Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About atewari
atewari
Path Finder
Member since:
11-19-2012
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 11-19-2012 |
Activity Feed
- Karma Re: Unable to bind splunk to IP for Ayn. 06-05-2020 12:46 AM
- Posted Splunkgit for private repositories on All Apps and Add-ons. 12-18-2012 05:45 PM
- Tagged Splunkgit for private repositories on All Apps and Add-ons. 12-18-2012 05:45 PM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 12-10-2012 10:38 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 10:37 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 09:31 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 07:32 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 06:48 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 06:47 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 06:46 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 06:19 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 06:13 AM
- Posted Re: Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-30-2012 12:03 AM
- Posted Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-29-2012 06:34 PM
- Tagged Universal Forwarder not displaying data on SplunkWeb on another server on Getting Data In. 11-29-2012 06:34 PM
- Posted Re: Unable to bind splunk to IP on Splunk Search. 11-29-2012 06:20 PM
- Posted Re: Unable to bind splunk to IP on Splunk Search. 11-28-2012 05:14 PM
- Posted Re: Unable to bind splunk to IP on Splunk Search. 11-28-2012 02:23 PM
- Posted Re: Unable to bind splunk to IP on Splunk Search. 11-28-2012 08:53 AM
- Posted Unable to bind splunk to IP on Splunk Search. 11-27-2012 02:20 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-18-2012
05:45 PM
Petter,
I just downloaded the Splunkgit app and I realized the instructions are for public repositories. Does SplunkGit support configuring private repositories? I looked at splunkgit.conf and that supports using public Git repositories. We have multiple repositories that are private can can be accessed via ssh or HTTPS.
How would one configure private repositories with splunkgit.conf? Any resources or useful links would be beneficial. I was able to successfully clone the repository locally on my windows laptop using the private Git credentials after creating ssh keys on my gitHub account.
Do I also need to install git on the Linux server? I get errors in var/log/splunk/splunkd.log "git command not found"
Thanks!
... View more
- Tags:
- for
12-10-2012
10:38 AM
As it turns out, internally, 8089 and 8001 were not communicating. The log files did not indicate that. After reviewing the firewall (iptables.rules.up), again and again, I just re-wrote the firewall rules again. Carefully reviewing the syslogs indicated that there was something being rejected by 127.0.0.1:8001. Now it all works. Thanks Drainy and Dave for your responses and support.
... View more
11-30-2012
10:37 AM
Thanks Dave. At this point I am not even looking at *-nix. I am looking at Spunk's summary page. I added the index = os in the inputs.conf file and restarted both forwarder and splunkWeb. It did not do anything. Reviewing the log files, I know data is being transferred from server2 (univ. forwarder) to server1 (fullinstall).
I followed all instructions in the inputs.conf spec with no luck.
Splunk has great features, and we were hoping for an easier configuration. Any last suggestions that you think we can try?
thanks again for your help! We really appreciate it.
... View more
11-30-2012
09:31 AM
Dave,
Do you see any issues with conf file changes we made for Splunk not to display both servers on summary page? I have increased the debugging to determine what is causing the forwarder server host not showing up on summary page of the portal.
Any insight would be greatly appreciated, thanks
... View more
11-30-2012
07:32 AM
BTW, index=summary did not show any data. I also changed the tcp to splunktcp
[default]
host = fullinstall.xyz.com
disabled = 0
[splunktcp://uf.xyz.com:8001] disabled = 0
I get the following info in splunkd.log on the forwarder server
11-30-2012 09:26:16.412 -0600 INFO loader - Using cipher suite ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
11-30-2012 09:26:16.504 -0600 INFO TailingProcessor - TailWatcher initializing...
11-30-2012 09:26:16.505 -0600 INFO TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk.
11-30-2012 09:26:16.505 -0600 INFO TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk/...stash_new.
11-30-2012 09:26:16.505 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/etc/splunk.version.
11-30-2012 09:26:16.505 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk.
11-30-2012 09:26:16.505 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log.
11-30-2012 09:26:16.505 -0600 INFO BatchReader - State transitioning from 2 to 0 (initOrResume).
11-30-2012 09:26:16.525 -0600 INFO TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:8001
11-30-2012 09:26:46.050 -0600 INFO CMConfig - A splunktcp forwarder port is not configured in inputs.conf
In any case should I not see raw data if I used tcp instead of SplunkTCP? What does the splunktcp forwarder port not configured mean? Are there missing stanzas in the input.conf of forwrader server or fullinstall server?
... View more
11-30-2012
06:48 AM
BTW, index=summary did not show any data.
... View more
11-30-2012
06:47 AM
BTW, index=summary did not show any data.
... View more
11-30-2012
06:46 AM
Drainy,
Thanks for your quick response. Here is what we now have in the inputs.conf on fulliinstall.xyz.com
[default]
host = fullinstall.xyz.com
disabled = 0
[tcp://uf.xyz.com:8001]
disabled = 0
No difference. could it be that all logs are sent to the same server and therefore two hosts are not shown.
We changed the inputs.conf [default] stanza to
host = anotherserver.xyz.com
When we did this, it showed this new host. But it collects data for the fullinstall.xyz.com
Are we missing anything else?
... View more
11-30-2012
06:19 AM
Thanks! We have confirmed that the forwarder has established connection and is sending data to the fullinstall server1. As Drainy pointed out, we may have left some configuration out. But we are not sure which stanza is missing to display the the universal forwarder host on the summary page.
Any suggestions? We have posted our conf files below.
... View more
11-30-2012
06:13 AM
Thanks Drainy! Here is a complete rundown of the conf files.
Universal Forwarder on uf.xyz.com:8001
local/inputs.conf
==================
[default]
host = uf.xyz.com
local/outputs.conf
==================
[tcpout]
defaultGroup = default-autolb-group
disabled = false
[tcpout:default-autolb-group]
server = fullinstall.xyz.com:8001
[tcpout-server://fullinstall.xyz.com:8001]
Now, the files for splunk full install
Splunk full install fullinstall.xyz.com:8001
local/inputs.conf
[default]
host = fullinstall.xyz.com
disabled = 0
index = summary
[tcp://uf.xyz.com:8001]
disabled = 0
index = summary
local/outputs.conf
[tcpout]
indexAndForward = 0
Here is the splunkd.log on uf.xyz.com. It does connect to fullinstall.xyz.com and the uf.xyz.com also sends data to it
11-30-2012 02:00:49.012 -0600 INFO TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk/...stash_new.
11-30-2012 02:00:49.012 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/etc/splunk.version.
11-30-2012 02:00:49.012 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk.
11-30-2012 02:00:49.012 -0600 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log.
11-30-2012 02:00:49.012 -0600 INFO BatchReader - State transitioning from 2 to 0 (initOrResume).
11-30-2012 02:00:49.028 -0600 INFO TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:8001
Any suggestions would be much appreciated.
Thanks!
... View more
11-30-2012
12:03 AM
We cannot see the host server that runs the universal forwarder on the summary page on the right side. On server1 (SplunkWeb full install), we changed the local/inputs.conf under [default] stanza and changed the host = it then showed two servers. But it still collects the main server1 data only.
Is there anything else we need to do? We basically changed the outputs.conf on server2 (with universal forwarder) and the inputs.conf (full install). We know that connection is established because the metrics.log shows receiving data,
... View more
11-29-2012
06:34 PM
We have two Linux servers using Splunk 5.0.1 on 64-bit.
A full Splunk install (SplunkD and SplunkWeb). We created a Receive data port 8001 on this.
Universal Forwarder on second Linus server. We added a forwarder using command
splunk add forward-server server1:8001 -auth admin:somepassword
It was successfully added. We restarted the forwarder on server2. So we ran the command
splunk list forward-server
This command showed that server1:8001 was added but was not active. When we ran the list command again it said the file was locked. The metrics.log file says it is connected successfully.
But how do we view server2 data on SplunkWeb running on server1? We added the *nix App, but it cannot see server2 selection anywhere. We only see server1 info. Is there another step to activate the forwarder on server2 and enable something on server1 to view server2 logs?
The "deploy" forwarder documentation is confusing. It gives a few commands and then asks to test the deployment of the forwarder without instructions on what to test.
Can anyone point us to the next steps - links, answers, anything?
Thanks
... View more
- Tags:
- forwarder
11-29-2012
06:20 PM
It appears the IPsec on Windows Server 2008 was disallowing. Once that was enabled, it worked beautifully. Thanks Ayn for your quick responses. Awarding point shortly.
... View more
11-28-2012
05:14 PM
Thanks Ayn. I ran the netstat -nao command and noticed that there were entries. We added the forwarding port 8001.
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:8000 0.0.0.0:0 LISTENING 1856
TCP 0.0.0.0:8001 0.0.0.0:0 LISTENING 3920
TCP 0.0.0.0:8089 0.0.0.0:0 LISTENING 3920
But there are no entries for these ports like port 80, which has [::]
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
TCP [::]:80 [::]:0 LISTENING 4
Why is that? Could this be the cause of unable to bind IP on port 8000?
... View more
11-28-2012
02:23 PM
Ayn,
It appears that Splunk, by default, does not listen on all interfaces. I ran a simple test with IIS. I started IIS and then did telnet localhost 80 and then telnet 10.10.10.10 80. In both cases, it connected.
But when I did this for Splunk:
telnet localhost 8000 - this worked
telnet 10.10.10.10 8000 - this did not connect.
Clearly, on windows 64-bit, Splunk 5.0.1 some configuration is different. Any ideas are much appreciated.
Thanks!
... View more
11-28-2012
08:53 AM
Thanks Ayn and Drainy.
We thought it was a firewall issue too, so we disabled it all together. We reverted to default changes, disabled the firewall, and then restarted SplunkD and SplunkWeb. We can connect from the local box using http://localhost:8000, but cannot connect using the IP on the local box http://10.10.10.10:8000.
So we did a simple test - we enabled IIS 7.0 to ensure we can reach IIS on port 80 from other servers. It worked fine - http://10.10.10.10.
Any ideas why SplunkWeb won't respond locally with an IP (http://10.10.10.10:8000). I'm assuming, if the local server works, we should be able to connect remotely with the firewall disabled.
... View more
11-27-2012
02:20 PM
We would like to access Splunk Web from other hosts. We did a full splunk 5.0.1 (build: 143156) install on a Windows Server 2008 64-bit. Everything worked fine with default. We could access the Splunk portal locally from the Windows box ONLY using http://localhost:8000. However, we could not use the machine's IP (10.10.10.10) as http://10.10.10.10:8000. As per Splunk's documentation on http://docs.splunk.com/Documentation/Splunk/latest/Admin/BindSplunktoanIP, we made the following changes and restarted SplunnkD and SplunkWeb with no luck. We primarily want to access Splunk Web from other servers. We are successfully able to ping the Splunk server from these other servers.
web.conf
# location of splunkd; don't include http[s]:// in this anymore.
# mgmtHostPort = 127.0.0.1:8089
# commented the above line to enforce IP
mgmtHostPort = 10.10.10.10:8089
# enforce the IP
server.socket_host = 10.10.10.10
splunk-launch.conf
# If unset, Splunk will use the parent of the directory this configuration
# file was found in
#
# SPLUNK_HOME=c:\build-amd64-5.0.1-20121112-1621\splunk
# Enforcing IP
SPLUNK_BINDIP=10.10.10.10
The SplunkWeb server goes down after attempting to run, when we restart with web_service.log
2012-11-27 15:51:00,614 INFO [50b535aea622cf390] root:535 - CONFIG: ui_inactivity_timeout (int): 60
2012-11-27 15:51:00,614 INFO [50b535aea622cf390] root:535 - CONFIG: updateCheckerBaseURL (str): https://quickdraw.splunk.com/js/
2012-11-27 15:51:00,614 INFO [50b535aea622cf390] root:535 - CONFIG: use_future_expires (bool): True
2012-11-27 15:51:00,614 INFO [50b535aea622cf390] root:535 - CONFIG: userRegistrationURL (str): https://www.splunk.com/index.php/pre_reg?destination=prod_reg
2012-11-27 15:51:00,614 INFO [50b535aea622cf390] root:535 - CONFIG: version_label (str): UNKNOWN_VERSION
2012-11-27 15:51:00,614 INFO [50b535aea622cf390] root:535 - CONFIG: version_number (str): 4.0
2012-11-27 15:51:00,614 INFO [50b535aea622cf390] root:134 - ENGINE: Bus STARTING
2012-11-27 15:51:00,630 INFO [50b535aea622cf390] root:134 - ENGINE: Set handler for console events.
2012-11-27 15:51:00,630 INFO [50b535aea622cf390] root:134 - ENGINE: Started monitor thread '_TimeoutMonitor'.
2012-11-27 15:51:57,023 ERROR [50b535aea622cf390] root:134 - ENGINE: Error in 'start' listener <bound method Server.start of <cherrypy._cpserver.Server object at 0x00000000022A5940>>
Traceback (most recent call last):
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\wspbus.py", line 147, in publish
output.append(listener(*args, **kwargs))
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\_cpserver.py", line 94, in start
ServerAdapter.start(self)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\servers.py", line 60, in start
self.wait()
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\servers.py", line 101, in wait
wait_for_occupied_port(host, port)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\servers.py", line 266, in wait_for_occupied_port
raise IOError("Port %r not bound on %r" % (port, host))
IOError: Port 8000 not bound on '10.10.10.10'
2012-11-27 15:51:57,023 ERROR [50b535aea622cf390] root:134 - ENGINE: Shutting down due to error in start listener:
Traceback (most recent call last):
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\wspbus.py", line 184, in start
self.publish('start')
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\wspbus.py", line 147, in publish
output.append(listener(*args, **kwargs))
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\_cpserver.py", line 94, in start
ServerAdapter.start(self)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\servers.py", line 60, in start
self.wait()
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\servers.py", line 101, in wait
wait_for_occupied_port(host, port)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\process\servers.py", line 266, in wait_for_occupied_port
raise IOError("Port %r not bound on %r" % (port, host))
IOError: Port 8000 not bound on '10.10.10.10'
2012-11-27 15:51:57,023 INFO [50b535aea622cf390] root:134 - ENGINE: Bus STOPPING
2012-11-27 15:51:57,023 INFO [50b535aea622cf390] root:134 - ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('10.10.10.10', 8000)) already shut down
2012-11-27 15:51:57,023 INFO [50b535aea622cf390] root:134 - ENGINE: Stopped thread '_TimeoutMonitor'.
2012-11-27 15:51:57,023 INFO [50b535aea622cf390] root:134 - ENGINE: Removed handler for console events.
2012-11-27 15:51:57,023 INFO [50b535aea622cf390] root:134 - ENGINE: Bus STOPPED
2012-11-27 15:51:57,023 INFO [50b535aea622cf390] root:134 - ENGINE: Bus EXITING
2012-11-27 15:51:57,023 INFO [50b535aea622cf390] root:134 - ENGINE: Bus EXITED
... View more
11-20-2012
07:58 AM
Thanks Damien! I am creating a local environment to test this. I really appreciate it. I will award points as soon as I have implemented this.
Thanks again!
... View more
11-19-2012
01:20 PM
Splunk Experts,
Has anyone integrated JMeter JMX file that contains test cases and run them automatically and presented test results through Spunk. We'd like to automate this process where we can initiate running test cases included in JMeter's JMX file (XML based) and display test results with Splunk Portal.
Is this possible?
Thanks!
... View more
- Tags:
- jmeter
