Hey Experts, I have a cluster setup with 3 search heads and 1 deployer. Out of the three search heads, one was temporary. Once i got the permanent, i being stupid and without thinking, removed the temporary without removing it being part of the cluster members. I decided to redo the whole deployer setup. Got deployer set, initialized cluster members done. Can't elect captain as i get this message: In handler 'shclustermemberconsensus': CONFIGURATION ID MISMATCH When i looked in the splunkd.log, it was looking for the temporary cluster member which was a part of it initially. Now it's gone. I just can't elect a captain. Is there any other way I can convince the SH cluster member I want to be captain that the temporary SH I added earlier is no more and R.I.P? Thanks, Raghav ... View more

Hello Experts, I have a QA setup with 1 search head, 2 indexers and 1 universal forwarder. I have created the following certificates on splunk search head box as mentioned in the docs: esCACertificate.csr, esCACertificate.pem, esCAPrivateKey, esForwarderCertificate.csr ,esForwarderCertificate.pem, esForwarderKey.key, esServerCertificate.csr , esServerCertificate.pem, esServerPrivateKey.key, esSplunkWebCert.csr, esSplunkWebCert.pem, esSplunkWebPrivateKey.key I then copied all these certs to both the indexers and universal forwarder. I was able to setup splunkweb ssl all fine as mentioned here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Self-signcertificatesforSplunkWeb Now i tried to setup SSL between two indexers and UF as per the docs: Indexer - Forwarder : http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/ConfigureSplunkforwardingtousesignedcertificates Here's my IDX config [default] host = xyz.com [splunktcp-ssl:9997] compressed = true [SSL] password = server certificate's password rootCA = $SPLUNK_HOME/etc/auth/escerts/esCACertificate.pem serverCert = $SPLUNK_HOME/etc/auth/escerts/esServerCertificate.pem Here's the splunkd.log after i restarted splunk service ****** ERROR TcpInputConfig - SSL server certificate not found, or password is wrong - SSL ports will not be opened ****** My UF outputs.conf: [tcpout] defaultGroup = splunkssl [tcpout:splunkssl] compressed = true server = x:9997,y:9997 sslCertPath = $SPLUNK_HOME/etc/auth/escerts/esServerCertificate.pem sslPassword = esServerCertificates password sslRootCAPath = $SPLUNK_HOME/etc/auth/escerts/esCACertificate.pem sslVerifyServerCert = true Restarted UF splunk service. Here's the error from splunkd.log ERROR TcpOutputProc - Error initializing SSL context - invalid sslCertPath for server x:9997 and ERROR TcpOutputProc - Error initializing SSL context - invalid sslCertPath for server y:9997 I have verified the passwords and they are correct. Please advise. Thanks, Raghav ... View more

Hello Experts, I have used the Table cell highlighting example from 6.x dashboard examples app. I have close to 20 fields in the table with each having several cell values. If i use the example as is, i have to write 20 if loops with range conditions. Has anyone tried looping through using an array with all the field values mentioned only once? I do understand this more a javascript question and not splunk. Any help is appreciated. Here's what i am trying to achieve. Actual js: require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { // Row Coloring Example with custom, client-side range interpretation var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for both the active_hist_searches and the active_realtime_searches field return _(['active_hist_searches']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = parseFloat(cell.value); // Apply interpretation for number of historical searches if (cell.field === 'active_hist_searches') { if (value > 2) { $td.addClass('range-cell').addClass('range-severe'); } else if (value > 1) { $td.addClass('range-cell').addClass('range-elevated'); } else if (value > 0) { $td.addClass('range-cell').addClass('range-low'); } } // Update the cell content $td.text(value.toFixed(2)).addClass('numeric'); } }); mvc.Components.get('highlight').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); // tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row // tableView.$el.find('td.range-cell').each(function() { // $(this).addClass(this.className); // }); //}); // Force the table to re-render tableView.table.render(); }); }); I want to achieve something like this var fields = [f1,f2,f3,f4,f5,f6....f20]; for (i = 0 ; i < fields.length ; i++ ) { if (cell.field === fields[i]) { if (value > 2) { $td.addClass('range-cell').addClass('range-severe'); } else if (value > 1) { $td.addClass('range-cell').addClass('range-elevated'); } else if (value > 0) { $td.addClass('range-cell').addClass('range-low'); } } } Again, i got it working by adding 20 different if loops one for each field...looking for a non-uglier code. Please pardon if this is not at all in Splunk's scope. Thanks in advance! Cheers, Raghav ... View more