About jadengoho

jadengoho · ‎05-08-2018

is it connected to this message : INFO ExecProcessor - Removing status item "/opt/splunk/etc/apps/snmp_ta/bin/snmp.py (snmp://testing) (isModInput=yes)

jadengoho · ‎05-08-2018

yes there is a SNMP app deployed to 20 Universal Forwarders. I am updating the snmp_ta/local/inputs.conf

jadengoho · ‎05-08-2018

I do all the configuration needed but still no data ingesting in the splunk ##POLL### [snmp://<NAME>] communitystring = public destination = <ip address of the server> do_bulk_get = 0 do_get_subtree = 0 index = <index_name> ipv6 = 0 mib_names = <SMI>,<Custom MIB's i put in .egg> object_names = <OID's> port = 161 snmp_mode = attributes snmp_version = 2C sourcetype = <sourcetype_name> split_bulk_output = 0 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol I deploy the addon on the universal forwarder, and reload the DS , But still no data ingesting .

jadengoho · ‎05-07-2018

That doesn't work on my side. But I Finally know the answer : We are login to our Username (e.g: FirstName.LastName) and for us to do the command ./splunk reload deploy-server We need to log in as a user in the splunk : sudo su splunk ./splunk reload deploy-server (this prompt me to enter my splunk credentials) and then it will RUN the command

jadengoho · ‎05-07-2018

if is do SUDO = An error occurred: Could not create Splunk settings directory at '/root/.splunk'. if no SUDO =Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment how can i reload the deployment server ?

jadengoho · ‎05-07-2018

./splunk reload deploy-server ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment

jadengoho · ‎05-07-2018

How can i do that in CLI ? to run the command ./splunk reload deploy-server

jadengoho · ‎05-07-2018

I see this answer but i cant really understand it : https://answers.splunk.com/answers/211892/could-not-create-splunk-settings-directory-at-root.html can somebody tell me the procedure ?

jadengoho · ‎05-07-2018

Hi, just want to ask why im getting this error and how to make this right : An error occurred: Could not create Splunk settings directory at '/root/.splunk'. Ialways get that when i am reloading the Splunk Deployment server

jadengoho · ‎05-03-2018

Thanks for the advice .

jadengoho · ‎05-02-2018

I deploy the app as "Splunk_TA_salesforce_sh" (January 1st week) and it stops getting data in March. Meaning it sends data for almost 3 months. Does changing the Folder Name affect the process ?

jadengoho · ‎05-02-2018

HI , Basically in the past week i have my salesforce working well but after that the salesforce just stop getting data: here is the error using this query **index=_internal sourcetype=sfcd:eventlog:log error** 2018-05-03 00:17:22,390 ERROR pid=4333 tid=MainThread file=base_modinput.py:log_error:307 | Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_salesforce_sh/bin/splunk_ta_salesforce/modinput_wrapper/base_modinput.py", line 113, in stream_events self.parse_input_args(input_definition) File "/opt/splunk/etc/apps/Splunk_TA_salesforce_sh/bin/splunk_ta_salesforce/solnlib/packages/splunklib/binding.py", line 665, in get response = self.http.get(path, self._auth_headers, **query) File "/opt/splunk/etc/apps/Splunk_TA_salesforce_sh/bin/splunk_ta_salesforce/solnlib/packages/splunklib/binding.py", line 1221, in request raise HTTPError(response) HTTPError: HTTP 404 Not Found -- {"messages":[{"type":"ERROR","text":"Application does not exist: Splunk_TA_salesforce"}]} Can somebody help ?

jadengoho · ‎05-01-2018

Hi, I'm trying to add a new Custom MIB by following this instruction, https://www.splunk.com/blog/2013/06/27/making-snmp-simpler.html unfortunately, I can't run the build-pysnmp-mib -o SOME-CUSTOM-MIB.py SOME-CUSTOM-MIB.mib or *smidump -f python | libsmi2pysnmp > * and I try this suggestion : https://answers.splunk.com/answers/513193/how-to-install-build-pysmp-mib-in-windows-server-2.html 1) Does the result of both processes are the same or not? 2) What does this mean "Then “egg” up your python MIB modules"? ----- Should change the extension to ".egg" before placing it to the location i.e. SAMPLE_MIB.txt > SAMPLE_MIB.py > SAMPLE_MIB.egg 3) after I place the file in the SPLUNK_HOME/etc/apps/snmp_ta/bin/mibs, do I need to restart for the new configuration to take effect?

jadengoho · ‎05-01-2018

Here is my input.conf [snmp://(NAME)] communitystring = public destination = (IP_ADDRESS) do_bulk_get = 0 do_get_subtree = 1 index = SNMP ipv6 = 0 mib_names = (MIB_Names) object_names = (OID_Names) port = 161 snmp_mode = attributes snmp_version = 2C sourcetype = (Sourcetype_Name) split_bulk_output = 0 trap_rdns = 0 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol at first, I set a whole "destination = 192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4,192.168.1.5,192.168.1.6....." - but if I put it on every forwarder I think the data will get duplicated so I am trying to do it individually using the deployment server ~UF_1 > Sample_App > inputs.conf ("destination = 192.168.1.1") ~UF_2> Sample_App > inputs.conf ("destination = 192.168.1.2") ~UF_3 > Sample_App > inputs.conf "destination = 192.168.1.3")

jadengoho · ‎05-01-2018

That's the first idea came to my mind create 20apps, The reason why I need the inputs.conf should differ is, there's a staza in the inputs.conf that get particularly that address "destination = 192.168.1.1" - where "192.168.1.1" is the ip that will get the data I am afraid that if i do it in a whole it would repeat the data to be forward. "destination = 192.168.1.1,192.168.1.2" - i think this would repeat the data.

jadengoho · ‎05-01-2018

I just read the documentation But here is the situation: I have 1(app), 20(UF) In the app, there are inputs.conf that change according to UF, meaning for every UF there is 1(app) but different inputs.conf in it. i.e. ~UF_1 > Sample_App > inputs.conf (contain specific configuration for UF_1) ~UF_2> Sample_App > inputs.conf (contain specific configuration for UF_2) ~UF_3 > Sample_App > inputs.conf (contain specific configuration for UF_3)

jadengoho · ‎05-01-2018

Is it possible to deploy different Inputs.conf to different Universal Forwarder?

jadengoho · ‎04-29-2018

Is there a way I can edit the input.conf of (20)Universal Forwarder just using a Deployment server. If yes, can you please help me.

jadengoho · ‎04-29-2018

I would like to know how I can verify that my add-on/app was successfully deployed in the client. I use deployment server to send add-on/app on the forwarders. Is there a way I can check if it is installed properly?

jadengoho · ‎04-26-2018

YES your right, i'll just talk to the management , Thanks frankV1 for helping

jadengoho · ‎04-26-2018

Yes the deployment server has an access to internet , is it possible to install it from the heavy forwarder to get the folder , and send it to the other ip address where the deployment server is located

jadengoho · ‎04-26-2018

Yes, I know that Splunk(HF, UF, enterprise ...etc) have a WGET so I can download and untar then for installation and other Splunkbase apps don't have. The problem is we don't have a WinSCP on the environment and asking for installing a new application would take a long time due to security purposes. That is why I'm finding the faster way to download the app from SPLUNKBASE to the deployment server. Is there a way to do it only using PUTTY?

jadengoho · ‎04-26-2018

Just want to know how can i download a specific add-on from splunkbase to my deployment server, by just using putty?

jadengoho · ‎04-26-2018

im quite confuse on the process.

jadengoho · ‎04-25-2018

I just want to install an add-on on the 5 UF , can the deployment server do that ?

Posts	252
Solutions	10
Karma Given	6
Karma Received	26
Member Since	‎08-31-2017

Online Status	Offline
Date Last Visited	‎02-28-2022 11:18 PM

Splunk Add-on for 0365: Why am I receiving Invalid...

Credentials Encryption in bash script

Missing date_* fields

WARN LineBreakingProcessor

Splunk High Utilization

Netskope Backend Error

SPL on configuration files

Why is there a Regex Character Limitation

Regex Condition for JSON

Regex Limitation

Re: SNMP doesnt get any data

Re: SNMP doesnt get any data

SNMP doesnt get any data

Re: splunk reload deployment server error

Re: splunk reload deployment server error

Re: splunk reload deployment server error

Re: splunk reload deployment server error

Re: splunk reload deployment server error

splunk reload deployment server error

Re: Salesforce stop getting data

Re: Salesforce stop getting data

Salesforce stop getting data

SNMP add new custom MIB

Re: Deploy Different Inputs.conf to different Univ...

Re: Deploy Different Inputs.conf to different Univ...

Re: Deploy Different Inputs.conf to different Univ...

Deploy Different Inputs.conf to different Universa...

Edit the Inputs.conf of 20(universal forwarder) us...

How could I know if I deploy the apps correctly?

Re: downloading add-on using putty

Re: downloading add-on using putty

Re: downloading add-on using putty

downloading add-on using putty

Re: Installing add-on on multiple forwarder

Re: Installing add-on on multiple forwarder

Join the Conversation