Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About PavelP
PavelP
Motivator
Member since:
12-03-2013
05-21-2024
Community Statistics
| Posts | 411 |
| Solutions | 62 |
| Karma Given | 82 |
| Karma Received | 57 |
| Member Since | 12-03-2013 |
Activity Feed
- Got Karma for Re: Splunk Upgradtation tar/rpm. 10-23-2024 01:30 PM
- Posted Re: TERM and PREFIX cannot find string with two dashes on Splunk Search. 03-04-2024 10:01 AM
- Posted Re: TERM and PREFIX cannot find string with two dashes on Splunk Search. 03-03-2024 03:52 AM
- Posted Re: TERM and PREFIX cannot find string with two dashes on Splunk Search. 03-03-2024 03:49 AM
- Posted Re: TERM and PREFIX cannot find string with two dashes on Splunk Search. 03-03-2024 02:53 AM
- Karma Re: TERM and PREFIX cannot find string with two dashes for tscroggins. 03-02-2024 02:18 PM
- Posted Re: TERM and PREFIX cannot find string with two dashes on Splunk Search. 03-02-2024 02:02 PM
- Karma Re: TERM and PREFIX cannot find string with two dashes for PickleRick. 03-02-2024 11:49 AM
- Got Karma for TERM and PREFIX cannot find string with two dashes. 03-02-2024 05:47 AM
- Posted TERM and PREFIX cannot find string with two dashes on Splunk Search. 03-02-2024 01:27 AM
- Karma Re: How come when I send Syslog info via UDP to local universal forwarder, the host is always 127.0.0.1? for FrankVl. 01-31-2024 09:08 AM
- Posted Re: Tracking Field Changes in Events on Splunk Search. 01-30-2024 07:09 AM
- Posted Re: Tracking Field Changes in Events on Splunk Search. 01-30-2024 06:45 AM
- Posted Re: Tracking Field Changes in Events on Splunk Search. 01-30-2024 03:33 AM
- Posted Re: Tracking Field Changes in Events on Splunk Search. 01-29-2024 11:49 AM
- Karma Re: Tracking Field Changes in Events for yuanliu. 01-29-2024 11:38 AM
- Posted Re: Tracking Field Changes in Events on Splunk Search. 01-25-2024 05:44 AM
- Posted Tracking Field Changes in Events on Splunk Search. 01-25-2024 04:13 AM
- Got Karma for Re: Splunk reports first-time run failed!. 12-15-2023 06:49 AM
- Got Karma for Re: parse csv content and header for fields. 12-08-2023 02:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
05-29-2020
06:41 AM
Hello @vrajshekar
is it possible you have 1512 different events in the DB? They cannot be duplicate because they have different AutoID values.
... View more
05-28-2020
06:24 PM
Hello @mvor
can you create a network capture with tcpdump/snoop on the Solaris itself? Don't filter by port, just filter out ssh
... View more
05-28-2020
02:54 PM
@socrates4rufio
is splunk running on windows or linux?
what happens if you click ignore/continue cert warning in Chrome? The same 500 Internal error?
can you post a full browser warning you get?
check also splunkd_access.log and splunkd_ui_access.log for 500 error and post the matching lines here
try to find any lines in splunkd.log matching the time when you navigating to Settings > Data Input
if not logged as admin - try to relogin as admin and test again. Do you get the same 500 error?
... View more
05-28-2020
10:42 AM
Hello @socrates4rufio
do you see any errors in $SPLUNK_HOME/var/log/splunk/splunkd.log ?
... View more
05-28-2020
02:00 AM
@jadengoho
tags are not exclusive for data models and used generally to assign names to specific field and value combinations, so if you search for tag=windows or tag::windows you get windows-related (coming from) events.
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Abouttagsandaliases
... View more
05-27-2020
08:20 AM
@bijenderkhosya I think this will work if the cert verification is disabled. I think you cannot enable cert verification selectively.
The setup described in the pdf doesn't use mutual authenticated TLS, only DS' certificate is verified, the UF's certificate is not verified.
... View more
Hello @bijenderkhosya
as @gcusello mentioned, SSL is already enabled, but default certificates are used, which means the connection is not "secure" and can be MitM-ed.
Please follow these steps: https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf
... View more
05-27-2020
06:52 AM
Hello @conwaw,
it's a pity that there are no such section "security considerations" in a planing manual https://docs.splunk.com/Documentation/DBX/3.3.0/DeployDBX/Architectureandperformanceconsiderations, but there is an indication between the lines that DBConnect should be installed on a heavy forwarder,
... View more
05-27-2020
06:01 AM
Hello @jlongworth
you can find this information in the operating system's logs:
Windows - eventvwr.msc - installation
Linux - find the installation date and time in /var/log/yum*log or /var/log/dpgk*log and correlate it with output of last command
you can find it using splunk UI if these logs are indexed by splunk
... View more
05-27-2020
04:16 AM
I've just tested - splunk cron doesn't accept any special cron characters, except listed on the doc page (*,-/)
... View more
05-27-2020
01:19 AM
Hello @gpradeepkumarreddy,
not a response that you asking, but a suggestion anyway:
is switching to KVstore instead of
static lookup an option?
Please consider KV-Store vs CSV lookup:
https://dev.splunk.com/enterprise/docs/developapps/kvstore/#The-KV-Store-vs-CSV-files
https://dev.splunk.com/enterprise/docs/developapps/kvstore/migrateyourappfromusingcsv/
another options is to use gziped CSV files.
... View more
05-27-2020
12:42 AM
Hello @jadengoho
the tag "windows" doesn't belong to the default Splunk CIM and can be set by Splunk Add-on for Microsoft Windows, here is an excerpt from default/tags.conf:
###### Global Windows Eventtype ######
[eventtype=fs_notification]
endpoint = enabled
change = enabled
[eventtype=wineventlog_windows]
os = enabled
windows = enabled
[eventtype=wineventlog_application]
os = enabled
windows = enabled
[eventtype=wineventlog_system]
os = enabled
windows = enabled
[eventtype=wineventlog_security]
os = enabled
windows = enabled
[eventtype=perfmon_windows]
os = enabled
windows = enabled
[eventtype=perfmon_processorinformation]
process = enabled
report = enabled
performance = enabled
cpu = enabled
[eventtype=hostmon_windows]
os = enabled
windows = enabled
[eventtype=hostmon_os]
os = enabled
windows = enabled
memory = enabled
performance = enabled
oshost = enabled
you can run btool command to find out which add-on sets this tag:
splunk btool tags list --debug
... View more
05-27-2020
12:05 AM
Hello @pbalbasdtt,
try directly on the UF:
./splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus
do you see anything in the output related to the monitored files?
Additionally check $SPLUNK_HOME/var/log/splunk/splunkd.log for any WARN and ERROR.
If the internals logs are being send from the UF to the index layer and the REST API is accessable, then you can check both from the SH.
... View more
05-26-2020
02:54 AM
@marone, I think you asking about log file rotation and autodeletion, right? This is configured under log.cfg:
appender.rootAppender=ConsoleAppender
appender.rootAppender.layout=PatternLayout
appender.rootAppender.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
# if these log files are getting too big for your liking, turn down the maxFileSize.
# it's best to not make them too small, however, because these logs can be very
# useful in troubleshooting.
appender.A1=RollingFileAppender
appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log
appender.A1.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.A1.maxBackupIndex=5
appender.A1.layout=PatternLayout
as you can see, for most log files that is max 5 log files x 25MB. More for license log.
Is this the info that you looked for?
... View more
05-26-2020
02:02 AM
Hello @marone,
which log files do you have in $SPLUNK_HOME/etc ? Most of logs are under $SPLUNK_HOME/var/log
... View more
05-26-2020
12:00 AM
@aagashe,
there are various scripts to install splunk on linux, also for an unattended install:
https://answers.splunk.com/search.html?f=&redirect=search%2Fsearch&sort=relevance&q=install+script+linux&type=question
Additionally check this: https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/StartSplunkforthefirsttime#Start_Splunk_Enterprise_without_prompting.2C_or_by_answering_.22yes.22_to_any_prompts
... View more
05-25-2020
01:36 PM
1 Karma
Agree! `_0_/
... View more
05-25-2020
11:47 AM
1 Karma
@aovrutsky,
thank you for the clarification, now I got it.
Since this script is based on urllib3, you can modify it to add proxy support: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#proxies
... View more
05-25-2020
11:44 AM
Hello @sethion,
thank you for the clarification, now I understand.
It is better to pre-filter on the estreamer side, check TA-eStreamer/bin/encore/estreamer/pipeline.py and bin/encore/estreamer/adapters/splunk.py and maybe others.
... View more
05-25-2020
11:26 AM
@amakwana
alternatively you can modify this setting in $SPLUNK_HOME/etc/system/local/server.conf
[diskUsage]
minFreeSpace = 100
and restart splunk, this will give you some hunderds of MB.
... View more
05-25-2020
11:19 AM
Hello @aovrutsky
what kind of error message you get? If it is "INFO ProxyConfig - Failed to initialize http_proxy from server.conf for splunkd" then it is safe to ignore them.
... View more
05-25-2020
06:08 AM
you can use a script which compare old and new version of the file and write the diff to a log, then let splunk monitor this log file.
another option is to use a database instead of csv file and let splunk monitor it for updates
you have to consider that splunk will not see if the record in the csv file is deleted
regarding your question "is there any way we can delete previous records before re ingesting updated file": there is no easy way to delete events from splunk once events are indexed.
do records in the csv file are with a timestamp?
can you output records sorted by time, so new events are appended to the csv file instead of overwriting?
... View more
05-25-2020
03:45 AM
@ajitshukla61116 ,
one of your requirements is "update any thing" - does it also means any line anywhere in the file, also at the beginning of file? If yes, then you have to reindex the whole file
... View more
05-25-2020
02:26 AM
Hello @ajitshukla61116 ,
I know a partial solution for your question - use initCrcLength = 1048576, splunk will calculate CRC sum based on the first 1MB and reindex the whole csv file if anything changed in the first 1048576 bytes of the file.
[monitor:///tmp/file.csv]
disabled = false
....
initCrcLength = 1048576
here is an excerpt from the documentation:
initCrcLength = <integer>
* How much of a file, in bytes, that the input reads before trying to
identify whether it is a file that has already been seen. You might want to
adjust this if you have many files with common headers (comment headers,
long CSV headers, etc) and recurring filenames.
* Cannot be less than 256 or more than 1048576.
* CAUTION: Improper use of this setting causes data to be re-indexed. You
might want to consult with Splunk Support before adjusting this value - the
default is fine for most installations.
* Default: 256 (bytes).
... View more
05-24-2020
10:54 PM
2 Karma
Hello @aagashe,
it looks like a permission issue, the splunk folders and files belong to other user (or root?) or splunk is already running. It happens often if splunk installed from tgz.
Run with root privileges (change the $SPLUNK_HOME as appropriate):
sudo pkill -f splunk
sudo chown -R splunk:splunk /opt/splunk
sudo /opt/splunk/bin/splunk enable boot-start -user splunk --accept-license
sudo systemctl start splunk
The modern way to run Splunk is using systemd, so you can change it to:
sudo pkill -f splunk
sudo chown -R splunk:splunk /opt/splunk
sudo ./splunk enable boot-start -user splunk -systemd-managed 1 --accept-license
sudo systemctl start Splunkd
if you choose the last method, stick to it and start/stop splunk using "sudo systemctl" only.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-21-2024
08:27 AM
|
Karma from
