Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About chanfoli
chanfoli
Builder
Member since:
03-14-2014
04-11-2025
Community Statistics
| Posts | 190 |
| Solutions | 35 |
| Karma Given | 46 |
| Karma Received | 130 |
| Member Since | 03-14-2014 |
Activity Feed
- Karma Re: How to round the decimal percentage in a piechart with XML? for mayurr98. 04-11-2025 09:12 AM
- Got Karma for Re: Counting number of characters in a Splunk field. 12-20-2023 08:33 AM
- Got Karma for Re: Could not create Splunk settings directory at '/root/.splunk'. 08-22-2023 10:50 AM
- Got Karma for Re: How to free up disk space?. 05-10-2023 04:52 PM
- Got Karma for Re: Alert that triggers based on errors per minute over time. 04-29-2023 09:54 PM
- Got Karma for Re: Universal Forwarder DsBind failed since upgrade to 6.0.2. 10-04-2022 03:16 AM
- Got Karma for Re: Is it possible to remove a string from _raw in a search using wildcards with the replace command?. 08-10-2022 08:02 PM
- Got Karma for Re: Counting number of characters in a Splunk field. 02-10-2022 02:13 AM
- Got Karma for Re: Could not create Splunk settings directory at '/root/.splunk'. 01-03-2022 08:49 AM
- Karma Search returning duplicated/wrong results after upgrading to 7.1 for jmangs. 06-05-2020 12:49 AM
- Karma Re: How can I capture these failures as timechart count by type of error in a single dashboard? for yannK. 06-05-2020 12:49 AM
- Got Karma for Re: Search Using Regular Expression is Case-Sensitive. 06-05-2020 12:49 AM
- Karma Re: Splunk Add-on for Amazon Web Services: Why are ALB Access logs not getting indexed or parsed correctly? for ytenenbaum_splu. 06-05-2020 12:48 AM
- Karma Splunk Add-on for Amazon Web Services: Why are ALB Access logs not getting indexed or parsed correctly? for ytenenbaum_splu. 06-05-2020 12:48 AM
- Karma Re: How to create an eval column in a table that says "yes" or "no" if the value in another column has changed from the previous row? for martin_mueller. 06-05-2020 12:47 AM
- Karma Splunk unable to read specific files even though it can when started from the command line for bosburn_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunk unable to read specific files even though it can when started from the command line for bosburn_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunk unable to read specific files even though it can when started from the command line for fharding. 06-05-2020 12:47 AM
- Karma Re: How to convert time format of 2014-10-22 15:32:00 to 10/22/2014 15:32:00 for richgalloway. 06-05-2020 12:47 AM
- Karma Re: How to determine if forwarder is phoning home to deployment server for lguinn2. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
01-12-2015
12:49 PM
1 Karma
The first place I would look in this case is in the splunkd.logs on your forwarders (SPLUNKHOME/var/log/splunk/splunkd.log) . I would look for messages about connections. I would also run SPLUNKHOME/bin/splunk list forward-server
... View more
01-12-2015
12:37 PM
It sounds like your monitor input is getting indexed on your sandbox instance. Yay! You did it!
... View more
01-12-2015
12:27 PM
Hello, that looks like pretty normal startup stuff. I would look at near the end of the log for anything relating to the monitor you set up. It looks like your forwarding connection is okay based on the list forward-servers output.
... View more
01-12-2015
12:17 PM
Also, based on the above config, you will need to have created a "test" index on your sandbox as well, and depending on user/role you may need to use index=test in your search. Also, did you create a catalina sourcetype on your sandbox instance? If your data is not one of the built in types, this should be done.
... View more
01-12-2015
12:15 PM
okay, so it looks like your connection is up. Since you are setting host to ip-172-31-35-141 in your inputs you should be able to search for host=ip-172-31-35-141 ( i would use all-time for troubleshooting in this case, just in case there are timestamp discrepancies). You also need to make sure that the user the splunk forwarder is running as has read permissions on the logs you have added.
... View more
01-12-2015
12:04 PM
Sorry missed this. Do not have administrative access to this system or are you just not finding the log?
... View more
01-12-2015
12:02 PM
Okay a couple of things here. Is the 54.x.x.69 IP your universal forwarder? A couple of log entries indicate that something was trying to forward logs TO this IP which makes me think that this is your sandbox IP or there was some other misconfiguration.... Also, the local side shutting down errors might be missed heartbeats and could simply be when splunk is being restarted.
please execute the following on your forwarder to check connectivity:
splunk list forward-server and again checking the splunkd.log from the forwarder might help.
... View more
01-12-2015
11:40 AM
SPLUNKHOME/var/log/splunk/splunkd.logs
On *nix home is usually /opt/splunkforwarder and on windows it would be under Program Files/splunkforwarder
... View more
01-12-2015
11:31 AM
At this point I would check the splunkd.logs on your fowarder and run the following search on your sandbox:
index=_internal xx.xx.xx.xx
where xx.xx.xx.xx is your forwarder's outside IP address.
This might provide some clues about connection status.
... View more
01-12-2015
11:14 AM
In my opinion, no. The configs under SPLUNKHOME/etc/apps/search for the search app, which is not relevant on a Universal Forwarder system.
... View more
01-12-2015
11:09 AM
You will need to have appropriate monitor stanzas on the forwarder for the tomcat logs you want to start indexing, ideally these will also need to be assigned an appropriate sourcetype.
Have a look at this:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories
Here is another answer which should get you in the right direction on inputs. This person appears to have set up different sourcetypes for the different logs:
http://answers.splunk.com/answers/135355/proper-input-conf-setup-apache-tomcat.html
My procedure is to load an example file on a splunk instance through add data and use the "data preview" functionality it to make sure timestamps and event breaks are getting parsed and what sourcetype settings are needed to make this happen for each sourcetype.
BTW, I removed tcpout-server stanza from my outputs.conf before my remote forwarder actually connected to the sandbox and forwarded events.
... View more
01-12-2015
07:17 AM
1 Karma
Hello, to get the picker time, try adding the following inside the each element with a search or search post process:
<earliestTime>$field1.earliest$</earliestTime>
<latestTime>$field1.latest$</latestTime>
... View more
01-10-2015
08:09 PM
Please note my edit at the end of my answer, it may help you.
... View more
01-10-2015
08:03 PM
Please note my edit at the end of my answer, it may help you.
... View more
01-10-2015
07:57 PM
EDIT: The following helped get this working!
Log into your sandbox instance and click on Universal Forwarder from your launch page.
Click on the button to download the cloud credentials.
Install this as an app on your forwarder ( /opt/splunkforwarder/bin/splunk install app /PATH/TO/splunkcouduf.spl )
Make sure your output is named splunkcloud in your outputs.conf - mine is below
Restart splunk
[tcpout]
defaultGroup = splunkcloud
[tcpout:splunkcloud]
server = input-prd-p-MYSERVERID.cloud.splunk.com:9997
... View more
01-10-2015
12:45 PM
4 Karma
If you are getting connection reset errors like I am from my Raspberry Pi Universal Forwarder, it would appear that there have been some changes made involving authenticating external inputs. I noticed a lot of similar questions being posted so I decided to try sandbox and set up some inputs from a Pi I have at home. It looks like the steps required to add data from forwarders are much different than the simple process you would use on a normal splunk installation and they are not clear nor intuitive even to an experienced splunk user. I found this new and possibly relevant info by digging around and trying different options and not getting my connection to work, then finally seeing the last comment on this answers post:
http://answers.splunk.com/answers/147295/how-do-i-send-my-own-data-into-a-splunk-cloud-sandbox-trial.html
[excerpt]
"The answers given above were valid at the time of writing but recently we secured all data inputs with a unique SSL certificate and key for each instance so you cannot just manually add the config files and make it work anymore. You have to download the universal forwarder app which has the required credentials embedded."
EDIT: The following helped get this working!
Log into your sandbox instance and click on Universal Forwarder from your launch page.
Click on the button to download the cloud credentials.
Install this as an app on your forwarder ( /opt/splunkforwarder/bin/splunk install app /PATH/TO/splunkcouduf.spl )
Make sure your output is named splunkcloud in your outputs.conf - mine is below
Restart splunk
[tcpout]
defaultGroup = splunkcloud
[tcpout:splunkcloud]
server = input-prd-p-MYSERVERID.cloud.splunk.com:9997
... View more
01-10-2015
12:25 PM
3 Karma
Paraphrasing my above comment as an answer: If you are getting connection reset errors like I am from my Raspberry Pi Universal Forwarder, it would appear that there have been some changes made involving authenticating external inputs. I found this by digging around and trying different options and not getting my connection to work, then seeing the last comment on this answers post:
http://answers.splunk.com/answers/147295/how-do-i-send-my-own-data-into-a-splunk-cloud-sandbox-trial.html
[excerpt]
"The answers given above were valid at the time of writing but recently we secured all data inputs with a unique SSL certificate and key for each instance so you cannot just manually add the config files and make it work anymore. You have to download the universal forwarder app which has the required credentials embedded."
EDIT: The following helped get this working!
Log into your sandbox instance and click on Universal Forwarder from your launch page.
Click on the button to download the cloud credentials.
Install this as an app on your forwarder ( /opt/splunkforwarder/bin/splunk install app /PATH/TO/splunkcouduf.spl )
Make sure your output is named splunkcloud in your outputs.conf - mine is below
Restart splunk
[tcpout]
defaultGroup = splunkcloud
[tcpout:splunkcloud]
server = input-prd-p-MYSERVERID.cloud.splunk.com:9997
... View more
01-10-2015
12:21 PM
I've also tried to get this going myself since I am seeing a lot of similar questions from folks having problems. For one thing, I learned that the sandbox server needs to have input- appended to the hostname in order to actually connect to the correct IP. After you get this far, you will probably see as I did that your connection to sandbox gets reset, this appears to be because splunk has made some changes to make this "easier". There are apparently some embedded credentials in a special forwarder package which need to be used. I guess this is not going to work for the universal forwarder that I installed on my Raspberry Pi. Hopefully they will improve the documentation as there is nothing to guide even experienced splunk users to getting this connection to work manually. See the last comment on this question for a clue about why so many might be having issues with sandbox trial inputs:
http://answers.splunk.com/answers/147295/how-do-i-send-my-own-data-into-a-splunk-cloud-sandbox-trial.html
... View more
01-10-2015
12:20 PM
1 Karma
I've also tried to get this going myself since I am seeing a lot of similar questions from folks having problems. For one thing, I learned that the sandbox server needs to have input- appended to the hostname in order to actually connect to the correct IP. After you get this far, you will probably see as I did that your connection to sandbox gets reset, this appears to be because splunk has made some changes to make this "easier". There are apparently some embedded credentials in a special forwarder package which need to be used. I guess this is not going to work for the universal forwarder that I installed on my Raspberry Pi. Hopefully they will improve the documentation as there is nothing to guide even experienced splunk users to getting this connection to work manually. See the last comment on this question for a clue about why so many might be having issues with sandbox trial inputs:
http://answers.splunk.com/answers/147295/how-do-i-send-my-own-data-into-a-splunk-cloud-sandbox-trial.html
... View more
01-10-2015
10:42 AM
Please post your inputs.conf and outputs.conf files. In a simple setup on your forwarder you should have your sandbox set up as a forward server and your inputs should be defined.
For tomcat, you would want monitor stanza(s) specifying the files you want to start indexing. I just answered another question (here: http://answers.splunk.com/answers/207373/why-am-getting-error-there-are-currently-no-forwar.html ) with regards to the "deployment clients" error. It seems that some information about setting up deployment clients has been left out here for the way sandbox "wizards" are designed. I am thinking that you are pretty close and perhaps seeing the conf files will help get it straightened out.
... View more
01-10-2015
09:59 AM
Although I do not see it documented specifically for setup.xml, if default values for query is what you are after, enclosing the text in a default element inside the query input might work.
<input field="query">
<label>Query</label>
<type>text</type>
<default>SELECT something FROM something-else</default>
</input>
... View more
01-10-2015
09:43 AM
It would appear that the sandbox "forward wizard" is assuming that all forwarders would be set up as "deployment clients" (see: http://docs.splunk.com/Documentation/Splunk/6.2.0/Updating/Aboutdeploymentserver ) in order to push configs to them. I did not see this covered in my poking around on sandbox so I think you are rightly confused. You can either set up your inputs manually which is covered in the documentation pretty well (here: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Usingforwardingagents) as well as this answer:
http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux.html
OR
you can get your forwarder set up as a deployment client and use the wizard to get your sandbox instance to push configs to your forwarder. The command for pointing a forwarder at a deployment server on linux is as follows:
su splunk -c "/opt/splunkforwarder/bin/splunk set deploy-poll "
BTW, in my sandbox, receiving on tcp port 9997 was enabled by default so doing so should not be necessary.
... View more
01-10-2015
08:47 AM
dbmon-tail stanzas are normally added to an inputs.conf in $SPLUNK_HOME/etc/apps/dbx/local when you create a tail input in the db connect web interface.
This section of the DBX documentation covers the basic concepts:
http://docs.splunk.com/Documentation/DBX/1.1.6/DeployDBX/Configuredatabasemonitoring#How_dbmon-tail_inputs_work. I am not sure I understand what you are trying to do with setup.xml in this context. Does this information help? If not could you elaborate a little more on what you are trying to change?
... View more
01-10-2015
08:32 AM
1 Karma
So, if your home computer is behind this router, it will most likely be assigned an internal IP address via DHCP when it attaches to the home network. You can find this ip on a windows system with ipconfig /all on the command line. Other operating systems have different tools. Most home routers I have worked with use DHCP pools in the 192.168.x.x range.
The thing about DHCP is that unless you configure the router to make a static IP assignment, this IP could change the next time you connect or when the DHCP lease runs out. So you should also look into static assignments at your router. I hope I understood your question correctly and that this information is helpful.
... View more
Role-mapping and related settings are manageable from splunk web with proper permissions under Settings->access controls then Roles or Authentication Method, depending on what you need to do. On the Authentication Method page there is a link to "Configure Splunk to use LDAP and map groups" which lets you change group mappings, view current LDAP users, etc.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-11-2025
09:12 AM
|
