About vikram_m

vikram_m · ‎09-12-2017

This was helpful amahoski but what I would like to know is, as I want to push outputs.conf automatically to the UFs, how can I achieve this functionality.

vikram_m · ‎09-11-2017

I have an app created and deployment client created. I need to push the app automatically to the UFs which are connected. How can that be achieved? For now UFs are connected to deployment server from there I add them in server class and push app. I want outputs.conf app should be automatically pushed to them. Please help. Thanks. Vikram.

vikram_m · ‎09-08-2017

in system/local directory below is the configuration. [monitor:\{Log Location}] sourcetype=test index=chilqa disabled = false but it is surprising why data is sent to main index still. is there any other location which is making the index to pass to main index? Thanks. Vikram.

vikram_m · ‎08-28-2017

I found the issue...it was port internal communication port was not open....opening the port resolved the issue.

vikram_m · ‎08-02-2017

Thanks this force command worked.

vikram_m · ‎08-02-2017

We have followed the link to create a search head cluster. https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.splunk.com%2FDocumentation%2FSplunk%2F6.5.3%2FDistSearch%2FStaticcaptain&data=02%7C01%7CVikram.Mawinkatti%40honeywell.com%7C11d72e1b5dcb4346aeb108d4d88f552d%7C96ece5269c7d48b08daf8b93c90a5d18%7C0%7C0%7C636371557512280453&sdata=nYIWxLt5gCOx0CdmZnE0HtM4vS6tl%2Bmh%2BkwG3k6321E%3D&reserved=0 however it says finally we need to initiate a captain then captain election will be random. On all the servers we connected them to the deployment server and when I hit the final command to elect a captain for the first time I see below error. I checked all 8089 and the mgmt port for Search replication are opened on VM level on all the search heads but it giving following erorr. [splunk@search1 bin]$ ./splunk bootstrap shcluster-captain -servers_list ":8089,:8089,:8089 " -auth admin:****** Failed to Set Configuration. One potential reason is captain could not hear back from all the nodes in a timeout period. Ensure all to be added nodes are up, and increase the raft timeout. If all nodes are up and running, look at splunkd.log for appendEntries errors due to mgmt_uri mismatch Thanks for your reply. Vikram.

vikram_m · ‎08-02-2017

Thanks Giuseppe but I tried this command and had a server restart still I am getting the same error. 😞 Thanks. Vikram.

vikram_m · ‎08-02-2017

splunk was installed on a machine and we wanted to reinstall it. What I did is I stopped Splunk, removed directory and restarted server. I still got this error so I went to the run level and removed the process from runnig and took server restart. Still I am facing the same issue of "package splunk-6.5.3-36937ad027d4.x86_64 is already installed" Please let me know how can I install splunk and begin configuration again. [splunk@Search3~]$ sudo rpm -ivh /opt/splunk-6.5.3-36937ad027d4-linux-2.6-x86_64.rpm warning: /opt/splunk-6.5.3-36937ad027d4-linux-2.6-x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 653fb112: NOKEY Preparing... ################################# [100%] package splunk-6.5.3-36937ad027d4.x86_64 is already installed Thanks. Vikram.

vikram_m · ‎07-04-2017

We need to give only DMC access to users from L1 team. We dont need the team to have admin or power role access can some one please help me with the capabiltiy we can use so that a set of users can only view the DMC console and raise alarms incase the Splunk cluster is not complete.

vikram_m · ‎06-29-2017

We have users mapped via names like "vikram" now we want to map it via "emp id" as we have configured search head with SAML. In this the biggest challenge is how can we change the user's saved search by his/her EIN else these will go into orphaned search. Also once the user is mapped via his EIN if he login in via SAML URL will he be using his SAML passwd or please help me with the configurations here. Thanks. Vikram.

vikram_m · ‎06-28-2017

our data in Splunk is differentiated based on Index. Now we need to se alert on index level whenever some index stops indexing data for more than 15min so that we can debug is there some thing wrong with getting particular data in.

vikram_m · ‎06-19-2017

This process link helps....https://docs.splunk.com/Documentation/Splunk/6.6.1/Scenarios/Extractfields Thanks Adonio

vikram_m · ‎06-19-2017

From the log mentioned below I need to extract the field 'Response Time' and then frame a query for response time < 10sec 2017-06-19 10:29:25,556 [[weather-project-v1-dev-corp].api-httpListenerConfig.worker.01] INFO org.mule.api.processor.LoggerMessageProcessor - Transaction [4610f1e7c84641f7ac851ea04d0e4e7b] - Response Time [0.404325574999973] - HTTP Status [200] - Returned Success Response to Client Can some one please suggest how can I add "Response time" to interesting fields and then I can use it for framing queries accordingly. Thanks. Vikram.

vikram_m · ‎05-28-2017

Our Splunk infrastructure is on Azure and recently we face a major issue where I/O wait time was high and so indexing and all the data pipeline queues were effected. Now we have decided as an RCA item to schedule the IO wait time alerts on the infrastructure so that we can know if there something wrong in our splunk config or it is an Azure storage which is piling up the data pipeline queues. Please let us know now can we schedule IO alerts on Splunk. Thanks. Vikram.

vikram_m · ‎05-17-2017

We have 6.5 Splunk instance configured as a heavy forwarder. We are forwarding data from Cloud PAAS service and that is reason logs which are forwarded are from an API so we dont have any IP to check if connectivity is possible but the team governing the PAAS tool is suggesting it has already configured to forward the data to Splunk. Now, in the Heavy forwarder which we configured how can we confirm if it is reachable to the PAAS tool or it is getting any data from the tool. THanks. Vikram.

vikram_m · ‎04-27-2017

what is the use of this directory in Splunk /opt/splunk/var/run/splunk/dispatch I am getting below error in one of our indexer "The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch."

vikram_m · ‎04-26-2017

We want to generate a CSR file for sharing with the internal certificate authority do we have any document or steps in doing so. We are using Splunk 6.5 instance.

vikram_m · ‎04-24-2017

I need to pull data from Azure storage tables specially the WAD logs, we have installed an app i.e Addon for Microsoft Cloud services here unless we give the table key we were unable to pull the WAD tables. Other than this even if the team shares the access key data is pulled for 1-2 hours later to which data lags started and the latency to pull the data goes on stretching, Finally in the app logs when we see data is pulled from the table but it is not shown in indexed data is which command can be used ti checked if the existing data is indexed if not get it done.

vikram_m · ‎04-18-2017

Thanks for the doc adonio...this will be helpful.

vikram_m · ‎04-18-2017

Thanks for the answer 3no what my next doubt comes is we have dashboards also configured. Now is a user logs in and sees the dashboard a core is utilized but suppose if no one opens the dashboard is there anything that still the core is utilized? Sorry it may feel a invalid question but I had this doubt so asked it. but thanks again for your previous reply.

vikram_m · ‎04-18-2017

We have a searchhead and it is an Azure D4V2 machine i.e 8core machine. We have real time alerts scheduled on the same, now a days we are facing the queue full alert regularly is this also due to the physical configuration of server will a recommendation to upgrade the VM help here. Thanks. Vikram.

vikram_m · ‎04-10-2017

Splunk's response. As per the case description, I understand that all your splunk instances are running on 6.3.0 version and you want to upgrade your Cluster master/license master/Deployment server to 6.5 version. I believe your indexers are in cluster mode and a single splunk instance is acting as "Cluster master/license master/Deployment server". Please correct me if I am wrong. First you can upgrade your Cluster master/license master/Deployment server(from 6.3 to 6.5 version). The cluster master and cluster peers can be on different versions but the version of the cluster master should be higher than the cluster peers(indexers). So in your environment all the splunk instances are on 6.3 version, if you upgrade the cluster master to 6.5 version, there will be no compatibility issue. Please refer the below link: http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/Systemrequirements#Splunk_Enterprise_version_compatibility We recommend a dedicated splunk instance for cluster master. For better functioning and performance of cluster master, we suggest you to deploy an another splunk instance for deployment server and License master. Note: As a support team, we recommend you to get all your splunk instances to the same version.

vikram_m · ‎04-10-2017

We have 3 Indexers, 2 Search Heads, 1 Master Indexer/License Master/Deployment server all instances working on 6.3. We are planning to upgrade Splunk to 6.5, but for initial stage we are planning to go with an upgrade only for Master Indexer which is a license master as well for us and later rest of the servers can be upgraded. Please suggest if any plan we can go ahead with to get the infra upgraded to 6.5 Splunk or the entire cluster needs to be upgraded at once. Thanks. Vikram,.

vikram_m · ‎04-05-2017

how much is the time difference between current and and next data pull time via MS Cloud Services addon\ When I am trying to put 240 or 300 still the data is pulled in less than a minute. is there any way I can find out (1) what is the time log is stored i Azure storage. (2) What is the time the log is pulled in Splunk (3) time at which the logs are indexed in Splunk.

vikram_m · ‎04-04-2017

Thanks Woodcock It seems you have a solution for me....I fired the command on all the 3 indexers we have and only one server showed below result. tcp_cooked:listenerports : 9997 9998 Else for this other 2 indexer in cluster show tcp_cooked:listenerports : 9997 Now please suggest where is the setting from where I can get the 9998 port opened. Thanks a lot for the initial finding help. Thanks. Vikram.

Posts	90
Solutions	1
Karma Given	6
Karma Received	4
Member Since	‎10-05-2016

Online Status	Offline
Date Last Visited	‎06-02-2021 03:14 AM

Consolidate data from 2 indexes

pass username and password while search head clust...

Stop splunk gracefully during system shutdown or r...

Need a querry to triage an api on all possible hos...

any error or warning in all cluster members need t...

Unable to anonymise data even after we have right ...

Encountered the following error while trying to up...

API to delete the indexed logs from indexer. - RES...

I would like to reuse the same field extraction na...

Is there an app that can restart the Splunk univer...

Re: Push apps from deployment server automatically...

Push apps from deployment server automatically to ...

Data is sent to main index only - RESOLVED

Re: unable to search static captain during search ...

Re: reinstalling splunk enterprise - RESOLVED

unable to search static captain during search head...

Re: reinstalling splunk enterprise - RESOLVED

reinstalling splunk enterprise - RESOLVED

We need to give only DMC access to users from L1 t...

We have users mapped via names like "vikram" now w...

which logs and how to check if data is written int...

Re: extract field for below mentioned log

extract field for below mentioned log

Need to schedule IO wait alerts on Splunk

confirm if heavy forwarder is receiving any data.

what is the use of this directory in Splunk /opt/s...

generate CSR certificate in Splunk 6.5

Need to pull data WADLogs from Azure storage table...

Re: is the physical server configuration effecting...

Re: is the physical server configuration effecting...

is the physical server configuration effecting the...

Re: Splunk license master upgradation

Splunk license master upgradation

how much is the time difference between current an...

Re: 9998 port to open

Join the Conversation