference between admin & user role
Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-03-2023
06:58 AM
|
