Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About greich
greich
Communicator
Member since:
02-06-2013
06-05-2020
Community Statistics
| Posts | 43 |
| Solutions | 1 |
| Karma Given | 27 |
| Karma Received | 6 |
| Member Since | 02-06-2013 |
Activity Feed
- Karma How to resolve splunk-perfmon.exe errors of Counter is not found? for dlpco. 06-05-2020 12:50 AM
- Karma Re: Why won't SplunkWeb start after ES was upgraded? for LukeMurphey. 06-05-2020 12:49 AM
- Karma Re: Can you regex or wildcard props Sourcetype stanzas? for jplumsdaine22. 06-05-2020 12:48 AM
- Karma Re: Why does an eventtype calling a macro only fails in an indexer / search head cluster? (macro is not expanded) for sowings. 06-05-2020 12:47 AM
- Karma Re: Linux Auditd: What is the best way to make /var/log/audit/audit.log accessible to a non-root Splunk forwarder? for pbunts. 06-05-2020 12:47 AM
- Karma Splunk DB Connect 2: Identities and Connections not synchronized between SHC members and encrypted passwords in db_connections.conf are not hashed using splunk.secret for darrend. 06-05-2020 12:47 AM
- Karma Re: Example: Simple XML using PostProcess? for Raghav2384. 06-05-2020 12:47 AM
- Karma Re: Does Enterprise Security automatically re-enable data model acceleration? for Lowell. 06-05-2020 12:47 AM
- Karma Re: How to remove real-time searches from Search and Home Page UI? for sherm77. 06-05-2020 12:47 AM
- Karma Re: Distributed Managment Console : What Server Role should an intermedeat or Heavy forwarder be set at? for esix_splunk. 06-05-2020 12:47 AM
- Karma Re: Distributed Managment Console : What Server Role should an intermedeat or Heavy forwarder be set at? for DamageSplunk. 06-05-2020 12:47 AM
- Got Karma for Re: How to retrieve logs from Azure Active Directory?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Enterprise Security: How to troubleshoot if the Threat Intelligence Source data is actually being downloaded?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Enterprise Security: How to troubleshoot if the Threat Intelligence Source data is actually being downloaded?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Enterprise Security: How to troubleshoot if the Threat Intelligence Source data is actually being downloaded?. 06-05-2020 12:47 AM
- Karma Re: How do you add dummy events to a search result? for rstitt. 06-05-2020 12:46 AM
- Karma Re: Fire Brigade - ERROR ApplicationManager - Unexpected duplicate app: TA-fire_brigade for Jason. 06-05-2020 12:46 AM
- Karma Re: How to add a new index to a cluster for Steve_G_. 06-05-2020 12:46 AM
- Karma How to clean a clustered index? for dart. 06-05-2020 12:46 AM
- Karma Re: IMAP app : getting "endid" error : Rackspace mail server for richnavis. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-28-2019
12:52 AM
whether you edit in UI or the conf files, it does not always update the kvstore until you "Apply changes"
... View more
10-24-2019
07:57 AM
Windows servers with the configuration documented in Splunk App for Infrastructure 1.4.1.
They both gather correctly metrics, albeit without prefix, AND generate daily each hundreds of thousands of these error messages.
... View more
01-24-2019
06:38 AM
anyone, purging queue on (intermediate) forwarders stuck at 100%, without reinstalling from scratch?
... View more
11-28-2018
03:37 AM
I have the same issue. What I found out so far is that on some very large events, the eventtype is correctly identified by the indexers and returned to the search heads, but if the marker (search string, term) appears to "deep" into the event, it is not matched on the search head, and of course neither is any tag associated with it.
Typically on stacktraces where the event is 2-400 lines or more.
Likely some limit on search heads with respect to pattern matching. Will update if I dig something up.
... View more
10-11-2018
05:15 AM
I am facing the same issue with splunk enterprise 7.1.3 and TA 5.0.1. NOT using the infrastructure app, just the TA
... View more
03-05-2018
12:22 AM
Slightly different symptoms for me after Splunk 5.0.0 search head cluster upgrade.
Splunkweb starts, and can be verified by netstat and / or a local curl (which returns a 302 redirect).
Would crash on first attempt to open a real web page.
Codes slightly different as well:
root:826 - Unable to start splunkweb
and
root:827 - cannot import name SplunkLookupTransform
Accepted answer worked a charm after I spent several hours banging my head.
... View more
02-01-2018
12:33 AM
as mentioned above, the correct answer is the markresults command
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults
... View more
07-18-2017
04:51 PM
while the accepted answer above works, it is a trick. the search command makeresults is the correct answer
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults
... View more
04-28-2017
01:39 AM
we are using 6.5.2 Enterprise>
On new search heads, the core logs have been moved to a symlink:
ls -l /opt/splunk/var/log/
drwx------. 2 splunk splunk 4096 Apr 17 17:50 introspection
lrwxrwxrwx. 1 splunk splunk 15 Mar 20 11:46 splunk -> /var/log/splunk
This results in reported errors
04-28-2017 07:36:37.346 +0000 ERROR FilesystemChangeWatcher - Error setting up inotify on "/opt/splunk/var/log/splunk": Not a directory
but the logs seems to be indexed normally.
Can I safely assume that these should be WARN, or am I going to have issues down the line (log rotation, upgrades, whatever)?
... View more
02-10-2017
06:36 AM
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Unauthorized</msg>
</messages>
</response>
... View more
12-30-2016
03:45 AM
macros.conf is normally not replicated to indexers. This is why it works in stand-alone and not with a distributed search to indexer or cluster.
You can add it in distsearch.conf.
... View more
12-06-2016
04:15 AM
I guess, the question is: is it safe/when is it safe to prune the older directories? are they only some sort of "backups" or are they used actively during replication for comparison purposes?
... View more
11-07-2016
05:15 AM
I can confirm that this fails on 6.4.0, even when run directly on a search head part of a cluster. (i.e. bypassing the load balancer)
... View more
10-26-2016
04:29 AM
this answers more accurately the question and does not involve restricting capabilities that might be required in a large context
... View more
06-10-2016
07:45 AM
1 Karma
http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/About
and in particular http://docs.splunk.com/Documentation/AddOns/latest/MSCloudServices/Hardwareandsoftwarerequirements
should answer your question.
... View more
06-03-2016
07:11 AM
3 Karma
1- from the UI: Audit / Threat Intelligence Audit
2- from the command line
ls -l $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/local/data/threat_intel/
... View more
06-01-2016
07:11 AM
getting the error on a 2.1.3 stand-alone SH! And the ldapsearch command is configured as local.
... View more
03-08-2016
01:11 AM
Specifically I don't understand why the cluster is trying to replicate a DMC asset supposed to be local
... View more
02-17-2016
01:55 AM
adding the key to the .conf.spec should resolve this
... View more
12-15-2015
01:45 AM
6.3 allow to set action.email.maxtime (in advanced edit) for any scheduled pdf.
but there does not seem to be a field for changing:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
PDFGEN_SIMPLE_REQUEST_TIMEOUT = 3600
$SPLUNK_HOME/etc/system/bin/pdfgen_endpoint.py
DEFAULT_TIMEOUT = 3600 # in seconds
and patching the code does not strike me as a good idea.
... View more
12-01-2015
01:29 AM
cloning the TA works as you obtain a different path
... View more
09-29-2015
03:00 AM
You can create your dashboard(s) using Reports (=saved searches) instead of inline searches. The reports can then be scheduled and embedded using a permlink (requires PowerUser).
See http://docs.splunk.com/Documentation/Splunk/6.3.0beta/Report/Embedscheduledreports
... View more
07-16-2015
01:15 AM
that did it, with no noticeable impact on CPU on the IF (was expecting some). Thanks again
... View more
07-15-2015
08:53 AM
Yes IF are HF. On the first instance, your solution seems to work perfectly. Will let soak, and confirm later. Thank you.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
