About gkanapathy

gkanapathy · ‎06-03-2014

Actually in the latest release of Splunk I believe the scripts create certs that are good for nearly 10 years (3650 days actually)

gkanapathy · ‎06-03-2014

That is the case if you just run the default Splunk cert generation scripts. If you want, you can either copy/edit the default scripts (in $SPLUNK_HOME/bin/gen*.sh) or manually run openssl to pick different dates for your own certificates, or you could generate certificates using other means and use those.

gkanapathy · ‎06-03-2014

This is not a hash. It is a reversible encryption, encrypted and decrypted using a key that is in $SPLUNK_HOME/etc/auth/splunk.secret. It is not possible to use a one-way hash on this password, since the purpose of it is to be accessible to the Splunk process to use. I believe the encryption used is Blowfish or AES, for what it's worth. You should treat this config just as you would treat the SSL private key, and make sure it is not readable by unauthorized users. The encryption here is suitable only for preventing casual inspection. Anyone with access to the Splunk server would be able to get this password, the decryption key, and the secret key.

gkanapathy · ‎05-30-2014

iamnos, can you please send your contact information to me and we'll get back to you? I'm at my username, gkanapathy, at splunk.com. Thank you!

gkanapathy · ‎05-28-2014

You can't have this situation. Retention polices are defined in the indexes.conf file, and in a clustered environment, that file must be placed on the cluster master and delivered to the search head that way.

gkanapathy · ‎05-27-2014

You can try ./splunk createssl web-cert to get the splunkweb certificate. If that doesn't work, it may be because the hashed password for the certificate in /opt/splunk/etc/system/local/server.conf in sslKeysFilePassword is now wrong after the regeneration. You can replace that with plaintext password (that's the default password, you can change it with openssl) and Splunk will re-hash it.

gkanapathy · ‎05-26-2014

For some reason, your startup didn't create the ca.pem on first-time run. You might try running /opt/splunk/bin/splunk cmd genRootCA.sh and see if it will create the file again.

gkanapathy · ‎05-24-2014

Have you looked at a custom event renderers? http://docs.splunk.com/Documentation/Splunk/6.0.1/AdvancedDev/EventRendering

gkanapathy · ‎05-08-2014

Yes, this is a slightly different issue from the enterprise one. We are working on a fix for this too and it is likely to be in an accelerated maintenance release.

gkanapathy · ‎05-06-2014

This appears to be a different though possibly related problem.

gkanapathy · ‎05-06-2014

I'm not sure how Easting and Northing work, but I assume that you can covert them via arithmetic (addition and multiplication/divison) to latitude and longitude. If you do that, then you can use the lat and long fields throughout the Splunk geo commands, including in maps and in the geostats command.

gkanapathy · ‎05-06-2014

It should be pretty straightforward. If you write the Oracle Audit logs to OS files, it's quite easy to bring them into Splunk. From there, you can use normal Splunk log search, alerting, reporting, and other functionality on them.

gkanapathy · ‎05-06-2014

This appears to be a bug in Splunk 6.1 for Splunk Free. We are currently looking at it. It affects several of the admin pages.

gkanapathy · ‎04-22-2014

You are correct. You can install the other Python instance elsewhere, and explicitly call it. I'm not sure Windows respects #! at the top of script, in fact I think it doesn't, so you'd have to code the path in the appropriate place.

gkanapathy · ‎04-18-2014

Seems you have a typo in your ProxyPassReverse directive? But you also should put ProxyPreserveHost On in your Apache config.

gkanapathy · ‎04-18-2014

Seems you have a typo in your ProxyPassReverse directive?

gkanapathy · ‎04-14-2014

This is something that is determined by the input's author. It is in fact possible (as suggested above) to change the sourcetype via a TRANSFORM rule in props.conf. It is also possible for the author of the input to set the sourcetype. This is typically not done, because the inputs are usually paired with a set of rules (field extractions, tags, etc) that operate against a particular sourcetype, as well as searches and dashboards. Since the purpose of a sourcetype is to specify the type of data, and any one input knows its own, it rarely makes sense to allow changes to it.

gkanapathy · ‎04-13-2014

I would suggest though that one could use a local web browser. I would also ask how you would play to get data to Splunk on such an isolated machine.

gkanapathy · ‎04-13-2014

All admin and user functions can be performed via the CLI. In fact, some can only be performed that way.

gkanapathy · ‎04-13-2014

Splunk works fine disconnected from the internet. The default login screen has the browser check back with Splunk for upgrade and update notifications. There is no harm is these fail, and the attempts can be turned off in configuration.

gkanapathy · ‎04-06-2014

That is correct, you can't set a new sourcetype for certain input types.

gkanapathy · ‎03-31-2014

$SPLUNK_HOME/etc/users/myusername/myappname/local/configfile.conf files are created when you set or modify a config in the "myappname" context, and the config change is scoped to be private to the user "myusername". This is what you did with you original call. If you changed the config to have app or global scope, it would move out of the /users/ folder to the app directory. it's generally not preferred to edit config files via the REST API. it's better to make the proper API call to make the change.

gkanapathy · ‎03-31-2014

It is not a single point of failure. If the cluster master is lost, there is no effect on operation of the cluster, either on searching or indexing. The effect of a failed cluster master is that, if an (additional) indexer node fails before the cluster master is recovered, then searches will be affected and data will be indicated as unsearchable. Note that a cluster master is stateless, so recovery does not need any kind of data recovery, but simply starting up a replacement at the same address as the missing one. This can be done with a simple boot of a plain master machine image.

gkanapathy · ‎03-27-2014

You can use "complex search" | where searchmatch("complex search") OR match("\*",_raw)

gkanapathy · ‎03-23-2014

kscher, short answer is that Splunk uses certain characters to decide what a word boundary is, and usually spaces and punctuation work fine. but when you have weird characters separating words, the words won't get indexed the way you need for a search to work. the custom segmentation simply tells Splunk to split words so they can be searched for and found. extraction works independently of this, because extraction happens after events are found, thus it may appear to work even if the field values that get extracted can not be found in the index.

Posts	3150
Solutions	814
Karma Given	1705
Karma Received	3589
Member Since	‎11-16-2009

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Using LWF as intermediate forwarder and using auto...

How do I use intentions and the ConvertToIntention...

Search Filters (srchFilter) when a user is in mult...

limits on "action.summary.index" vs piping to "col...

Can a subsearch return only the value (without the...

Can you refresh or reload index-time sourcetype pr...

How are values in lookups matched?

Does SEDCMD use PCRE regular expressions?

Is there a way to list enabled apps from the CLI?

Re: Level of encryption for ssl self signed passwo...

Re: Level of encryption for ssl self signed passwo...

Re: Level of encryption for ssl self signed passwo...

Re: Can't get in touch with sales

Re: Clustering Retention Policies

Re: Error opening CA Certificate ca.pem

Re: Error opening CA Certificate ca.pem

Re: Custom event viewer for records that have XML,...

Re: 6.1 upgrade - can't access search macros

Re: 6.1 upgrade - can't access search macros

Re: Easting and northing plotting into maps

Re: How to use Splunk Oracle admin-level log audit...

Re: 6.1 upgrade - can't access search macros

Re: Installing Python 3 interpreter on Windows Spl...

Re: Splunk behind reverse proxy keeps redirecting ...

Re: Splunk behind reverse proxy keeps redirecting ...

Re: Change WinHostMon sourcetype

Re: Isolated network

Re: Isolated network

Re: Isolated network

Re: Change WinHostMon sourcetype

Re: How to edit authentication.conf via Rest (roun...

Re: Why does master node continue to be single poi...

Re: literal * in search?

Re: Field discovery/extraction works but extracted...

Join the Conversation