Smart AnSwerS #81

Hey there community and welcome to the 81st installment of Smart AnSwerS.

The San Francisco Bay Area user group will be meeting tomorrow, Wednesday, November 2nd @ 6:30PM PDT at Yahoo! HQ. Gregg Daly from the Children’s Discovery Museum of San Jose will be speaking on how the nonprofit has been using the free Splunk Enterprise license donated by Splunk4Good to monitor IT and security operations. Jason Szeto, principal software engineer at Splunk, will be giving a talk and live demo on a new Splunk feature currently under development. If you happen to be in the area, you’re welcome join us! Please visit the SFBA user group event page for more details and to RSVP.

Check out this week’s featured Splunk Answers posts:

 Why is my cluster master reporting “Cannot fix search count as the bucket hasn’t rolled yet”, preventing me from meeting my Search Factor?

LiquidTension’s cluster master was reporting 18 pending fixup tasks that were preventing both search and replication factors from being met, and this was an issue affecting several other users as well. Luckily, cluster master rbal from Splunk support answers the question, explaining why these messages occur in an indexer clustering environment, where to investigate in Splunk Web, and how to resolve the issue right away.

How to monitor changes made to the inputs.conf file?

With inputs.conf getting updated periodically, agoyal needed a way to keep track of any changes made to the file. lukejadamec provides the steps for monitoring changes on an inputs.conf file, noting that there may be several Splunk instances that should be taken into account for complete coverage of all changes in a deployment.

How to write a search to only keep a certain type of value for a multivalue field?

dmacgillivray had a table with a multivalue field, and was looking for an SPL solution to filter out any values that did not match a certain format, but still maintain the same number of rows. New SplunkTrust member sundareshr provides two search solutions using eval and regex to get the same expected result.

Thanks for reading!

Missed out on the first eighty Smart AnSwerS blog posts? Check ‘em out here!

Patrick Pablo
Posted by

Patrick Pablo

Born and raised in Los Angeles, Patrick made his way up north for college and fell in love with the Bay Area, making it his second home. After working 5 years for a non-profit as a college & career counselor in San Francisco public high schools, he stumbled across a new career opportunity himself! Patrick found a new way to apply his community organizing background in a way he didn’t know was possible at Splunk.


Smart AnSwerS #81

Show All Tags
Show Less Tags

Join the Discussion