About malmoore

malmoore · ‎10-12-2015

Ok, so did telnet fail with a connection refused or a connection timed out ? If the former, that might be expected because communication has already occurred on those ports, though I do believe that multiple inbound connections are acceptable. If it's a timeout, then some sort of network barrier or break exists between your forwarder and your indexer. It looks like your forwarder did make a connection to the indexer, so we need to see why it's not sending the data. Let's take a look at splunkd.log on the forwarder and see what the connection conversation looks like. You'd be looking for attempts from the forwarder to hit the indexer. If you don't mind, you can paste that conversation here.

malmoore · ‎10-12-2015

Nope, nothing different for Linux hosts. The Splunk Add-on for Windows's sole purpose on Linux Splunk instances is to define those indexes.

malmoore · ‎10-12-2015

Hi, Here's what that means: If you define inputs by clicking on entries in the "Enable inputs" dialog box during the installation, that the installer creates configurations that reference indexes for those inputs. This means that, when the forwarder sends data to the indexer for those inputs, it expects that the indexer already has those indexes defined. By default, indexers do not have those indexes defined. To fix that problem, you need the Splunk Add-on for Windows, which you can download here. You can install the app through Splunk Web on the indexer that will receive the forwarded data. No additional configuration is needed. I hope this helps clear up things. I will update the doc text to make it easier to understand. Thanks.

malmoore · ‎10-09-2015

Hi cschmit1, Looks like your setup is correct…so this seems like a connectivity issue. Possibly Windows Firewall. Check splunkd.log on the forwarder. Does it attempt to connect to the indexer at 172.28.28.28? Add the telnet capability to your forwarder and attempt to connect to the instance that way: telnet 172.28.28.28 9997 If that works, then we can troubleshoot what is going on with the forwarder.

malmoore · ‎10-01-2015

Technically it's not a known issue, but a reversion to a previous behavior that was not caught in the documentation. It has been added now. Again, sincere apologies for the headache that this caused.

malmoore · ‎10-01-2015

After some research I've determined that this was indeed changed for all versions of 6.2. The documentation has been updated and an upgrade note has been added. Apologies for any inconvenience.

malmoore · ‎09-23-2015

Were you getting a file permission error when attempting to run the commands on the forwarder? We will be updating the instructions to include steps for Windows hosts, but I am curious as to what made you have to "change permissions on the installed forwarder directory." You should not have to do that normally. Thanks.

malmoore · ‎08-20-2015

Hi Rich, Apologies for the late response. It's been really busy here and I didn't see the updates you had made until now. So, I would see what is going on with the D:\ drive. Is it local? Is it a Windows drive formatted as NTFS, or a shared drive off a Linux server? If a Windows drive, then does the "Everyone" group have read permissions? Does the NT AUTHORITY\SYSTEM account have Full Control permissions? Once you fix the permissions issue, the service should start and this message should go away.

malmoore · ‎08-13-2015

It's not going to be in C:\Program Files\Splunk unless that is where %SPLUNK_HOME% is. Like that other answer says, mongod (the Key Value Store service) won't run unless the lock file is zero bytes or not there because it thinks that the service is not in a good state. I would shut down Splunk on this instance, back up %SPLUNK_HOME%\var\lib\splunk, then delete the lock file and restart Splunk.

malmoore · ‎08-11-2015

Hi, I know you said that you found the similar issue on a *nix system to be a dead end in your case, but this message appears only when the app detects that the App Key Value Store process (mongod) has not started for some reason. Can you check to see if the mongod process is running on your system? Also, if you could check mongod.log and post the contents of the log during startup, that would be very helpful in determining next steps.

malmoore · ‎07-16-2015

Hi @guilmxm, apologies for not responding sooner, I've been out of the office on vacation. This seems like a bug. I will follow up with folks here and either open a ticket to have the issue sorted out or provide a response as to why Firefox isn't supported in this way. Thank you in advance for your patience.

malmoore · ‎06-11-2015

Yes, both will be turned on when you upgrade. You should determine whether or not you need to use both features before disabling them. A number of apps use App Key Value a Store, for example.

malmoore · ‎06-11-2015

The new network ports for Splunk Enterprise 6.2 are open for connections to the local instance. This means that other instances (such as search head cluster members, indexer cluster members, etc.) that use App Key Value Store (port 8191) and Appserver (8065) use these ports to handle those specific operations. If you block those ports, that communication can't happen.

malmoore · ‎06-05-2015

Hi, docteam here. I've spoken with the top product manager for Splunk and while he does not want to lower the guidance of 5GB for any Splunk instance, I've softened the language so that we now recommend that you maintain that level of free space available. You should not need 5GB for a forwarder in many scenarios. However, to account for logging plus internal recordkeeping data (the fishbucket) it's a good idea not to run too lean, even on a forwarder (if it's forwarding a lot of things, for example). I hope this helps.

malmoore · ‎04-29-2015

Hi, We do, as a matter of course, support the latest version of Firefox ESR. The version number that we list in this page is incorrect. At the time of GA of Splunk 6.2.2, the current ESR version was 31, not 24. The minor version was 31.4esr, which was released on January 13, 2015. Splunk Enterprise 6.2 was released on October 28, 2014, and 6.2.2 was released on February 23, 2015. So I have updated this page to note the correct ESR version for Splunk 6.2. I still have some research to complete re: exact versions for ESR and will update this topic with additional information as needed.

malmoore · ‎04-21-2015

Hi guys, Please file a support ticket to have someone triage the issues you are experiencing. The sooner you do this, the sooner we can determine if it is a bug. The msDS-PrincipalName attribute does not exist in Windows Server 2003 Active Directory services.

malmoore · ‎04-21-2015

Confirm that Windows Firewall isn't silently eating packets on both the client and the server.

malmoore · ‎04-16-2015

What version of Exchange App are you using? What version of Splunk Enterprise?

malmoore · ‎04-14-2015

Did you take a look at any of the log files (both in Splunk and on the system) to see if there was a problem when vmstat.sh was only returning the header? What version of *nix do you run?

malmoore · ‎04-14-2015

Unfortunately a file rename is likely the only answer here. You could also try to set up a symbolic link, but it's not guaranteed that bundle replication would work under such a scheme. I've filed a ticket regarding extreme file lengths on Windows for engineers to triage. In order to officially get resources on it, you should file a support case.

malmoore · ‎04-14-2015

This appears to be a problem with installation. However, we need more information to be able to help. What browser are you using? What other text or data is shown with the above error message? What URL is the browser connected to when you receive the message? Thanks.

malmoore · ‎04-14-2015

Events for AD go into the msad index. Are your indexers configured with that index? Can you perform a search and see any data in that index?

malmoore · ‎03-17-2015

By default kvstore should be enabled on Splunk Enterprise 6.2. If it isn't, it's likely because of a file permission or lock issue that's causing the service to fail to start silently. Take a look at $SPLUNK_HOME/var/log/splunk/mongod.log for clues as to why the service hasn't started.

malmoore · ‎03-09-2015

Does the splunk-system-user user have the winfra-admin role? You should not need to edit roles manually - simply assign the winfra-admin role to the user that you log in as to run the app, and you should be done with that part.

malmoore · ‎03-06-2015

This issue is likely the result of an error in the instructions on setting up the 'send to indexer' app that eventually gets deployed to all universal forwarders in a Splunk App for Windows Infrastructure deployment. A forwarder cannot forward things to itself. When you attempt to do this, messages such as the one in this question appear. As part of setup of the "send to indexer" app, you were instructed to create an outputs.conf that directs forwarders to forward to one or more indexers. If you are working on the same machine, as is assumed in these instructions, then by creating the app on the machine, you unintentionally create a 'forwarder loop' if you follow the steps in the next topic, which says to copy the app out of the apps directory and into the deployment apps directory. Instead, you should move the app out of the apps directory and into the deployment apps directory. Since a deployment server cannot be a client of itself, it will never receive the "send to indexer" app and this forwarding loop can be avoided. The documentation has been fixed. Apologies for any inconvenience caused.

Posts	192
Solutions	21
Karma Given	11
Karma Received	164
Member Since	‎10-06-2010

Online Status	Offline
Date Last Visited	‎09-10-2020 04:31 PM

Multiline events ingested by Splunk at different t...

I installed the Splunk Enterprise version 7.2 tria...

What software package dependencies are there for S...

Deployment server: Edit of serverclass.conf requir...

When will Splunk support Mac OS X 10.8 Mountain Li...

Does enabling Splunk Free force all incoming data ...

Re: Can´t get any logfiles into splunk enterprise

Re: Splunk Universal Forwarder Install Question

Re: Splunk Universal Forwarder Install Question

Re: Can´t get any logfiles into splunk enterprise

Re: [WinEventLog://Security] default for evt_resol...

Re: [WinEventLog://Security] default for evt_resol...

Re: Instructions for installing windows forwarder ...

Re: Splunk App for Windows Infrastructure: it has ...

Re: Splunk App for Windows Infrastructure: it has ...

Re: Splunk App for Windows Infrastructure: it has ...

Re: Splunk Supported Browsers - Should Firefox sta...

Re: New ports open in Splunk 6, how are they utili...

Re: New ports open in Splunk 6, how are they utili...

Re: Minimum Disk Space for Splunk 6.x Universal Fo...

Re: Splunk Supported Browsers - Should Firefox sta...

Re: Splunk App for Windows Infrastructure: Why am ...

Re: Splunk Universal Forwarder won't forward event...

Re: How to troubleshoot error "File length is grea...

Re: Splunk Add-on for Unix and Linux: Why vmstat f...

Re: How to troubleshoot error "File length is grea...

Re: Trouble with splunk app for windows infrastruc...

Re: No data on eventtype=msad-dc-health

Re: How to enable kvstore in Splunk 6.2.2 to finis...

Re: Why do I get this error in splunkd.log? "Searc...

Re: Splunk App for Windows Infrastructure: Forward...

Join the Conversation