Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About keerthana_k
keerthana_k
Communicator
Member since:
11-02-2012
06-05-2020
Community Statistics
| Posts | 89 |
| Solutions | 5 |
| Karma Given | 38 |
| Karma Received | 20 |
| Member Since | 11-02-2012 |
Activity Feed
- Karma Re: systemd start restart for splunk not working as expected for neilsquires. 06-05-2020 12:49 AM
- Karma Re: systemd start restart for splunk not working as expected for groland. 06-05-2020 12:49 AM
- Got Karma for Systemd start restart for splunk not working as expected (CentOS 7.3).. 06-05-2020 12:49 AM
- Karma Re: Using Deployment Server as Search Head Deployer for strive. 06-05-2020 12:48 AM
- Karma Re: How to resolve lots of Splunk internal connections in a CLOSE_WAIT status? for strive. 06-05-2020 12:48 AM
- Karma Re: How to force local indexing in each site of a multisite indexer cluster? for jkat54. 06-05-2020 12:48 AM
- Got Karma for Splunk upgrade causes error in Zoom out option in sideview utils based chart. 06-05-2020 12:48 AM
- Karma Re: Restricting index access from apps for gfuente. 06-05-2020 12:47 AM
- Karma Re: How do I change the owner of a saved search or view in a search head cluster environment? for rphillips_splk. 06-05-2020 12:47 AM
- Got Karma for Re: timestamp format of the input files. 06-05-2020 12:47 AM
- Got Karma for Re: timestamp format of the input files. 06-05-2020 12:47 AM
- Got Karma for Re: timestamp format of the input files. 06-05-2020 12:47 AM
- Karma PARSER: Applying intentions failed This search cannot be parsed when parse_only is set to true for Moogz. 06-05-2020 12:46 AM
- Karma Re: Splunk clean eventdata using duration for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: What happens to a summary index search during a server restart? for gfuente. 06-05-2020 12:46 AM
- Karma Re: How to display the timerange of cron schedule in dashboard for jonuwz. 06-05-2020 12:46 AM
- Karma Search Head severe performance issue for flle. 06-05-2020 12:46 AM
- Karma Re: Plotting a trapezoid on a chart and calculating its area for jtrucks. 06-05-2020 12:46 AM
- Karma Re: case: defaulting to "value" rather than NULL for sowings. 06-05-2020 12:46 AM
- Karma Re: Running outputcsv without append option for sideview. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
09-17-2019
11:12 AM
Hi,
We have distributed Splunk deployment running version 7.3.0. We have a custom REST endpoint which runs some searches and returns the search results in JSON format. When we run searches for long time ranges, the request times out after 500 seconds with 502 error code even when we see the search running in the Job Manager page. We found this error in the splunkd.log:
ERROR HttpClientRequest - HTTP client error=Read Timeout while accessing server=http://127.0.0.1:8065 for request=http://127.0.0.1:8065
We tried adjusting various timeout values like tools.session.timeout , ui_inactivity_timeout etc. but none of them seemed to help.
Has anyone faced similar issues. How do we fix this to make the request wait till the search completes.
Thanks in advance,
Keerthana
... View more
09-16-2019
02:57 AM
We are upgrading our Splunk distributed deployment to 7.3.0. After upgrade we noticed that the time range picker module inside our app shows the value "default times.conf label" as one of the options. Did anyone face any such issues?
Thanks in advance,
Keerthana
... View more
05-04-2018
05:00 AM
Is this scenario changed with newer versions of Splunk? I couldn't find any documentation related to it but would like to know if it is possible.
... View more
02-26-2018
08:26 AM
That didn't quite work so we are using systemctl enable splunk instead.
... View more
02-26-2018
08:25 AM
The log shows a normal Splunk shut down
... View more
02-26-2018
03:30 AM
1 Karma
We are running a distributed Splunk appication on CentOS 7.3. Please find below our unit file:
[Unit]
Description=Splunk Enterprise 6.5.2
After=network.target
Wants=network.target
[Service]
Type=forking
RemainAfterExit=False
User=root
Group=root
LimitNOFILE=65536
ExecStart=/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
ExecStop=/opt/splunk/bin/splunk stop
ExecReload=/opt/splunk/bin/splunk restart
PIDFile=/opt/splunk/var/run/splunk/splunkd.pid
[Install]
WantedBy=multi-user.target
When we start/restart Splunk in our nodes through systemctl for the first time, the service starts and then stops in a short while. Starting splunk after that works correctly. What are we missing here? Should we be making additional changes to the unit file?
Thanks in advance, Keerthana
... View more
Labels
- Labels:
-
distributed search
10-27-2017
10:47 AM
Hi,
We have a distributed Splunk deployment where we have deployed an indexer cluster consisting of a cluster master and 5 indexers. We recently exceeded our license quota four times. We got in touch with splunk and got license for a higher limit and have deployed the new licenses also. Even after this, one indexer out of the five is still showing license warning. When we try to run a search, we are constantly receiving errors from one indexer saying that it is has exceeded the splunk license limit.
We checked the Licensing page in the license master and it lists all the indexers in the license pool. When we checked the debug details, it was showing that 4 out of 5 indexers had 4 violations and one of them had five violations. All the other indexers are fine and we are able to search data from them.
Is this a valid scenario in case of clustered indexers? Is a reset license required to fix this issue? Please help out.
Thanks, Keerthana
... View more
10-26-2017
04:54 AM
I am not using a search head cluster. I just have two search heads which serve two different purposes. If I set restartSplunkd to false, then what will happen if I make any configuration change which might require splunk restart?
... View more
10-26-2017
04:53 AM
We are setting restartSplunkd to true. So if I remove the configuration, then what will happen when I make other configuration changes that may require splunk restart?
... View more
10-26-2017
04:33 AM
We finally ended up installing a HAProxy load balancer on each of the indexer and search head nodes. All requests to the cluster master was configured to go through the load balancer. We used keepalived libraries in the cluster masters to determine which is the primary and which is standby. Based on this, splunk service will be automatically started or stopped in the cluster masters.
... View more
10-26-2017
04:25 AM
We finally fixed the issue by moving the app configurations to the default directory and letting customers use local directory for creating dashboards. Additionally, we have added excludeFromUpdate option for the local directory.
... View more
10-26-2017
04:20 AM
Hi,
We have a distributed Splunk system installed and use deployment server to manage configurations. We have a python script which updates a few lookup CSV files and binary database files periodically. In the script, we run the reload deploy-server command to distribute the changed files across all the systems. Though the change is only lookup files, it is causing restart of splunk service at all the nodes. Is there anyway we can prevent the this restart? We have saved summary searches running and it is causing missing buckets of data.
Thanks in advance,
Keerthana
... View more
09-08-2017
12:08 AM
We did that and it didn't work. Hence this approach.
... View more
09-07-2017
03:40 AM
just moving things to default directory might work in case of new installations and not on existing upgrade ones. So we need to use a combination of both putting configurations in default directory and adding excludeFromUpdate for the local directory.
... View more
09-06-2017
11:51 PM
Hi Strive,
We have already separated the default configurations into the default directory. We want to add excludeFromUpdate on top of that.
... View more
06-29-2017
05:42 AM
Hi,
We have a distributed Splunk deployment with a license master and 5 indexers connecting to it. We have recently added a fixed sourcetype enterprise license. After that we found that indexers were not added to the pool automatically. Due to this, we faced 5 license violations. We obtained the Splunk reset license and applied it on the system. Now the search functionality has been restored. However, we found that data got ingested into the reset license which does not have any volume and hence once more license warnings have started appearing. We deleted the reset license and manually added the indexers to the pool under the fixed sourcetype enterprise license but we find that the indexing volume is not updated in the pool.
Can anybody help me with this issue.
Thanks in advance,
Keerthana
... View more
06-25-2017
12:18 PM
Hi Adonio,
We have set up a stand-by master and we are bringing it up manually now. But in the docs, it is also mentioned that we can do a DNS based or load balancer based failover, so I wanted to know if anyone has actually implemented it.
... View more
06-19-2017
04:19 AM
Hi,
We are currently running our splunk deployment with a multi-site indexer cluster with search head clustering . The cluster master is present in one site and we would like to configure a stand-by cluster master on the other site for fail-over. We want to implement automated fail-over using a load balancer like HAProxy. Has anyone implemented this? How would you configure your peer indexers and search heads in this case?
Thanks in advance,
Keerthana
... View more
04-25-2017
05:32 AM
We tested the apps distribution through the deployment server and it did work.
... View more
04-25-2017
05:27 AM
I think you misunderstood my question. We are going to have 3 search head instances as cluster. My question is whether Deployer is really required or whether we can continue to use the Deployment Server to distribute apps across the cluster. Is there any drawback of using deployment server or any added benefits in using a Deployer?
... View more
04-25-2017
05:09 AM
Hi,
We currently have a distributed setup with a Deployment Server, Indexer Cluster Master, Peer Indexers and a single Search Head. We are trying to migrate to Search head clustering.
Currently, we are distributing apps using Deployment Server to the Search Head as well. However, in the SH clustering documentation, it has been mentioned that the Deployer should be used for distributing apps to the SH cluster. But this would involve moving the Search head related apps to a new location /etc/shcluster/apps/ which would complicate things for distributed deployment. We tested app distribution using the Deployment Server configuration to the new SH cluster and it is working fine.
I would like to know the reason why the use of Deployment Server is discouraged in SH clustering.
Thanks in advance,
Keerthana
... View more
04-17-2017
04:53 AM
Hi All,
Our distributed splunk setup contains a deployment server, an indexer cluster master, 3 peer indexers and 2 search heads. We use CentOS 7.2 for all our splunk instances and use salt stack to manage the nodes from a single point.
In our salt script, we use the command: service splunk stop/restart while installing or upgrading our apps. However, we find that this command works inconsistently. The command /opt/splunk/bin/splunk stop/restart works correctly.
Has anybody else faced this issue? Is this an issue specific to CentOS? Any pointers to this will be really helpful.
Thanks,
Keerthana
... View more
03-28-2017
05:19 AM
1 Karma
Hi,
We use sideview utils in our application for visualization. We have customized an inbuilt visualization of sideview utils to use in our application. Recently, we upgraded our Splunk to 6.5.2. After that we observe that the Zoom out option in the chart is not functioning as expected. Upon debugging, we find the following error in the browser console.
Uncaught TypeError: Cannot read property 'DateTime' of undefined
at klass.zoomOut (common.min.js:26987)
at klass.zoomOut (modules-49ee4f4….min.js:3419)
at HTMLAnchorElement.dispatch (common.min.js:1468)
at HTMLAnchorElement.eventHandle (common.min.js:1280)
Has anyone faced this issue? Any inputs to fix this is highly appreciated.
Thanks,
Keerthana
... View more
03-15-2017
02:08 AM
This works for dashboards inside an app. We want to customize the login page using CSS. I don't think your answer caters to our requirement.
... View more
03-15-2017
12:48 AM
Hi,
We are currently upgrading our Splunk to 6.5.2 version. We had some customizations in the login page previously and we would like to bring them back. Using the docs, we were able to bring back the custom background and logo. We need further customizations on the appearance of the text boxes, button, etc. We want to add our custom CSS for doing the same but we are unable to figure out where to place the CSS so that it gets applied to the login page. Any pointers to this will really help.
Thanks,
Keerthana
... View more
