Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About dantimola
dantimola
Communicator
Member since:
11-13-2016
08-17-2025
Community Statistics
| Posts | 86 |
| Solutions | 2 |
| Karma Given | 41 |
| Karma Received | 17 |
| Member Since | 11-13-2016 |
Activity Feed
- Posted Splunk Stream for M1/arm-based processor on Splunk Search. 07-17-2023 10:19 PM
- Posted Re: Internal server error 500 on system/licensing- How to resolve? on Dashboards & Visualizations. 07-17-2023 10:13 PM
- Got Karma for Re: Is it possible to rebuild multiple buckets with this command in the thawed directory?. 05-02-2023 12:39 PM
- Got Karma for Re: Is it possible to rebuild multiple buckets with this command in the thawed directory?. 09-21-2022 11:51 AM
- Karma Re: Help with script to make Splunk status up automatically if Splunk is down for gaurav_maniar. 03-18-2022 10:04 AM
- Karma Re: Indexers showing: WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user for RishiMandal. 10-11-2021 01:45 AM
- Got Karma for Re: Is it possible to rebuild multiple buckets with this command in the thawed directory?. 03-10-2021 06:54 AM
- Karma Re: Logic Behind Geographically Improbable Access Detected ? for Richfez. 02-01-2021 10:10 PM
- Got Karma for FS-ISAC Feeds Not Showing in Threat Artifacts. 11-01-2020 04:56 AM
- Posted Re: Splunk ES - Threat Intelligence TAXII feed not Working in Splunk Cloud on Splunk Enterprise Security. 10-14-2020 04:02 AM
- Posted Re: STIX TAXII Data Not Showing On Some Days on Splunk Enterprise Security. 10-14-2020 04:01 AM
- Karma Re: SEP 14.2 RU1 log format change for cascompany. 06-05-2020 12:50 AM
- Karma Re: Best practice to integrate Citrix mcs to Splunk for jconger. 06-05-2020 12:49 AM
- Karma Re: how create alert is send email in each once appear new result? for p_gurav. 06-05-2020 12:49 AM
- Karma Re: Splunk search help -- output data should match 2 or more of the keywords for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Search to display port scan attempts for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Universal Forwarder Disk Usage for koshyk. 06-05-2020 12:49 AM
- Karma Re: Is there a way set CPU and Memory consumption for splunkd process to a particular limit? for lguinn2. 06-05-2020 12:49 AM
- Karma Re: Using more than one Management Port for ddrillic. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk search help -- output data should match 2 or more of the keywords. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-17-2017
01:02 AM
Hi Ninjas,
Just like to ask if I still need to have a Heavy Forwarder in monitoring AD and DHCP logs? Or Universal Forwarder and Indexers will suffice? Thanks.
Regards,
Dan
... View more
07-13-2017
09:12 PM
Please share what you've done to resolve the issue. Thanks.
... View more
07-13-2017
07:30 PM
@dantimola will give you +30 Karma points for answering this question.
... View more
07-11-2017
08:34 PM
I've conducted health check on our infra. Maybe this can help. Looks like the event-processing queues is having an issue. How can I optimize/resolve this? Thanks.
... View more
07-11-2017
08:25 PM
Hi All,
Good day, would like to seek for help regarding on our universal forwarders. Some of our sources (universal forwarder) intermittently stops forwarding logs. I don't know why, firewall definition is intact, if you telnet splunk ports from the sources, the results are good. However, when checking splunkd.log , Cooked Connection, Raw Connection, Ping connection and Connection TIme out can be seen. Please help. Thanks.
Universal Forwarder Versions are:
6.2.6, 6.4.0
Splunk Enterprise Infra and versions:
6 Indexers: 6.6.1
3 Heavy Forwarders: 6.6.1
2 SH: 6.6.1
Regards,
Dan
... View more
07-11-2017
08:07 PM
Hi, its universal forwarder 6.2.6 and 6.4.0
... View more
07-11-2017
08:06 PM
Thanks for your answer. My case is that, even we deleted the log file, splunk is still reading it as seen on the screenshot I've provided. What could be the problem?
... View more
07-10-2017
11:27 PM
Hello fellow ninjas,
Good day. I'd like to ask if splunk uf restart is essential after I deleted a log file that is being monitored by splunk? Because, every time I delete the file, splunk is still reading it resulting high resources usage.
Thanks,
Dan
... View more
- Tags:
- universal-forwarder
07-09-2017
08:02 PM
This might help
https://answers.splunk.com/answers/389363/getting-error-streamed-search-execute-failed-becau.html
... View more
07-07-2017
01:39 AM
Hi Fellow Ninja,
I just want to ask what are the advantages and disadvantages of clustered indexers and Load balanced indexers environment. Let's say I have 3 Heavy Forwarder , 2 Search Head and 6 Indexers, what is your recommendation for this setup?
Thanks,
Dan
... View more
06-13-2017
10:01 PM
Hi, MuS,
What will happen if he didn't remove the option from inputs.conf?
Thanks,
Dan
... View more
06-09-2017
12:50 AM
The folder does not change, I've checked internal logs and found out cooked connection and raw connection error towards our Heavy Forwarders even though connection is allowed through firewall. What seems to be the problem here?
... View more
06-07-2017
02:58 AM
06-07-2017 17:11:07.135 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:11:12.923 +0800 WARN TcpOutputProc - Raw connection to ip=IP:9997 timed out
06-07-2017 17:11:12.923 +0800 INFO TcpOutputProc - Ping connection to idx=IP:9997 timed out. continuing connections
06-07-2017 17:11:42.875 +0800 WARN TcpOutputProc - Cooked connection to ip=IP:9997 timed out
06-07-2017 17:11:42.875 +0800 WARN TcpOutputProc - Raw connection to ip=IP:9997 timed out
06-07-2017 17:11:42.875 +0800 INFO TcpOutputProc - Ping connection to idx=IP:9997 timed out. continuing connections
06-07-2017 17:12:02.718 +0800 WARN TcpOutputProc - Cooked connection to ip=IP:9997 timed out
06-07-2017 17:12:07.164 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:12:07.164 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:12:07.180 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:13:00.189 +0800 WARN TcpOutputProc - Forwarding to indexer group group1 blocked for 100 seconds.
06-07-2017 17:13:07.193 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:13:07.209 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:13:07.224 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:13:12.372 +0800 WARN TcpOutputProc - Raw connection to ip=IP:9997 timed out
06-07-2017 17:13:12.372 +0800 INFO TcpOutputProc - Ping connection to idx=IP:9997 timed out. continuing connections
06-07-2017 17:13:23.105 +0800 INFO TcpOutputProc - Connected to idx=IP:9998
06-07-2017 17:17:51.067 +0800 ERROR TailReader - File will not be read, seekptr checksum did not match (file=C:\Program Files (x86)\CyberArk\Password Manager\Logs\ThirdParty\HP_pseudo-ISDP-Root-CCBDPD02_logadm.Debug.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
06-07-2017 17:17:51.083 +0800 ERROR TailReader - File will not be read, seekptr checksum did not match (file=C:\Program Files (x86)\CyberArk\Password Manager\Logs\ThirdParty\HP_pseudo-ISD VA-Root-CCBDPD02_secadmin.Debug.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
... View more
06-07-2017
02:27 AM
What does Cooked connection and Ping connection means beside of network error?
... View more
06-07-2017
02:25 AM
06-07-2017 17:11:07.135 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:11:12.923 +0800 WARN TcpOutputProc - Raw connection to ip=IP:9997 timed out
06-07-2017 17:11:12.923 +0800 INFO TcpOutputProc - Ping connection to idx=IP:9997 timed out. continuing connections
06-07-2017 17:11:42.875 +0800 WARN TcpOutputProc - Cooked connection to ip=IP:9997 timed out
06-07-2017 17:11:42.875 +0800 WARN TcpOutputProc - Raw connection to ip=IP:9997 timed out
06-07-2017 17:11:42.875 +0800 INFO TcpOutputProc - Ping connection to idx=IP:9997 timed out. continuing connections
06-07-2017 17:12:02.718 +0800 WARN TcpOutputProc - Cooked connection to ip=IP:9997 timed out
06-07-2017 17:12:07.164 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:12:07.164 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:12:07.180 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:13:00.189 +0800 WARN TcpOutputProc - Forwarding to indexer group group1 blocked for 100 seconds.
06-07-2017 17:13:07.193 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:13:07.209 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:13:07.224 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_IP_8089_IP_pamapd02_508640B8-DCCC-43F7-BAEA-C19506B7C372
06-07-2017 17:13:12.372 +0800 WARN TcpOutputProc - Raw connection to ip=IP:9997 timed out
06-07-2017 17:13:12.372 +0800 INFO TcpOutputProc - Ping connection to idx=IP:9997 timed out. continuing connections
06-07-2017 17:13:23.105 +0800 INFO TcpOutputProc - Connected to idx=IP:9998
06-07-2017 17:17:51.067 +0800 ERROR TailReader - File will not be read, seekptr checksum did not match (file=C:\Program Files (x86)\CyberArk\Password Manager\Logs\ThirdParty\HP_pseudo-ISDP-Root-CCBDPD02_logadm.Debug.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
06-07-2017 17:17:51.083 +0800 ERROR TailReader - File will not be read, seekptr checksum did not match (file=C:\Program Files (x86)\CyberArk\Password Manager\Logs\ThirdParty\HP_pseudo-ISD VA-Root-CCBDPD02_secadmin.Debug.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
... View more
06-07-2017
12:11 AM
Here's splunkd.log before the problem occurred.
... View more
06-06-2017
08:44 PM
1 Karma
Hi All,
Good Day, I have a problem with our universal forwarder, it frequently stops forwarding data. When the problem occur, my temporary resolution is to restart the forwarder and it will forward data again, however, the next day problem will occur again. It happen almost every day. What could be the solution here?
Universal Forwarder version: 6.2.6 (build 274160)
Thanks,
Dan
... View more
- Tags:
- universal-forwarder
05-25-2017
12:46 AM
Hi Splunk Ninjas,
Good Day. Just like to ask on how can I remove event that contain special character only, as sample below.
Thanks.
... View more
05-10-2017
03:24 AM
OS: Windows Server 2008 R2 Enterprise
Splunk Universal Forwarder version: 6.2.6 (build 274160)
Hi,
Good Day. Would like to seek for an assistance, resolution on my issue. Here's the case:
I have 5 universal forwarder and an app config in a server class and have this stanza in my inputs.conf
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
index = dhcp_winevt
renderXml=false
###### DHCP ######
[monitor://C:\Windows\System32\dhcp\DhcpSrv*]
disabled = 0
sourcetype = dhcp_server_logs
index = dhcp_index
## connection_host = none
Indexing of the logs is fine on the first and second months, then, eventually 2 of 5 universal forwarder has stopped forwarding the DHCP logs as seen on the inputs.conf stanza, but still forwarding the Security logs, so, we then check the logs on the server side but DHCP log is still actively logging. What seems to be the problem here? Thanks in advance.
... View more
04-10-2017
02:27 AM
Hi All,
What's the appropriate regex for event break Every Line? Is my props.conf correct?
[index_name]
LINE_BREAKER = ([\r\n]+)
... View more
04-07-2017
12:47 AM
That's too risky, I have the same problem too, I'm not allowed to reboot the server and even I'm allowed to do that, I'm not gonna do it specially if the server is on the production. Is there any suggested solution for this problem?
... View more
04-04-2017
02:20 AM
Hi All,
We have missing logs from a DHCP server that has a splunk forwarder installed, the network connectivity is fine, configs are also fine, firewall is also allowed, however, when I checked the splunkd.log, I still saw -0500 WARN TcpOutputProc - Raw connection to ip=xx.xx.xx.xx:9997 timed out and 0500 WARN TcpOutputProc - Cooked connection to ip=xx.xx.xx.xx:9997 timed out
We performed initial troubleshooting and the results are as follows:
The connectivity from the two servers are established both in our DS and HF and yet we still haven't got any logs
The log file is right and currently active during this time
Configs on inputs and outputs are also proper
Thanks in advance
... View more
03-28-2017
03:46 AM
In my case splunk enterprise did not index compressed file so we created a bash script to uncompressed the data and proceed with the indexing.
... View more
03-01-2017
12:03 AM
We still not using any splunk app for bluecoat, is it required? Is there any way to integrate bluecoat metadata to splunk? Thanks.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-17-2025
08:35 PM
|
Karma from
Karma given to
