Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About BuzzLights10
BuzzLights10
Explorer
Member since:
06-01-2021
12-05-2023
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 06-01-2021 |
Activity Feed
- Posted Re: How do I get a list of all my lookups with their file size? on Splunk Search. 12-05-2023 07:42 AM
- Posted Re: How do I get a list of all my lookups with their file size? on Splunk Search. 12-05-2023 07:29 AM
- Posted How do I get a list of all my lookups with their file size? on Splunk Search. 12-05-2023 06:28 AM
- Karma Re: Why are there Delay/Missing logs from UF source? for Roy_9. 05-10-2022 08:07 AM
- Posted Re: Why are there Delay/Missing logs from UF source? on Getting Data In. 05-10-2022 08:06 AM
- Posted Re: Why are there Delay/Missing logs from UF source? on Getting Data In. 05-09-2022 05:08 AM
- Posted Why are there Delay/Missing logs from UF source? on Getting Data In. 05-06-2022 05:38 AM
- Karma Re: How to stop index extraction fields displaying on the search head?? for richgalloway. 06-04-2021 10:56 AM
- Posted Re: How to stop index extraction fields displaying on the search head?? on Getting Data In. 06-04-2021 09:37 AM
- Posted How to stop index extraction fields displaying on the search head?? on Getting Data In. 06-01-2021 05:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
12-05-2023
07:42 AM
A majority of these are blacklisted from bundle replication and only exist on the SH cluster. I will check this out still. Thanks!
... View more
12-05-2023
07:29 AM
Hey @richgalloway , Thanks for the reply! Would I need to run this over a larger time range to get as many lookups in as possible? Any approximate how large a range would get the best results??
... View more
12-05-2023
06:28 AM
Hey Splunkers, I wanted to get a list of all the lookup files on my SH and their file sizes along with other data. I can't get the size from the rest API. Appreciate any and all answers. Below are the searches I've been trying to use: | rest/servicesNS/-/-/data/lookup-table-files | rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path | table title owner sharing app |foreach title [| inputlookup <<FIELD>> | foreach * [| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] | addtotals b_* fieldname=b | stats sum(b) as b | eval mb=b/1000/1000, gb=mb/1000 | fields mb] The foreach does not allow non-streaming commands and thus this does not work. Using a direct eval like below: | rest/servicesNS/-/-/data/lookup-table-files | rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path | table title owner sharing app |eval size= [| inputlookup 'title' | foreach * [| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] | addtotals b_* fieldname=b | stats sum(b) as b | eval mb=b/1000/1000, gb=mb/1000 | fields mb] This also does not work since the inner search cannot see the outer values. I have been trying to work with subsearches, foreach and the map command but couldn't get anywhere. Thanks in advance folks
... View more
05-10-2022
08:06 AM
@Roy_9 Thanks a lot for the pdf link, that's very helpful. We increased the thruput in limits.conf and did the same for the maxSize in the parsingQueue stanza in server.conf As of now, we can see a larger volume of data from the servers we increased the limits on and there is no delay in the past 12 hours either. Will probably do the same for the rest of them as well. Thanks for your answers everyone!!
... View more
05-09-2022
05:08 AM
Thank you for all the answers! In our last session we identified that these log files were hitting the size limit and getting rolled over as a .txt file every 30 mins, which later got archived every 24 hours. We are currently not monitoring any .txt files so gonna try that first. @isoutamo the block errors we saw were far and few in between, but if this doesn't solve it then we will be looking into increasing the throughput in limits.conf @Roy_9 Thanks for the answer, is there any way you were able to determining the optimal value without overprovisioning kbps in limits.conf?? Or is trial and error the only way? Also, would any other logging be affected by this change? @PickleRick no whitelist/blacklist rules in play at the moment, we will probably change the throughput in limits.conf next Will keep you guys updated on this..thanks again for the answers!
... View more
05-06-2022
05:38 AM
Hello all,
I have a clustered indexer and SH environment.
I'm now noticing that there's a long delay in some of my data showing up. I can see that the logs are being continuously generated at the source but they do not show up in Splunk until a long time later.
Some items I'm not able to search on until the next day. The UF is set to monitor a directory with all .log files to be read and sent to Splunk. No issues with permissions and no fw blocks either. Additionally, the exact same configurations seem to work on my qa servers but not on the prod ones. The biggest difference between the two is the log volume, approximately in the ratio 1:600 qa to prod. Also, the file is set to roll over to archive once it hits the size of 50MB. Does this have something to do with the zipping/archiving? Splunk unable to read when other processes are writing to the file, reach the limit and zip before Splunk can do anything?? Or would this concern something in the pipelines or limits.conf? All help is appreciated.
... View more
Labels
- Labels:
-
inputs.conf
-
source
-
universal forwarder
-
XML
06-04-2021
09:37 AM
Hi @richgalloway Thank you for the reply . On some data sets when I need to see the detailed list of fields or to only see the fields i've manually extracted(basically running in smart or verbose)...is there any way to not display these default fields then?? Thanks again!
... View more
06-01-2021
05:59 AM
Hello Community, I want to remove a select few fields which are extracted by default like punct, splunkserver, etc. By remove, I mean I do not want these fields to be displayed when I search for data in these indexes on the Search head. I went through many posts but could not find anything appropriate as to how this can be achieved in the back end. Maybe I am missing something on the props or fields.conf files?? Any help is appreciated!
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-05-2023
11:18 AM
|
