Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About effem
effem
Communicator
Member since:
11-13-2013
08-16-2022
Community Statistics
| Posts | 41 |
| Solutions | 3 |
| Karma Given | 26 |
| Karma Received | 10 |
| Member Since | 11-13-2013 |
Activity Feed
- Got Karma for Re: How to resolve "Problem replicating config (bundle) to search peer 'xxxxx.yyyy.com:8089', got http response code 400 HTTP/1.1 400 Unparsable URI-encoded request data."?. 12-22-2021 08:17 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 10-20-2021 06:23 AM
- Karma Re: Trying to fix the corrupted bucket. Error - JournalSliceDirectory: Cannot seek to rawdata offset 0 for amitm05. 08-24-2021 01:47 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-19-2021 09:48 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 04-07-2021 08:45 AM
- Karma Re: macro with eval-based definition: error - the definition is expected to be an eval expression that returns a string. for martin_mueller. 06-05-2020 12:50 AM
- Karma Re: Splunk FSCK exitCodes for richgalloway. 06-05-2020 12:50 AM
- Karma Re: SF and RF never met while adding an indexer to multi-site cluster for mchang_splunk. 06-05-2020 12:50 AM
- Karma Re: Splunk REST interface slow for DavidHourani. 06-05-2020 12:50 AM
- Got Karma for Re: Trying to fix the corrupted bucket. Error - JournalSliceDirectory: Cannot seek to rawdata offset 0. 06-05-2020 12:50 AM
- Karma Re: unable_to_write_batch in db connect add-on for thomasroulet. 06-05-2020 12:49 AM
- Got Karma for Re: How to filter by dimension and include names in mstats result?. 06-05-2020 12:49 AM
- Karma Re: Securing HTTP Event Collector for ischoenmaker. 06-05-2020 12:48 AM
- Karma Re: How to change the app icon background color in Splunkbase? for mglauser_splunk. 06-05-2020 12:48 AM
- Karma Re: Getting error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0" when running a search for the_wolverine. 06-05-2020 12:48 AM
- Karma Re: Systemd unit with pid tracking for Splunk for rabbidroid. 06-05-2020 12:48 AM
- Karma Re: Systemd unit with pid tracking for Splunk for mwirth. 06-05-2020 12:48 AM
- Karma Systemd unit with pid tracking for Splunk for mwirth. 06-05-2020 12:48 AM
- Karma Re: HTTP Event Collector: How to generate token through Splunk CLI ? for jherring_splunk. 06-05-2020 12:47 AM
- Karma Re: Unknown search command 'gauge'. for srinathd. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
02-14-2020
07:30 AM
1 Karma
This can happen, when both systems have diverting License-Master/Licenses.
You should set the licensemaster to the same master_uri/same license pool.
On the License-Slave:
splunk edit licenser-localslave -master_uri https://<license-master>:8089
Or via server.conf:
[license]
master_uri = https://<licensemaster>:8089
However HTTP 400 Response is a very ambiguous message. Splunk should implement a proper Error-Message for this case.
... View more
02-11-2020
01:57 AM
This can happen, when both systems have diverting License-Master/Licenses.
You should set the licensemaster to the same master_uri/same license pool.
On the License-Slave:
splunk edit licenser-localslave -master_uri https://<license-master>:8089
Or via server.conf:
[license]
master_uri = https://<licensemaster>:8089
However HTTP 400 Response is a very ambiguous message. Splunk should implement a proper Error-Message for this case.
... View more
11-25-2019
01:40 PM
Hey guys,
how have you been able to fix this?
I have the same issue with
| rest splunk_server=local /services/search/jobs
Can't find a safe way to find the malicious characters, although splunk is stating its this:
Entity: line 305799: parser: Input is not proper UTF-8, indicate encoding !\nBytes: 0xC3 0x20 0x2E 0x2E
... View more
11-05-2019
04:47 AM
It basically was the way Splunk handles LDAP-Requests in Combination with 40ms more delay per request.
Having Splunk doing 1000 requests per minute isn't expensive, when the delay is under a ms. But over the internet it becomes significant and draws lots of CPU Time.
... View more
10-16-2019
02:06 AM
@tkw03 No.
I got told by Splunks Docs Team to raise a support ticket so they can get the Info from Devs with priority.
I haven't had time yet to do so. Feel free to raise a support ticket to extend this part of the docs:
http://docs.splunk.com/Documentation/Splunk/7.3.1/Troubleshooting/CommandlinetoolsforusewithSupport
... View more
08-12-2019
11:42 AM
If you dont know how to actually get to know, whats space-consuming inside the bundle, then go to your searchhead:
tar -vtf <path to bundle> | awk '{print $3" "$4" "$5" "$6}' | sort -h
This prints the biggest files in the bundle on the bottom.
... View more
08-09-2019
06:54 AM
Hi,
does anybody have a list of Human readable reasons to the splunk fsck exitCodes?
Specifically 17 and 3. Or where can i find a list?
Kind,
F.
... View more
08-06-2019
07:58 AM
Awesome. That resolved the issue for me. (Have a server in german Locale)
... View more
06-26-2019
02:53 AM
If you are not successful using gunzip, try 7z.
Someone had this problem.
https://answers.splunk.com/answers/755426/trying-to-fix-the-corrupted-bucket-error-journalsl.html
... View more
06-25-2019
12:56 PM
Isn't that exactly what is suggested in the link I posted?
... View more
06-25-2019
06:58 AM
Hi,
i just tested:
index="_internal" | timechart avg(executes) as a_executes avg(cumulative_hits) as a_hits
and
index="_internal" | stats avg(executes) as a_executes avg(cumulative_hits) as a_hits by _time
Both draw 2 lines with time as a X-axes. If you use timechart you will always have time on the x-axes.
With stats by you can haven your grouping on the x-axes.
... View more
06-25-2019
02:48 AM
This exception indicates a connectivity issue to your F5
... View more
06-25-2019
02:32 AM
Depending on how your networking is set up and if the Splunk Instance on your machine is bind to your "external" IP.
However, it is not recommended to send data unsecured/unencrypted over the internet.
... View more
06-25-2019
12:50 AM
What Splunk Version and App are you using?
... View more
06-25-2019
12:17 AM
1 Karma
May be that this helps.
Although it sounds like you tried these steps already?
https://answers.splunk.com/answers/389363/getting-error-streamed-search-execute-failed-becau.html
... View more
06-25-2019
12:00 AM
Usually you would use timechart like this and it will give it automatically to you:
<your-search>| timechart span=1h average(your_field) as your_field_average
Let me know, if it was helpful.
... View more
06-04-2019
11:46 PM
Hi,
for running Splunk commands other than "splunk version" it is usually necessary to authenticate with an Splunk internal account. It is not sufficient to just use the splunk OS user to run the command.
In case of "splunk enable maintenance-mode" you are required to authenticate with an admin account.
... View more
06-04-2019
11:22 PM
3 Karma
I downvoted this post because i downvoted this post because i can't remove all data to fix my data issue
... View more
02-05-2019
11:47 PM
1 Karma
I'm not really sure what you want to accomplish directly.
But if you use mstats like this:
| mstats latest(_value) AS last_value WHERE index="my_metrics" metric_name="*" by custom_dimension, metric_name
You are able to use metric_name as well as the custom_dimension field after this command. As well as metric_name and the values of all the metrics.
hope that helps.
... View more
06-06-2018
07:20 PM
Exactly what i already built. Very useful. You can also recycle some stuff of the original datetime.xml
... View more
In Addition to the capabilities, you need to make the manager endpoints readable in the metadata of the search-app:
[manager]
access = read : [ splunk_developer, admin, splunk_analyst ], write : [ splunk_admin, admin]
export = system
[manager/accesscontrols]
access = read : [ splunk_admin, admin ], write : [ splunk_admin, admin ]
... View more
10-19-2016
06:43 AM
Hello.
Got an update on this.
The problem is the field "index" in the Eventdata. This causes an issue for splunk.
To resolv this issue you have to evaluate the splunk-index-field.
index=nameofindex kpi_type=voldemort earliest=09/01/2016:00:00:00| eval index= "nameofindex" | delete
I could delete everything successful.
... View more
10-13-2016
03:51 AM
Wouldnt it be better to hold the logfiles as long as the Searchhead has not all results? This way we are missing the remote-Search.log from the indexer everytime the indexers have a high difference in finishing their Search.
... View more
10-12-2016
01:24 AM
http://www.splunk.com/r/bugs is right.
http://www.splunk.com/r/bug is wrong.
The link mentioned by you has the "name" http://www.splunk.com/r/bugs but is linking to http://www.splunk.com/r/bug 😉
... View more
10-11-2016
05:09 AM
I downvoted this post because the link is different to the linktext
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-16-2022
06:46 AM
|
Karma given to
