Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About mikelanghorst
mikelanghorst
Motivator
Member since:
11-03-2010
08-29-2025
Community Statistics
| Posts | 286 |
| Solutions | 20 |
| Karma Given | 360 |
| Karma Received | 229 |
| Member Since | 11-03-2010 |
Activity Feed
- Got Karma for Re: What are the ports that I need to open?. 04-16-2025 05:18 AM
- Posted Re: Splunk 9.3+ Deployment on CIS Red Hat 9 level 1 image - No GUI on Deployment Architecture. 04-02-2025 03:34 PM
- Karma Re: Splunk 9.3+ Deployment on CIS Red Hat 9 level 1 image - No GUI for jwestbank. 04-02-2025 03:33 PM
- Got Karma for Re: What are the ports that I need to open?. 01-06-2025 02:51 AM
- Posted Re: Why is Powershell input not receiving data? on Getting Data In. 05-10-2022 02:21 PM
- Posted Why is Powershell input not receiving data? on Getting Data In. 05-10-2022 09:48 AM
- Got Karma for Re: What are the ports that I need to open?. 03-17-2022 07:11 AM
- Got Karma for Re: What are the ports that I need to open?. 08-18-2021 05:28 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-19-2021 09:48 AM
- Got Karma for Re: What are the ports that I need to open?. 07-28-2020 03:20 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-13-2020 10:52 PM
- Karma Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist" for LukeMurphey. 06-05-2020 12:49 AM
- Karma Re: New forwarder: An Admin password is required??? for xpac. 06-05-2020 12:49 AM
- Karma Re: Where to add certificate info for port 8089? for dwaddle. 06-05-2020 12:48 AM
- Karma Re: what could be the reason for some splunk sessions observed to be in the DDMMYYYY format ( ideally it is in MMDDYYYY format)? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: What are my options to specify the user to start splunk service as on linux for yannK. 06-05-2020 12:48 AM
- Karma Re: Community Supported apps - should they have an external repo for the community to assist in improving? for Damien_Dallimor. 06-05-2020 12:47 AM
- Karma Re: Filtering out 90% log events from indexing for dshpritz. 06-05-2020 12:47 AM
- Karma Re: Splunk installed failed to create splunk account on RHEL for grijhwani. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 |
09-10-2012
03:36 PM
1 Karma
gkanapathy's point was there isn't much point in forcing this to happen prior to your filesystem filling.
... View more
08-30-2012
08:05 AM
The HA license is for the scenario where you would have your forwarders send all data to 2 different indexers all the time. So that if one went down all data would still be available.
... View more
08-09-2012
08:00 AM
I bet you're probably correct there. Just need to verify. Thanks.
... View more
08-08-2012
11:55 AM
I have a few users utilizing vmware desktop environments, that only have Internet Explorer 8 available.
When the user clicks on Alerts or Jobs, IE crashes with a pop-up containing the following message:
"Whoa! Google Chrome has crashed. Relaunch now?"
The pop-up has the chrome icon, but I've confirmed that Chrome isn't installed. What's going on here? Something with a Google Chrome Rendering policy?
... View more
07-13-2012
01:01 PM
Would be nice to be able to "acknowledge" the message so you don't constantly have it up all day.
... View more
07-12-2012
10:40 AM
5 Karma
It's a shot in the dark without more information, but I had this issue before. Are you using the deployment server in your environment? Is it possible your forwarders' outputs.conf got deployed to your indexer?
On the indexer:
./splunk cmd btool outputs list --debug
See if you're somehow looping your inputs back to itself.
... View more
07-04-2012
05:28 PM
UNKNOWN,caiso.com
unknown,caiso.com
ISOOA1,caiso.com
I put the lower case unknown in there after UNKNOWN didn't work. ISOOA1 is our netbios name. Yet they're still showing up as mlanghorst@unknown.
... View more
07-03-2012
11:23 PM
Why do you have the test index on SH1? Is SH3 configured to search against SH1 as a peer? I think the index needs to exist on SH3, even if the data will actually reside elsewhere.
... View more
07-03-2012
08:49 PM
I've created this file after initial setup, but it hasn't updated. Does this have to be in before receiving data?
... View more
07-03-2012
08:45 PM
the provided default file has an incorrect path (and seems to be duplicated) to the python script:
# The check_my_reputation.py script can be run on any host, but requires you to
# enable stuff in reputation.conf
#
[script://$SPLUNK_HOME\etc\apps\fwd_reputation\bin\check_my_reputation.py]
source=Senderbase
sourcetype=MSExchange:Reputation
interval=14400
index=msexchange
disabled=true
[script://$SPLUNK_HOME/etc/apps/fwd_reputation/bin/check_my_reputation.py]
source=Senderbase
sourcetype=MSExchange:Reputation
interval=14400
index=msexchange
disabled=false
Looks like this file needs to be updated from the beta to:
[script://$SPLUNK_HOME/etc/apps/TA-SMTP-Reputation/bin/check_my_reputation.py
... View more
07-03-2012
08:32 PM
I've installed the Splunk for Exchange app. One of the issues I'm having is with users showing up with @unknown.
I've created the domain_aliases.csv on the search head, with UNKNOWN, unknown, and our netbios name, and our domain name. But it's still showing mlanghorst@unknown.
I have 2 indexers and one search head. I've thought that maybe this needs to go on the indexer, but according to the docs I should only need to install the TA* apps there.
What am I missing here? Not sure yet what records that this search is keying off of.
... View more
07-01-2012
04:56 PM
As for the field extractions, searching for each of these sourcetypes it there are a number of fields extracted. But obviously, theres at least one missing.
... View more
07-01-2012
04:46 PM
Sourcetypes, in the index=msexhange there are currently 9 sourcetypes seen:
WinEventLog:Security
WinEventLog:Application
MSExchange:2010:Topology
MSExchange:2010:PublicFolder-Stats
MSExchange:2010:MessageTracking
MSExchange:2010:Mailbox-Usage
MSExchange:2010:Folder-Usage
MSExchange:2010:Database-Stats
MSExchange:2010:AdminAudit
... View more
07-01-2012
04:38 PM
Thanks for replying. The confusing part for me is when there are many searches on the page, such as the summary not knowing which search is complaining. Yea, I'll have to dig deeper, but maybe someone saw this.
I'll add the additional info to the original question.
... View more
06-30-2012
03:32 PM
3 Karma
Well it depends on the app, as some will need additional configuration, such as enabling inputs. But to start simply untar them in $SPLUNK_HOME/etc/apps and restart splunk to make it available.
... View more
06-30-2012
07:50 AM
1 Karma
Use #1, you can control how field extractions occur. What sourcetype is being detected for your input? You may need to override it either in inputs.conf or props.conf on the forwarder. Then setup your own field extractions either with the UI or directly in props.conf doc here
... View more
06-29-2012
05:48 PM
I've installed the MSExchange app, and have data coming in. However when I view the summary page, and several other dashboard pages, I get a blue banner message saying "No matching fields exist." Many of the "activity" reports currently aren't working, but I don't know if those are related.
... View more
06-27-2012
08:57 AM
This should be simple to fix, if you're interested and could join #splunk on EFNet we could knock this out pretty easy. http://cbe002.chat.mibbit.com/ is one webclient
... View more
06-27-2012
08:53 AM
Would need to see you're etc/system/local/inputs.conf if it's not configured in there, then there's no reason why it should be still getting data if you've restarted. Can you confirm that new data is still being indexed, not just seeing old data?
... View more
06-26-2012
09:10 AM
Hmm, I'm lost on why that would occur. I've only seen hex data when I had tried sending tcp syslog data to a splunktcp listener.
... View more
06-26-2012
09:08 AM
How are you receiving the data? Via tcp/udp or reading a file directly?
... View more
06-26-2012
08:52 AM
run:
splunk cmd btool inputs list --debug
This will give you all of the configured inputs, and their properties. the first column will indicate which app has configured that input.
Is the data you're seeing possibly from before the inputs were removed? Did you restart after modifying the inputs?
... View more
06-22-2012
03:34 PM
The summary page should only be showing data from their default searched indexes. Could you provide more details for which search or section of the summary page their seeing the data?
... View more
06-22-2012
12:35 PM
1 Karma
changing inputs.conf - will stop getting new data
"| delete" in the UI - will make it non-searchable (but not save space)
splunk clean eventdata - will remove all data (and the files/space on disk)
Sounds like this may be what you need Setaretirementandarchivingpolicy, setting splunk to remove older data. The forwarders (if you're using seperate forwarders) keep track of the position in the files they've read. If it's just a couple files, you could do something to change the checksums of the files, like add an empty line to the beginning of it(?), or you could if it's a forwarder "splunk clean all" but don't do this unless you understand all the changes that will make.
... View more
