Amazon RDS MySQL instance – when it’s really really big

750GB big. If you want to restore a mysql dump to an RDS instance, expect to encounter some issues on the first go-round. You’ll likely have to create a custom parameter group. You’ll likely have to increase your max_allowed_packet parameter for the instance.

So, do yourself a favor and create a parameter group up front and search for my.cnf tweaks that optimize the sort of workload your database will see.

By the way, the following error may be that your max_allowed_packet size is too small for your restore:

ERROR 2006 (HY000) at line 1466: MySQL server has gone away mysqldump: Got errno 32 on write

Recovering a Windows Administrator Password in Amazon EC2

Say you’ve lost the admin creds to your Windows EC2 instance. And then you lose the private key. Bummer. You can still recover the password.

http://ift.tt/1ApWQcd

Just do it step-by-step.

When it says in step 8. (Optional) If your temporary instance is based on the same AMI that the original instance is based on, and the operating system is later than Windows Server 2003, you must complete the following steps or you won’t be able to boot the original instance after you restore its root volume because of a disk signature collision.

What does that look like? Well, when you reattach the dirve and start up the instance, it will continually stay in the “initializing” state. You will see it sort of flash to something else then return to “Initializing”. It’ll do this forever, so if it’s been 5 minutes and it’s still in the “initializing” state, then you have to do step 8.

When, in step 8 it says to “In the Registry Editor, load the following registry hive into a folder named BCD: d:\boot\bcd.” Just open regedit.exe, select the root node, then search for “Windows Boot Manager”. It’ll find something, but look at the registry tree for the one named 11000001.

If you mount the disk to the original instance, by default it puts it at xvdf… you have to mount it at /dev/sda1, otherwise you will get an error message about there not being any root volume mounted.

Regular Expressions, REX, Eval and Splunk – some tips to make it easier on yourself

Splunk uses “PCRE” Regular expressions, so when you use this tool (and you really should) select that from the dropdown: http://ift.tt/1fMXgx6

Just paste in a sample event and it’ll match it in real time, right before your eyes! Granted, Splunk does have this sort of feature, but honestly, I find it helpful to sort of “back up and out” of what I’m doing in Splunk to solve a problem that’s not strictly a Splunk thing.

Reset Splunk Universal Forwarder so it will resend logs

Rreplacing backslashes in Splunk

Say you are extracting data that has nested JSON. Splunk may auto-escape double quotes. You can’t then directly run spath on that field and get anything out of it. You have to remove the backslashes. You need to use the “eval” function and for some reason stuff in 4 backslashes. Like this:

| eval MyDataField=replace(MyDataField,”\\\\”,””)

Splunk answer about this:

http://ift.tt/1DOsu1z

Splunk props.conf – yeah, you have to restart splunk entirely when you make changes

On this page, it seems to indicate you could search with ” | extract reload=T” and it would reload your props.conf file. I didn’t see it work, at least not with extract-time transformations (it may work with search-time stuff).

http://ift.tt/1zpDC5H

Multiple events logged to a single log line – how to work with it in Splunk

I have log lines that are really multiple lines of events (JSON in this case, and many events are batch-logged at once). I need Splunk to split them into individual events.

props.conf is where you have to muck around. And, yes, you have to restart splunk any time you make changes there.

Ultimately, this worked for me:

[name_of_my_sourcetype]

LINE_BREAKER = (\n)

SHOULD_LINEMERGE = false

TRUNCATE = 0

#TIME_PREFIX = “Timestamp”:”

#TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N

#TZ = UTC

KV_MODE = JSON

I’ve commented out the TIME…. things, but they do set the timestamp of each event to be whatever immediately follows that TIME_PREFIX regex.