Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About vgollapudi
vgollapudi
Communicator
Member since:
06-29-2017
06-05-2020
Community Statistics
| Posts | 51 |
| Solutions | 3 |
| Karma Given | 19 |
| Karma Received | 8 |
| Member Since | 06-29-2017 |
Activity Feed
- Got Karma for Re: How to allow users to share their dashboard?. 11-10-2020 05:17 AM
- Karma Splunk 7.2.2 - systemd - Root privileges required when starting/stopping Splunk? for whrg. 06-05-2020 12:50 AM
- Karma Re: Splunk systemd unit file in versions 7.2.2 and newer - how do I stop this prompting for the root password? (Q&A) for chrisyounger. 06-05-2020 12:50 AM
- Karma Re: Splunk systemd unit file in versions 7.2.2 and newer - how do I stop this prompting for the root password? (Q&A) for gjanders. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk systemd unit file in versions 7.2.2 and newer - how do I stop this prompting for the root password? (Q&A). 06-05-2020 12:50 AM
- Got Karma for Re: Splunk systemd unit file in versions 7.2.2 and newer - how do I stop this prompting for the root password? (Q&A). 06-05-2020 12:50 AM
- Got Karma for Re: Splunk 7.2.2 - systemd - Root privileges required when starting/stopping Splunk?. 06-05-2020 12:50 AM
- Karma Re: Setting up SQS based S3 input! for wagnerlucena. 06-05-2020 12:49 AM
- Karma Setting up SQS based S3 input= Is it a requirement that SQS is updated via a subscription to an SNS topic? for Stokers_23. 06-05-2020 12:49 AM
- Got Karma for Re: Need help with integration of Symantec App with Splunk. 06-05-2020 12:49 AM
- Karma PagerDuty App for Splunk 1.0: Why am I getting "Invalid key in stanza ... Did you mean 'param.incident_url'" for alert_actions.conf? for tjbaker72. 06-05-2020 12:48 AM
- Karma Invalid Key: serverCert for erictreesh. 06-05-2020 12:48 AM
- Karma Re: install REST API modular input for mintughosh. 06-05-2020 12:48 AM
- Karma How to resolve error "Waiting for requisite number of peers to join the cluster... Cluster has only 0 peers (waiting for 3 peers to join the cluster)"? for andrewdwest. 06-05-2020 12:48 AM
- Karma Re: PagerDuty App for Splunk 1.0: Why am I getting "Invalid key in stanza ... Did you mean 'param.incident_url'" for alert_actions.conf? for ThomasKoeberlei. 06-05-2020 12:48 AM
- Karma Re: Palo Alto Networks Add-on for Splunk: How to resolve "Invalid key in stanza" errors? for Richfez. 06-05-2020 12:48 AM
- Karma Re: How to edit my time_prefix and time format in props.conf? for DMohn. 06-05-2020 12:48 AM
- Got Karma for Re: Why is the deployment server unable to push apps to search head clusters?. 06-05-2020 12:48 AM
- Got Karma for Re: Why is the deployment server unable to push apps to search head clusters?. 06-05-2020 12:48 AM
- Got Karma for Re: How to allow users to share their dashboard?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-16-2018
11:52 AM
Yes,
I've custom app which has this configuration for symantec.
[monitor:///opt/splunk/syslog/symantec/.../*.log]
sourcetype = sep12:log
index = symantec
host_segment = 4
disabled = false
I don't have the TA of symantec on the Indexers.
Since, it's already configured in production. I can't modify the configuration.
I appreciate your inputs regarding the add-on.
Regards
Venky
... View more
03-16-2018
10:59 AM
Hello Nychawk,
Thanks for providing your inputs but sourcetype doesn't work for me. So we just configured to get only one sourcetype and written custom sourcetypes based on data.
... View more
03-16-2018
10:59 AM
No Damode. I just configured and we are getting data but unable to parse that into different sourcetypes.
... View more
11-18-2017
05:54 PM
I was able to resolve this issue, here is the process I have followed
I have updated (replicate = true) parameter in collections.conf file on these instances (Cluster Search Heads Members as well as on Enterprise Search Head Instance).
Make sure you copy the collections.conf under local directory and make changes, /opt/splunk/etc/apps/Splunk_TA_paloalto/local/collections.conf
[minemeldfeeds]
replicate = true
field.indicator = string
field.splunk_source = string
field.value = string
Stanza should like above.
Push these changes on the Cluster Search Head through deployer such that you have similar changes across cluster.
Run the below command as per your environment
/opt/splunk/bin/splunk apply shcluster-bundle target {cluster search head captain} -auth
If the enterprise search head is managed by the deployment server then try to follow the below process
Edit the add-on collections.conf under local directory by making a local copy and reload the deployment server
/opt/splunk/bin/splunk reload deploy-server
This should fix the issue, you can also ensure whether the knowledge bundle is applied successfully or not in two ways.
One, try to search data through UI (Enterprise Search Head).
Second, login into your indexer server and cd this path /opt/splunk/etc/var/run/searchpeers/. Here you can see the Knowledge bundles that are applied and check if the latest bundle applied has the change that you have made which got either pushed through the deployment or deployer.
... View more
11-07-2017
11:36 AM
Splunk has made the upgrade process of the app and add-on much simpler. If you're using deployment server as the origin to distribute among the clients, then there is easy way to do it.
Follow these steps
Access UI of the deployment server. In the Manage Apps window, you have an option to upgrade necessary apps and add-ons when available in the Splunkbase marketplace. Make sure if the existing Splunk version is not compatible with the Apps and Add-ons then deployment server will not give update option for those especially.
In this way, the local configuration will not be disturbed in /etc/deployment and updated content will be in /etc/apps for the updated app which you will override by moving into /etc/deployment-apps by.
In this way, you don't have to untar any file to update the apps.
I tried with this approach on Heavy Forwarder, I got an update for Splunk AWS Add-on which was not managed by Deployment server. I did have custom files inside local directory of this Add-on, I went ahead and updated the Add-on through Heavy Forwarder UI. After the updating add-on, files inside local directory are preserved, default directory is updated with configuration files.
... View more
07-28-2017
03:33 PM
Hello Splunk Techies !!
I need guidance in integrating Symantec Add and Add on with Splunk. I have managed to get those apps in the splunkbase, what is surprisingly confusing is the documentation and installation that is required for these apps.
Symantec Add-on: https://splunkbase.splunk.com/app/2772/#/details
In the Add-on details section, there is link to the splunk documentation. I have followed those instruction and installed the Add-on on Cluster Search Heads and also on the Enterprise Search Head.
Symantec App: https://splunkbase.splunk.com/app/1365/#/details
Whereas, in the App details section, under installation stanza it is mentioned that Add-on is already available under appserver directory.
What I don't understand is which Add-on to use and what instructions to follow for the successful integration of the both App and Add-on.
I have made progress by configuring the Symantec to forward the syslogs to Heavy forwarder and assign index = symantec and sourcetype= sep12:log.
I will share how I deployed the App and Add-on separately to make it simple to understand and debug.
Downloaded the Symantec App and Add-on from the splunkbase.
Installed Symantec App through Splunk UI on Enterprise Search Head.
Manually copied the Add-on and App to Search Head Deployer, deployed these two apps to Cluster Search Heads (Followed the documentation to deploy only Add-on given by Splunk). Also, there was a add-ons directory that was given under appserver directory in SplunkforSymantec App which I have removed before deploying to Cluster Search Heads.
Next, copied only Add-on file to Deployment server and deployed on to Enterprise Search Head.
I'm currently stuck on what Add-on has to be chosen whether the one that is given along with the App or the Add-on that is available on Splunkbase.
Is there any necessity to install both App and Add-on or just Add-on is sufficient ? Are there any steps I can follow apart from Splunk Documentation.
Thanks.
... View more
07-25-2017
04:18 PM
The re-election of the captain has to get approval from the majority of the current cluster members that means if one of the Cluster member is down and only two of them are available to vote but the issue is one of two has to be captain. It won't be possible if the cluster has only 3 members.
A cluster should consist of a minimum of three members. A two-member cluster cannot tolerate any node failure. Failure of either member will prevent the cluster from electing a captain and continuing to function.
http://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/SHCarchitecture#Captain_election_process_has_deployment_implications
The other approach would be elect static captain and it becomes complicated because again you have make them dynamic once the maintenance is done. This process has to be repeated 3 times for each member.
http://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/Staticcaptain
... View more
07-25-2017
04:17 PM
Another question though, the re-election of the captain has to get approval from the majority of the current cluster members that means if one of the Cluster member is down and only two of them are available to vote but the issue is one of two has to be captain. It won't be possible if the cluster has only 3 members.
A cluster should consist of a minimum of three members. A two-member cluster cannot tolerate any node failure. Failure of either member will prevent the cluster from electing a captain and continuing to function.
http://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/SHCarchitecture#Captain_election_process_has_deployment_implications
The other approach would be elect static captain and it becomes complicated because again you have make them dynamic once the maintenance is done. This process has to be repeated 3 times for each member.
http://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/Staticcaptain
... View more
07-24-2017
11:52 PM
Thanks Sheth for your response. If we restart the node that has been stopped is it necessary to run the re-sync command "splunk resync shcluster-replicated-config" on each node after the node is up after the backup ?
I checked this link and the documentation said that it will be done automatically before the set time exceeds. I'm not aware of the default set time for the syncing process to kick on its own.
http://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/HowconfrepoworksinSHC#Replication_synchronization_issues
... View more
07-24-2017
10:52 PM
Hello Techies !!
I have to take snapshots of the EBS volumes that are attached to the cluster search heads, I have to do it by stopping the instance and perform the task. The reason behind stopping the instances is I wanted to deploy apps through deployer but, I don't know whether the deployer will override the existing apps under /opt/splunk/etc/apps on the cluster search heads so, I don't want to take any risk. I'm aware of file precedence related to apps that are installed on the cluster search heads. In worst case scenarios, I can revert back the changes through snapshots.
Any recommendations on how to perform the maintenance and also on what instances should I stop the splunk service during the downtime.
... View more
07-20-2017
11:16 AM
Duke, we don't know what the person Iksridhar is looking for. This thread can be closed.
... View more
07-20-2017
11:00 AM
Duke, are you having issues with the input configurations related to the windows logs that you want to log into Splunk ?
... View more
07-18-2017
04:14 PM
In my environment, Heavy forwarder acts like syslog server gathering logs from sources and I have configured rsyslog to use particular location through a rule which is shared below.
$RuleSet {rule_name}
$template dsm,"/opt/splunk/syslog/dsm/%fromhost%/%$YEAR%-%$MONTH%-%$DAY%.log"
$RuleSet {rule_name}
. -?dsm
& ~
$InputUDPServerBindRuleset {rule_name}
$UDPServerRun {udp_port}
This basically listens to udp_port that has been configured on the DSM and will store logs. Later, these logs are forwarded from HF to indexers such that data gets indexed. Also, I have configured the inputs file.
[monitor:///opt/splunk/syslog/dsm/.../*.log]
sourcetype = deepsecurity
index = dsm
host_segment = 4
disabled = false
I tried to search by using sourcetype=deepsecurity-antimalware in UI but no results.
Is there anything I have configured on the App just like the inputs file or create any regex to assign the sourcetype ?
... View more
07-18-2017
04:05 PM
Thanks aaraneta
... View more
07-18-2017
03:51 PM
2 Karma
I have found the solution for the issue.
The secret key is not same across the search head deploy and search head cluster member. So I have created new key which will be in plaintext format and I have copied under /opt/splunk/etc/system/local/server.conf in shclustering stanza on both search head deploy and cluster search head.
[shclustering]
pass4SymmKey = plaintext
Once I have made the above change I have restarted splunkd service on both of them. The plain text got converted to encrypted text to know the change is effective.
I tried to push the bundle through the search head deploy once the splunk service is up then I was able to push the apps successfully and the apps got copied under /opt/splunk/etc/apps on the cluster search head.
I hope this helps.
Links:
https://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/Setsecretkey
http://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/SHCconfigurationoverview#Configuration_methods
... View more
07-18-2017
01:05 PM
I have included this configuration stanza in /opt/splunk/etc/system/local/inputs.conf file
[udp://xxx]
index = dsm
sourcetype = deepsecurity
Also, edited the rsyslog configuration to create a directory on the heavy forward and store all the logs from the DSM in this below format.
$RuleSet xxx
$template dsm,"/opt/splunk/syslog/dsm/%fromhost%/%$YEAR%-%$MONTH%-%$DAY%.log"
$RuleSet xxx
. -?dsm
& ~
From this what I believe is what ever logs that are been forwarded from DSM through xxx port are assigned only deepsecurity as the sourcetype.
I tried to search by using sourcetype=deepsecurity-antimalware in UI but no results.
... View more
07-18-2017
11:25 AM
Hello Splunk Techies !!
I have configured the Deep Security Manager to forward syslog directly to Heavy forwarder since, we are using a Heavy Forwarder as the primary source to store the logs and later forward those to the indexers to index the data. I'm able to see the data in the search UI by using index=dsm and also logs related to "WebReputation Security Events" but, the trend micro dashboards doesn't seems to visualize the data. Is there any configuration I missed when deploying the Trend Micro Deep Security for Splunk app on Splunk? I deployed the app through the deployment server and it is installed on Heavy Forwarder and also on the Enterprise Search Head. I have used the same syslog configuration for the system events and security events in the Deep Security Manager. Any suggestions where to look to resolve this issue?
Thanks
... View more
07-18-2017
11:17 AM
Did you configure the SIEM events on the Trend Micro Manager ? If so, did you give an endpoint for the syslogs to be forwarded (endpoint could be syslog-ng or heavyfowarder) such that Splunk can see those logs.
... View more
07-05-2017
10:27 AM
Sorry for the confusion. I'm not trying to build the environment, I'm just configuring the environment with the existing instances launched previously. I'm trying to understand the importances of pushing the apps through the deploy(etc/shcluster/apps) to the search head clusters which will query set of indexers. I will probably skip the pushing of the apps to the cluster search head.
... View more
06-30-2017
12:26 PM
You can have only search head according this documentation link.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Deploy/Searchheadwithindexers
... View more
06-30-2017
12:05 PM
Maciep, I'm not creating search head cluster as of now, justing apps through shdeploy to search head cluster instance. At present, only one cluster search head is available in Development environment. I didn't research into the topic of downsides of having only one cluster search head instead of 3. If that's the case won't the shdeploy raise an exception about the instances available in the search head cluster since in this scenario only one search cluster head is present.
... View more
06-30-2017
11:25 AM
In dev environment, we have only one cluster search head so obviously captain would be the existing one. I executed the command and status is Up for the captain and the hostname and mgmt_uri looks good.
... View more
06-30-2017
11:24 AM
Drrillic, the error is different from mine. I have also tried using http instead of https still no progress. The error is about the fetching the apps baseline on the search head cluster captain.
... View more
06-30-2017
11:03 AM
Yes, earlier configuration had different pass4Symmkey between search head deploy and search head cluster and I was aware about this issue when I applied the shcluster bundle from the search head deploy. Later, I have changed the pass4Symmkey on the search cluster head and rebooted the cluster head also splunk service too.
I have ensured the pass4Symmkey used for the searh head deploy and search head cluster are same in the general stanza as well as in the shclustering stanza too.
In the splunkd.log on the search head deploy says about the same error which I have posted in the beginning.
On the cluster search head in splunkd.log
SHPMasterHTTPProxy - Low Level http request failure err=failed method=POST path=/services/shcluster/captain/members/{guid} captain={search_head_cluster_captain_hostname}:{port} rc=0 actual_response_code=502 expected_response_code=200 status_line=Error connecting: Connection refused error="Connection refused"
06-29-2017 19:54:01.879 +0000 ERROR SHPSlave - event=SHPSlave::handleHeartbeatDone heartbeat failure (reason: failed method=POST path=/services/shcluster/captain/members/{guid} captain={search_head_cluster_captain_hostname}:{port} rc=0 actual_response_code=502 expected_response_code=200 status_line=Error connecting: Connection refused error="Connection refused")
ERROR LMTracker - failed to send rows, reason='WARN: path=/masterlm/usage: invalid signature on request from ip={search_head_cluster_captain_ip_address}
These were the errors reported.
... View more
06-29-2017
05:46 PM
Yes, this is a new cluster and deploying apps for the first time. I'm trying to replicate design of the production splunk environment such that development splunk environment is identical.
Deployment Server
I have pushed apps through deployment-server which has a functionality of forwarder management feature where you can track all the apps, clients and serverclasses. Apps got deployed on the deployment clients too after reloading the deployment server.
Search Head Deploy
I'm having issues with search head deploy which is responsible to deploy apps to the cluster search heads. The deployment of the apps to the cluster search heads is not possible through deployment server, it has to be done using search head deploy server.
In spite of identical Pass4Symmkey in the general stanza and also in shclustering stanza in the server.conf file doesn't fix the issue.
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
