About SanjayReddy

SanjayReddy · ‎09-05-2024

Hi @PeterBoard Infact recently we faced same issue for domain controller server where UF stopped sending data found that ququs filled up. as per support they asked to change to useACK to False to aviod issue and they said it not recomneded to Use useack= true on UF. in your case any errors your obeserved in splunkd.log during issue

SanjayReddy · ‎09-05-2024

Hi @jsbapple I’m a Community Moderator in the Splunk Community. you are reploying to question was posted couple of years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!

SanjayReddy · ‎09-02-2024

Thanks @PickleRick for information. I will try use options you menioned as well

SanjayReddy · ‎09-02-2024

Hi @tlmayes seems there is know in issue on latest version for Splunk 9.2 and after. can you follow this link and try fixit https://docs.splunk.com/Documentation/Splunk/9.3.0/Updating/Upgradepre-9.2deploymentservers Possible issues with upgrade Data not appearing in forwarder management UI following upgrade This problem can occur if your deployment server forwards its data to a standalone indexer or to the peer nodes of an indexer cluster. To rectify, add these settings to outputs.conf on the deployment server: [indexAndForward] index = true selectiveIndexing = true If you add these settings post-upgrade, you might need to restart the deployment server.

SanjayReddy · ‎09-02-2024

Hi @splunktup1 I would recomend using AWS/AZure/GCP and try creating windows/linux machines and install splunk on them, instead of using VM on Laptop. it might take up lot of resources on laptop. or install splunk directly on laptop

SanjayReddy · ‎09-02-2024

Hi @Sathish28 Can you please run following comand in CLI of the server , where you are seeing in message and share the output. /opt/splunk/bin/splunk btool server list --debug | grep -i local

SanjayReddy · ‎09-02-2024

Hi @KhalidAlharthi If you able to view the index name incluster manager page.it means it has searchable data howerver when you try searhcing with same index name, what was time range you are looking for. try run for longer timeframe. or you need to have the permission to view the index data in Splunk. can you please confirm is indexname you are searching has present in allowed list for your role?

SanjayReddy · ‎08-23-2024

Hi @rammeduru Currently There is no app available for Dashboards in Splunk Base. you might try creating dashboards for yourself

SanjayReddy · ‎07-14-2024

Hi @bwheelerice recently I did similar exercise if you have backend access on Searchead CLI navigate to $PLUNK_HOME/etc run command grep -Ril "index=<indexname>" it will list wherever index=<indexname> present with location its covers etc/apps/ and etc/users However, one problem is that you need to do it based on your needs. At least it worked for me to find index names and replace them wherever needed. searching of index name depends on component for ex: on deployment server you need to run in location $PLUNK_HOME/etc/deployment-apps on cluster manager $PLUNK_HOME/etc/manager-apps or master-apps it works for any keyword that you want to lookfor

SanjayReddy · ‎07-14-2024

Hi @thevikramyadav In addtion to @PickleRick answer , below is the basic understandinf of SH cluster Search head cluster need minimum of 3 search heads and max 100 Group of search heads where apps, search, artifacts and jobs scheduling are same Group of search heads replicates knowledge objects replicates search artifacts increases search accessibility Advantages Horizontal scaling High availability No single point of failure - Deployer Centralized location to distribute apps and other configurations to search head cluster members Not participate in searches - Captain - Its a cluster member with additional responsibilities - responsible include - Scheduling jobs/searches - Coordinating alerts and alerts suppression across the cluster - Pushes the knowledge bundle to search peers(indexers) - Coordinating artifacts replication - Replicating configuration updates - Cluster members - Same as search head in single instance - Participate in searches - Load balancer (optional) - 3rd party software - Resides between users and cluster members - Replication factor - Determines the number of copies of each artifact/search result - Only artifact/search result from scheduled saves searches are replicated - Results from ad hoc searches or real time searches are not replicated - by default, schedules saves searches results are stored in - $SPLUNK_HOME/var/run/splunk/dispatch/search/ - Search peers - These Indexers where data is searched

SanjayReddy · ‎07-12-2024

Hi @splukiee have you changed the pass4SymmKey value under general stanza seems you updated pass4SymmKey for clustring stanza, IMO , log message trggerting for pass4SymmKey under general also as suggested by @PickleRick can you please run btool for pass4SymmKey to check different location of pass4SymmKey present on the server. /opt/splunk/bin/splunk btool server list --debug | grep -i pass4SymmKey

SanjayReddy · ‎07-12-2024

Hi @SplunkExplorer for your question regarding sudors I dont think Splunkuser you created , by deafult its not part of any sudors list , it will be group same as splunk user for running Splunk on linux you dont need to part of any sudors. Splunk perfrom its core funcations as normal.

SanjayReddy · ‎04-27-2024

Hi @tv00638481 following post help to understand stpes need to followed befroe upgrade. https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Enterprise/td-p/408003 in this case you need to upgrade first deploymentserver then HF and UF. compatbility between Splunk cloud and forwaders https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Service/SplunkCloudservice#Supported_forwarder_versions ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated

SanjayReddy · ‎04-27-2024

Hi @Ismail_BSA you can use following restcall to find caluclated fields created by you | rest splunk_server=local services/data/props/calcfields/ | search author = <yourid> | table attribute field.name eai:acl.app author eai:acl.sharing ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated

SanjayReddy · ‎04-04-2024

Hi @wberkowicz Can you try with powershell with refernece to following post. https://community.splunk.com/t5/Installation/Handy-commands-for-uninstalling-SplunkUniversalForwarder-from/m-p/542627

SanjayReddy · ‎04-04-2024

Hi @Manasa_401 response provided by @richgalloway , will work. https://localhost:8000/en-US/account/login?loginType=splunk In addition to rich reponse. if your existing URL contains 8000 number keep that as well. sometimes it might be issue with language en-us or en-gb , kindly try with language for URL with SAML auth

SanjayReddy · ‎02-15-2024

Hi you can enable debug mode for splunkd.log file before taking diag. Enable debug logging on all of splunkd.log Splunk software has a debugging parameter (--debug) that you can use when you start Splunk software from the CLI in *nix. This command outputs logs to the $SPLUNK_HOME/var/log/splunk/splunkd.log file. This option is not available on Windows. To enable debugging on Splunk software running on Windows, enable debugging on a specific processor. See Enable debug logging in Splunk Web or Enable debug logging using log.cfg. Navigate to $SPLUNK_HOME/bin. Stop the Splunk platform instance, if it is running. Save your existing splunkd.log file by renaming it, like splunkd.log.old. Restart the instance in debug mode with splunk start --debug. When you notice the problem, stop the instance. Move the new splunkd.log file elsewhere and restore the old file. Stop or restart the instance normally (without the --debug flag) to disable debug logging. Not all messages marked WARN or ERROR indicate actual problems with Splunk software; some indicate that a feature is not being used. for splunk diag run following command *nix example Windows example ./splunk diag splunk diag @raghunandan1

SanjayReddy · ‎02-12-2024

Hi @LearningGuy folllwing XML worked for me <dashboard version="1.1" theme="light"> <label>Test</label> <row> <panel id="DisplayPanel"> <single id="datestyle"> <search> <query>| makeresults | addinfo | eval text = "How to align this text to left?" | table text </query> </search> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> </single> </panel> <panel depends="$alwaysHideCSS$"> <title>Single value</title> <html> <style> #DisplayPanel { width: 40% !important; font-size: 16px !important; text-align: left !important; float: left; } </style> </html> </panel> </row> </dashboard>

SanjayReddy · ‎02-11-2024

Hi @LearningGuy In html code open bracket is missing highlited in RED and width value set accrodingly to keep left <html> <style> #DisplayPanel { width: 40% !important; font-size: 16px !important; text-align: left !important; float: left; } </style> </html>

SanjayReddy · ‎02-09-2024

Hi @pm11 please follow below steps to reset password go to <SPlunk installation directory>/splunk/etc/ under this location file called passwd rename it to passwd.backup go to following location <SPlunk installation directory>/splunk/etc/system/local create new file user-seed.conf inside user-seed file add following contents [user_info] USERNAME = admin PASSWORD = <newpassword> and restart splunk from cmd <SPlunk installation directory>/splunl/bin/ splunk restart ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated

SanjayReddy · ‎12-04-2023

Hi @pm2012 you can use following query index=_internal source="*license_usage.log" type=Usage h="<forwader name>" | rename _time as Date | eval Date=strftime(Date,"%b-%y") | stats sum(b) as license by Date h | eval licenseGB =round(license/1024/1024/1024,3) | rename licenseGB as TB

SanjayReddy · ‎12-04-2023

Hi @LogUx it seems ,533 is milliseconds 2023-12-05T04:21:21,533+00:00 %Y-%m-%dT%H:%S,%3Q+00:00

SanjayReddy · ‎11-30-2023

Hi @syazwani please follow below steps to reset password go to <SPlunk installation directory>/splunk/etc/ under this location file called passwd rename it to passwd.backup go to following location <SPlunk installation directory>/splunk/etc/system/local create new file user-seed.conf inside user-seed file add following contents [user_info] USERNAME = admin PASSWORD = <newpassword> and restart splunk from cmd <SPlunk installation directory>/splunl/bin/ splunk restart ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated

SanjayReddy · ‎11-28-2023

Hi @Colloh I would suggest you to open in incognito or clearer your broswer cookies and loginto STEP this would be temporary issue

SanjayReddy · ‎11-27-2023

Hi @Simon1 I feel there is not direct way to change the app context in UI also you are using splunk cloud. otherway is go to searches reports and alerts from settings from their click on edit alet and clone then you can change the app context and , once clone the alert delete the alert with app in slack context

Posts	328
Solutions	50
Karma Given	20
Karma Received	135
Member Since	‎21-07-2021

Online Status	Offline
Date Last Visited	‎02-13-2026 01:09 AM

Is there a way to increase dropdown input text fon...

Is it possible to run a Script From Splunk on Rem...

Why won't data parsing while sending data through...

How can I customize color for cell value based on ...

How to plot backlog data on timechart?

.conf 22 Registration

Splunk Log File Monitoring

Re: Splunk UF Windows Security Event logs just see...

Re: splunk indexer: status: "pending", fully searc...

Re: Need to find where index was used in lookups, ...

Re: Splunk 9.3 deployment server page

Re: Splunk Environment Set up - VMware

Re: After upgrading from 9.0.3 version to 9.1.0 Ve...

Re: index problem search

Re: Dashboard APP for Citrix Netscaler

Re: Need to find where index was used in lookups, ...

Re: Need more details about SH clustering

Re: pass4SymmKey issue

Re: Required permission for linux user owner of Sp...

Re: Splunk DS & HF upgrade from 9.0 to 9.1

Re: Difficulty Locating Newly Added Calculated Fie...

Re: Trying to uninstall Splunk Enterprise 7.0.1.0 ...

Re: Splunk access to External users

Re: How to get the diag files with debug files of ...

Re: How to align single value text to left in Dash...

Re: How to align single value text to left in Dash...

Re: password reset

Re: How to calculate data ingestion from a specifi...

Re: Time format

Re: Reset password in splunk for admin

Re: Error while accessing the trainings

Re: Unable to Remove Slack Alert From the Slack Al...

Join the Conversation