About bosburn_splunk

bosburn_splunk · ‎12-22-2013

Where were the indexes.conf originally located? In etc/system/local/ or etc/system/local?

bosburn_splunk · ‎10-14-2013

Splunk isn't designed to be the "traditional" document repository or to act as a wiki such as Confluence. For example, since .doc files are a type of binary file, Splunk wouldn't be able to ingest them. I suggest you stick to traditional Wiki / Document repository (such as Documentum) systems to do that. Now, if you wanted to use Splunk to ingest the logs of said systems, go ahead full steam 🙂 Brian

bosburn_splunk · ‎08-07-2013

This is a known issue. It's unknown if / when it will be fixed since fschange is a deprecated feather.

bosburn_splunk · ‎07-08-2013

I actually suggest you install this app instead - http://splunk-base.splunk.com/apps/74435/splunk-for-symantec - Mine is outdated and hasn't been updated in a long time. Brian

bosburn_splunk · ‎05-15-2013

This seems to be a Splunk issue - Steps below identify how to correct. (Identify strong 128 bit tls1 ciphers to use) openssl ciphers -tls1 DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA:KRB5-DES-CBC3-SHA:KRB5-DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:PSK-AES128-CBC-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:KRB5-RC4-SHA:KRB5-RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:KRB5-DES-CBC-SHA:KRB5-DES-CBC-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-KRB5-RC2-CBC-SHA:EXP-KRB5-DES-CBC-SHA:EXP-KRB5-RC2-CBC-MD5:EXP-KRB5-DES-CBC-MD5:EXP-RC4-MD5:EXP-KRB5-RC4-SHA:EXP-KRB5-RC4-MD5 (Modify Splunk web.conf with common TLS and vendor recommended ciphers) cd /opt/splunk/etc/system/local vi web.conf [settings] enableSplunkWebSSL = 1 httpport = 8443 cipherSuite = TLS_RSA_WITH_AES_128_CBC_SHA:TLS_DHE_RSA_WITH_AES_128_CBC_SHA:TLS_DHE_DSS_WITH_AES_128_CBC_SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:PSK-AES128-CBC-SHA (Save, restart web services) /opt/splunk/bin/splunk restart (Test Browser SSL3 reject - Test Browser TLS1 accept)

bosburn_splunk · ‎05-15-2013

Attempting to have users login into Splunk using TLSv1 for FIPS 140-2 requirement -unsuccessful to date - still allowing ALL in. We have updated the web.conf and server.conf files with: cipherSuite = TLSv1 Is this an issue with openssl, or a splunk issue?

bosburn_splunk · ‎05-10-2013

This functionality is not included in the base Splunk forwarder install. You could use deployment monitor app to watch for forwarders that stop sending data, or write a watchdog script that will keep an eye out on the Splunk process and restart it if it crashes.

bosburn_splunk · ‎05-01-2013

Are you running deployment monitor? If so, you may be hitting SPL-63568 (located here - Splunk Known Issues Current work around is to delete any stanza's referring to dm_license_summary_10m_by_indexer in etc/apps/splunk_deployment_monitor/default/savedsearches.conf.

bosburn_splunk · ‎05-01-2013

Are you running deployment monitor? If so, you may be hitting SPL-63568 (located here - Splunk Known Issues Current work around is to delete any stanza's referring to dm_license_summary_10m_by_indexer in etc/apps/splunk_deployment_monitor/default/savedsearches.conf.

bosburn_splunk · ‎04-23-2013

You may need to check and see if there's some kind of firewall in your network that may be hosing the download.. Brian

bosburn_splunk · ‎04-22-2013

As Oliver said having multiple versions in your environment will impact search speeds. For example, if your search heads are 5.0.x and your indexers are 4.x, you will not be able to leverage all the benefits of running 5.0.x. If you can, get all your indexers up to the same revision.

bosburn_splunk · ‎04-19-2013

Szethius - unfortunately we can't help you with determining what is a threat and what isn't a threat. If you're really concerned, you pretty much have two options. You can contact a professional security person to review your logs. The other option is to start Googling those log entries. Brian

bosburn_splunk · ‎04-19-2013

Not having the date in the event means there's no guarantee's Splunk is going to get the date right. It also may be looking at something else in the event to determine the date. I suggest you set DATETIME_CONFIG = CURRENT in the props.conf and let splunk assign the timestamp. Brian

bosburn_splunk · ‎04-15-2013

Sounds like you're using some kind of editor to create the inputs.conf that's mangling the End of lines. I'd suggest you use something like vi if on *nix or notepad on windows.

bosburn_splunk · ‎03-08-2013

Judging by the error, it looks like you haven't installed the CLI commands onto the system that is running Hadoop Connect. Please check out the documentation here - http://docs.splunk.com/Documentation/HadoopConnect/latest/DeployHadoopConnect/HadoopCLI You have to install the CLI on the Splunk instance you are running Hadoop Connect because it connects remotely to the HDFS file system.

bosburn_splunk · ‎03-08-2013

Just to double check - this is for Splunk App for HadoopOps and NOT Hadoop Connect? Unfortunately, there's no way to configure which user will run those Hadoop Commands. It will run as the Splunk user, just as most other scripts do. Brian

bosburn_splunk · ‎01-24-2013

This is a known issue - SPL-58682 - with Splunk monitoring the Current Control Set for this section. The work around is to use the following setting for hive: hive = HKEY_LOCAL_MACHINE\\SYSTEM\\*CONTROLSET*\\ENUM\\USBSTOR?.* This will monitor all control sets for changes for that path. Brian

bosburn_splunk · ‎01-24-2013

The following set up was used in regmon-filters.conf: [WinRegistry] proc = C:\\.* baseline = 0 disabled = 0 hive = HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\?.* index = default type = rename|close|set|delete|open|create|query When adding a USB drive, I see nothing being reported on. What is going on?

bosburn_splunk · ‎12-28-2012

Are ya'll running 5.0? Check this out - http://docs.splunk.com/Documentation/Splunk/5.0.1/Installation/Aboutupgradingto5.0READTHISFIRST#The_Windows_performance_monitoring_input_is_now_modular The Windows performance monitoring input is now modular The performance monitoring inputs for Windows now use the new modular input type. When you upgrade, Splunk replaces the existing scripted input with the new modular input. During the migration, Splunk saves the existing perfmon.conf file and renames it to perfmon.conf.migrated. It then copies the inputs defined in that file and places them into inputs.conf under similarly-named stanzas. This has major impact for users who use the Splunk App for Microsoft Exchange and the Splunk App for Active Directory. Those apps use performance monitoring inputs extensively. If you use either of these apps, we suggest that you do not upgrade the apps until compatible versions are released. For additional information on what a modular input is, read "Modular inputs overview" in the Developing Views and Apps for Splunk Web Manual.

bosburn_splunk · ‎12-28-2012

Take a look at this - http://docs.splunk.com/Documentation/Splunk/5.0.1/Installation/Aboutupgradingto5.0READTHISFIRST#The_Windows_performance_monitoring_input_is_now_modular I'm willing to guess it's the same issue. The application will have to be updated.

bosburn_splunk · ‎12-11-2012

You can find several different queries here - http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume Brian

bosburn_splunk · ‎10-11-2012

As of right now, there is no facility that accomplishes this goal. You could write a script to rotate the log files outside of Splunk.

bosburn_splunk · ‎10-02-2012

Check out http://splunk-base.splunk.com/answers/10500/tiered-deployment-servers-is-it-possible

bosburn_splunk · ‎10-02-2012

Hrrm. The default location an application gets deployed to is $SPLUNK_HOME/etc/apps, so that may not work. It may be an easier solution to set up an rsync process and to schedule a period reload of serverclass.conf..

bosburn_splunk · ‎10-02-2012

Yes, it can. It's called a multi-tenant deployment environment. You can read more here - Deploy in multi-tenant environment

Posts	107
Solutions	20
Karma Given	166
Karma Received	262
Member Since	‎04-25-2012

Online Status	Offline
Date Last Visited	a month ago

Windows Forwarder reading file just fine while Lin...

I can't download the installation files from the S...

I changed Splunk from using SSLv3 to TLSv1.2, and ...

Splunk unable to read specific files even though i...

How do I give users access to view the License Usa...

Halp! My data is being rolled to frozen and I don...

How to restrict all user logins to TLS1 cypher

Trying to monitor HKLM\\SYSTEM\\CurrentControlSet...

How to apply licenses at a more granular, per-user...

Re: V6.0.1 update appears to have broken indexes.c...

Re: Splunk as a document repository

Re: FS Change keeps adding and deleting files from...

Re: Symantec Endpoint Reporting App blank

Re: How to restrict all user logins to TLS1 cypher

How to restrict all user logins to TLS1 cypher

Re: Splunk light weight forwarder failover capabil...

Re: Anybody know what this error means

Re: Invalid URI Fragment error in splunkd.log

Re: Installation error 1335 - 64-bit downloaded tr...

Re: Multiple indexer versions

Re: Can anyone help me determine if this is a thre...

Re: Timestamps jump back a day

Re: Deployment client as Universal Forwarder

Re: Invalid Hadoop CLI command path Why?

Re: Invalid Hadoop CLI command path Why?

Re: Trying to monitor HKLM\\SYSTEM\\CurrentContro...

Trying to monitor HKLM\\SYSTEM\\CurrentControlSet...

Re: XenDesktop no session information

Re: Universal Forwarder 5 and XenDesktop App

Re: Index volume by host

Re: Universal forwarder monitor clean files

Re: Can one Deployment server send data to another...

Re: Can one Deployment server send data to another...

Re: Can one Deployment server send data to another...

Join the Conversation