Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mcdp_matsumoto
mcdp_matsumoto
New Member
Member since:
03-11-2019
09-28-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-11-2019 |
Activity Feed
- Posted Some Japanese is not searchable, what should I do?（日本語が検索されません。） on Splunk Enterprise. 09-28-2020 02:00 AM
- Posted how to restore TSIDX on Deployment Architecture. 04-16-2020 02:13 AM
- Tagged how to restore TSIDX on Deployment Architecture. 04-16-2020 02:13 AM
- Tagged how to restore TSIDX on Deployment Architecture. 04-16-2020 02:13 AM
- Tagged how to restore TSIDX on Deployment Architecture. 04-16-2020 02:13 AM
- Tagged how to restore TSIDX on Deployment Architecture. 04-16-2020 02:13 AM
- Posted If I comment out the "enableTsidxReduction", will TSIDX be recreated? on Deployment Architecture. 04-12-2020 08:03 PM
- Tagged If I comment out the "enableTsidxReduction", will TSIDX be recreated? on Deployment Architecture. 04-12-2020 08:03 PM
- Tagged If I comment out the "enableTsidxReduction", will TSIDX be recreated? on Deployment Architecture. 04-12-2020 08:03 PM
- Posted サーチが遅れている旨のエラーが表示される。 on Splunk Search. 04-08-2020 01:11 AM
- Tagged サーチが遅れている旨のエラーが表示される。 on Splunk Search. 04-08-2020 01:11 AM
- Tagged サーチが遅れている旨のエラーが表示される。 on Splunk Search. 04-08-2020 01:11 AM
- Posted Re: How to get API at specified time with "Splunk Add-on Builder". on All Apps and Add-ons. 01-28-2020 12:54 AM
- Posted How to get API at specified time with "Splunk Add-on Builder". on All Apps and Add-ons. 01-28-2020 12:49 AM
- Tagged How to get API at specified time with "Splunk Add-on Builder". on All Apps and Add-ons. 01-28-2020 12:49 AM
- Tagged How to get API at specified time with "Splunk Add-on Builder". on All Apps and Add-ons. 01-28-2020 12:49 AM
- Posted "Project_migration_tool" of "splunk add-on builder" does not work because "python3" is not included in "Splunk8.0.1" of "docker". on Getting Data In. 01-21-2020 01:35 AM
- Tagged "Project_migration_tool" of "splunk add-on builder" does not work because "python3" is not included in "Splunk8.0.1" of "docker". on Getting Data In. 01-21-2020 01:35 AM
- Posted Re: I want to know when there is a change in the user list. on Alerting. 01-07-2020 12:25 AM
- Posted I want to know when there is a change in the user list. on Alerting. 01-05-2020 11:16 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-28-2020
02:00 AM
I want to search logs like this.（このようなログを検索したいのですが、）
{
Operation:hoge
Workload:ほげ
}
This search works fine: (この検索は正しく動作するのですが、)
index="default" Operation="hoge"
But this search doesn't work:（この検索は正しい動作をしません。）
index="default" Workload="ほげ"
I would like to be able to search in Japanese as well, but what should I do?（日本語でも検索できるようにしたいのですが、どのようにすればよいでしょうか。）
... View more
- Tags:
- japanese
Labels
- Labels:
-
configuration
04-16-2020
02:13 AM
I am trying to execute the following command to restore TSIDX.
splunk rebuild "bucket directory"
What is correct to specify for "bucket directory"?
Some start with "db_" or "rb_" and some end with ".rbsentinel".
$ sudo -u splunk ls /opt/splunk/var/lib/splunk/someindex/db
CreationTime
GlobalMetaData
db_1575255638_1550733795_1_2EB5DD1B-EBFC-4678-A599-3C90C8E80123
db_1575255638_1550733795_1_2EB5DD1B-EBFC-4678-A599-3C90C8E80123.rbsentinel
db_1575255638_1550733795_4_2EB5DD1B-EBFC-4678-A599-3C90C8E80123
db_1575255638_1550733795_4_2EB5DD1B-EBFC-4678-A599-3C90C8E80123.rbsentinel
db_1583828795_1575944480_0_2EB5DD1B-EBFC-4678-A599-3C90C8E80123
db_1583828795_1575944480_0_2EB5DD1B-EBFC-4678-A599-3C90C8E80123.rbsentinel
db_1585128403_1583828817_2_2EB5DD1B-EBFC-4678-A599-3C90C8E80123
db_1585128403_1583828817_2_2EB5DD1B-EBFC-4678-A599-3C90C8E80123.rbsentinel
db_1585209454_1575944480_3_2EB5DD1B-EBFC-4678-A599-3C90C8E80123
db_1585209454_1575944480_3_2EB5DD1B-EBFC-4678-A599-3C90C8E80123.rbsentinel
db_1585894857_1585209525_5_2EB5DD1B-EBFC-4678-A599-3C90C8E80123
db_1585894857_1585209525_5_2EB5DD1B-EBFC-4678-A599-3C90C8E80123.rbsentinel
db_1586917200_1580354616_6_2EB5DD1B-EBFC-4678-A599-3C90C8E80123
db_1586917200_1580354616_6_2EB5DD1B-EBFC-4678-A599-3C90C8E80123.rbsentinel
db_1586918400_1586916300_7_2EB5DD1B-EBFC-4678-A599-3C90C8E80123
rb_1561972997_1550733795_1_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1561972997_1550733795_1_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5.rbsentinel
rb_1561972997_1550733795_4_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1561972997_1550733795_4_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5.rbsentinel
rb_1575255638_1550733795_7_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1583828450_1564380558_0_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1583828450_1564380558_0_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5.rbsentinel
rb_1585128180_1583828597_2_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1585128180_1583828597_2_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5.rbsentinel
rb_1585295925_1564380558_3_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1585295925_1564380558_3_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5.rbsentinel
rb_1585894871_1585295926_5_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1585894871_1585295926_5_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5.rbsentinel
rb_1585901346_1575944480_6_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1586917500_1585901374_8_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
rb_1586918400_1586917500_9_C03F81F1-D923-458D-B4BE-0D5C6DF1EBC5
... View more
Labels
- Labels:
-
indexer clustering
04-12-2020
08:03 PM
If I comment out the following settings, will TSIDX be recreated?
enableTsidxReduction = true
timePeriodInSecBeforeTsidxReduction = 864000
The following is the contents of indexes.conf
vi /opt/splunk/etc/master-apps/_cluster/local/indexes.conf
[onepocket]
coldPath = $SPLUNK_DB/onepocket/colddb
homePath = $SPLUNK_DB/onepocket/db
thawedPath = $SPLUNK_DB/onepocket/thaweddb
enableTsidxReduction = true
timePeriodInSecBeforeTsidxReduction = 864000
frozenTimePeriodInSecs = 63072000
repFactor = auto
... View more
Labels
- Labels:
-
indexer
04-08-2020
01:11 AM
サーチが遅れている旨のエラーが表示されるようになりました。
どのサーチがどのくらい遅れているのか、状況を確認したいのですが、
どのように確認するのが適切でしょうか。
【エラー内容】
The percentage of non high priority searches delayed (21%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=669. Total delayed Searches=141
... View more
01-28-2020
12:54 AM
We are developing an app using the python code of "Add-on Builder".
... View more
01-28-2020
12:49 AM
How to get API at specified time with "Splunk Add-on Builder".
How to get API at specified date and time with "Splunk Add-on Builder"?
I don't want to get API at a specific interval.
... View more
01-21-2020
01:35 AM
"Project_migration_tool" of "splunk add-on builder" does not work because "python3" is not included in "Splunk8.0.1" of "docker".
Specifically, the error "builtins module is missing" appears.
What should I do ?
... View more
01-07-2020
12:25 AM
Thank you for your answer.
Finally, my solution is as follows. Thank you very much.
json
[
{
id: xxxxxx
login: tom
},
{
id: yyyyyy
login: aina
},
・
・
・
]
spl
your_search | spath {}.login
| eval user_list='{}.login'
| table user_list
| append [ search your_search
| spath {}.login
| eval user_list='{}.login'
| table user_list ]
| stats dc(user_list) as count
| where count > 1
... View more
01-05-2020
11:16 PM
I want to know when there is a change in the user list.
For example, if you get the following json once a day, I want to send an alert if a user has been added or deleted compared to the previous day's json.
Is there any way?
{
1: tom
2: nick
3: potter
4: aina
}
... View more
12-12-2019
12:09 AM
thank you.
Solved the problem.
... View more
12-10-2019
05:54 PM
Thank you for response.
Please let me know the setting to send logs from "Seach Header" to indexer. The document cannot be found.
... View more
12-09-2019
06:56 PM
Thank you for looking.
I would be grateful if you help me.
＝＝日本語＝＝
以下の構成のSplunkがあります。
SeachHeader 1
ClusterMaster 1
Indexer 2
licenceMaster/DeployMaster 1
「GitHub Addon」を「SeachHeader」にインストールしました。
githubからログを取得する設定を入れました。
なぜかログが「SeachHeader」に蓄積されてしまいます。
githubのログを「Indexer」に蓄積する方法はないでしょうか。
＝＝English＝＝
There is a Splunk with the following configuration.
SeachHeader 1
ClusterMaster 1
Indexer 2
licenceMaster / DeployMaster 1
Installed “GitHub Addon” on “SeachHeader”.
Added a setting to get logs from github.
For some reason logs are accumulated in "SeachHeader".
Is there any way to accumulate github logs in "Indexer"?
... View more
03-12-2019
02:26 AM
ご回答ありがとうございます。
試したら結果を連携します。
しばらくお待ちください。
... View more
03-11-2019
12:44 AM
universal forwarder経由で取り込んだログが途中で途切れてしまいます。
一行約4050文字でログの取り込みをやめてしまうようです。
そのログは一行一行がとても長いです。
splunkに行の最後まで読み込ませたいのです。
何か方法はありますか。
Google Translate:
Logs imported via universal forwarder are cut off halfway.
It seems that it stopped fetching the log with about 4050 characters per line.
One line of that log is very long.
I want to make splunk read until the end of the line.
Is there any way?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-28-2020
05:31 AM
|
