Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Bill_B
Bill_B
Communicator
Member since:
12-10-2013
06-05-2020
Community Statistics
| Posts | 60 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 11 |
| Member Since | 12-10-2013 |
Activity Feed
- Karma Re: NetApp Data ONTAP: App is indexing events, but no information is appearing in dashboards. for jcoates_splunk. 06-05-2020 12:47 AM
- Got Karma for Re: License Pool daily volume allocation not working running Splunk 6.0.4 on Linux Redhat. 06-05-2020 12:47 AM
- Got Karma for Re: License Pool daily volume allocation not working running Splunk 6.0.4 on Linux Redhat. 06-05-2020 12:47 AM
- Got Karma for What files contain the configs for Splunk web to do http or https?. 06-05-2020 12:47 AM
- Got Karma for Re: What files contain the configs for Splunk web to do http or https?. 06-05-2020 12:47 AM
- Got Karma for Re: What files contain the configs for Splunk web to do http or https?. 06-05-2020 12:47 AM
- Got Karma for Does NetApp ONTAP 2.0.1 need intermediate forwarders?. 06-05-2020 12:47 AM
- Got Karma for How does a customer set up Support Portal account?. 06-05-2020 12:47 AM
- Got Karma for NetApp Data ONTAP: App is indexing events, but no information is appearing in dashboards.. 06-05-2020 12:47 AM
- Got Karma for Splunk TA for Unix/Linux: Where can I find download for version 5.0.2 ?. 06-05-2020 12:47 AM
- Karma Re: How to get Windows domain log in data for ChrisG. 06-05-2020 12:46 AM
- Karma Re: Universal Forwarder Error during install for linu1988. 06-05-2020 12:46 AM
- Got Karma for Re: Universal Forwarder install- can't browse log file location. 06-05-2020 12:46 AM
- Got Karma for Re: Override Sourcetype. 06-05-2020 12:46 AM
- Posted Re: Windows events: Why no data in the "Message" field? on Getting Data In. 03-10-2015 10:25 AM
- Posted Re: How do I change the user Splunk runs as? on Security. 02-02-2015 01:39 PM
- Posted Re: How do I change the user Splunk runs as? on Security. 02-02-2015 10:46 AM
- Posted How do I change the user Splunk runs as? on Security. 01-30-2015 04:37 PM
- Tagged How do I change the user Splunk runs as? on Security. 01-30-2015 04:37 PM
- Posted Re: If I disable an index, will events for that index stop being counted against the license? on Installation. 10-30-2014 12:52 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 |
07-29-2014
04:39 PM
It seems that most of the dashboards require the sourcetype ontap:perf and when I do a search on sourcetype=ontap:perf, I get no events returned. My dashboard problem may be related to this, but I don't know how.
... View more
07-29-2014
04:00 PM
1 Karma
I installed the Splunk App for NetApp and everything seemed to install fine. Filers and clusters were added and show "valid" connection and credentials. I can also see events being indexed via the "App Data Volume", under "Settings".
However, none of the App dashboards are populating with information. All dashboards show, "No results found."
Can anyone tell me why I am not getting any information on the dashboards?
Thanks.
... View more
07-15-2014
04:48 PM
1 Karma
Hi. I'm trying to deploy the Splunk app for NetApp ONTAP (v. 2.0.1). In the documentation it shows intermediate forwarders for collecting and forwarding NetApp Data ONTAP logs. Here: http://docs.splunk.com/Documentation/NetApp/2.0.1/DeployNetapp/WhataSplunkAppforNetAppDataONTAPdeploymentlookslike
Do you actually need these intermediate forwarders or can the NetApp Data ONTAP logs be sent directly to the Splunk Enterprise instance?
Thank you.
... View more
07-10-2014
01:58 PM
2 Karma
Got it. In the web GUI go to "Settings">"System Settings">"General Settings". About half way down is, "Enable SSL in Splunk Web?", select radio button "No".
Restart.
Problem solved.
Not sure why, but changing the web.conf file worked for 2 of my servers and did not work for the other 2. However, the radio button solution, above, worked.
... View more
07-10-2014
01:44 PM
Yes, restarted Splunk. No brackets around enableSplunkWebSSL= false.
Also, cleared browser history and restarted server that Splunk is installed on.
... View more
07-09-2014
05:05 PM
Yes. [enableSplunkWebSSL= false] in web.conf but still have to use https to connect to splunk web when launched from local machine.
... View more
07-09-2014
03:51 PM
1 Karma
I have a heavy forwarder on a Win2008 R2 server. After installing the NetApp ONTAP app, Splunk web would only take https connections. I fixed the web.conf file in that app, but Splunk web still will only take https connections. Is there another file which needs to be modified?
Thank you.
... View more
06-30-2014
04:40 PM
Hi. I am working on a Splunk deployment that involves a Splunk enterprise receiver at the data center and heavy forwarders at the branch offices. Do the heavy forwarders need to have the same apps installed on them as the Splunk receiver?
Thanks.
... View more
06-19-2014
04:10 PM
This issue was caused by the linux servers not having the correct time configured on them. Basically the servers thought it was 2013 when it was actually 2014. This caused the enterprise license not to activate because licenses are valid from date issued, which was 2014.
... View more
06-19-2014
04:09 PM
2 Karma
This issue was caused by the linux servers not having the correct time configured on them. Basically the servers thought it was 2013 when it was actually 2014. This caused the enteprise license not to activate because licenses are valid from date issued, which was 2014.
... View more
06-19-2014
03:57 PM
Thank you. This solves an entire licensing issue I have been working on. Turns out my servers thought it was 2013.
... View more
06-19-2014
03:26 PM
I am running Splunk 6.0.4 on linux. On the "Licensing" page, my enterprise license shows a status of "FROM_THE_FUTURE" instead of "valid" like in the documentation. Why is this and what does it mean?
Also, the volume of my license is 5,120 MB but Effective daily volume is 0 MB. Why?
Any help is greatly appreciated.
... View more
06-19-2014
03:06 PM
Hi all,
I am running Splunk 6.0.4 on linux redhat. I installed an enterprise license and the auto-generated pool was created. However, when trying to set the daily volume allocation, it appears the pool will not go over 0MB. I have a 5GB license and have tried configuring pool in MB and GB, but the pool continues to show as 0MB.
Does anyone know what's wrong?
Other info:
The Splunk Enterprise stack shows, "Effective daily volume" of "0 MB". The enterprise license "Status" shows, "FROM_THE_FUTURE". "auto_generated_pool_enterprise" shows volume used today as, "57 MB / 0 MB".
Thanks for any help.
... View more
06-18-2014
03:10 PM
Hi all,
I am running Splunk 6.0.4 on linux redhat. I installed an enterprise license and the auto-generated pool was created. However, when trying to set the daily volume allocation, it appears the pool will not go over 0MB. I have a 5GB license and have tried configuring pool in MB and GB, but the pool continues to show as 0MB.
Does anyone know what's wrong?
Other info:
The Splunk Enterprise stack shows, "Effective daily volume" of "0 MB". The enterprise license "Status" shows, "FROM_THE_FUTURE". "auto_generated_pool_enterprise" shows volume used today as, "57 MB / 0 MB".
Thanks for any help.
... View more
06-09-2014
02:03 PM
I am setting up a linux server with Splunk 6.0.4. I want to install "Splunk App for NetApp Data ONTAP". I followed the instructions for downloading and installing the app. After installing from file and restarting splunk, the app fails to appear in Splunk Home. When I tried to re-install from file I receive the error: "App with this name already exists."; yet still no app displayed in Splunk Home.
Anyone know how to fix this?
Thanks.
... View more
06-05-2014
12:31 PM
If the above command returns no result then a manual uninstall must done. Yes?
... View more
06-05-2014
11:39 AM
In the guide for uninstalling Splunk from Linux, it says; "rpm -e splunk_product_name".
What is meant by, "splunk_product_name"? Is that the name of the installed file?
I installed using the wget URL. So would the command be, "rpm -e splunk-6.1.1-207789-Linux-x86_64.tgz"?
Also, what directory should this command be executed from?
-Thank you
... View more
04-02-2014
05:24 PM
Can a heavy forwarder be configured to queue event data and hold it until a specified time? Can some data be queued and other data be forwarded immediately?
To reduce network traffic throughout the day I want to queue some data at the heavy forwarder and deliver it on off hours, like 3am.
Thanks.
... View more
- Tags:
- heavy-forwarder
- queue
03-11-2014
04:21 PM
Thanks. That gave me a lot more info including the account names.
... View more
03-11-2014
03:14 PM
Hi all,
I have a universal forwarder that is forwarding Windows security logs to my Splunk instance on a linux machine. The logs are being written to a folder on a Windows 2008R2 server that the universal forwarder is installed on.
For Windows event code 4740 (user account locked out), I would like to get the user name for the account that was locked out. However, that information does not seem to be in the log.
Does anyone know how or where I could get the user name information?
This is the info I'm currently getting from a typical security log:
03/11/2014 11:19:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4740
EventType=0
Type=Information
ComputerName=USWV-DC1.XXX-inc.local
TaskCategory=User Account Management
OpCode=Info
RecordNumber=608568744
Keywords=Audit Success
Message=
Thank you.
... View more
03-05-2014
05:57 PM
1 Karma
Thanks for your answer lguinn, but I am trying to do a sourcetype override based on host. As in the example at the bottom of this doc: http://docs.splunk.com/Documentation/Splunk/6.0/Data/Advancedsourcetypeoverrides
I have multiple hosts sending events to udp:514 but I would like the events from certain hosts to be overridden and labeled differently.
Any ideas?
... View more
03-04-2014
05:19 PM
To solve this:
Modify file-
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf
All types of logs you don't want as a source should be edited to: "disable = 1"
The above file path is for a default install of Universal Forwarder on Windows2008R2.
... View more
03-04-2014
03:03 PM
I'm trying to do a sourcetype override and not having much luck. I am trying to change the sourcetype from 2 hosts, from udp:514 to "PAN". I went through the "Override Sourcetype" guide and followed the example. When opening the transforms.conf and props.conf file there is a message that says, "Do not edit this file. Make edits in etc/system/local." Ok, so in "etc/system/local" I created tthe transforms.conf and props.conf files and placed the following inside:
"transforms.conf"
[set_sourcetype_syslog_pan]
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(10.0.1.21|10.0.1.23)[\w.-]]?\s
FORMAT = sourcetype::PAN
DEST_KEY = MetaData:Sourcetype
"props.conf"
[source::udp:514]
TRANSFORMS-changesourcetype = set_sourcetype_syslog_pan
This appears to of had no effect. All sourcetypes still show as "syslog". When I tried to test the REGEX in Splunk with the rex command I received the error: "Error in 'SearchParser': Missing a search command before '('.
So what's wrong here? The REGEX is right out of the guide, so I don't think it should error out.
Thank you.
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
