About kwchang_splunk

kwchang_splunk · ‎09-25-2015

Thank you HTH. I didn't know the meaning of "X-Forwarded_For" header. It's for the original client ip. Right? Thank you for clarification. Regarding "X-Cluster-Client-IP" ("X-Cluster-IP" seems like a typo from my customer), I think I can do similarly in my search. BTW, can I get those "X-*" headers which was not listed in the doc?

kwchang_splunk · ‎09-25-2015

Hello experts, My customer has a following requirement. When there is a HTTP header like "X-Forwarded-For" or "X-Cluster-IP", this HTTP request is using a proxy server. In this case, the src_ip should be set with the value of the original machine's ip (not with the proxy's ip). Using stream, how can I do this? How can I know the original machine's ip?

kwchang_splunk · ‎09-22-2015

Dear stream experts, In case of TCP/UDP inputs, there are the persistent queue and memory queue which can deal with the network problem with indexers behind. What happen if the UF which runs streamfwd disconnected from indexer? Is there any buffer which can handle it? If there is, how can I manage the size of it? Thank you.

kwchang_splunk · ‎09-18-2015

Hello experts, Is there a way to identify SSH Tunneling packets using the Splunk App for Stream? From a security point of view, it would be valuable if possible. Thank you.

kwchang_splunk · ‎09-18-2015

Thank you.

kwchang_splunk · ‎09-18-2015

Hello stream experts, Detecting TOR packets is very simple with Splunk App for Stream. It's just searching "app=TOR". How can streamfwd know whether the packets are TOR or not? Also I'd like to know whether false-positive detections can happen. Thank you in advance.

kwchang_splunk · ‎09-16-2015

Hello Apfender, Thank you for replying. I think, it looks different problem.

kwchang_splunk · ‎09-16-2015

Thank you vshcherbakov. What do you think about "net.ipv4.udp_mem" for UDP? Any recommendation?

kwchang_splunk · ‎09-15-2015

Hello experts, Can Search Head Clustering work with enableSplunkdSSL = false option? I tried the following: on deployer instance. - "enableSplunkdSSL = false" on each SHC member instance. - "enableSplunkdSSL = false" - conf_deploy_fetch_url : changed https to http - mgmt_uri : changed https to http Tried to restart all instances and also repeated init/bootstrap steps of SHC, but failed. Each search head can start up well and run distributed searches, but when I run the bootstrap shcluster-captain command, I find following entry from the splunkd.log. ERROR SHPRaftConsensus - Failed to bootstrap this node as a captain. And when I set category.SHPRaftConsensus=DEBUG , I can find the following log entries repeatedly in the splunkd.log of all search head instances. DEBUG SHPRaftConsensus - Will become candidate in 110661 ms Any comments would be very appreciated. Thank you.

kwchang_splunk · ‎09-14-2015

Hello. I have a customer who wants to do a performance test using stream. He has 2 scenarios: First one is about collecting UDP packets without drops. UDP packets will be collected from 2ea x 1g NICs with 2gbps in total. The fields that need to be extracted are L4 attributes including src_ip, src_port, dest_ip, dest_port and timestamp. The measurement would be the number of droped packets so we need to minimize the drops. The other scenario is collecting TCPpackets. TCP packets will be generated with the speed of 35,000 connections/seconds. Also, he will check the number of the lost packet. Is there any guide documentation for tuning parameters of OS kernel and streamfwd for doing these kind of tests? Thank you in advance.

kwchang_splunk · ‎09-09-2015

Hello, Is there a way to reassemble the original file which was sent via http, smtp, or ftp protocol? If it is possible, how can we do that? If not, is there alternative ways or complementing solutions for that? Thank you.

kwchang_splunk · ‎09-09-2015

In case of using a dedicated server for running streamfwd, can I think that the proper value of ProcessingThreads would be same with the number of CPU core?

kwchang_splunk · ‎09-09-2015

Great. Thank you.

kwchang_splunk · ‎09-09-2015

Hello, Where can I find the default values of the following parameters in streamfwd.xml, and what's the reasonable range of values? ProcessingThreads, MaxPacketQueueSize, MaxTcpSessionCount, MaxTcpReassemblyPacketCount And one more question. Is there any recommended set of values for above parameters to collect packets with 1Gbps without problems? Thank you.

kwchang_splunk · ‎12-19-2013

Hi all, Using real-time output app, I want to send newly updated events to 3rd party system. But when I tested this app, many duplicated events were sent again and again. It works exactly same way with all-time windowed realtime searches and if an events is shown, it will not disappear until the number of result count hit the maximum count(100000). Can I send only new events without duplications in realtime using this app? How can I config? Thank you in advance.

kwchang_splunk · ‎07-17-2013

SSL is turned off, but nodes are still trying to negotiate using PK. Can we turn off this behavior? 07-18-2013 10:35:44.191 +0900 ERROR NetUtils - Unable to negotiate ssl connection: error=1, Undefined error: 0 07-18-2013 10:35:44.191 +0900 ERROR NetUtils - SSL Error = error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 07-18-2013 10:35:44.191 +0900 WARN DistributedPeerManager - Send failure while pushing PK to search peer = https://xxx.xxx:8093, rv = 2 , http request to peer with uri=https://xxx.xxx:8093 returned an error. Check if the peer is up.

kwchang_splunk · ‎07-16-2013

That was the problem! Thank you. Now it works.

kwchang_splunk · ‎07-15-2013

I also disabled 'enableSplunkdSSL' in all peers. But it doesn't work.

kwchang_splunk · ‎07-15-2013

But.. there were so many errors in splunkd.log. In master's splunkd.log : 07-15-2013 17:11:39.970 +0900 ERROR HTTPServer - Incomplete request="<80>V^A^C^A^@-^@^@^@ ... In peers's splunkd.log : 07-15-2013 17:12:10.785 +0900 ERROR NetUtils - Unable to negotiate ssl connection: error=1, Undefined error: 0 07-15-2013 17:12:10.785 +0900 ERROR NetUtils - SSL Error = error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 07-15-2013 17:12:10.785 +0900 ERROR HTTPClient - Should have gotten at least 3 tokens in status line, while getting response code. Only got 0. ...

kwchang_splunk · ‎07-15-2013

Thank you for your comment. I agree. I don't think this is a good idea. But I'm just trying this for testing. 🙂 I could turn off SSL of splunkd process using enableSplunkdSSL =false in server.conf But I cannot find client side config for turning off SSL. I tried several parameters including useClientSSLCompression, useSplunkdClientSSLCompression but not successful so far. Any idea? Thank you in advance.

kwchang_splunk · ‎07-15-2013

Dear experts? When deploying cluster, can we disable SSL between peers and search head? My customer's SH connects to peers over WAN, so the network bandwidth is not enough. All searches take several seconds before they display the results. Currently dispatch.createProviderQueue is 3~5 seconds. I'd like to check whether disabling SSL can help this situation by skipping time for SSL handshaking. Thank you.

kwchang_splunk · ‎07-15-2013

Thank you so much!!

kwchang_splunk · ‎07-10-2013

Dear, I'm looking for Javascript SDK sample code of changing "seriesColors" attribute of a chart. Thank you in advance.

kwchang_splunk · ‎07-02-2013

Hi. Please check whether you are using same serverName value (in server.conf) across different splunk instances. I had exactly same problem when I installed several splunk instances in a same machine in same OS account. But after changing those to different value from each other, the problem was disappeared. Hope this helpful.

kwchang_splunk · ‎06-17-2013

Sorry for ambiguous question. My question is about the DataFlare app, (not Splunk license). During the installation process of DataFlare app, the price was displayed as around $1,000 per server. I just wanted to check it.

Posts	51
Solutions	0
Karma Given	11
Karma Received	3
Member Since	‎09-02-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to add BOM to alert attached CSV file?

Splunk Enterprise Security: Why are notable events...

How to deploy the Splunk App for Stream to multipl...

Stream App for Stream: field parsing problem when ...

Splunk App for Stream: about X-Forwarded-For Heade...

Splunk App for Stream: Why does the Splunk Web UI ...

Splunk App for Stream: Where can I find a complete...

Why is the Splunk App for Stream not extracting th...

Is there a plan for the Splunk App for Stream to s...

Splunk App for Stream: Where do I set the timezone...

Re: Splunk App for Stream: proxy detection and map...

Splunk App for Stream: proxy detection and mapping...

Splunk App for Stream : if indexing queue blocked ...

Splunk App for Stream: How to detect SSH Tunneling...

Re: App for Stream: How can streamfwd detect TOR?

App for Stream: How can streamfwd detect TOR?

Re: Is it possible to disable splunkd SSL in Searc...

Re: Splunk App for Stream: Is there documentation ...

Is it possible to disable splunkd SSL in Search He...

Splunk App for Stream: Is there documentation on t...

Splunk App for Stream: Is it possible to reassembl...

Re: Splunk App for Stream: Where can I find the de...

Re: Splunk App for Stream: Where can I find the de...

Splunk App for Stream: Where can I find the defaul...

[Real-Time Output App] same events are sent again...

Re: Can we disable SSL between SH and peers?

Re: Can we disable SSL between SH and peers?

Re: Can we disable SSL between SH and peers?

Re: Can we disable SSL between SH and peers?

Re: Can we disable SSL between SH and peers?

Can we disable SSL between SH and peers?

Re: assigning "seriesColors" attribute in Javascri...

assigning "seriesColors" attribute in Javascript S...

Re: Authentication Failed using distributed search

Re: License question

Join the Conversation