About viramamo

viramamo · ‎06-21-2021

Hi, We want to add Q server to our development activities, where we used to have only one server earlier, which is enterprise standalone splunk instance, to be little precise i name it as 'A' which is also the production one. Now we have to maintain P and Q server separately for production and testing. Current splunk enterprise instance 'A' is a standalone and we continue with the production activities on it. But. to have Q server live. we have to move the Apps and data (A/Production server) in index to Q server for testing. Before migrating, i was trying to point splunk enterprise Q server's(B instance) search head to splunk enterprise P server's(A instance) indexer. As this could make our Q server availability in a faster way. Enterprise standalone splunk Q(B) search head -> Enterprise standalone splunk P(A) indexer It could be great, if i was guided to configure the above one or any directions in terms of distributed or indexer clustering,or adding peers. Advance thanks.

viramamo · ‎05-11-2021

Hi Splunkers, I am trying to achieve a customized tool tip to be shown for all the available bars in the chart on mousehover on a specific legend of a specific bar in a bar chart. I have checked different answers, but still finding difficult crack this one. For reference please find the image attached, 1) Tool tip should be customized with only the number shown below, need to remove the other information. 2) On mousehover on any one of the bars, the tooltip with the value count(number) for other bars should also be displayed on their respective bars along with bar on which the mousehover was happening. ex: In below bar chart, the tool tip on mousehover on the left most bar should also bring the tool tip for the other 3 bars available to its right in their respective bars. Where the tooltip should only contain the passed(legend) value, which is total count/number of passed. Please suggest me the available options, which I can try,. Advance thanks for the support.

viramamo · ‎03-11-2020

Hi, We have a single server machine, where Splunk enterprise edition is installed. Configurations, CPU - 1 Cores - 8 RAM - 32 GB We have implemented several dashboards, charts and tables. Also, where more than 5 users will concurrently access these datas. Due to which, we faced lot of performance issue, such as waiting for queue or maximum concurrent search was reached. Because of which we were forced to change the default configuration in limit.conf and update the following attributes, max_searches_per_cpu=4 base_max_searches=6 Now, according to the formula, No of Concurrent searches = 4 *(1*8) + 6 = 38 (as per my understanding it will handle 38 searches concurrently) After the changes, Where it reaches max of 56 concurrent searches and CPU usage of around 80 to 90 percent. Questions, Is this configuration is recommended? please suggest the nos for the attributes or alternate approach for the current system configurations? Many thanks.

viramamo · ‎12-12-2019

Hi woodcock, Thanks for your reply. When I interpret your answer. I understand that I can create a cron job for checking a file was been successfully monitored or not. If I am correct, I am not looking for this. Let me try to put my question in a simpler terms, How to make universal forwarder to understand that splunk instance was successfully indexed the file it was sent to it by the universal forwarder through monitoring process. Can monitoring stanza in universal forwarder can receive the success/failure response from Splunk server. By which universal forwarder will come to know indexing for the data source happened or not. Many Thanks, Vignesh

viramamo · ‎12-01-2019

Hi Giuseppe, Thanks for your reply. Probably I know Its been a while. I do understand Monitoring UF and alert in Splunk server is two different process. But that's what I am trying bridge here. Step1: Monitor file in UF Step2: Alter from splunk server Step3: Trigger script I haven't found any cross server process execution. The only solution I could found is, alert based on script. But It is not done in UF rather it is done in Splunk server. But, there is an alternative way, Step1: Monitor file in UF Step2: Alert if file got indexed in Splunk server. Also Alert needs to execute script in Splunk server which needs to send some sample file with status string to UF. Step3: Have a file monitoring stanza and which will run pre-processor script in UF(Trigger happens via file monitor rather than waiting for input from splunk server). Again thanks for your reply. I hope my alternative way will work. Any thoughts on that. Thanks Vignesh

viramamo · ‎10-24-2019

Hi gcusello, Your idea of using alert is what I already planned to do. But problem in using alert is, on successful alert of the indexing. I do need to run the script from Splunk, where I guess I need to place the script file in Splunk instance server, where splunk is running. But my forwarder is running in different machine. Splunk Instance and Universal forwarder are running in two different machine. The script which will run an application hosted in forwarder. It is better to have the script running in forwarder under pre-processing. It will be, EX: Forwarder: Step1: Mointor -> file1 -> Index -> file1 -> Splunk Server Step2: Pre-process -> script -> trigger an application -> output log - > Splunk Server Both, needs to be done in forwarder machine, using alert the script will be running in splunk server. Which is not what I wanted. Thanks for your reply, Thanks, Vignesh

viramamo · ‎10-23-2019

Hi gcusello, If my requirement is to schedule a script and monitor the output/result of the script execution(may be a file), then your solution will be right. But my need is to monitor files which is different process altogether. Once the monitoring of files is success(the success criteria may be indexing). Then I need to run the script for pre-processing a different file. I want to synch process 1(file monitoring) with process 2 (running script) to make a sequential execution. That process 2 must be trigger only on process 1 completion.

viramamo · ‎10-23-2019

Hi, In Universal Forwarder(Windows), I have scenario where I need to run my pre-processing scripts after file from remote machine was successfully monitored, input.confg Step 1: [monitor:\\UnitTest\r.xml] disable`enter code here`d=false index=test sourcetype=r_xml_component Output: r.xml indexed in SPLUNK Step 2: Step 1 successful completion [script://C:\Program Files\SplunkUniversalForwarder\etc\system\bin\Run.bat] index=test1 interval=1800 disabled = false sourcetype=log4j source=test How to link Step 1 result with Step 2 Help is appreciated, Many thanks

viramamo · ‎10-23-2019

Indexing of different sourcetypes such as .xml to Splunk from Jenkins is not possible, but indexing key:value pair in format of .csv or .json is possible again with its own limitations. This is due to HEC in splunk, which listens to only one sourcetype also it needs to be in key:value pair. Jenkin's Splunk Plugin is an agent which forwards the data by parsing the files in jenkin's system, if the data of the file is of key:value pair, then they will be sent in the events key in the Json paylod to HEC ex: {"events":"key:value"}. But what if the data of the file is not key:value pair ex: xml, then there is no guarantee that the exact key:value pair will be extracted out of the xml. Due to which the data extraction by the jenkin's splunk plugin agent will be failed for non key:value pair sourcetypes. Basically, HEC of Splunk has limited usecase. The communication between Jenkins to Splunk happens through this will not be useful for indexing all the files with different file format. Solution: There needs to be conversion scripts in jenkins side to convert all the non key:value pairs to key:value pair. This will help in indexing appropriate data into splunk, but again it cannot be mapped to more than one sourcetype.

viramamo · ‎08-21-2019

Hi, I need to send files(ex: XML and CSV) from Jenkins to Splunk. For which, I have integrated Jenkins and Splunk using below, 1) Jenkins app in Splunk(Splunk app for Jenkins) and 2) Splunk plug-in in Jenkins In Jenkins, I have configured "Custom Metadata" like this [Data Source->'logfile', Config Item-> 'Source Type', Value->'custom_xml_sourcetype' ] [Data Source->'logfile', Config Item-> 'Source Type', Value->'csv' ] In Splunk, Indexed files(ex: a.xml and b.csv) has the same sourcetype ->'custom_xml_sourcetype'. Ideally both needs to be mapped to the exact sourcetypes. Which should be like this, a.xml -> 'custom_xml_sourcetype' b.csv->'csv' but, it is currently mapped like this, a.xml -> 'custom_xml_sourcetype' b.csv->'custom_xml_sourcetype' It is not certain, how to map the sourcetypes to the correct file. Also, There is no job level config information available as well. My Requirements is very simple to get different files generated from the jenkins build artifact to splunk with different sourcetypes. Where the Jenkins is configured as Master -> Slave setup. Kindly suggest me it is possible to use the Jenkin's splunk plug-in app or go with different approach. Many thanks.

Posts	10
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎08-21-2019

Online Status	Offline
Date Last Visited	‎06-24-2021 12:49 AM

Splunk enterprise standalone search head to point ...

Show customized tool tip on mousehover for all the...

Recommended No of Concurrent searches for the curr...

How to make Universal Forwarder to run script afte...

Problem in indexing different sourcetypes from jen...

Splunk enterprise standalone search head to point ...

Show customized tool tip on mousehover for all the...

Recommended No of Concurrent searches for the curr...

Re: How to make Universal Forwarder to run script ...

Re: How to make Universal Forwarder to run script ...

Re: How to make Universal Forwarder to run script ...

Re: How to make Universal Forwarder to run script ...

How to make Universal Forwarder to run script afte...

Re: Problem in indexing different sourcetypes from...

Problem in indexing different sourcetypes from jen...