About pacifikn

pacifikn · ‎04-23-2020

Dear Skoelpin, thank you for your guidance, I have checked into the intrnal logs, i found out the below output logs which it seems abnormal, under Event 04-23-2020 20:51:17.667 +0200 INFO TcpOutputProc - Connected to idx=host_Ip:9997 ,pset=0 , reuse=0. host=host_name source=/opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype=splunkd 04-23-2020 20:51:17.667 +0200 INFO TcpOutputProc - Closing Stream for idx=host_Ip:9997 host=host_name source=/opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype=splunkd I see the above logs, how may i fix this?

pacifikn · ‎04-23-2020

Hello dear Skoelpin, in MC it showing me that 1 instances unreachable and it is that one indexer that are down. and when am checking if splunk process is running using ./splunk status it is showing me that splunkd is not running ,how to make it run again using CLI ?

pacifikn · ‎04-23-2020

Hi all, One Splunkd indexer is failing while other indexers are running. I'm also getting a TCPOutAutoLB-0 error. How can I fix these issues? Thank you in Advance.

pacifikn · ‎04-17-2020

Greetings!!! I need your help on how I can resolve the below issues, I got from message status 1 issue: Health Check: Intelligence download of "Phishtank" has failed on host "Splunksh01" at: Fri Apr 17 12:46:36 2020 "threat list download failed after multiple retries" 2 issue: Getting Warning, says: File Integrity checks found 1 files that did not match the system-provided manifest. Review the list of problems reported by the installedFieldHashChecker in Splunkd.log FIle integrity Check view, When I click on warning icon on splunk GUI , I got this message: (yellow Warning icon) splunkd Data Forwarding Splunk-2-Splunk Forwarding (yellow Warning icon) TCPOutAutoLB-0 Kindly help me with the above issue on how I can solve these issues, Thank you in advance!!!

pacifikn · ‎03-17-2020

Greetings!! what are the difference between support license and splunk enterprise license? and other license? am still confused about this ,kindly help me to know how is differ? is there anyhow to check all the diiference license if it expired? Thank you in advance!

pacifikn · ‎03-16-2020

greetings!! is the splunk enterprise 7.2.6 vulnerable? kindly help me with more information, i need to know if am vulnerable to this version "Splunk enterprise 7.2.6"? what are the steps to update to the latest version? I need help! Thank you in advance!

pacifikn · ‎03-16-2020

Dear richgalloway, is the splunk enterprise 7.2.6 vulnerable by now???

pacifikn · ‎03-16-2020

Greetings!!! hope you are doing well! how to update Splunk Enterprise from 7.2.6 to 8.0 version? what is required? is it free? please i need help! Thank you in advance

pacifikn · ‎01-19-2020

Hi Jawaharas! the issue was fixed, The issue was lack of available storage on the /opt partition that received all logs from Syslog sender on the Splunk Management node, This caused the Splunk Forwarder to stop working, the issue was managed and fixed. everything is fine now. Thank you a lot for your kind help!

pacifikn · ‎01-16-2020

Thank you so much gcusello for your quick reply! That's exactly the problem and this cause me to not see the logs in the search app. could you help on the following options and guide me on how I could use this way below you mentioned: """" Eventually, you could install on the Syslog collector a Heavy Forwarder (a full Splunk instance that forwards all the logs to Indexers) and use it as Syslog collector, so you haven't the problem of the full folder because syslogs are immediately (if network is ok) sent to indexers and you don't need to delete files. """"

pacifikn · ‎01-15-2020

Greetings!! I would like to ask about Syslog logs for network devices, I have added new network devices by doing configuration to send logs into Splunk log collector server , what I have done: configuration of network devices to send logs and after configuration, I checked in Splunk Syslog collector server I verified that logs are received well secondly Splunk configuration In order to collect and index the new data in Splunk, I have done with Splunk configuration input. before all it was working good with my 4 index But now after added other the same network devices(Syslog) and modify the "inputs.conf " by adding other devices Now I faced an issue, where all logs from Syslog sender(network devices) received in Splunk directory, this Splunk Syslog directory is full and I have deleted logs and stop the added devices to send logs, BUT now all these exercises CAUSE me to not receiving logs in Splunk search GUI, after bringing them as it is before! how to troubleshoot this to see logs in Splunk search? when verifying in Syslog directory I can see logs are received well, but the only problem is that I can't see it in Splunk search GUI? how to fix this, I NEED YOUR HELP ME, thank you

pacifikn · ‎01-14-2020

Right! yes, that is the question I have! I see the old when I set the time before one week, I can view it. But after adding the other 20 same appliances, I don't see both the old and new ones. The configuration and the firewall routes between appliances and the Splunk server are done correctly. Kindly help me step by step on how to crosscheck the inputs on Splunk, maybe I am not doing this correctly!

pacifikn · ‎01-14-2020

HI gcusello, Thank you for your quick response, Let me clarify again the issue am getting, I want to add other inputs data from network devices (Syslog sender) into Splunk, before I had few devices (8devices) configured well and generating logs, and I wanted to add the other 20 devices but after I did this Splunk configuration as I do before, I can't see its logs not only that and this seems has affected the 8 devices configured before, for now, the logs are not available as it appeared before on the 8 devices, the entire index for this specific devices its not available on the other index ,when you do search: index=* to see all index you only see other not this mentioned above. when I do search: index=xxx is not available. BUT the issue is that after doing the configuration, I can't see the data of those inputs in search? even the previous 8 devices that before I use to see its logs I can't see it? even its index is not available as before? It seems like it was disabled/deleted. how to check it? challenge; when I do search in one week I can see the logs of 8 previous devices before adding the 20 devices but currently not, I don't know where the problem comes from?????

pacifikn · ‎01-14-2020

Hi richgalloway? Thank you for the quick response, I have verified the settings in inputs.conf all are included correctly, am getting logs from Syslog sender(network devices), I think UF we use it when it is operating system to forward logs while here is configuration of syslog sender , even when am searching index=xx , i can't find its data? only i see it when i set the time before the configuration at this point i see the logs but after configuration i can't see that index??

pacifikn · ‎01-14-2020

Greetings!! I can't find the existing index, after inputs other data into that index? I have done /opt/Splunk/bin/Splunk reload deploy-server BUT the problem is that I can't find the existing index after this Splunk configuration?? I was confused somehow? am getting data from Syslog sender(network devices) and when I checked /opt/splunkforwarder/bin/Splunk list forward-server I got the following output: Active forwards: None Configured but inactive forwards: " IP of all indexers: port" is this could be a root cause of not getting logs for index XXXX??? even when you do search index=** you can see other index but not the one you have input data? Kindly help me how I can fix this, thank you

pacifikn · ‎01-13-2020

Hello!!!! I can't collect logs in Splunk after Splunk configuration I have done all configuration but I still not getting logs in Splunk? I verified that logs come from Syslog sender are well received, and also doing Splunk configuration when I search index=* I can't find index=xxxx expected, why? where can I check and fix this?? Other issues, is that I get a message that says, msg=A script exited abnormally with exit status:1" input=".$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py" stanza=" default" -->the error identified by health check, how to fix this? Kindly help me on the above issues, thank you

pacifikn · ‎01-13-2020

Greetings!!! What does this mean? ignoreOlderThan=7d

pacifikn · ‎01-13-2020

Greetings!! help me on the following questions: I would like to ask about Splunk configuration issue of not getting logs after doing configuration. i have added new data inputs in inputs.conf as i always does and I have already done /opt/splunk/bin/splunk reload deploy-server BUT the problem am not getting the logs in Splunk GUI ??? index= xxx host="y.y.y.y", i can't get its logs??? what the best way to do when opt/syslog directory is almost full??

pacifikn · ‎01-08-2020

Greetings! I would like to ask the Splunk Administrator ABOUT splunk reload deploy-server THAT gives me error while i running, it gives me this error" bash-4.2$ cd /opt/splunk/bin/splunk reload deploy-server bash: cd: /opt/splunk/bin/splunk: Not a directory Q/where exactly we run this command? Q/How to fix it????? in order reach where it ask username and password? I find this error below "bash: cd: /opt/splunk/bin/splunk: Not a directory"

pacifikn · ‎12-19-2019

Thank you to4kawa and Woodcock, Thank you for your assistance.

pacifikn · ‎12-19-2019

Greetings!! I would like to ask a question about dedup eg: |dedup host ,IP |dedup host |dedup IP I've tried but when I use a comma, dedup works only on the first fields, and I want that this can be performed on both sides not only one side, I wanted that the output for fields 1 and fields 2 no redundancy values come again? for example: |dedup host, IP --->this brings me the below output: and I want that this one could not be repeated also like on host fields. host IP x 1.1.1.1 y 1.1.1.1 z 2.2.2.2 what the best way to remove redundancy for two fields???????? I need your help? Thanks!

pacifikn · ‎12-11-2019

Dear to4kawa , now it is working good , but when I saw the command you wrote, it looks the same with the one I used but I added the name of the firstColumn OUTPUTNEW secondColumn(description of the first column) like this: index= xx sourcetype=ttt |top host |lookup xyz_lookup host OUTPUTNEW hostname(Desc)

pacifikn · ‎12-11-2019

Thank you All for your quick response, I didn't tell soon , I have tried to use OUTPUTNEW and it is working correctly, index=xxx sourrcetype=tttt action=T |top host |lookup name_lookup host OUTPUTNEW hostname I used the above command and it was working correctly. Thank you again for the other way you mentioned above it is also working good! thank you all

pacifikn · ‎12-11-2019

How to download existing lookup file? and how to add new row and modify existing lookup file table?

pacifikn · ‎12-11-2019

Greetings!! I have created a new lookup table xyz.csv that contain host and hostname(as description) and the name of lookup is xyz_lookup when i search |inputlookup xyz_lookup I got the table with host and hostname, BUT my question is: what query can I use to combine the other command with this lookup, when I search for index= xx sourcetype=ttt |top host -this gives me host,count,percent BUT i want also to use that it gives me also hostname , not only host ... Help me on how I could combine my lookup with other query? Thank you in advance regards paci N

Posts	107
Solutions	1
Karma Given	10
Karma Received	3
Member Since	‎10-27-2019

Online Status	Offline
Date Last Visited	‎10-13-2022 11:35 AM

How to create a script that will help me to know e...

How to deploy fortimail add-ons in splunk enterpri...

Why is Splunk forwarder is not active?

Splunk forwarder is running but in Forwader:Manage...

How to to check data size indexed in indexers per...

How can install splunk indexers in centos?

How create a Test distribution Environment that is...

Splunk Enterprise Security upgrade

splunk troubleshooting Training

How to create tickets and assign it to someone?

Re: How to fix failed indexer on Splunkd?

Re: How to fix failed indexer on Splunkd?

How to fix failed indexer on Splunkd?

Health Check: Intelligence download of "Phishtank"...

Difference between support license and splunk ente...

is the splunk enterprise 7.2.6 vulnerable?

Re: how to update Splunk Enterprise from 7.2.6 to ...

how to update Splunk Enterprise from 7.2.6 to 8.0 ...

Re: I can't collect logs in splunk GUI after splun...

Re: syslogs for network equipments to forward sysl...

syslogs for network equipments to forward syslog t...

Re: i can't find the existing index

Re: i can't find the existing index

Re: Splunk configuration issue

i can't find the existing index

I can't collect logs in splunk GUI after splunk co...

ignoreOlderThan=7d

Splunk configuration issue

splunk reload deploy-server error

Re: how can I use dedup command using many fields?...

how can I use dedup command using many fields??

Re: lookup query

Re: lookup query

How to download existing lookup file? and how to a...

lookup query

Join the Conversation