Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About aelliott
aelliott
Motivator
Member since:
10-03-2013
06-05-2020
Community Statistics
| Posts | 451 |
| Solutions | 66 |
| Karma Given | 96 |
| Karma Received | 201 |
| Member Since | 10-03-2013 |
Activity Feed
- Got Karma for Re: How to use a $ in a form search?. 12-17-2023 12:27 AM
- Got Karma for Re: How to use a $ in a form search?. 05-16-2022 09:15 AM
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 04-27-2022 03:08 PM
- Got Karma for Re: How to use a $ in a form search?. 10-06-2021 06:14 PM
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 03-10-2021 10:12 AM
- Got Karma for Re: How to use a $ in a form search?. 09-10-2020 10:58 PM
- Got Karma for Anonymous access to dashboards. 09-03-2020 06:31 AM
- Karma So many Spams in Splunk answers for guilmxm. 06-05-2020 12:47 AM
- Karma Re: How to tell if accelerated data model is still rebuilding? for jamesvz84. 06-05-2020 12:47 AM
- Karma Re: How to fill a field with an ip address extracted from another field? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Will changing a lookup file persist on app update? for strive. 06-05-2020 12:47 AM
- Karma Re: Split ip and port into two fields using delims for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security for jcoates_splunk. 06-05-2020 12:47 AM
- Karma Re: Quick Question - CPU Search Limit on Search Head or Indexer? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Splunk plz help for alacercogitatus. 06-05-2020 12:47 AM
- Got Karma for Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Will changing a lookup file persist on app update?. 06-05-2020 12:47 AM
- Got Karma for Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security. 06-05-2020 12:47 AM
- Got Karma for Re: Documentation on implementing a function triggered by change of a token's value?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
05-08-2014
07:13 AM
Just learned that our server is on Windows 2012 R2, Will be getting the splunk 6.1 forwarder on there sometime to verify that is our issue.
... View more
05-07-2014
11:56 AM
This is specifically my Windows Security Event Logs, the splunk logs get forwarded just fine.
... View more
05-07-2014
09:05 AM
is there any implications that could happen if it were set to overwrite and current_only set to 1?
... View more
05-07-2014
07:56 AM
Raised my maxkbs to 0 (unlimited) and it ran for 4 minutes.. instead of the ~45-60 minutes, changed it to 56kbps.. stopped after 22 minutes.
... View more
05-07-2014
06:23 AM
I am having this issue as well, in 6.0.3
... View more
05-06-2014
08:42 AM
Now it went for about 45 minutes, then stopped
metrics.log states: 05-06-2014 10:50:42.121 -0500 INFO StatusMgr - destPort=6666, eventType=connect_done, sourceHost=44.44.44.44, sourceIp=44.44.44.44, sourcePort=50138, statusee=TcpInputProcessor
05-06-2014 10:50:42.121 -0500 INFO StatusMgr - sourcePort=6666, ssl=false, statusee=TcpInputProcessor
05-06-2014 10:50:42.340 -0500 INFO StatusMgr - destPort=6666, eventType=connect_close, sourceHost=44.44.44.44, sourceIp=44.44.44.44, sourcePort=50138, statusee=TcpInputProcessor
so my domain controller 44.44.44.44 is still connecting to the indexer
... View more
05-06-2014
07:28 AM
i think i've figured this out
http://answers.splunk.com/answers/64554/starting-point-of-index
... View more
05-06-2014
07:11 AM
I have a windows domain controller with a universal forwarder.
I have Splunk_TA_Windows deployed out to it using the universal forwarder(this is the only app deployed),
I have an outputs.conf file pointing to my indexer port
[tcpout:DomainControllers]
server=myserver.mycompany.com:6666
I have my indexer with a splunk 2 splunk looking watching on port 6666
I have this in my inputs.conf on the Universal forwarder:
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 0
checkpointInterval = 5
index = dclogs
The data is forwarded once to the indexer successfully, then does not send anything more, the logs simply say that is is phoning home.
I send a small update to the splunk_ta_windows (such as adding a space) and it then sends the data to my indexer Once and only once.
Here are the only possible errors that i see in the logs:
TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
05-06-2014 08:21:22.632 -0500 INFO TcpOutputProc - Connection to 44.44.44.44:6666 closed. Read error. Either the application has not called WSAStartup, or WSAStartup failed.
ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - SysmonMigrator::read - 'sysmon.conf' was not found, no migration is required.
More Logs:
05-07-2014 16:28:49.717 -0500 DEBUG TcpOutputProc - channel registered
05-07-2014 16:28:49.717 -0500 DEBUG TcpOutputProc - Pushed eventId=86331 on chanID=33 to back of tcp client (tcp output) queue
05-07-2014 16:28:49.717 -0500 DEBUG TcpOutputProc - channel registered
05-07-2014 16:28:49.717 -0500 DEBUG TcpOutputProc - Pushed eventId=86332 on chanID=33 to back of tcp client (tcp output) queue
05-07-2014 16:28:49.717 -0500 DEBUG TcpOutputProc - channel registered
05-07-2014 16:28:49.717 -0500 DEBUG TcpOutputProc - Pushed eventId=86333 on chanID=33 to back of tcp client (tcp output) queue
05-07-2014 16:28:49.732 -0500 DEBUG TcpOutputProc - channel registered
05-07-2014 16:28:49.732 -0500 DEBUG TcpOutputProc - Pushed eventId=86334 on chanID=33 to back of tcp client (tcp output) queue
05-07-2014 16:28:49.732 -0500 DEBUG TcpOutputProc - channel registered
05-07-2014 16:28:49.732 -0500 DEBUG TcpOutputProc - Unregistering Channel for : source::C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log|host::mydc|splunkd|3744.44.44.444:6666, oneTimeClient=0, _events.size()=1, _refCount=2, _waitingAckQ.size()=0, _supportsACK=0
05-07-2014 16:28:49.732 -0500 DEBUG TcpOutputProc - Pushed eventId=86335 on chanID=33 to back of tcp client (tcp output) queue
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - numchannels = 0
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - ---- existing clients - start ----
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Client 444.444.44.444:6666, oneTimeClient=0, _events.size()=0, _refCount=1, _waitingAckQ.size()=0, _supportsACK=0
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - ---- existing clients - end ----
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - AutoLB timer started to select new connection
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Removing quarantine for idx=444.444.44.444:6666
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Pinging idx=444.444.44.444:6666
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Destryong AutoLBWrappedPollableDescriptor for 444.444.44.444:6666
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - BEGIN - randomizeConnectionsList
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Indexer uri 444.444.44.444:6666, client refCount=1, client=non-NULL
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - BEGIN - After sorting
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Indexer uri 444.444.44.444:6666, client refCount=1, client=non-NULL
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Found currently active indexer 444.444.44.444:6666, client refCount=1, client=non-NULL
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - getting connected clients
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Sending HB to 444.444.44.444:6666, oneTimeClient=0, _events.size()=0, _refCount=1, _waitingAckQ.size()=0, _supportsACK=0
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Sending hb from TcpOutputClient for 444.444.44.444:6666, oneTimeClient=0, _events.size()=0, _refCount=1, _waitingAckQ.size()=0, _supportsACK=0
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Connector::runRawStateMachine in state=eRawInit
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - tcpConnect to 444.444.44.444:6666
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - ConnectionSuccessful. _rawConnectionState=eRawTcpConnectInProgress
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Connector::runRawStateMachine in state=eRawTcpConnectDone
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Destryong AutoLBWrappedPollableDescriptor for 444.444.44.444:6666
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - channel not registered yet
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Registering Channel for : source::C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log|host::mydc|splunkd|37444.444.44.444:6666, oneTimeClient=0, _events.size()=0, _refCount=1, _waitingAckQ.size()=0, _supportsACK=0
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Pushed eventId=86336 on chanID=33 to back of tcp client (tcp output) queue
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - channel registered
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Pushed eventId=86337 on chanID=33 to back of tcp client (tcp output) queue
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - channel registered
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - Pushed eventId=86338 on chanID=33 to back of tcp client (tcp output) queue
05-07-2014 16:28:52.748 -0500 DEBUG TcpOutputProc - channel registered
... View more
05-05-2014
07:50 AM
1 Karma
I added 8 dns names to my whitelist through the "Edit Clients" for my Server Class on my deployment server.
I saved and reloaded, then went back in to edit it.
I removed all but one entry, hit save and reload and got the following error:
In handler 'serverclasses': Gap in numbered regexes: expected attribute=whitelist.8 not found.
I believe this is a bug within the Edit Clients UI.
... View more
05-05-2014
06:43 AM
any idea of the ETA of fixing this? does this affect ldapsearch or enterprise security?
... View more
04-25-2014
09:53 AM
Received writers.py and followed instructions as stated above, already working perfectly
... View more
04-25-2014
06:55 AM
Update: Still waiting on a response from splunk support after 11 full business days.
... View more
04-16-2014
11:29 AM
Correct.
The CIM provides normalization for many types of events and provides the data models for the Common Information Models.
In addition you can find other ones in the splunk apps.
Other than those resources, you have to create your own.
... View more
04-11-2014
07:31 AM
yeah it's just literally downloading the full installation to upgrade: https://www.splunk.com/download?r=header
... View more
04-11-2014
07:16 AM
1 Karma
Did you try Select TOP 1000 * FROM TABLE-NAME
... View more
04-11-2014
06:45 AM
Looks like there is an update available: http://www.splunk.com/view/SP-CAAAMB3
... View more
04-09-2014
11:43 AM
My main question is, if i provision 8 post multi-threaded cores and have 8 GB of Ram on a virtual machine, Will my ES App/Install not run?
The Splunk App for Enterprise Security may not run on virtualized machines with insufficient hardware. (SOLNESS-1118)
Running Splunk Enterprise on Windows on under-provisioned virtualized hardware may cause Enterprise Security setup to fail. If you have well-provisioned hardware, retry the setup if it fails the first time. (SOLNESS-4256)
What is the threshold for such an error?
... View more
04-09-2014
11:01 AM
I have submitted my issue to splunk support and if the resolution in this post works, then i will mark this as answer.
... View more
04-09-2014
08:47 AM
http://answers.splunk.com/answers/58398/the-universal-forwarder-and-server-2008-event-logs
... View more
04-09-2014
08:18 AM
2 Karma
aha! this is a known issue:
http://docs.splunk.com/Documentation/ES/latest/RN/KnownIssues
On a Windows search head, the asset and identity center shows no results. Error messages will be displayed on the search head about missing lookup files. The python_modular_inputs.log reports errors:
ERROR pid=4040 tid=asset file=writers.py:_move_lookup:108 | FAILURE: Temporary output file was not created: C:\Program Files\Splunk\var\run\splunk\lookup_tmp\lookup_conv6jppog.txt
ERROR pid=4040 tid=asset file=writers.py:move_lookups:156 | FAILURE: A lookup table could not be created: (key: cidr, tempfile: C:\Program Files\Splunk\var\run\splunk\lookup_tmp\lookup_conv6jppog.txt)
The asset and identity lookup creation and expansion process is not working correctly due to an issue with a python script on Windows. Please contact Splunk Support for a replacement script and reference SOLNESS-4642. (SOLNESS-4642)
Once the script is obtained, follow the instructions below:
1. Replace the writers.py script in $SPLUNK_HOME\etc\apps\SA-Utils\lib\SolnCommon\lookup_conversion
2. Make sure all the *.csv's in SA-IdentityManagement\lookups are there, and if not create a new copy from the *.csv.default files.
3. Delete all the contents under $SPLUNK_HOME\var\lib\splunk\modinputs\identity_manager
4. Restart Splunk Enterprise
... View more
04-08-2014
02:09 PM
1 Karma
You should check your main index to make sure they are not going in there.
... View more
04-08-2014
12:52 PM
1 Karma
I'm using Enterprise Security and am getting the following:
Using SA-IdentityManagement
Populating identities using ldapsearch to lookup within scheduled search.. lookup then populates using Identity Management
Populating Assets into csv, feeding to lookup file with automated search.. lookup file then populates identity table with Identity Management
lookup_conversion: A lookup table could not be created (key: identity, tempfile: C:\Program Files\Splunk\var\run\splunk\lookup_tmp\lookup_convwnyv1y.txt)
Troubleshooting: checked splunkd.log, no messages
To resolve temporarily: recreated identity_expanded.csv, assets_by_str.csv manually (using the .default template), csv's will repopulate automagically with data. When it tries to do it automatically, the csv's are deleted and splunk is unable to recreate. Checked access and account has full access to csv's and directory.
Here's some more details that I found within the _internal index.
014-04-09 09:02:10,568 ERROR pid=9620 tid=asset file=writers.py:move_lookups:156
| FAILURE: A lookup table could not be created: (key: dns, tempfile: C:\Program Files\Splunk\var\run\splunk\lookup_tmp\lookup_convelz2ua.txt)
2014-04-08 14:05:34,845 ERROR pid=8512 tid=identity file=writers.py:_move_lookup:106
| FAILURE: A lookup table could not be created: identities_expanded.csv
2014-04-08 14:05:30,180 ERROR pid=8512 tid=asset file=writers.py:_move_lookup:106
| FAILURE: A lookup table could not be created: assets_by_str.csv
And More Logs:
2014-04-09 06:02:36,535 ERROR pid=4588 tid=asset file=writers.py:_move_lookup:98 | EXCEPTION: Could not rename file after multiple retries src=C:\Program Files\Splunk\var\run\splunk\lookup_tmp\lookup_convqgehyc.txt dst=C:\Program Files\Splunk\etc\apps\SA-IdentityManagement\lookups\assets_by_str.csv
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\lookup_conversion\writers.py", line 85, in _move_lookup
os.unlink(dst_lookup_path)
WindowsError: [Error 5] Access is denied: 'C:\\Program Files\\Splunk\\etc\\apps\\SA-IdentityManagement\\lookups\\assets_by_str.csv'
2014-04-09 06:02:36,535 ERROR pid=4588 tid=asset file=writers.py:_move_lookup:106 | FAILURE: A lookup table could not be created: assets_by_str.csv
... View more
04-08-2014
12:32 PM
1 Karma
Since installing Enterprise Security, Splunk-optimize crashes all the time on my machine.
I've tested this on another machine as well.
We are using splunk 6.0.3
Log Name: Application
Source: Application Error
Date: 5/9/2014 1:33:55 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: myIndexer.myCompany.com
Description:
Faulting application name: splunk-optimize.exe, version: 1536.768.0.7498, time stamp: 0x5344d6ef
Faulting module name: MSVCR110.dll, version: 11.0.51106.1, time stamp: 0x5098826e
Exception code: 0xc0000417
Fault offset: 0x000000000006d4f9
Faulting process id: 0xcfc
Faulting application start time: 0x01cf6bb53be10712
Faulting application path: D:\Program Files\Splunk\bin\splunk-optimize.exe
Faulting module path: D:\Program Files\Splunk\bin\MSVCR110.dll
Report Id: 79aee57d-d7a8-11e3-9663-001ec92d4e67
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-09T18:33:55.000000000Z" />
<EventRecordID>6403</EventRecordID>
<Channel>Application</Channel>
<Computer>myindexer.mycompany.com</Computer>
<Security />
</System>
<EventData>
<Data>splunk-optimize.exe</Data>
<Data>1536.768.0.7498</Data>
<Data>5344d6ef</Data>
<Data>MSVCR110.dll</Data>
<Data>11.0.51106.1</Data>
<Data>5098826e</Data>
<Data>c0000417</Data>
<Data>000000000006d4f9</Data>
<Data>cfc</Data>
<Data>01cf6bb53be10712</Data>
<Data>D:\Program Files\Splunk\bin\splunk-optimize.exe</Data>
<Data>D:\Program Files\Splunk\bin\MSVCR110.dll</Data>
</EventData>
</Event>
... View more
- Tags:
- splunk-optimize
04-08-2014
08:50 AM
if it says your database validation failed, it may have attempted to run the query the first time and failed. I would suggest trying again 🙂 Especially since that same query was able to get data previously.
... View more
