About Venkat_16

Venkat_16 · ‎07-13-2016

We have our dedicated Splunk Environment setup on AWS with Indexer and Search Head Clustering. - Splunk App for AWS is installed on Splunk Search Head Cluster - Splunk Add-on for Amazon Web Services is installed on a dedicated single instance server (Heavy Forwarder) All our Splunk servers on AWS Cloud do NOT have connectivity to Internet. They have only Private IPs - dedicated VPC/Subnet. We are unable to configure AWS Add-On CloudTrail Input. The SQS Queue are not getting populated on the drop-down. What I doubt is, since we do not have connectivity to internet, the Heavy Forwarder is unable to connect to AWS API and get the required queue details, etc. We do not want to open our AWS servers to the Internet. For now, we have configured the AWS add-on on our on-prem Heavy Forwarder and pushing data to Indexers on AWS. We are worrying about unnecessary data transfer between AWS API->On-Prem HF->AWS Indexers. How do we approach this issue?

Venkat_16 · ‎05-06-2016

We had search query were we extract field 1 and field 2 using regular expressions. We have doubt here that which of the dashboards will load faster case 1: dashboard whose extracted fields are saved in props.conf case 2: dashboard whose extracted fields are directly using them in search query Please help us in which case works efficient P.S: In both cases no of events and search queries are same only the fields change

Venkat_16 · ‎04-27-2016

Yes we choose the REST API method to configure the mulesoft gave heavy forwarder IP and port number 8080 and created a user in heavy forwarder and as well in the Splunk search head and kept default values for the advance settings, Between thanks alot

Venkat_16 · ‎04-27-2016

Have configured the props.conf as directed in the mulesoft link: [mule] TRUNCATE = 0 LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false INDEXED_EXTRACTIONS = JSON KV_MODE = JSON category = Mule Splunk Integration description = Mule Agent event information but still we are not able to view any of the logs in splunk.... any way to check to error logs...not error logs in _internal index

Venkat_16 · ‎04-25-2016

Greetings everyone!!!! We have configured Splunk app for AWS and everything is working perfectly. Now the AWS application team wants to onboard the logs of AWS cloudtrail for last year (i,e) from Jan 2015 to Dec 2015 which are available in the s3 buckets. Is adding the ignoreOlderThan = 1y in the inputs stanza of cloudtrail inputs.conf a healthy way of doing it? Please guide us on this further. Thanks in advance!!!!!

Venkat_16 · ‎04-25-2016

Hey Thanks i didnt check this part, Thanks again!!!

Venkat_16 · ‎04-22-2016

Thanks for the answer please refer the below documentation link where it suggests the default port to be configured as 8089 http://blogs.mulesoft.com/biz/mule/anypoint-runtime-manager-v1-2-monitoring-servers-and-apps-with-splunk-elk/ i believe we can get data through 8089 port if we are using API calls

Venkat_16 · ‎04-19-2016

Greetings everyone!!! We were trying to integrate Splunk with Mulesoft. we already had splunk plugins in Mulesoft. We gave heavy forwarder IP and 8089 as port number. But we are not getting data in main index. Is this configuration correct or we need to give indexer IP and port 8089 in the mulesoft configuration... Please guide us

Venkat_16 · ‎03-31-2016

Hey All, We have a file which has the version number of an application in the below format : version = 4.0 The requirement is to get notified when the version field gets updated. In order to do so, the file has to be re-indexed very often. Also note that file size is very small. We are looking for a solution where we can get notified when the version field gets changed. We do not want to restart the Splunk server as we can re-index a file after deleting the fish bucket. Kindly suggest any solution which matches above constraints

Venkat_16 · ‎01-27-2016

Here is the way i configured it: 1. First install TA_BOX_APP from splunk and configure with box details and restart the server 2. Then download Box app for Splunk, configure and then restart 3. Go to backend of Splunk server and make thease below changes: change no 1: Comment off the streaming_request = 0 in the Splunk/etc/apps/BoxAppForSplunk/default/inputs.conf change no 2: create a new index in the indexes.conf file in Box app for splunk change no 3: edit the degault file in inputs.conf of TA_BOX app and replace "disabled=true" as "false" also add the new index below each of the input stanza, like below: [box_service://events] rest_endpoint = events duration = 30 disabled = false index = change no 4: update the Splunk/etc/apps/BoxAppForSplunk/default/inputs.conf file with new index which we have created. Then hit a restart and it will work like charm

Venkat_16 · ‎01-18-2016

Hi, we currently have Splunk 6.2.0 running in our production and we want to upgrade to the next version which has minimal bugs in it. Kindly suggest which version of Splunk has been so far stable and reliable? p.s: Yes, we have quite an amount of dashboards and alerts to be configured this year.

Venkat_16 · ‎12-17-2015

any particular reason for this significant move? we have our indexers in Solaris SPARC, we have migrate now to Linux 😞

Venkat_16 · ‎12-17-2015

I am unable to find latest 6.3.x install package for Solaris SPARC OS. When can we expect this? Or is it deprecated?

Venkat_16 · ‎11-13-2015

We entered in the URL and Crontab fields, but are not able to save it. I downloaded casper.js and phatom.js and placed it in the Splunk app folder

Venkat_16 · ‎11-03-2015