About oreoshake

oreoshake · ‎07-24-2011

I have log files with color codes and control characters that we'd like to strip because they clutter the search results. In a few cases, we've just removed them from the file with the commands found at http://www.commandlinefu.com/commands/view/3584/remove-color-codes-special-characters-with-sed It used to be a one off case, but now it is the standard case. It seems there is some global setting I might be missing. Or is this something that I would have to use a transform for? EDIT So based on http://www.splunk.com/base/Documentation/4.1.4/Admin/Configurecharactersetencoding which says "Splunk escapes the invalid characters as hex values (for example: "\xF3")." It appears my file encoding was set wrong. Is there a way to just tell splunk to ignore the characters?

oreoshake · ‎08-22-2010

I would definitely be interested if this ever changes. I've seen CPUs (24 cores) idling most of the time and I figure we might as well use them for something.

oreoshake · ‎07-08-2010

I believe that is the session timeout for logged in users and has nothing to do with the SSL problem. 1 hour to do an SSL handshake? OUCH

oreoshake · ‎07-06-2010

Yep, I've done it. 32-bit splunk 3.4.11 indexes -> 4.0.3 64 bit host

oreoshake · ‎07-06-2010

I am trying to create a report that notifies me when a host starts sending an unusual amount of data by using the summary index data. I suppose I could just use the metrics data as is

oreoshake · ‎07-01-2010

I have some summary index data that is stored with sistats: index="_internal" group="per_host_thruput" source=*metrics.log | eval megs=kb/1024 | fields series,kb,megs | sistats sum(megs) by series I'd like to do a delta on some of this data but I'm not quite sure which events/fields I should use since sistats does some massaging of the data. index=summary prestats_reserved_type=sum | delta prestats_reserved_val as delta_megs This will get the delta info that I need, but index=summary prestats_reserved_type=sum | delta prestats_reserved_val as del | stats max(del) by series Returns nothing. Any thoughts?

oreoshake · ‎06-24-2010

Not that this is a good idea...but couldn't you push a script to etc/apps/APP/bin that copies itself or another file to etc/system/bin? Just have it run once, then remove it. I've thought about using this strategy to push things to dirs outside of etc/apps but I haven't found a NEED to do so. This is a potentially damaging scenario.

oreoshake · ‎06-17-2010

They also recommend running bonnie++ as it mimics Splunk disk usage

oreoshake · ‎06-14-2010

Do you think splunk could scale to 1 petabyte a day? What is the amount indexed by the largest installation out there?

oreoshake · ‎06-03-2010

sourcetype=package_formatted [search sourcetype=package_formatted | stats dc(version) as version_test by name | search version_test>1 | fields name] | dedup host | stats values(version) by name Basically what I'm trying to do is figure out which packages are installed and see if they are of consistent version numbers across the infrastructure. sourcetype=package_formatted | stats dc(version) as version_test by name | search version_test>1 Works fine, only returns the packages where more than one version exists, but I noticed the fields command at the end didn't have an effect (all fields were returned). But when I put it in the subsearch, I'm getting back "name"s which weren't in the subsearch. So is a reporting function like stats ignored and only the raw results are used?

oreoshake · ‎06-03-2010

Thanks, facepalm

oreoshake · ‎06-02-2010

Will do, I'll reference your case number

oreoshake · ‎06-02-2010

Still on 4.0.11 The first search stopped returning results around the time of my other ones, the second search returns results probably because it comes from the forwarders themselves.

oreoshake · ‎06-02-2010

Somewhat odd behavior, my deployment server stopped generating log entries. I've been using the searches from http://answers.splunk.com/questions/2038/whats-the-best-way-to-monitor-deployment-activity to monitor activity but the entires have pretty much stopped. Specifically, these searches don't return anything in the past week or so index="_internal" sourcetype="splunkd" source=*metrics.log Component="DeploymentMetrics" index=_internal sourcetype=splunkd Component="DeployedApplication" source="/opt/splunk/var/log/splunk/splunkd_access.log" index=_internal /services/broker/phonehome | rex "/services/broker/phonehome/connection_[\\d|\\.]*_\\d*_(?<src>.*)_(?<client>.*)_" | dedup client Yet, my deployment server still works. I can see new apps being deployed, the forwarders are restarting, etc. This was helpful because we have a forwarder deployed on a machine that I cannot access. I can see via the rest interface that the apps that should have been deployed have not been deployed so I want to make sure it can at least phone home. Any ideas why my logs went silent?

oreoshake · ‎06-02-2010

I was including index=os, the command runs fine, and no errors were returned in that search. Hmm.

oreoshake · ‎06-02-2010

env[home] = linux, centos, splunk 4.0.11, everything on one test box cat /opt/splunk/etc/apps/unix/bin/uname.sh #!/bin/sh uname -a cat etc/apps/unix/local/inputs.conf [script:///opt/splunk/etc/apps/unix/bin/uname.sh] disabled = false index = os interval = 30 sourcetype = uname I've set the interval pretty low just to get the script to execute but it isn't working. File permissions are 755 on that file and other scripted inputs work fine. Any ideas? Any logs to check? Also, if I search _internal for per_sourcetype_thruput, entries for this sourcetype are returning non-zero values so Splunk is doing something with it... There are no errors related the file not existing or not being under $SPLUNK_HOME...

oreoshake · ‎05-18-2010

No sourcetype was set in inputs.conf, causing it to be set by props.conf in the learned app, thus ignoring my second props entry that was less specific. After setting the sourcetype in inputs.conf and deleting the entries in the learned app, I had to remove the trailing * to get the transform to be applied.

oreoshake · ‎05-18-2010

I deleted the entries in etc/app/learned/local/props.conf. Also, the sourcetype originally wasn't set in inputs so it's possible that the learned types were causing my transform to be skipped. I fixed this so the sourcetype is set in inputs.conf but my transform still isn't being applied

oreoshake · ‎05-14-2010

Hmm, maybe you have a transform changing the sourcetype. I'd run the same command but replace wmi with props and search for those values. Or check the props.conf on your indexer?

oreoshake · ‎05-14-2010

We are using "heavy" forwarders, but I have the following config on both the forwarder and the indexer but the events are not being dropped for some reason. A typical event that we are trying to drop looks like this: =INFO REPORT==== 14-May-2010::00:00:54 === closing TCP connection <0.17671.5> from 10.1.1.1:12345 sourcetype=rabbit props.conf [rabbit*] TRANSFORMS-rabbit=rabbit transforms.conf [rabbit] REGEX=(?m)INFO REPORT DEST_KEY=queue FORMAT=nullQueue The sourcetype is set in inputs.conf, I have removed all references to rabbit in the learned app

oreoshake · ‎05-13-2010

Try running C:\Program Files\Splunk>bin\splunk.exe cmd btool --debug wmi list That will show if any configs are clobbering other settings

oreoshake · ‎05-12-2010

This did not help, /etc/shadow is still showing up 😞

oreoshake · ‎05-05-2010

I'm starting to get a lot of these errors on my forwarders. Any suggestions? Pushing /etc/security/limits.conf doesn't sound ideal. I'm running heavy forwarders as root.

oreoshake · ‎05-05-2010

Thanks, this certainly makes sense. I do see the fschange events but I was only worried about the text being indexed. It actually came up when I was demoing the *nix app!!! The weird thing is that it is very sporadic. My indexers and forwarders pretty much share the same config for the *nix app, but it was only seeing /etc/shadows from 2 of my 3 indexers and none from my forwarders. Odd. I will accept the answer if I don't see any events for a while. I created a saved search to automatically delete these events.

oreoshake · ‎05-05-2010

unix [monitor:///etc] unix _blacklist = (/etc/shadow) system _rcvbuf = 1572864 unix _whitelist = (\.conf|\.cfg|config$|\.ini|\.init|\.cf|\.cnf|shrc$|^ifcfg|\.profile|\.rc|\.rules|\.tab|tab$|\.login|policy$) system host = blah.blah.com unix index = os /etc/shadow is being indexed and I can't figure out why. This is the only stanza related to /etc other than the fschange stanza. Does fschange index the files it monitors? We don't want /etc/shadow indexed 🙂 I added the _blacklist entry but that didn't do anything.

Posts	65
Solutions	5
Karma Given	54
Karma Received	72
Member Since	‎02-23-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Strip control/color codes

Using Summary Index Data

Do you think splunk could scale to 1 petabyte a da...

Passing subsearch reporting command results to the...

Deployment Server Log Entries Stopped

Scripted input not showing up in search results

Yet Another Problem Sending Events to the nullQueu...

Too many open files on forwarders

Why is /etc/shadow being indexed? Does fschange i...

"Failed to set cookie. Ensure cookies are enabled ...

Strip control/color codes

Re: splunk searches to be multithreaded in a singl...

Re: Odd Deployment Server Log Entry - Received mes...

Re: Is 32-bit OS Splunk indexes compatible with 64...

Re: Using Summary Index Data

Using Summary Index Data

Re: How do I get a script pushed to all forwarders...

Re: How can I measure I/O on my Splunk hardware?