About Hemnaath

Hemnaath · ‎07-19-2017

Hi ddrillic, thanks for your response on this, first i need to find from which host these data are being ingested to the index=win_svrs. On getting the correct host name , i can check the inputs.conf file. Currently in splunk search head, i could see the host=$decideOnStartup . So please let me know how to check the correct host name, from where this data being is ingested to the index=win_Svrs in the indexer instances.

Hemnaath · ‎07-19-2017

Hi All, Currently i am facing an issue in finding the correct host name for windows Universal agent server which is sending the data to index=windows. I am not sure why it is sending the data with this name, I hope there should be some configuration issue in inputs.conf file. So Is there an easy way to determine what server has the messed up configuration? Kindly guide us in troubleshooting this issue. thanks in advance.

Hemnaath · ‎07-19-2017

Hi All can any one guide me on how to write a props/transforms to apply for a field aliases and evals for firewall events. thanks in advance.

Hemnaath · ‎07-19-2017

hi skalliger thanks for your quick response. I am looking for watchguard application but I did not find any app related to this. So kindly guide me how to write a props/transforms to apply for a field aliases and evals. thanks in advance.

Hemnaath · ‎07-19-2017

Hi All, Kindly guide me on how to write a props and transforms to apply for a field aliases and evals for a firewall devices,using CIM Network data model. The below are the list of fields that are available in the firewall events. interesting fields date_hour date_mday date_minute @date_month date_second @date_wday date_year @date_zone @disp @dst dstport @eventtype @in_if @index ip_len ip_TTL lineCount @out_if @policy @proto @punct @serial @splunk_server @src srcPort @tag @tag::eventtype timeendpos timestartops I had gone through the below CIM Network Traffic Model but not sure how to start and what to write in the props.conf and transforms.conf. Kindly guide me on this. https://docs.splunk.com/Documentation/CIM/4.8.0/User/NetworkTraffic

Hemnaath · ‎07-13-2017

HI All, After recent upgrade to the latest splunk version 6.6.1 we could see some of the splunk agent throwing some errors in splunkd.log, when executed the below query we found almost 170 agent node are throwing the same error. The below host mentioned in the log_level error refers to Deployment server. Query Details: index=_internal log_level=ERROR "Connection to host=168.x.x.x:9997 failed" | dedup host | table host Among 170 agents some are running with older version which we are planning to upgrade soon but rest of the agent are with 6.2 version and we are able to see s data when searching with that host but need to know what is causing this issue. So kindly guide me how to troubleshoot this issue and also let me know is there any other query which can be used to find out exact issue.

Hemnaath · ‎07-12-2017

Hi All the issue got resolved after clearing the catch from the browser, as it was taking the previous session when there was an issue with the splunk instance running in Heavy forwarder instance, same catch was stored in the browser and it was not reading it from splunk instance. After clearing the catch it started working. thanks all.

Hemnaath · ‎07-11-2017

Hi All, Currently we are facing an issue in accessing the splunk web interface, as soon as we hit the splunk URL http:hostname.com:8000 the portal goes in hung mode, so when checked into the splunkd.log, could see the below WARN message not sure what should be done to fix this issue. splunkd.log details 07-12-2017 01:20:45.428 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499769163.453/metadata.csv 07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499769163.454/metadata.csv 07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499770963.455/metadata.csv 07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499770963.456/metadata.csv 07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499772763.457/metadata.csv 07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499772763.458/metadata.csv 07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499774563.459/metadata.csv 07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499774563.460/metadata.csv 07-12-2017 01:22:12.885 -0400 WARN HttpListener - Connection from 10.x.x.x didn't send us any data, disconnecting 07-12-2017 01:22:12.885 -0400 WARN HttpListener - Connection from 10.x.x.x didn't send us any data, disconnecting 07-12-2017 01:22:12.885 -0400 WARN HttpListener - Connection from 10.x.x.x didn't send us any data, disconnecting 07-12-2017 01:22:12.885 -0400 WARN HttpListener - Connection from 10.x.x.x didn't send us any data, disconnecting Below ERROR tell that its unable to communicate with the indexer instances. 07-07-2017 10:02:43.320 -0400 ERROR SyslogOutputConfig - Syslog output server not in expected format. Please use : format 07-08-2017 01:33:00.065 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed 07-08-2017 01:42:28.078 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed 07-08-2017 01:45:57.370 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed 07-08-2017 01:46:57.211 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed 07-09-2017 14:28:51.100 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed 07-09-2017 14:32:20.308 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x failed 07-09-2017 14:32:20.309 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed 07-09-2017 14:32:50.140 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x failed 07-09-2017 14:33:49.829 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x failed Kindly guide me how to fix the issue .

Hemnaath · ‎07-11-2017

Hi lguinn, can you guide me whether the above output provide in the comment is something to do with the issue. Or is there any other troubleshooting method which we need to follow to fix it. thanks in advance.

Hemnaath · ‎07-10-2017

Hi All, Can anyone guide me on how to filter a particular configuration detail using btool command in windows environement. thanks in advance.

Hemnaath · ‎07-10-2017

Hi Iguinn, thanks for your effort, when I ran the btool check on the indexer instance, I have got the below output but not sure whether this is related to the issue. Kindly guide me if it related to this issue. Note: The Admin-all_indexers app contains all the index config details Invalid stanza [_blocksignature] in /opt/splunk/etc/apps/ADMIN-all_indexers/local/indexes.conf, line 197. The block-signing feature is no longer available in Splunk. Please remove stanza=[_blocksignature] from the indexes.conf. For further details, please refer to the related topic in the latest version of 'Securing Splunk' manual on docs.splunk.com. Invalid key in stanza [search] in /opt/splunk/etc/system/local/limits.conf, line 166: max_results_raw_size (value: 100000000). Invalid key in stanza [LDAP] in /opt/splunk/etc/apps/ADMIN-all_indexers/default/authentication.conf, line 6: charses (value: utf8). Invalid key in stanza [search] in /opt/splunk/etc/system/local/limits.conf, line 243: multi_threaded_setup (value: false). Invalid key in stanza [scheduler] in /opt/splunk/etc/system/local/limits.conf, line 409: peristance_period (value: 30). Invalid key in stanza [tscollect] in /opt/splunk/etc/system/local/limits.conf, line 467: tsidx_init_file_goal_mb (value: 500).

Hemnaath · ‎07-10-2017

Hi All, Currently we are facing an issue while performing a search against a particular index and found it was due to the searches across the reduced buckets and getting this error in Job and it is running very slow. Error message : Search on most recent data has completed. Expect slower search speeds as we search the reduced buckets. query : earliest=-24h index=windows sourcetype="WinEventLog:Security" EventCode=4735 However the tsidx should not be reduced on a search that is in the past 24 hours. Our tsidx reduction is set for 90 days. stanza details [default] frozenTimePeriodInSecs = 31536000 enableTsidxReduction = true timePeriodInSecBeforeTsidxReduction = 7884000 Kindly let me know how to troubleshoot this issue. thanks in advance.

Hemnaath · ‎07-10-2017

Hi Team, How to filter a particular index config details using btool command in windows environment? In unix we use the btool command along with the pipe symbol to filter out a specific detail from entire configuration setup. Example index=web In unix we run the btool command like this ./splunk cmd btool inputs list --debug | grep web | more similarly what is the syntax to filter the same details in windows command prompt. Kindly provide me the exact syntax details to filter out index=web from the inputs.conf. thanks in advance.

Hemnaath · ‎07-07-2017

HI richgalloway, you're right, i could see the config details for all the indexes which are listed in the above comments in savedsearches.conf, so by disabling the index details in savedsearches.conf will stop sending the data to these indexes, is that correct. And also please guide us why it is configured like this usually monitoring details will be in inputs.conf right. Btool details: ./splunk cmd btool savedsearches list --debug | grep summary_forwarders | more /opt/splunk/etc/apps/SplunkDeploymentMonitor/default/savedsearches.conf search = index="summary_forwarders" | delete /opt/splunk/etc/apps/SplunkDeploymentMonitor/default/savedsearches.conf action.summary_index._name = summary_forwarders /opt/splunk/etc/apps/SplunkDeploymentMonitor/default/savedsearches.conf search = index="summary_forwarders" | eval mb=kb/1024 | eval _time = _time+1800 | timechart pa rtial=f sum(mb) as MB by sourceHost thanks in advance.

Hemnaath · ‎07-07-2017

Hi richgalloway, I had tried above search and found the source type and source, then ran the btool to find out the location of the inputs.conf stanza in the indexer instance host but no luck. index=summary_forwarders source="All forwarders - regenerator summary index" sourcetype=stash btool details : ./splunk cmd btool inputs list --debug | grep All forwarders | more grep: forwarders: No such file or directory so decided to run the btool against the sourcetype=stash and found some output but there was no source mapped to it. btool details: ./splunk cmd btool inputs list --debug | grep stash | more /opt/splunk/etc/system/default/inputs.conf [batch:///opt/splunk/var/spool/splunk/...stash_new] /opt/splunk/etc/system/default/inputs.conf queue = stashparsing /opt/splunk/etc/system/default/inputs.conf sourcetype = stash_new Executed the btool against the props.conf file to find out the location, but no luck. ./splunk cmd btool props list --debug | grep stash | more /opt/splunk/etc/system/default/props.conf [source::...stash] /opt/splunk/etc/system/default/props.conf sourcetype = stash /opt/splunk/etc/system/default/props.conf [source::...stash_new] /opt/splunk/etc/system/default/props.conf sourcetype = stash_new /opt/splunk/etc/system/default/props.conf [stash] /opt/splunk/etc/system/default/props.conf REPORT-1 = stash_extract /opt/splunk/etc/system/default/props.conf [stash_new] /opt/splunk/etc/system/default/props.conf TRANSFORMS-sourcetype = set_sourcetype_to_stash kindly guide how to get this fixed, we need to remove above mentioned index details from indexes.conf before removing we want to stop these index to ingest data into it.

Hemnaath · ‎07-06-2017

Hi richgalloway, thanks for your effort on this, but when tried the above find command, it did not fetch any output. Need to find for all the below list of indexes details summary_forwarders summary_indexers summary_sourcetypes summary_sources summary_hosts summary_pools Kindly guide me, is there any other way i can narrow down the inputs.conf details for the above list of indexes details.

Hemnaath · ‎07-06-2017

Hi All, we are removing the unwanted indexes from prod environment as they are deprecated, while performing this activity, we got stuck in finding the exact inputs.conf stanza monitoring and sending the data to a particular index, I had used below steps to find out the inputs stanza to disable and remove it from the host, but unable to get the index details in inputs.conf stanza. steps: 1) From search head, we have got the host, source and sourcetype details by searching index=summary_forwarders. 2) Next logged into the particular indexer host from where the data are being sent to the index=summary_forwardes and executed the btool command "./splunk cmd btool --debug inputs list | grep summary_forwarders | more but unable to locate the stanza. 3) Tired to access the indexer instance via GUI but unable to access the web URL. Kindly let me know is there any other method where we can filter out index detail from inputs.conf stanza details.

Hemnaath · ‎06-28-2017

thanks Hiroshisatoh its working now, but what is the difference between the two command "readabledate + " " + readabletime" and strftime /_time.

Hemnaath · ‎06-28-2017

Hi All, Can any one guide me how to get Date_Time filed by using the above search query. thanks in advance.

Hemnaath · ‎06-27-2017

Hi All, I have used the below query to capture the splunk service status (Up or Down) via splunkd.log. After an upgrade to latest version this query is not working as expected, though we are getting the status update but the date_time field is left blank. In older version 6.2.1 we use to get the data in the date_time field. The date_time filed used to display data containing the earliest / latest time stamp of splunk service status, currently we are not getting it. Kindly let me know whether we need to modify the below query to fetch the date_time data. index=_internal host=hp* OR host=vm* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "loader - Splunkd starting" OR "INFO ShutdownHandler - Shutting down splunkd" | eval message=if((message="Shutting down splunkd"),"failure","success") | rename message as status |eval Date_Time= readabledate + " " + readabletime | sort host | table host Date_Time status thanks in advance.

Hemnaath · ‎06-27-2017

Hi jplumsdaine, thanks for your effort on this, Yes I had removed the stanza that was showing the Invalid Key error. After deleting the stanza from the configuration files and bounced the splunk service and found no errors were popping out.

Hemnaath · ‎06-16-2017

Hi All, Currently we have moved from older splunk version to latest version, but when we reboot the splunk services, we found it is throwing some invalid key stanza details, but not sure what exactly we need to do to fix this issue. Checking conf files for problems... Invalid key in stanza [serverClass:All_search_heads] in /opt/splunk/etc/apps/search/local/serverclass.conf, line 34: targetRepositoryLocation (value: "/splunk_search_pool/etc/apps"). Invalid key in stanza [tcpout:all_indexers] in /opt/splunk/etc/apps/All_fwd_outputs/default/outputs.conf, line 7: autoLB (value: true). Invalid key in stanza [sys_activated] in /opt/splunk/etc/apps/security/default/eventtypes.conf, line 2: index (value: n_fw sourcetype=syslog "Input/CMD1" OR edsnotifier activated OR fwrules/active). Invalid key in stanza [email] in /opt/splunk/etc/system/local/alert_actions.conf, line 5: reportServerEnabled (value: 0). Invalid key in stanza [email] in /opt/splunk/etc/system/local/alert_actions.conf, line 6: reportServerURL (value: ). Kindly guide me how to fix the issue.

Hemnaath · ‎06-12-2017

thanks maciep for throwing some lights on automatic lookups. But how to fix this issue as I could see the Message level error being popped out whenever the saved search condition matched. In newly migrated clustered search head environment, could see the automatic lookup configured for this app. Kindly let me know how to fix this. thanks in advance.

Hemnaath · ‎06-12-2017

hi maciep, once again thanks for you're effort, no i had run the query in different search head portal and more over last week we have upgraded the splunk environment from 6.2.1 to 6.6.1 series. what is the purpose of using automatic lookup in splunk. thanks in advance.

Hemnaath · ‎06-12-2017

Hi Maciep, thanks for you're effort on this issue. We are not getting this message level error while running the query manually in search portal. Regarding automatic lookup is configured with the above name, but when checked the configuration via web, I could see sourcetype = empty filed under lookup inputs filed option in lookup table and also lookup output fields could see Product, vendor, vendor product= empty under lookup outputs filed. Kindly let me know how to trouble shoot this issue now. thanks in advance.

Posts	903
Solutions	12
Karma Given	1
Karma Received	55
Member Since	‎03-15-2015

Online Status	Offline
Date Last Visited	‎11-20-2025 08:58 PM

How to create heatmap visualization in dashboard s...

Where I can get the Splunk Add-on for AWS 6.0.0 ve...

What splunk precedence rules should be followed to...

How to write a Splunk query to find the Splunk UF ...

Where can I get the release notes for Splunk ente...

How to fix this error: could not use the strptime ...

How to write a monitoring stanza to monitor the wi...

How to write time format for 2022-04-07 20:40:03.3...

Why is Splunk ingesting additional information fro...

How to fix the Splunk LDAP AD SYN issue ?

Re: how to determine the name of the server the un...

how to determine the name of the server the univer...

Re: How to write props & transforms to apply for f...

Re: How to write props & transforms to apply for f...

How to write props & transforms to apply for field...

Deployment server connectivity issue ?

Re: Unable to access the splunk web portal using t...

Unable to access the splunk web portal using the U...

Re: How to fix the searches across the reduced buc...

Re: what is the syntax used for filtering a config...

Re: How to fix the searches across the reduced buc...

How to fix the searches across the reduced buckets...

what is the syntax used for filtering a configurat...

Re: Unable to locate an inputs stanza sending a da...

Re: Unable to locate an inputs stanza sending a da...

Re: Unable to locate an inputs stanza sending a da...

Unable to locate an inputs stanza sending a data t...

Re: After upgrade to 6.6.1,one of my search query ...

Re: After upgrade to 6.6.1,one of my search query ...

After upgrade to 6.6.1, one of my searches is not ...

Re: After a successful upgrade from 6.2.1 to 6.6.1...

After a successful upgrade from 6.2.1 to 6.6.1, we...

Re: Why I am getting an additional Message level E...

Re: Why I am getting an additional Message level E...

Re: Why I am getting an additional Message level E...

Join the Conversation