Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About napomokoetle
napomokoetle
Communicator
Member since:
03-14-2012
11-01-2024
Community Statistics
| Posts | 63 |
| Solutions | 0 |
| Karma Given | 31 |
| Karma Received | 24 |
| Member Since | 03-14-2012 |
Activity Feed
- Got Karma for Re: Deploying onto Search Head pool sometimes causes errors. 01-05-2023 04:05 PM
- Karma Re: How do you find the earliest event in an index by sourcetype and source? for skoelpin. 03-16-2021 06:50 AM
- Karma Re: How do I reset the admin password or create a new admin in Splunk 7+? for splunk2day. 09-10-2020 12:25 AM
- Karma Is possible to use more than one IDP with splunk SSO ? for joaquim. 06-05-2020 12:50 AM
- Karma When trying to set up a distributed system, can you help me with the following error?: "Unable to distribute to peer, peer has status=2" for xindeNokia. 06-05-2020 12:50 AM
- Karma Why am I receiving the following Collections.conf and Drilldown_settings warning messages after installing the Alert Manager App? for MSKinder. 06-05-2020 12:50 AM
- Karma Re: Health warning - The percentage of small of buckets created (40) over the last hour is very high ... for simonq. 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Re: Why am I receiving the following Collections.conf and Drilldown_settings warning messages after installing the Alert Manager App?. 06-05-2020 12:50 AM
- Karma Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Dashboard - FY18" to PDF. for CarmineCalo. 06-05-2020 12:49 AM
- Karma FireEye error message: "Could not load configuration" - why? for reswob4. 06-05-2020 12:49 AM
- Karma Splunk Add-on for *Nix "ignoring alternate expansion" for specified inputs on new server for manderson7. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 5 | |||
| 1 | |||
| 1 | |||
| 0 |
02-01-2016
10:02 AM
Hi Everyone,
Every night just after midnight, I need to verify that data for a specific sourcetype has been indexed during the course of yesterday for a list of hosts that is provided as a master list. This is so that admins can take remedial measures for those hosts that for some reason stopped sending data from the sourcetype before too much data is lost.
The master list consists of two hundred hosts.
Please help with how to structure the search for this type of problem. Thanks in advance for your kind help.
... View more
01-12-2016
02:59 AM
Hi lycollicott,
Have you received any feedback from Splunk? Would be interesting to get an official helpful response.
... View more
01-04-2016
10:30 AM
Thanks for the tip ryanlait. Will only be back in office next week to try it out.
... View more
12-08-2015
04:28 AM
Excellent mikaelbje. You rock!
... View more
12-04-2015
11:49 AM
Work around works but is not feasible for me since I don't access to the agent hosts to be able to manually edit the app.conf! 😞
Any estimates as to when might expect to be able to download Splunk 6.3.2?
... View more
11-29-2015
10:37 PM
Hi MuS, Thanks for your response. I'm using the SA-ldapsearch. I hope you can help resolve this performance problem.
Just to check if Splunk was the problem or NOT. I installed the Centos ldapsearch client and executed the same Active Directory search I've been trying through Splunk, and the AD results return in seconds.
So it seems to me the problem is with Splunk and not Active Directly or my system.
... View more
11-26-2015
07:43 AM
Frustrating! Let's hope someone from Splunk or otherwise will hear our cry and help us out of our specific ldapsearch related pain Lucas K 😉 .
... View more
11-26-2015
03:54 AM
5 Karma
My environment:
Splunk Supporting Add-on for Active Directory 2.1.1
Splunk Enterprise 6.3.1
Running on Linux Centos 6.5
When I execute any LDAP search I have to wait for at least 5 minutes before I see results back! This is extremely slow. What can I do to troubleshoot this performance problem and improve the performance?
Kind regards,
J. Napo Mokoetle
... View more
11-13-2015
04:48 AM
Was getting the "ERROR AdminManager - Parameter name: Path must be absolute" problem when I tried upLoad File into Splunk. After a couple of attempt without success on Firefox web browser, I decided to try Chrome browser and the data file was uploaded successfully!!!
I hope that saves someone some grief!
... View more
10-27-2015
03:34 AM
I'm experiencing the same exact problem. Stuck!
I don't have a search head cluster so I couldn't have done what the log states!!! I have two search heads but they are NOT clustered. Moreover, I've NOT used them to distribute applications!
10-27-2015 13:31:32.682 +0200 WARN DeployedApplication - app=Splunk_TA_windows was already installed via search head cluster deployer, UI, CLI, or RES
T API; it may not be overridden via deployment server; remove existing app=Splunk_TA_windows via search head cluster deployer, UI, CLI, or REST API if
you wish to install it via deployment server
... View more
10-15-2015
02:11 AM
Hi dolivasoh,
I applied Splunk DBCONNECT 2.0.6 released yesterday on my Search Head this morning and the problem is now history. Perhaps that will resolve your problem too since it seems to be the same one I had.
https://splunkbase.splunk.com/app/2686/release/2.0.6/agree/
I wish you success.
... View more
10-15-2015
02:07 AM
1 Karma
Applied the DBCONNECT 2.0.6 on my Search Head and wallah... Problem solved!
You rock jcoates!
Thank you very much for your responsiveness and effort on resolving this matter.
... View more
10-14-2015
01:54 AM
Is there perhaps some work-around in the meantime while you look into a permanent fix for the bug, that would enable me to continue using DB Connect from the Search Head without altering the architecture?
Thanks!
... View more
10-12-2015
12:17 PM
Thank you very much for the update jcoates and all the attempts to help me resolve the issue. Hope to hear from you soon regarding the fix.
... View more
10-12-2015
09:05 AM
Hi dolivansoh, thanks for confirming that I'm not going crazy 😉
I was hoping Splunk would have provided me with a tested working procedure by now for the specific setup as the official documentation does NOT contain the particular scenario.
I've been stuck for two weeks now and am beginning to risk falling behind on my deliverables... 😞
... View more
10-06-2015
08:43 AM
1 Karma
Hi,
I did follow that document you refer to for installing DBCONNECT on Splunk Search Heads jcoates. Thereafter I and configured as documented and got error stating the dbxquery script is missing on indexers every time I tried to execute a query from the Search Head. This prompted me to deviate from the document and install the DBCONNECT to get rid of the error.
Would you recommend I uninstall the DBConnect app from the Indexers?
If so, should the error around the missing dbxquery.py script on indexers return, how do I then tell the Search Head to stop contacting the Indexer to accomplish the query?
My commands.conf reads precisely like your the one you shared jcoates:
[root@JHBTLSPLxxx ~]# cat /opt/splunk/etc/apps/splunk_app_db_connect/default/commands.conf
[dbxquery]
filename = dbxquery.py
supports_getinfo = true
supports_rawargs = true
passauth = true
run_in_preview = false
local = true
Where JHBTLSPLxxx is my Search Head
... View more
10-04-2015
01:43 PM
Yeah I hear and understand what you're saying. Could it be that the double query from the indexers is then confusing the results?
How then does one configure the Search Head such that it uses DBConnect without involving the indexers? Is there specific documentation that explains how the Search Head must be configured to use DBConnect directly in an environment that has clustered indexers?
Thanks again for your assistance jcoates.
... View more
10-04-2015
12:46 PM
Is it not because when the indexers are clustered, they actually perform the search function, and the search head only combines the results?
Seems to me the indexers are succeeding in executing the queries, but for some odd reason instead of returning the actual records retrieved from the database, return zero rows to the search head.
... View more
10-04-2015
10:02 AM
Hi,
I'm doing the second(dbxquery), and I'm doing it from a search head. However dbxquery doesn't work unless I have DBCONNECT installed on the indexer cluster. It returns errors complaining about dbxquery missing on the indexer cluster. But then when I install DBCONNECT on the cluster, the queries execute without errors but return zero rows!
How then would I command/configure the Search Head to bypass the indexer cluster for DBCONNECT?
Thanks for your help jcoates.
... View more
10-02-2015
06:59 AM
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches
... View more
09-30-2015
05:32 AM
1 Karma
Hi folks,
I have installed Splunk 6.3 on Centos Linux 6.5
The installation consists of...
- a dedicated Search Head
- a master node that also serves as a Search Head
- two clustered indexers
- two Heavy Forwarders (with one used as also a Deployment Server)
My problem is using DB Connect 2.0.5 from the two Search Heads to query an MSSQL database returns "0 rows", while executing the same SQL query from the Search Peers in the indexer cluster returns the expected data from the MSSQL database. The query execution on the Search Head has a green check to show there are NO errors... but unfortunately zero data is shown.
I need to have the DB queries working from the Search Head.
Perhaps the way I installed DB Connect is not correct! Here's how I've tried deploying DB Connect into the Splunk environment...
First, I installed DB Connect directly onto each of the TWO Search Heads. I didn't use the Deployer because the TWO Search Heads are NOT clustered because we need at least three for Search Head Clustering.
Then, I used the Deployment Server on the Heavy Forwarder to push the DB Connect 2.0.5 App into the Master Cluster Node running on one of the Search Heads
Then, I used the Master Cluster Node to deploy the DB Connect Package Bundle into the Indexer Cluster nodes. This returned a great number of VALIDATION errors. I tried skipping the VALIDATION, but that need not get rid of errors when I tried to APPLY the bundle on the Indexer Cluster NODES. Nonetheless the DB Connect Package Bundle seemed to get placed on the two Indexer nodes slave-apps directory. But when I execute an SQL query from the Search Heads using DB CONNECT it complained about missing the DBXquery script on the Clustered Indexer Nodes.
I then removed the DB Connect Package Bundle from the Indexer Cluster Nodes using the Master Cluster Node, and then installed it directly on each of the Indexers in the Cluster. Then SQL Queries then returned 0 rows when executed from the Search Heads, BUT return data as expected when executed from each of the two Indexer NODES in the cluster.
Anybody experienced this situation and know how to remedy it?
Any one who knows the official way to deploy DB Connect 2.0.5 to an indexer cluster with NO search head cluster?
Any one know where I can find documentation on how to install/deploy DB Connect 2.0.5 into an environment where the Indexers are clustered, but the Search Heads are NOT clustered?
Thanks for all your help.
... View more
09-25-2015
08:19 AM
Did indeed fix it! Looked for DBConnect 2.0.5 yesterday but could only find the documentation. I guess the app was not there yet. Thanks for your help.
... View more
09-25-2015
07:08 AM
1 Karma
I upgraded from Splunk Enterprise 6.2.5 yo 6.3 on Linux Centos 6.5
The error I get on the cluster master splunkd.log when trying to run...
[root@ClusterMaster ~]# splunk apply shcluster-bundle --answer-yes -target https://10.zz.yyy.x:8089 -auth admin:adminPasss
is
09-25-2015 15:40:31.078 +0200 WARN AppsDeployHandler - Error while fetching members from uri=https://10.zz.yyy.x:8089: Non-200 status_code=503: Service Unavailable
Please help resolve!
... View more
09-24-2015
11:03 AM
1 Karma
Hi Everyone,
After upgrading my Splunk 6.2.5 instance to Splunk Enterprise 6.3, the menu-bar for the Splunk DBConnect V2 disappeared! Any workarounds to have the menu-bar reappear?
... View more
- Tags:
- splunk-enterprise
- « Previous
-
- 1
- 2
- Next »
