Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About splunkreal
splunkreal
Motivator
Member since:
05-26-2016
07-29-2025
Community Statistics
| Posts | 568 |
| Solutions | 29 |
| Karma Given | 806 |
| Karma Received | 48 |
| Member Since | 05-26-2016 |
Activity Feed
- Got Karma for Re: How to troubleshoot why we are getting "appserver port: already bound" on startup of Splunk 6.2.x after re. 2 weeks ago
- Posted Re: oracle:audit:unified Parsing Issue on All Apps and Add-ons. 07-25-2025 09:09 AM
- Karma Re: oracle:audit:unified Parsing Issue for kiran_panchavat. 07-25-2025 06:43 AM
- Karma Re: oracle:audit:unified Parsing Issue for kiran_panchavat. 07-25-2025 06:43 AM
- Karma Re: Moving Cluster to new subnet for esix_splunk. 07-21-2025 08:51 AM
- Karma Re: Where to perform field extraction in Splunk cluster for PickleRick. 06-30-2025 11:49 PM
- Karma Re: Where to perform field extraction in Splunk cluster for FrankVl. 06-30-2025 11:48 PM
- Posted Re: Splunk HEC/kafka raw logs parsing / addons on Getting Data In. 06-26-2025 08:36 AM
- Karma Re: Splunk HEC/kafka raw logs parsing / addons for livehybrid. 06-26-2025 08:35 AM
- Karma Re: Extract fields from RFC5424 syslog with nested json field for PickleRick. 06-25-2025 05:54 AM
- Karma Re: Extract fields from RFC5424 syslog with nested json field for tej57. 06-25-2025 05:53 AM
- Posted Re: Splunk HEC/kafka raw logs parsing / addons on Getting Data In. 06-18-2025 05:44 AM
- Karma Re: Splunk HEC/kafka raw logs parsing / addons for livehybrid. 06-18-2025 05:43 AM
- Posted Splunk HEC/kafka raw logs parsing / addons on Getting Data In. 06-18-2025 05:14 AM
- Karma Re: Submitting events over HEC to an index other than main? for PickleRick. 06-18-2025 04:45 AM
- Posted Extract fields from RFC5424 syslog with nested json field on Getting Data In. 06-05-2025 07:45 AM
- Karma Re: How to get the nested objects from my JSON data field? for PickleRick. 06-01-2025 05:13 AM
- Posted Re: Does props.conf support wildcards? on Getting Data In. 05-16-2025 12:24 AM
- Got Karma for Re: How do I renew an expired Splunk Certificate?. 05-02-2025 11:58 AM
- Karma Re: Disable visibility of app on Search Head Cluster for lroynsky. 04-30-2025 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-30-2024
08:21 AM
Hello, Could you tell me what is priority? capabilities explicitly enabled/disabled or from inherited roles? I had to manually edit etc/system/local/authorize.conf (clustered environment) on edit_correlationsearches = enabled (was disabled) even if it had ess_admin, ess_analyst and power inherited. Thanks for your help.
... View more
Labels
- Labels:
-
administration
-
troubleshooting
07-25-2024
02:31 PM
Hello, we receive data using _TCP_ROUTING from forwarders from another team using another Splunk cluster. We don't use same indexes. Instead of routing data based on source or host we receive on our indexers, is it possible to route data from one index (specified in their inputs.conf) to our own index? Especially what would be the props.conf stanza? Thanks.
... View more
Labels
07-23-2024
10:00 AM
1 Karma
Try connecting directly to one of your search heads (through ssh tunnel if needed) and see if IR is showing now and investigate your haproxy.conf
... View more
07-23-2024
10:00 AM
Hello, if you have these errors while loading Incident review and you are behing haproxy server, probably there is a misconfiguration. Possible web errors: Error loading some filters Updating... Waiting for data...
... View more
Labels
07-23-2024
09:58 AM
Subject moved to https://community.splunk.com/t5/All-Apps-and-Add-ons/Solution-Splunk-Enterprise-Security-ES-incident-review-not/m-p/694084/thread-id/80869#M80870
... View more
07-23-2024
09:56 AM
Subject moved to https://community.splunk.com/t5/All-Apps-and-Add-ons/Solution-Splunk-Enterprise-Security-ES-incident-review-not/m-p/694084/thread-id/80869#M80870
... View more
07-18-2024
09:54 AM
Hello, this is old topic but want to know if pushing addon from deployer using encrypted credentials in new local/passwords.conf (previously encrypted by clustered search head) is different in term of behavior than configuring addon on search head (web UI) and letting SHC replicating passwords.conf?
... View more
07-18-2024
09:29 AM
1 Karma
Hello, anyone already had similar error : “07-17-2024 14:28:21.721 +0200 WARN PasswordHandler [38267 TcpChannelThread] - Unable to decrypt passwords.conf/[credential:REST_CREDENTIAL#TA-thehive-cortex#configs/conf-ta_thehive_cortex_account:service_thehivesplunk_cred_sep2:]/password” This was solved by using clear-text or (it seems) pushing addon with SHC "already encrypted password." Thanks.
... View more
Labels
- Labels:
-
deployer
-
search head clustering
07-18-2024
09:24 AM
Hi @woodcock this is old topic however just want to know if pushing addon from deployer using encrypted credentials in new local/passwords.conf (previously encrypted by clustered search head) is different in term of behavior than configuring addon on search head (web UI) and letting SHC replicating passwords.conf?
... View more
07-12-2024
07:03 AM
Hello, be careful TA-WALLIX_Bastion/default/passwords.conf can crash Configuration page of its own settings/configuration page + other addons.
... View more
Labels
07-12-2024
06:54 AM
Following advice from developer, I renamed passwords.conf from another addon TA-WALLIX_Bastion/default/passwords.conf and now Configuration finally opening
... View more
07-11-2024
10:28 AM
Hello, can't load Settings page: "Something went wrong!" Configuration page failed to load (ERR0002) Splunk Enterprise 9.1.1 (clustered) / standalone Splunk 9.0.4 Addon version 2.3.2 or 3.3 (same error) Log: 07-11-2024 11:05:34.421 +0200 ERROR AdminManagerExternal [25211 TcpChannelThread] - Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [500]: Internal Server Error -- Traceback (most recent call last):\n File "/OPT/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunktaucclib/rest_handler/handler.py", line 117, in wrapper\n for name, data, acl in meth(self, *args, **kwargs):\n File "/OPT/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunktaucclib/rest_handler/handler.py", line 338, in _format_all_response\n self._encrypt_raw_credentials(cont["entry"])\n File "/OPT/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunktaucclib/rest_handler/handler.py", line 368, in _encrypt_raw_credentials\n change_list = rest_credentials.decrypt_all(data)\n File "/OPT/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunktaucclib/rest_handler/credentials.py", line 289, in decrypt_all\n all_passwords = credential_manager._get_all_passwords()\n File "/OPT/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/solnlib/utils.py", line 153, in wrapper\n return func(*args, **kwargs)\n File "/OPT/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/solnlib/credentials.py", line 341, in _get_all_passwords\n return self._get_clear_passwords(passwords)\n File "/OPT/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/solnlib/credentials.py", line 324, in _get_clear_passwords\n clear_password += field_clear[index]\nTypeError: can only concatenate str (not "NoneType") to str\n". See splunkd.log/python.log for more details. Thanks for your help.
... View more
Labels
06-28-2024
02:15 AM
Hi @jkamdar check splunkd.log on forwarders, they are usually good to diag. Good luck!
... View more
06-26-2024
07:12 AM
Hi @nspaitsec license manager and clustered indexers
... View more
06-03-2024
02:46 AM
Make sure Scheduledview objects have right permissions too.
... View more
06-01-2024
07:05 AM
Hello, is it indexer? If yes it can happen, if it's search head you can force stopping current searches.
... View more
06-01-2024
06:58 AM
Hello, you should check DNS records on your server, not sure internal logs can help.
In worst case use this example :
props.conf
[host::<IP address>]
TRANSFORMS-<hostname>=<hostname>_override
transforms.conf
[<hostname>_override]
REGEX = (.*)
DEST_KEY = MetaData:Host
FORMAT = host::<FQDN>
... View more
05-18-2024
05:48 AM
Hi @dgiberson look at the macro :
[cisco_ios_index]
definition = (index=*)
... View more
05-18-2024
05:40 AM
Hi @gcusello thanks, just confirmed then that we don't need to go especially to the MC server to see this kind of warning/error.
... View more
05-18-2024
12:49 AM
Hello 🙂 I'm wondering if warnings like "Local KV Store has replication issues" are shown to any admin user on any Splunk web (DMC server and any SHC member) ? Thanks.
... View more
05-16-2024
12:10 PM
Hello @CSReviews you can export as csv file it's then easy to import. https://hurricanelabs.com/splunk-tutorials/ingesting-a-csv-file-into-splunk/ "Upload with Splunk Web"
... View more
05-16-2024
11:58 AM
Hello @whitecat001 try this :
index=_audit action="search" search="*" NOT user="splunk-system-user" savedsearch_name="" NOT search="\'|history*" NOT search="\'typeahead*"
| rex "index=(?P<myIndex>\w+)\s+\w+="
| stats count by myIndex
... View more
05-16-2024
03:29 AM
Hello @Poojitha you can try splunk list deploy-clients -count -1 Also you should use Settings/Forwarder management (GUI interface of your DMC server).
... View more
05-13-2024
06:39 AM
Hi @ITWhisperer you should filter with _time otherwise you will find unaccurate results probably?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-29-2025
11:31 AM
|
Karma given to
