GeoIP with Splunk

People are checking their emails all over the world. Maybe they're stuck because of Eyjafjallajökull ...?

Comments

Post a Comment

Popular posts from this blog

SLOG Latency

Image
After reading Brendan's newest blog entry, I was curious about what kind of slog latency we can see for our data migration load. To remind you, only synchronous writes go into the slog SSD devices. As this is a migration running, we can see mostly NFS write operations: In our configuration the SSD slog is mirrored (HDD4 and HDD8). Hence the same number of IOPS: The next picture shows us the latency for our SDD SLOG Device HDD 4. We can see here that latencies start at 79 us and are mostly under 200 us. There are some outliers, but approx. 95% are under 500 us: This matches quite well with the values Brendan blogged about (137-181 us), which includes NFSv3 latency. For reference (no picture here), we can see latencies of about 170-500 us mostly for NFSv4. By the way. SLOG Devices are mostly one way devices, as shown here. Only if things go really bad, they are read from...
Read more

Connecting Opensolaris to a Cisco VPN

I finally got my Opensolaris box hooked up to a Cisco VPN: 1. Get the tun/tap driver from Kazuyoshi. This driver is used for creating a using between the client and the Cisco VPN router. 2. Compile and install the driver: pkg install sunstudioexpress export CC=/opt/SunStudioExpress/bin/cc ./configure make make install 3. Download the vpnc client. This program handels the vpn connection. I've used the version 0.5.1. 4. Get gmake pkg install SUNWgmake 5. Adjust installation paths (my personal preferences): Makefile: PREFIX=/opt/vpnc ETCDIR=/opt/vpnc/etc config.c (hardcoded locations): Line 250: return "/opt/vpnc/etc/ssl/certs"; Line 270: return "/opt/vpnc/etc/vpnc-script"; Line 275: return "/var/run/vpnc.pid"; Line 541: ... : /opt/vpnc/etc/", ... Line 760: ... "/opt/vpnc/etc/default.conf" ... Line 761: ... "/opt/vpnc/etc/vpnc.conf" ... gmake gmake install 6. Convert the pcf file into vpnc format using /opt/vpnc/pcf2vpnc . Stor...
Read more

Heating up the Data Pipeline (Part 1)

Image
Pre-Processing Data I often hear the question from our customers, how data can be transformed prior to indexing in Splunk. Damien from  Baboonbones  has done a tremendous job in creating add-ons   providing custom inputs for Splunk. Most of his custom inputs provide the means to pre-process data by allowing custom event handlers to be written. Sometimes you still want to pre-process data that gets collected from Splunk's standard input types, like file monitors, Windows EventLogs, scripted inputs etc. Also, not everyone is capable of writing custom event handlers. A requirement these customers have, is that they have rolled out a large number of Splunk Universal Forwarders and they do not want to install another agent. To summarize, the solution capable of pre-processing data, should be easy to use, be easily integrated and be build on top of their existing architecture. How to plumb Splunk Pipelines Splunk has its own fittings to connect a Univer...
Read more