Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About avalle
avalle
Path Finder
Member since:
12-15-2014
06-05-2020
Community Statistics
| Posts | 26 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-15-2014 |
Activity Feed
- Posted Re: How to properly document (diagram) a splunk enviroment on Dashboards & Visualizations. 03-26-2018 12:15 PM
- Posted Re: How to properly document (diagram) a splunk enviroment on Dashboards & Visualizations. 03-19-2018 11:42 AM
- Posted How to properly document (diagram) a splunk enviroment on Dashboards & Visualizations. 03-19-2018 11:20 AM
- Tagged How to properly document (diagram) a splunk enviroment on Dashboards & Visualizations. 03-19-2018 11:20 AM
- Posted Re: Best way to deal with the \local configuration files after deploying new configuration files under \apps? on Getting Data In. 10-24-2017 06:14 AM
- Posted Best way to deal with the \local configuration files after deploying new configuration files under \apps? on Getting Data In. 10-23-2017 01:37 PM
- Tagged Best way to deal with the \local configuration files after deploying new configuration files under \apps? on Getting Data In. 10-23-2017 01:37 PM
- Tagged Best way to deal with the \local configuration files after deploying new configuration files under \apps? on Getting Data In. 10-23-2017 01:37 PM
- Posted Re: How to generate a search to determine why our license usage doubled? on All Apps and Add-ons. 05-30-2017 10:51 AM
- Posted Re: How to generate a search to determine why our license usage doubled? on All Apps and Add-ons. 05-30-2017 10:51 AM
- Posted Re: How to generate a search to determine why our license usage doubled? on All Apps and Add-ons. 05-30-2017 10:14 AM
- Posted How to generate a search to determine why our license usage doubled? on All Apps and Add-ons. 05-30-2017 09:06 AM
- Tagged How to generate a search to determine why our license usage doubled? on All Apps and Add-ons. 05-30-2017 09:06 AM
- Tagged How to generate a search to determine why our license usage doubled? on All Apps and Add-ons. 05-30-2017 09:06 AM
- Posted Re: Extracting fields from Syslog event on Splunk Search. 04-07-2017 01:06 PM
- Posted Extracting fields from Syslog event on Splunk Search. 04-04-2017 09:30 AM
- Tagged Extracting fields from Syslog event on Splunk Search. 04-04-2017 09:30 AM
- Tagged Extracting fields from Syslog event on Splunk Search. 04-04-2017 09:30 AM
- Posted Re: How to properly configure a deployment app to deploy configuration files on Deployment Architecture. 12-27-2016 02:11 PM
- Posted Re: How to properly configure a deployment app to deploy configuration files on Deployment Architecture. 12-27-2016 01:32 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-26-2018
12:15 PM
Yes thank you! I have accepted! I am still waiting to get access to the environment to confirm the set up.
... View more
03-19-2018
11:42 AM
Thank you! Right now I can't change the way the environment is set up I need to document the current set up in order to move forward with changing the environment. You may be right the server may not be a master node. I know it is not clustered and I am used to a clustered environment which mine has been for years. I guess I am having a problem understanding how the logs move through one environment. The UF send to the Indexers and they send it to the SH in the same IP? I guess different ports?
... View more
03-19-2018
11:20 AM
I have an all in one Splunk environment (indexers, master, deployment all run on the same server) how do i document the set up in a diagram. What is the best way and what configuration files have the information. My current Splunk environment has all independent servers therefore I am not sure how an all in one works.
... View more
10-24-2017
06:14 AM
I have splunk 6.4.0 on the deployment and it did not wipe /local
... View more
10-23-2017
01:37 PM
I have integrated a deployment client into my environment to manager the configuration files but now I am having multiple issues with configuration files precedence. I am able to deploy new configuration files to the forwarders but they are not taking effect because the \local configuration files are taking precedence.
Question:
1. what is the best way to deal with the \local configuration files after I deploy the new configuration files under \apps? should I delete or rename the files under the local directory?
This leads me to my second question....
Now that the \local directory configuration files will be gone how do I make sure that the forwarders are getting their correct host name? reinstalling Splunk is not an option and currently they are getting their host name from the configuration files in the local directory. How can i use a configuration file under the newly deployed app to display the correct host name.
... View more
05-30-2017
10:51 AM
NICE! that worked!!
... View more
05-30-2017
10:51 AM
Oh this looks like a great app!!! do i have to install it in all HF and indexers? I installed in the search head and no data came up.
... View more
05-30-2017
10:14 AM
Thank you! this helped determine what index doubled in size. How do i run these searches for that particular index? I tried adding index=XXX but the search did not like it at all
... View more
05-30-2017
09:06 AM
Over the holiday weekend our license usage doubled and I need to figure out what is causing this. I have S.o.S - Splunk on Splunk installed but I am not sure if this is where I find this information. anyone have any searches to determine what devices started sending data or volume change?
... View more
04-07-2017
01:06 PM
That kind of worked you can say. I can extract the port but for some reason none of my logs are on port 22 therefore I need to dig deeper
... View more
04-04-2017
09:30 AM
I have an alert set up to email me if I see failed log on to a list of servers. I would like to alter this alert to only email me if we see failed log on on port 22. The event has a port fiend that is not extracted but I have never extracted a field and I tried to extract it but I am not sure I am doing it right. I have also tried to add "AND "port 22"" to the alert and that did not work
This is the event:
Jan 4 00:03:45 xxxxxxxxx.com sshd[26448]: [ID 800047 auth.notice] Failed keyboard-interactive for wcsuser from xxx.xxx.xxx.xxx port 56395 ssh2
This is the alert I want to filter port 22:
host=xxxdb* OR host=xxxod-* AND "ID 800047 auth.notice" | fields - index - linecount - source - sourcetype - splunk_server
... View more
12-27-2016
02:11 PM
Apparently I was looking in the wrong UF directory.
The configuration files in the UF have been updated on $SPLUNK_HOME\etc\apps\security\local but for some reason the new entries are all in one line. Do I have to remove the conf files in the etc\system\local directory to test if these new files work?
... View more
12-27-2016
01:32 PM
I reloaded the deployment server and the configuration files under the $SPLUNK_HOME/etc/deployment-apps/App1/local directory disappeared and the UF did not get the updated configuration files.
... View more
12-27-2016
01:31 PM
Thank you so much for your answer! I did reload the deployment server and the configuration file I had in $SPLUNK_HOME/etc/deployment-apps/App1/local disappeared and the Forwarders did not get the updated configuration files therefore I am not ready to delete the conf files in the local directory until I get thus update to happen in the UF.
... View more
12-27-2016
01:27 PM
Right now I am working on updating one conf file at a time it does not matter which one as long as i get one working.
... View more
12-23-2016
09:40 AM
Hello,
I have searched the answer but can't seem to find out how to properly set up my apps in the deployment server.
I already have over 4k devices communicating to the deployment server, they are all in their correct server class and I have a directory for each app in the $SPLUNK_HOME/etc/deployment-apps. Let's say I have App1 and i want to use App1 to send my configuration files to a server class. I create $SPLUNK_HOME/etc/deployment-apps/App1/local/outputs.conf with the correct settings and I deploy the app but for some reason it does not update the outpts.conf on the clients. What am I doing wrong?
... View more
09-19-2016
08:00 AM
@frmaasdam may have a better answer than me or @triest since they both answered my question
... View more
02-02-2016
09:00 AM
Yes I am sure! we had an LDAP delay.
... View more
02-01-2016
11:36 AM
I think I found the answer...........there is a delay in LDAP synch. I just had to wait it out and it worked.
... View more
02-01-2016
08:31 AM
Hello all,
I have looked at documentation and a few of the questions on here and have tried it all.
I have created an app (let's call it ppl app), assigned a role (let's call it ppl role) to it, and that role is locked down to one index (lets call it the ppl index).
I have given the app access to the ppl role.
I have restricted that role to search index=ppl only.
Gave it the following capabilities:
accelerate_search
change_own_password
get_typeahead
pattern_detect
search
Why are the users assigned to this role able to search the main index?
Am I missing a step somewhere?
... View more
12-15-2015
08:36 AM
Thank you! I started working on this but now I have an error on my app
In handler 'applications': File='/opt/splunk/etc/deployment-apps/security/local/app.conf', needed for application=security, not found
Any ideas?
... View more
12-03-2015
07:35 AM
Thank you! I just needed some clarification. I am new to splunk and this is the first time I am building a deployment server. Any pointers? the documentation is lengthy!
... View more
11-25-2015
10:47 AM
Hello,
I have an indexer clustering environment with 1 Search head, 1 Manager and 2 indexers. I am looking to add a deployment server to manage the configuration files on the universal forwarders that send data to the Indexers. I am reading up on how to do this, but I am confused if this can be done. Does the deployment server need to be part of the cluster even though I am not managing anything in the cluster, or can it just be a regular stand alone Splunk instance that i can just use as a deployment server?
... View more
08-10-2015
06:41 AM
Hi there!
So I am trying to figure out a way to see the my license usage for longer than thirty days . I opened the report in search and changed earliest=-30d@d in both places, but still does not work...... can anyone help me figure out what I am missing?
index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS "volume" fixedrange=false
| join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(stacksz) AS "stack size" by _time]
| fields - _timediff
| foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
... View more
Labels
- Labels:
-
license
07-01-2015
03:51 PM
Thank you! Splunk was already deployed before I took the position and they used another app to send the conf files toall of the devices and now it is my job to manage them.
I've never created an app before, is there a default app that I can use to put the conf files in?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
