Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About damode
damode
Motivator
Member since:
09-26-2017
05-06-2021
Community Statistics
| Posts | 310 |
| Solutions | 8 |
| Karma Given | 132 |
| Karma Received | 21 |
| Member Since | 09-26-2017 |
Activity Feed
- Got Karma for Re: How to upgrade add-ons on Indexers and Forwarders after Splunk ES upgrade ?. 01-27-2026 11:03 AM
- Got Karma for Re: operation:"copying source to destination", error:"Access is denied.". 03-19-2025 09:25 PM
- Got Karma for Bucket replication issues - No possible srcs for replication. 08-26-2021 01:26 PM
- Posted cannot change user and/or app context of a report that is embedded on Knowledge Management. 05-06-2021 03:57 AM
- Posted Re: How to configure index settings to index data directly in S3 buckets/smartstore ? on Getting Data In. 05-05-2021 06:48 PM
- Posted How to configure index settings to index data directly in S3 buckets/smartstore ? on Getting Data In. 05-04-2021 05:38 PM
- Posted Is there any Splunk recommended best practice for ingesting Netflow data ? on Getting Data In. 05-03-2021 09:16 PM
- Got Karma for How to configure input in DB Connect v3.1.2 for Splunk Add-on for Microsoft SQL Server using template mssql:audit ?. 03-01-2021 04:55 PM
- Posted Re: What is the recommended logging requirement for Linux OS from Splunk ES perspective ? on Splunk Enterprise Security. 02-04-2021 01:54 PM
- Posted What is the recommended logging requirement for Linux OS from Splunk ES perspective ? on Splunk Enterprise Security. 02-03-2021 09:18 PM
- Posted Need help to find specific auth logs for Linux OS on Getting Data In. 02-01-2021 12:31 AM
- Posted Re: Is there any ES Analytical Story or Usecase for Certificates and Alerts datamodel ? on Splunk Enterprise Security. 01-31-2021 04:22 AM
- Posted Is there any ES Analytical Story or Usecase for Certificates and Alerts datamodel ? on Splunk Enterprise Security. 01-28-2021 11:48 PM
- Posted Application Protocols list in ES - unclear in documentation on Splunk Enterprise Security. 01-28-2021 02:30 AM
- Posted What is the actual use of Expected Views lookup ? on Splunk Enterprise Security. 01-28-2021 02:23 AM
- Posted How does ESCU app exactly maps Analytical Stories against CIS Controls ? on Splunk Enterprise Security. 01-12-2021 03:43 AM
- Posted Is there any automated way to check or validate magix six parsing attributes have been configured ? on Getting Data In. 01-09-2021 05:28 PM
- Posted Re: Accelerating CIM Validation (S.o.S.) datamodel results in error on Splunk Enterprise Security. 01-06-2021 04:09 PM
- Posted Re: SSL Certificate Checker: Which extensions are supported? on All Apps and Add-ons. 01-05-2021 02:17 PM
- Posted Strategies for populating watchlist field in Assets and Identity Framework on Splunk Enterprise Security. 01-04-2021 05:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-06-2017
05:35 PM
Hi Myron,
Thanks for that.
Can you please also answer this qn ?
https://answers.splunk.com/answers/586014/invalid-key-in-stanza-should-linemerge-of-inputsco.html
... View more
12-06-2017
03:34 PM
So you mean UF can be used for data buffering ? if yes, can you please share the documentation for the configuration ? Thanks
... View more
12-05-2017
04:42 PM
In the historical view of Index Detail: Instance page of the Indexer DMC, it shows data for only _audit and _telemetry. No data for other indexes.
EDIT : There is no historical data shown on all of my splunk instances- 1 S.H, 1 Indexer and 2H.Fs. I have set their DMC's in standalone mode.
I learnt from here that the historical panels get data from introspection logs. Then I re-read the "Monitoring Console setup prerequisites" where it says,
Platform instrumentation must be enabled for every Splunk Enterprise instance that you intend to monitor, except forwarders. (that means Platform instrumentation must NOT be enabled on Forwarders)
Forward internal logs (both $SPLUNK_HOME/var/log/splunk and $SPLUNK_HOME/var/log/introspection) to indexers from all other components. (Forwarding internal logs from Search Head and Heavy Forwarders will basically make them also "Forwarders")
Does that mean I should disable Platform instrumentation on Search head and Heavy forwarders ?
And if I disable Platform instrumentation on these "forwarders" then it will not generate any introspection logs. Then what would be the sense in forwarding them to Indexer ?
Please help me understand this.
... View more
12-05-2017
02:13 AM
Please ignore my previous comment regarding S.H not starting. Its resolved now.
At this stage, since ldap is already configured on Indexer, would the above settings override Indexer's current ldap settings ? or
should I delete the current configuration on Indexer and wait for Search head's ldap config to get replicated to the Indexer ?
I had already referred that link you shared, but it has to many varying answers with no concrete points. for e.g, the 1st answer deals with version prior to 2.1.2 but I am already running the latest version 2.1.4 still the issue persists.
Most of those talk about manually installing the ldap app on Indexer and pushing the config from the S.H via deployer. However with my architecture (1 S.H and 1 Indexer) how can I push the config to the Indexer so that it uses the same password hashes ? OR would your above provided settings achieve that task ?
... View more
12-05-2017
01:27 AM
Hi Hardik,
The info on the distsearch.conf for the [replicationSettings:refineConf]
setting says that
These settings on their own do not cause files to be replicated. A file
must still be whitelisted (via
replicationWhitelist) to be eligible
for inclusion via these settings
So I am guessing I will have to add a file to the whitelist as well. is that right ? if yes, then please advise how I can do it via replicationWhitelist.
... View more
12-04-2017
10:46 PM
Hi Hardik,
I have got only one Search Head and one Indexer. Would the above settings have any negative impact on the S.H considering these [shclustering] settings are applicable for a search head cluster ?
... View more
12-04-2017
09:38 PM
I had tried that but Splunk keeps updating/deleting these folders. The folder in which I had made those changes isn't there anymore.
Currently, its giving me the same error from C:\Program Files\Splunk\var\run\searchpeers\SEARCH-HEAD-1512451985\apps\SA-ldapsearch\bin\packages\splunklib\client.py
... View more
12-04-2017
06:04 PM
I just did a file system check from the operating system using SFC.EXE /scannow and did not find any integrity violations.
... View more
12-04-2017
05:51 PM
If you mean health check on DMC, then yes.
On Search head, I have license warning and scheduled searches skipped messages. On Indexer, I am getting these event processing issue about which I have posted here.
... View more
12-04-2017
05:30 PM
Now I am getting the same error from datasourcetype = licensealert-5 as well, in addition to splunk_pdfgen.
... View more
12-04-2017
04:44 PM
This is what I found within the client.py at line 1653,
try:
response = self.get(key)
return ConfigurationFile(self.service, PATH_CONF % key, state={'title': key})
except HTTPError as he:
if he.status == 404: # No entity matching key
raise KeyError(key) //**line 1653**
else:
raise
How can I resolve this ?
I also noticed this folder (mentioned in the error message)
C:\Program Files\Splunk\var\run\searchpeers\SEARCH-HEAD-1511928556\apps\SA-ldapsearch has only bin folder. Should I create a local folder and place the ldap.conf and password.conf files here ?
... View more
12-04-2017
03:00 PM
I did it via GUI too, but still it gives that error.
Currently, both Search Head and the Indexer have the exact copy of app.conf, passwords.conf, ldap.conf
... View more
12-03-2017
05:42 PM
Hi @MuS, I had changed back to default TIME_FORMAT , but that still gave the same issue.
Based on the above observation, do you recommend setting the [splunk_pdfgen] attributes exactly same as yours ?
... View more
12-03-2017
05:20 PM
I was referring to this link, https://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input to configure data buffering on Heavy Forwarder. The instructions provided talk about configuring the below attributes in outputs.conf,
maxQueueSize = integer
usePersistentQueue = true/false
persistentQueuePath = absolute_path_that_must_exist
maxPersistentQueueSizeInMegs = integer
However, except maxQueueSize, no other attributes can be found in the outputs.conf file.
Please advise how can I configure data buffering in this case.
... View more
11-29-2017
11:37 PM
Hi David,
Spike in Password Reset Emails (Assistant: Detect Spikes) use case returns results for the detect spikes search but doesnt populates data in "Field with data points" and "Field for our subject". Can you please suggest how can I make it work ?
... View more
11-29-2017
11:32 PM
Hi Hardik,
I didnt go for the 2nd option which is about editing the commands.conf just to avoid any impact on search performance. W.r.t architecture, I have just 1 Search head and 1 Indexer.
I have tried configuring through GUI and also got connection tested successfully. However, the issue with that page is, it shows connection untested when you either refresh or go back to that page. And whenever, I used to check the ldap.conf file, the ssl used to somehow get enabled, which I wanted to be disabled. Hence, I just do it manually.
... View more
11-29-2017
10:18 PM
Hi @MuS,
Upon comparing with the above list of options, I found the below fields having different value in comparison to yours. Everything else is same.
CHARSET = AUTO
TRUNCATE = 20000
detect_trailing_nulls = auto
... View more
11-29-2017
10:03 PM
Hi @hardikJsheth,
There is already ldap.conf is the local dir of both S.H and Indexer. I had manually created ldap.conf on Indexer with same config as S.H, upon reading one of the posts on similar topic here.
Additional info : there is no passwords.conf and app.conf in the local folder of Indexer. S.H has all 3 files.
... View more
11-29-2017
09:49 PM
Hi Harsh,
None of the views on the Views page match the page title, I am looking for.
For e.g: Emails with Lookalike Domains (Assistant: Simple Search) page doesnt exist on the views page.
... View more
11-29-2017
09:12 PM
Thanks for that, Harsh.
... View more
11-29-2017
08:00 PM
Also, you are not able to see asterisk * after index= is because it gets somehow removed after posting the comment. But just know the query uses index=asterisk
... View more
11-29-2017
07:58 PM
Hi Harsh,
Thanks for that. After correcting that part the query got results. But now my question is, how can I make this correction within the use case dashboard ? Because there is no option to edit the dashboard.
This app uses this line "tag==email" within the query atleast in 2-3 use cases to perform data check. Because of this I am getting that error. After removing the extra = sign, the query runs well.
Example below,
| tstats count where index=* sourcetype=cisco:esa* OR sourcetype=MSExchange*:MessageTracking OR tag==email earliest=-4h
index=* sourcetype=cisco:esa* OR sourcetype=MSExchange*:MessageTracking OR tag==email | head 100 | eval length_combined = len(src_ip) * len(src_user) | stats sum(length_combined) as count
... View more
11-29-2017
07:09 PM
1 Karma
In the Splunk Security Essentials app, I get this error , "Error in 'TsidxStats': WHERE clause is not an exact query" when I run the below query,
| tstats count where index=* sourcetype=cisco:esa* OR sourcetype=MSExchange*:MessageTracking OR tag==email earliest=-4h
Please help
... View more
11-28-2017
08:30 PM
Whenever I run any ldap query on the Search Head, I get results, however, I always get the below error,
[INDEXER] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""C:\Program Files\Splunk\var\run\searchpeers\SEARCH-HEAD-1511928556\apps\SA-ldapsearch\bin\packages\splunklib\client.py"", line 1653 : u'ldap'" "
On another post where this question was asked, following options were given,
1. Install and configure the SA-ldapsearch component on your indexer instances.
2. Modify the commands.conf within SA-ldapsearch to run in the local space only.
However, I have already installed SA-ldapsearch on the Indexer but it didnt make any difference. And the drawback of 2nd solution is that it can result in degraded search performance due to restricting LDAP queries to the search head only.
Please advise how I can resolve this.
Thank you.
... View more
11-27-2017
08:22 PM
Throughout the installation manual of the app, it says to install the app only on the Search Head.
However, I noticed on the "Troubleshoot the Splunk App for Microsoft Exchange" page, it says, "Confirm that the Splunk App for Microsoft Exchange resides on all indexers and search heads in the deployment."
Does it really needs to be installed on the Indexer ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-06-2021
08:24 AM
|
