Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tlmayes
tlmayes
Contributor
Member since:
01-25-2014
Tuesday
Community Statistics
| Posts | 149 |
| Solutions | 3 |
| Karma Given | 12 |
| Karma Received | 20 |
| Member Since | 01-25-2014 |
Activity Feed
- Posted Re: Deployment Server clients have wrong apps on Splunk Enterprise. a month ago
- Got Karma for Deployment Server clients have wrong apps. a month ago
- Posted Re: Splunk 9.3 deployment server page on Splunk Enterprise. 09-02-2024 05:34 PM
- Posted Splunk 9.3 deployment server page on Splunk Enterprise. 08-13-2024 06:47 AM
- Posted Re: Splunk message to teams 'chat' on Splunk Enterprise. 08-13-2024 06:26 AM
- Karma Re: Splunk message to teams 'chat' for tscroggins. 08-13-2024 06:26 AM
- Posted Splunk message to teams 'chat' on Splunk Enterprise. 08-01-2024 10:58 AM
- Got Karma for host_segment being overridden. 06-26-2024 07:59 AM
- Posted SAML users unable to load reports or alerts on Splunk Search. 05-15-2024 07:05 AM
- Posted Re: Access request to IA4S on All Apps and Add-ons. 05-07-2024 10:01 AM
- Posted Access request to IA4S on All Apps and Add-ons. 05-07-2024 06:42 AM
- Got Karma for Deployment Server clients have wrong apps. 04-25-2024 06:28 AM
- Got Karma for Re: Deployment Server clients have wrong apps. 04-25-2024 02:44 AM
- Posted Re: Deployment Server clients have wrong apps on Splunk Enterprise. 04-03-2024 08:31 AM
- Posted Re: Deployment Server clients have wrong apps on Splunk Enterprise. 03-28-2024 04:28 AM
- Posted Re: Deployment Server clients have wrong apps on Splunk Enterprise. 03-27-2024 01:04 PM
- Posted Re: Deployment Server clients have wrong apps on Splunk Enterprise. 03-27-2024 12:35 PM
- Posted Re: Deployment Server clients have wrong apps on Splunk Enterprise. 03-27-2024 12:30 PM
- Posted Re: Deployment Server clients have wrong apps on Splunk Enterprise. 03-27-2024 12:01 PM
- Posted Re: Deployment Server clients have wrong apps on Splunk Enterprise. 03-27-2024 11:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-02-2024
05:34 PM
Thanks... but already tried that. This was an upgrade from 9.2 to 9.3 so shouldn't have been necessary, but tried it anyway. No affect. Splunk support has been working on this for 3 weeks now. Only having the problem on 1 of 4 Deployment Servers
... View more
08-13-2024
06:47 AM
We were running Splunk Enterprise v9.2 on our Deployment Server. Everything worked fine.... Upgraded to v9.3.0, now the path "https://<fqhn>/en-US/manager/system/deploymentserver" no longer renders. Tried on 3 computers using several different browsers. All return a blank white screen on this URL only. All other dashboards on this host work fine, it is only the "Forwarder Manager" link. Nothing in the logs other than INFO events, and nothing to indicate a problem. Any ideas what is going on?
... View more
Labels
- Labels:
-
troubleshooting
08-13-2024
06:26 AM
Thanks.... this was the only path we found to work as well. Appreciate the confirmation
... View more
08-01-2024
10:58 AM
Has anybody here ever cracked the nut on how to send Splunk messages triggered by an alert to a Microsoft Teams "chat" (not a Teams channel)
... View more
Labels
- Labels:
-
configuration
05-15-2024
07:05 AM
SAML authenticated users are unable to access either REPORTS or ALERTS from the search app @ ./app/search/reports or from the top level menu @ Settings/Searches, reports, alerts. When they attempt to access reports from the Search app, the page stalls at "Loading Reports". When they attempt to filter on reports or alerts from "Settings/Searches, reports, alerts" a small icon appears at the bottom stating "server error". The reports are listed, but none are accessible. If the user is provided a URL to any report, everything works fine. The ability to browse the list is what is broken. Finally, if a user goes to "Settings/Searches, reports, alerts" and DOES NOT leaves "Type:All", everything works fine. If the selection is changed to "Type:Reports" or "Type:Alerts" the error appears at the bottom Debug logs do not reveal anything obvious The permissions used for the SAML users is the default "power" role. I tried moving test users to Admin role, no change. Also, all local authenticated users in the same role work fine
... View more
Labels
- Labels:
-
other
05-07-2024
10:01 AM
I realize this, since it clearly states created by "Splunk Works". My question was not directed at Splunk, since this is a "community" board (and Splunk Works is a pseudonym for "Splunk (but we don't support it)". Finally, the "download link" is marked "Download Restricted", and when selected responds with "Request Access, Splunk Employees only"
... View more
05-07-2024
06:42 AM
How do I get access to IA4S, app #7186? Assume it is probably still in testing, but very interested
... View more
04-03-2024
08:31 AM
1 Karma
Splunk support concluded it was an "as yet discovered software bug"
... View more
03-28-2024
04:28 AM
Such a small and straightforward environment I used GUI. I get the sense there is a bug in 9.2.0.x
... View more
03-27-2024
01:04 PM
Great point, and something I did not know beforehand. In troubleshooting stumbled onto the documentation stating what you are pointing out, the new _ds* indexes. So yes, the _ds* indexes are local to the DS.
... View more
03-27-2024
12:30 PM
Everything is shiny "new". This is a satellite to our full implementation, hosted in AWS. Splunk 9.2.0.1 on both agents and the DS (which doubles as an HF) running on AWS RHEL 8.9. UF's are all running 9.2.0. Less than 40 total agents (14 Win, 26 nix). DS was acting up, so destroyed it and built new. Instantly, the same problem. Even tried adding hostnames to the filter vice using wildcard. Same. The odd thing. The DS reports that Windows hosts are running the Linux TA, but when you check the Windows hosts, they are running the Windows TA as they should be
... View more
03-27-2024
12:01 PM
Pretty simple.... serverClass:All:app:all_outputs]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:All]
whitelist.0 = *
[serverClass:Windows:app:Splunk_TA_windows]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:Linux:app:Splunk_TA_nix]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:All:app:all_deploymentclient]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:Linux]
machineTypesFilter = linux-x86_64
whitelist.0 = *
[serverClass:Windows]
machineTypesFilter = windows-x64
whitelist.0 = *
... View more
03-27-2024
11:39 AM
Yes, filtering by OS. Rebuilt the DS from scratch, set filters (using the OS filter). All Linux servers receive the Linux TA. All Windows Servers receive the Linux TA, and confirmed the OS filter, again 😕
... View more
03-26-2024
12:22 PM
2 Karma
We have a small satellite deployment of 40+ servers, that have a dedicated HF doubling as a Deployment Server running on Linux. Equal mix of Windows and Linux. 24h ago discovered that a few of the Windows servers were now reporting that they no longer had the Windows_TA installed, but instead were running the Linux_TA. Checking the UF hosts directly, they in fact were running the Windows_TA even though the DS was reporting they were running the Linux_TA?? After a day of trying to figure out how (validated filters, tested, removed and readded all Server Classes, and Apps), it continued. Noticed throughout the day a few more were now reporting this "mix-up", and again validated those reporting Linux_TA were running Windows_TA. As a final drastic measure, removed Splunk from the host (the HF/DS, not the UF's), reinstalled from scratch, and created the environment new. Made sure the UF's were not running any of the distributed apps/ta's. Built new Apps, Server Class. The UF's started phoning home, and once again, the Windows servers were reporting the Linux_TA, but running the Windows_TA
... View more
Labels
- Labels:
-
configuration
02-05-2024
08:25 AM
Splunk support responded that this was a known, as yet published, bug in the software. Was hoping 9.2 release fixed this but sadly it did not
... View more
01-08-2024
11:55 AM
Splunk says that it is an "as yet published" "known issue" since v9.1.0. They will not classify it as a "bug" until they can verify. How can it be classified as a known issue, and simultaneously not verified?
... View more
01-02-2024
09:47 AM
@gcusello , appreciate the response. Yes, this is a DMC that has been operational for ~ 3years, and suddenly started doing this. All sources are connected without error. I even removed a few and added back to see what happened. No immediate change. The interface works..... some of the time, about 20% but cannot figure out why it suddenly works, and without any change, refresh the screen and it is broken AGAIN. I did update as soon as 9.1.2 appeared hoping that would fix it (updated the entire architecture). No luck, still broken About to the point what I am simply going to delete it, and start over
... View more
01-02-2024
06:12 AM
On our Monitoring Console on the "Overview", it does not display any metrics under "Resource Usage" for each of the categories "Indexers", "Search Heads", etc. Not the browser, have tried from different computers, same problem. No WARN or ERROR messages on the host, no errors in the "Setup" page, and CPU/RAM utilization is extremely low. Anybody else experienced this?
... View more
Labels
- Labels:
-
monitoring console
07-17-2023
05:21 AM
PickleRick, seems you were right, and thanks for the response. There was a bug reported in 2019, that in my opinion is back with v9.1.0.1. Reference: https://community.splunk.com/t5/Security/Admin-can-t-see-users-with-a-certain-role-and-we-can-t-take-out/m-p/399779 Adding all roles to 'grandableRoles' solved the problem. Consider this a bug since the problem appeared immediately on several deployments, all unrelated to each other, that all worked fine immediately preceding upgrade.
... View more
07-12-2023
06:02 AM
Upgraded several independent instances of Splunk Enterprise from various starting points, all to 9.1.0.1. Some clustered, some standalone. 8.1 -> 9.1.0.1 9.0.1 -> 9.1.0.1 All had the same outcome: When browsing to: Settings > Users and Authentication > Users, most but not all users are no longer visible in the 'Users' list, but the users still have access as validate by Splunk logs. In the most severe case there were 100+ users, mostly SAML, some local. Post upgrade there are 4 showing, yet in validation all can still login
... View more
Labels
- Labels:
-
upgrade
02-15-2023
12:59 PM
Anybody here running Splunk Enterprise on an IBM E950 or similar IBM POWER8 or POWER9 CPU based servers with a Linux kernel?
... View more
Labels
- Labels:
-
Linux
07-15-2022
11:10 AM
You actually provided a solution several weeks ago that resolved the query count problem for subsearches. Sub-search#1 produces ~ 1000 events. Outcome of sub-search#2 produces ~ 4,500 events. The final search produces ~60,000 events (the same query that ends with "|collect index=summary"
... View more
07-15-2022
10:58 AM
Interesting, and thanks for the reminder (I forget about the job inspector). No smoking gun, other than the fact it says is wrote "1,000" results?? The query returns 60,000 events. Is there a limit to how much you can write to a summary?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Tuesday
|
