Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About mikelanghorst
mikelanghorst
Motivator
Member since:
11-03-2010
08-29-2025
Community Statistics
| Posts | 286 |
| Solutions | 20 |
| Karma Given | 360 |
| Karma Received | 229 |
| Member Since | 11-03-2010 |
Activity Feed
- Got Karma for Re: What are the ports that I need to open?. 04-16-2025 05:18 AM
- Posted Re: Splunk 9.3+ Deployment on CIS Red Hat 9 level 1 image - No GUI on Deployment Architecture. 04-02-2025 03:34 PM
- Karma Re: Splunk 9.3+ Deployment on CIS Red Hat 9 level 1 image - No GUI for jwestbank. 04-02-2025 03:33 PM
- Got Karma for Re: What are the ports that I need to open?. 01-06-2025 02:51 AM
- Posted Re: Why is Powershell input not receiving data? on Getting Data In. 05-10-2022 02:21 PM
- Posted Why is Powershell input not receiving data? on Getting Data In. 05-10-2022 09:48 AM
- Got Karma for Re: What are the ports that I need to open?. 03-17-2022 07:11 AM
- Got Karma for Re: What are the ports that I need to open?. 08-18-2021 05:28 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-19-2021 09:48 AM
- Got Karma for Re: What are the ports that I need to open?. 07-28-2020 03:20 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-13-2020 10:52 PM
- Karma Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist" for LukeMurphey. 06-05-2020 12:49 AM
- Karma Re: New forwarder: An Admin password is required??? for xpac. 06-05-2020 12:49 AM
- Karma Re: Where to add certificate info for port 8089? for dwaddle. 06-05-2020 12:48 AM
- Karma Re: what could be the reason for some splunk sessions observed to be in the DDMMYYYY format ( ideally it is in MMDDYYYY format)? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: What are my options to specify the user to start splunk service as on linux for yannK. 06-05-2020 12:48 AM
- Karma Re: Community Supported apps - should they have an external repo for the community to assist in improving? for Damien_Dallimor. 06-05-2020 12:47 AM
- Karma Re: Filtering out 90% log events from indexing for dshpritz. 06-05-2020 12:47 AM
- Karma Re: Splunk installed failed to create splunk account on RHEL for grijhwani. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 |
11-24-2015
05:02 PM
Yes, this would work
... View more
11-24-2015
04:13 PM
I'd ask the easy question first. Are you searching in index=wineventlog? Or have your role to search all internal indexes?
This response likely doesn't rate as an answer yet.
... View more
10-12-2015
02:52 PM
Asking the most basic question: Did you actually configure inputs?
Edit: The Splunk_TA_windows inputs aren't actually enabled when you download them from SplunkBase.
... View more
10-12-2015
02:45 PM
It's not asking about SPLUNK_HOME, but rather $HOME, of the user splunk runs as.
... View more
10-12-2015
09:02 AM
Makes it difficult when you have a larger or more complex install. Trying to resync multiple nodes across a wan at the same time makes your network admins cry.
... View more
10-01-2015
08:41 AM
Karen, Thanks for your well thought out detailed response provided. It's good to know that it's taken seriously.
... View more
08-17-2015
02:05 PM
Though if you're only concerned with status=408, I'd go ahead and put it in the originating search, before the "|top" shown here.
... View more
08-07-2015
09:45 AM
2 Karma
While you'll want the app deployed to your indexed clusters, thru the normal Cluster Master -> Indexer deployment, the inputs should definitely NOT be enabled/configured there.
You'll want a seperate Heavy Forwarder somewhere in your environment, setup the Opsec app there, and have the HF forward the data to your indexers.
... View more
08-07-2015
09:42 AM
splunksurekha -
Are you either running the search on your License Master or are you sure that the license master is forwarding to your indexers? Looking at the license log itself it going to be to be difficult, since it's only reporting in small increments. Something like the search kendrickt gives is what you'll need to show how it adds up.
... View more
08-03-2015
02:49 PM
1 Karma
It looks like 6.2 wants the tag to be url encoded, not "[shell=/bin/bash" but rather "[shell=%2Fbin%2Fbash]". But like phoffman said, update to latest version and it should be ok.
... View more
05-13-2015
10:47 AM
Absolutely, I wouldn't want it a requirement by any means. But maybe something in the submission asking "Is there an external repository" as a gentle nudge so that the submitter considers it.
Thanks for the feedback Damien.
... View more
05-13-2015
10:07 AM
edit: typo, replacing approving with improving
... View more
05-13-2015
10:05 AM
2 Karma
As time goes on I see that some of the community supported apps languish behind, not being updated to support later splunk versions If they're going to be community supported, shouldn't we have them in an available external code repository like github?
For a widely known vendor that intends to support it long term this may not be a huge issue, but i've even seen times where Splunk apps could use something to allow easier improvement by users (Splunk_TA_nix scripts for example). Though they've been receptive in the past for improvements sent by mail. But for community supported apps I think it would be very helpful to have an external repo where other users could more easily assist in improving/maintaining these apps.
Yes, I'd agree that it should be a decision made by the submitter, but should it be encouraged to have this?
... View more
04-07-2015
11:16 AM
1 Karma
"Splunk Forwarder" is typically referring to the lighter weight install of the Splunk Universal Forwarder or UF. It has a smaller disk footprint with some functionality stripped out, and smaller memory usage. Typically if you're only reading files or running scripted inputs, such as Splunk_TA_nix, the UF is all that's needed. However as jeffland mentions there are some occasions that the full install or heavy forwarder is desired. Being able to filter unneeded data before hitting the wire, or acting as a collection node between data centers being 2 of those reasons.
... View more
02-09-2015
02:53 PM
I needed the results of dropped packets on an interface, so I modified the default interfaces.sh script to include those fields. I tested deploying to a small number of dev hosts and everything looked fine.
When I moved it to a bigger set of servers this morning, I started seeing the header in the search results. Since Splunk is now passing that and other *nix source types to "|multikv" by default, what could be going on here? Not sure where to look for this.
... View more
08-29-2014
11:06 PM
After talking with Masa from support, he pointed out the "/local" in my path above, and that it shouldn't be included when deploying from the cluster-master. A co-worker had previously extracted the files into this location and I didn't realize it.
For the lack of a spec file, the option "--skip-validation" is available to allow it to continue to apply the bundle. However this makes me a bit nervous.
I ended up deploying this manually into the regular etc/apps directory for now.
... View more
08-25-2014
10:46 AM
In deploying the VMWare app to clustered indexers, I'm currently getting the following errors, when attempting to "splunk apply cluster-bundle". This is preventing the apply, and halting our progress:
In handler 'clustermastercontrol': No spec file for: /app/splunk/splunk_cm8189/etc/mas ter-apps/SA-Hydra/local/hydra_gateway.conf
;No spec file for: /app/splunk/splunk_cm8189/etc/master-apps/SA-Hydra/local/hydra_node .conf
; Possible typo in stanza [keyindicator] in /app/splunk/splunk_cm8189/et c/master-apps/SA-Utils/local/alert_actions.conf, line 4: title
Anyone see this, or have a resolution? Opening a case, but pasting this here so I can come back later with the resolution.
... View more
05-20-2014
10:22 AM
In 6.0, replicated buckets are now kept in the same "level" on both sides. Hot buckets are replicated into the same location as the hot buckets on the peer.
... View more
05-13-2014
03:26 PM
1 Karma
When running a search against a weblog, and attempting to "|timechart span=1h limit=0 count by queryname" for 24hrs, I get the " Your search generated too much data for the current visualization configuration."
Is it just truncating the graph, or the statistics table as well?
... View more
04-12-2014
09:41 AM
6.0.3 was solely for the OpenSSL bug fix.
... View more
04-12-2014
09:40 AM
1 Karma
After opening a support case, I was told this was a known bug being worked on and should be in an upcoming release. The OpenSSL bug was the only fix for 6.0.3, so I'd expect it to likely be in 6.0.4.
... View more
04-12-2014
09:37 AM
6.0.3 was a release only to fix the recent OpenSSL bug. The other fixes they're working on have been pushed back.
... View more
04-09-2014
05:19 PM
it was already set in the ps.sh script, which is how I stumbled across it. I tried to copy/paste the CMD from ps.sh and got that same error.
... View more
04-09-2014
05:07 PM
1 Karma
Finally circled back to this and found the issue. HP-UX needs "UNIX95=1" set to use the -o switch for ps. It's using ps in this script, to get the SystemUpTime field.
I've just updated my copy of the script with the following snippet.
- #Setting UNIX95 for HP-UX
- if [ "x$KERNEL" = "xHP-UX" ]; then
- export UNIX95=1
- fi
... View more
02-19-2014
11:43 AM
Recently I looked at the Forwarder Management page, and selected the "Phone Home: Later than Expected". A large number of hosts were listed here, but when I filtered for the individual hosts, and set it back to Phone Home: All, I found that the host was listed multiple times.
Now some of them were likely related to DHCP IP's being changed. But several of them have static IP's.
The page shows that the Host Name, Client Name, IP Address, are all the same. Yet one entry shows a Phone Home of 12 hours ago, while the other shows a few seconds ago.
Why the duplicates?
... View more
- Tags:
- forwarder-management
