Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Mag2sub
Mag2sub
Path Finder
Member since:
11-29-2012
06-05-2020
Community Statistics
| Posts | 81 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 11-29-2012 |
Activity Feed
- Got Karma for Splunk Hosts metadata correlation with index. 06-05-2020 12:47 AM
- Got Karma for Splunk web not showing login fields JAVAscript enabled. 06-05-2020 12:46 AM
- Got Karma for Re: Deployment server to deploy specific serverclass to a client excluding whitelist *. 06-05-2020 12:46 AM
- Posted Re: Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec? on Getting Data In. 11-05-2014 08:34 PM
- Posted Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec? on Getting Data In. 11-05-2014 12:42 AM
- Tagged Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec? on Getting Data In. 11-05-2014 12:42 AM
- Tagged Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec? on Getting Data In. 11-05-2014 12:42 AM
- Tagged Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec? on Getting Data In. 11-05-2014 12:42 AM
- Posted Re: Splunk Hosts metadata correlation with index on Splunk Search. 07-06-2014 10:16 PM
- Posted Re: fast query to output hosts not logging to index on Splunk Search. 07-06-2014 10:11 PM
- Posted Re: fast query to output hosts not logging to index on Splunk Search. 07-06-2014 10:08 PM
- Posted fast query to output hosts not logging to index on Splunk Search. 07-05-2014 04:58 AM
- Tagged fast query to output hosts not logging to index on Splunk Search. 07-05-2014 04:58 AM
- Posted Re: Splunk Hosts metadata correlation with index on Splunk Search. 07-05-2014 04:49 AM
- Posted Re: Splunk Hosts metadata correlation with index on Splunk Search. 07-03-2014 06:58 AM
- Posted Re: Splunk Hosts metadata correlation with index on Splunk Search. 07-03-2014 04:15 AM
- Posted Re: Splunk Hosts metadata correlation with index on Splunk Search. 07-03-2014 02:36 AM
- Posted Splunk Hosts metadata correlation with index on Splunk Search. 07-03-2014 01:45 AM
- Tagged Splunk Hosts metadata correlation with index on Splunk Search. 07-03-2014 01:45 AM
- Tagged Splunk Hosts metadata correlation with index on Splunk Search. 07-03-2014 01:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-21-2013
06:25 PM
i dont see a consistent deployment ...does whitelist=clientname exclude whitelist=* ?
As i see serverclass with whitelist=*
also being deployed to serverclass having specific clientnames and continuematch=false
... View more
10-21-2013
05:29 PM
I have deleted the erroneous post /config as that was my last config and i had the config as you have stated before
Also checked
ndex=_internal source=*splunkd.log (component=application OR component=serverclass) warn OR error on the deployment server serach app and did not find any eror
... View more
10-21-2013
05:26 PM
agreed ..that was my first config...ie whitelist in serverclass and not app...it did nto work ,,thats when i went superfluous
... View more
10-21-2013
04:00 PM
typo in whitelist * ..i just posted the most superfluous version above ...the whitelist was at serverclass before this and since default stance for continuematching was true had only the config as you said before
... View more
10-21-2013
02:55 PM
Ok..i have 2 separate serverclass and found when i mention specific clientname whitelist on top of serverclass and continue matching =false in that serverclass:app stanza...it just ignored the rest of serverclass below it ..and all apps deployed with * were undeployed suddenly... and cant see the specific client name app also deployed..i do see the specific bundles in ~splunk/var/tmp...however i had moved one specific app from a serverclass with * whitelist to a new server class that was on the top with specific clientname and continuematching=false
... View more
10-21-2013
02:13 PM
Is there any mitigation for above splunk vulnerablity in version 5.0.4 ...ie cant upgrade to latest version in a jiffy as have lot of apps and distribution
Any specifics appreciated!
... View more
- Tags:
- security
10-21-2013
01:57 PM
How do we make a deployment client with specific client name and serverclass designated not honor "*" whitelist designated for another serverclass
ie this client needs to download only the serverclass designated with its client name in whitelist and ignore all other serverclass with whitelist *
... View more
- Tags:
- deploy
- deploy-client
10-03-2013
02:00 PM
Hmmm...just clarifying further or splitting the hair as it seems 🙂 ..or maybe need some jolt of java
ONLY after adding the custom index on my forwarder was an issue with HWF for this to work ? with receiving cluster peers
and in case i go for UF ...i dont need to add the custom index at UF level ..all i need to do is add monitor i shuld be done
really appreciate!
... View more
10-03-2013
01:22 PM
Hmm..bear with me 🙂
1)Normally i would not need to add indexes on the forwarder i would just add inputs
But in this case only after adding indexes on forwarder it was forwarded to the receiver index...
so are you recommending i use a universal forwarder and i will not run into this bug at all ? and just be adding inputs through add monitor command or directly edit inputs.conf it should be ok on a universal fowarder
Thanks!
... View more
10-03-2013
11:44 AM
1 Should we be adding these custom indexes normally to a forwarder...if its a known issue with Cluster based fowarding is there a known bugid for this somewhere and is it resolved in splunk 6 ? or splunk 5.0.5?
2)Run into authetication issues at search head now ..ugh...autentication issues sis very flaky...restart or readd serach head resolves everytime hmmm confidence just dropping
Appreciate inputs
... View more
10-03-2013
11:19 AM
I added indexes my custom indexes and also idx1 on forwarder and restarted the add monitor now does not fail BUT do not see nay data on the cluster search head for those indexes ...howoever the main was forwarded correctly
Appreciate pointers..did you really mean for me to add a index name idx1 on fowarder ? or only my custom indexes?
... View more
10-03-2013
09:49 AM
yes i had checked the same after deploying the cluster app artifacts indexes and inputs and the search head does return the custom indexes correctly and the indexes are alive and enabled in the peer nodes
I have also checked by forwrading to main ..the add monitor works ....however it fails in adding monitor for the custom indexes
Do we need create the custom indexes on the forwarder too ?
I have never known that to be case as the index always needs to be created on the target indexer
Confused
... View more
10-02-2013
05:48 PM
loading splunk static common.min.js is where it stops across all browser on 5.0.4 but not in 5.0.1
... View more
10-02-2013
02:55 PM
My cluster peers have a cluster app with indexes.conf which have custom indexes defined
Clustre bundle has been deployed and works perfectly slave apps have artifacts...receiving also has been setup in peers
My forwarder is correctly configured to send events to cluster peers with ACK
However whenever i try add monitors(on forwarder) sources to specific indexes which exist on the receiving cluster peers ..get error in "handler monitor" paramter index no currently active index..not loaded,disabled,or not defined
The index is however available in the receiving cluster peers
Please suggest ...thanks
... View more
- Tags:
- cluster
10-02-2013
01:51 PM
its across all browsers i have tried but does not have an issue with 5.0.1 splunk build
... View more
10-02-2013
09:48 AM
It did not work..clearing cache ...the only pattern i see i am ableto see fields for a 5.0.1 splunk build but not for 5.0.4 build..."something "in the network is chopping of "something" that possibly changed betwen 5.0.1 and 5.0.4
Now /with 2 unknowns dont know what ? release notes on splunk do not seem to show changes between each splunk minor version ..or i may be mistaken ...appreciate pointers
... View more
10-02-2013
09:47 AM
It did not work..clearing cache ...the only pattern i see i am ableto see fields for a 5.0.1 splunk build but not for 5.0.4 build..."something "in the network is chopping of "something" that possibly changed betwen 5.0.1 and 5.0.4
Now /with 2 unknowns dont know what ? release notes on splunk do not seem to show changes between each splunk minor version ..or i may be mistaken ..can someone show some pointers
... View more
09-24-2013
07:36 PM
No i could not as nothing seemed wrong in the logs and network in between...
... View more
09-23-2013
06:31 PM
Well i did see that post ..and yes a similar screen ....but did not see an answer/solution 😞
... View more
09-23-2013
06:07 PM
Trying to access this over network
Yes is a new install
All browsers(chrome,firefox,IE) with Javascript enabled
Login screen shows without login fields
No errors
... View more
09-23-2013
06:00 PM
1 Karma
Not able to see login fields when launching splunk web ...
Javascript enabled in browser and no iptables issue etc
Appreciate inputs !
... View more
- Tags:
- instal
08-21-2013
07:14 PM
And there is not any way to make the search head a deployment client ?...it has to be manual only ?
I also did read up that Splunk also does not recommend any config management tool like puppet etc to be used to update cluster config ?...
Thanks
... View more
08-21-2013
03:28 PM
Looking to leverage Index replication but still unsure on how to deploy apps with views,search time apps to participating indexers?,search heads
online documentation suggestes there are some limitation for Cluster apps in sense tknowledge bundel dont support search time artifacts ....so how does one actually achieve search time apps in Clustered environments..confused ...and appreciate pointers as i may be amiss on the caveats of CLuster apps ?
... View more
- Tags:
- cluster
08-15-2013
02:56 PM
WE have a syslog ng infrastructure dumping logs and read by splunk default sourcetype "syslog" with defaut extractions ...down the line discover a firewall app...with some good points..how does one midway change the firewall app that was a UDP monitor to be changed to become a file monitor and sourcetype also changed ? along with all the interesting knowledge objects of that app ?
Is there some graceful way to do this without cleaning out data ?
Thanks
... View more
- Tags:
- sourcetype
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
