Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jasonlow
jasonlow
Loves-to-Learn
Member since:
02-13-2019
07-07-2020
Community Statistics
| Posts | 4 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-13-2019 |
Activity Feed
- Posted Re: Getting specific MS SQL perform on selected hosts on All Apps and Add-ons. 06-02-2019 10:19 AM
- Posted Getting specific MS SQL perform on selected hosts on All Apps and Add-ons. 06-01-2019 10:54 AM
- Tagged Getting specific MS SQL perform on selected hosts on All Apps and Add-ons. 06-01-2019 10:54 AM
- Posted Onboard Windows event log based on source name on Getting Data In. 05-29-2019 02:51 PM
- Tagged Onboard Windows event log based on source name on Getting Data In. 05-29-2019 02:51 PM
- Tagged Onboard Windows event log based on source name on Getting Data In. 05-29-2019 02:51 PM
- Tagged Onboard Windows event log based on source name on Getting Data In. 05-29-2019 02:51 PM
- Posted How do I schedule a recurring search that would alert if an index is missing data feeds from hosts? on Splunk Search. 02-13-2019 12:58 PM
- Tagged How do I schedule a recurring search that would alert if an index is missing data feeds from hosts? on Splunk Search. 02-13-2019 12:58 PM
- Tagged How do I schedule a recurring search that would alert if an index is missing data feeds from hosts? on Splunk Search. 02-13-2019 12:58 PM
- Tagged How do I schedule a recurring search that would alert if an index is missing data feeds from hosts? on Splunk Search. 02-13-2019 12:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
06-02-2019
10:19 AM
Hi David. Thanks for helping me get started.
In my example, would I create three instances/copies of the MS SQL add-on, ie. Splunk_TA_microsoft-sqlserver_Grp1, Splunk_TA_microsoft-sqlserver_Grp2, and Splunk_TA_microsoft-sqlserver_Grp3, each with its own inputs.conf?
Or could I achieve the same goal by creating a fourth instance of the MS SQL add-on with the folder structure shown below (with \local but no inputs.conf) pushed out to all SQL hosts:
\Splunk_TA_microsoft-sqlserver
license-eula.txt
license-eula.rtf
app.manifest
README.txt
\lookups
\metadata
\default
\samples
\static
\local
eventtypes.conf
tags.conf
app.conf
sqlserver_dbx2.conf
db_input_templates.conf
eventgen.conf
transforms.conf
(NO inputs.conf)
props.conf
savedsearches.conf
\data
And each SQL host will then get a second app with just the inputs.conf customized with the proper perfmon stanzas:
\Splunk_TA_microsoft-sqlserver_Grp1
\local
inputs.conf
\Splunk_TA_microsoft-sqlserver_Grp2
\local
inputs.conf
\Splunk_TA_microsoft-sqlserver_Grp3
\local
inputs.conf
So each SQL host will get two apps - the complete SQL add-on app and a custom add-on with just inputs.conf. Is the second method do-able and am I making it more complicated than it needs to be?
... View more
06-01-2019
10:54 AM
Hi. With the MS SQL add-on, how would I go about ingesting specific SQL perfmon source types on selected hosts? For instance, ingest perfmon:sqlserverhost:processor from hosts A, B and C. On host D, perfmon:sqlserverhost:processor and perfmon:sqlserverhost:memory. And on every other SQL hosts, ingest all perfmon source types perfmon:sqlserverhost:*.
... View more
05-29-2019
02:51 PM
Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?
... View more
02-13-2019
12:58 PM
Hi.
I need to schedule a recurring search that would alert/email me if an index, say "web", is missing data feeds from any of the expected hosts, say web1, web2 and web3, in the past hour. What would this search term be?
In other words, combine three separate scheduled searches into one:
index=web host=web 1 | head 1
index=web host=web 2 | head 1
index=web host=web 3 | head 1
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-07-2020
08:30 PM
|
