topic Re: Splunk errors and issues in Getting Data In

How to resolve Splunk CIM errors and issues?

domino30 — Tue, 28 Mar 2023 01:06:27 GMT

I am in a environment and I am able to get data in from a general perspective. We have a index clustered and search head clustered test env I can search * and get data in andjust deal with that. we have the CIM vladiator app and we get errors such as the following

So then I go and hunt the splunkd.log files of said location but really cant make heads or tails of whats important to solve any issues I may have.

attached are the splukd.log from sh01 and indx03,indx03 and indx04 respectively.

Should I care about info warning and should I worry about warnings or should I focus on errors?

Keep in mind I have tried to search Some of these errors but they answers are amiguitous or not relevant or don't work.

Is there a strategy that people use to go about this ?

is there anything that is seen on here that stands out?

Re: Splunk errors and issues

bowesmana — Mon, 27 Mar 2023 22:20:26 GMT

It says that SA_CIM_validator cannot be found on the indexers. Is the app installed on them? Some apps need to be deployed on the indexers too, but not sure what else may be relevant or if that's necessary here.

Errno 111 = Connection Refused?

Can't offer much more I'm afraid.

Re: Splunk errors and issues

PickleRick — Tue, 28 Mar 2023 08:43:53 GMT

~~Notice the spelling. The screenshot says "SA-cim_vladiator", not "validator".~~

~~There is much more going on underneath than meets the eye I'm afraid. Someone must have hurt this environment...~~

Re: Splunk errors and issues

bowesmana — Tue, 28 Mar 2023 04:18:55 GMT

https://splunkbase.splunk.com/app/2968

Re: Splunk errors and issues

PickleRick — Tue, 28 Mar 2023 06:51:25 GMT

Oh, my bad. Seemed like a typo more than a legitimate name.