About warmup031

warmup031 · ‎08-20-2020

Many thanks for your Quick reply 🙂

warmup031 · ‎08-20-2020

Hello, when the trial version expires, is it possible, when re installing splunk, to keep the buckets from old splunk installation ? thank you

warmup031 · ‎07-22-2020

Hello, I'm trying to send rsyslog logs via ssl to indexer (splunk version 8), the logs are received by the indexer but not readable (which is my problem, logs are not decrypted). I've configured the input.conf like this : tcp-ssl://8514] Sourcetype = syslog disabled = false index = linux [SSL] password = #requireClientCert = false rootCA = $SPLUNK_HOME/etc/auth/xxx.ca-bundle serverCert = $SPLUNK_HOME/etc/auth/xxx.crt netstat show the tcp/8514 opened for splunkd on indexer and btool /opt/splunk/etc/apps/search/local/inputs.conf [tcp://8514] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/apps/search/local/inputs.conf connection_host = dns /opt/splunk/etc/system/local/inputs.conf host = xxxxx.fr /opt/splunk/etc/apps/search/local/inputs.conf index = linux /opt/splunk/etc/apps/search/local/inputs.conf sourcetype = syslog Thank you for your help

warmup031 · ‎06-26-2020

Hello, I have to update the $SPLUNK_HOME/etc/system/local/limits.conf of clustered indexer, with new parameters. I'll have to create an app on deployment server to deploy it to indexers via masternode. In the app, do I need to create a limits.conf with all parameters already existing on the indexers limits.conf + the new parameters to add, or do I have to put only the new parameters to add to the limits.conf ? Thank you for your help

warmup031 · ‎05-14-2020

Hello Giuseppe, Many thanks for your reply. But is it possible (with "stats count" or timechart with span=1h), to get hosts with the less events or with zero events with span=1h for a day received by the forwarder ? Thank you

warmup031 · ‎05-14-2020

Hello, We have had a forwarder that has its disk full several times in a weekend, So some hosts were not able to send their logs to this forwarder while splunk forwarder disk was full. how to list hosts (and know period for each host that sent no logs while this period. there are +100 hosts behind this forwarder, so a host=xxx | timechart count by host would not be efficient. Thank you for your help

warmup031 · ‎04-20-2020

Hello Codebuilder, The error would come from manual searches not from scheduler. In Dmc you talk about scheduled searches skipped ? or something else. I'm searching for manual searches in error. Thank you

warmup031 · ‎04-20-2020

Hello, I would like to know how to find searchs that do not succeed (no results or with errors) ? Some users complains about the fact that searchs does not give any results, and I would like to find if there is a search to find these errors (are there any errorcode to find, or else ?) Thank you

warmup031 · ‎04-01-2020

Wonderful, thank you very much Giuseppe

warmup031 · ‎04-01-2020

Hello gcusello and adonio, I already tried thèse search but my main problem is to set each sourcetype as a column, hosts as row and get sourcetype count valid for each host Thank you

warmup031 · ‎04-01-2020

Hello, I would like to Check for each host, its sourcetype and count by Sourcetype. I tried host=* | stats count by host, sourcetype But in fact I need all the sourcetypes to be set as column, and get the count by host for each sourcetype. Can you help ? Many thanks

Posts	11
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎04-01-2020

Online Status	Offline
Date Last Visited	‎08-20-2020 11:37 AM

Splunk trial

rsyslog ssl to indexer

modify/update limits.conf on indexer cluster

hosts event log lost behind a splunk forwarder

searchs that does not succeed

Sourcetype count per host

Re: Splunk trial