Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rcreddy06
rcreddy06
Path Finder
Member since:
08-08-2015
06-05-2020
Community Statistics
| Posts | 23 |
| Solutions | 1 |
| Karma Given | 21 |
| Karma Received | 33 |
| Member Since | 08-08-2015 |
Activity Feed
- Karma Re: Splunk Universal Forwarder On AIX Fails To Start After Upgrade To Spunk 6.4.x for dshakespeare_sp. 06-05-2020 12:48 AM
- Karma Re: Difference between splunkd -p 8089 restart or splunkd -p 8089 start for woodcock. 06-05-2020 12:48 AM
- Karma Is it possible to disable replication to specific peers in the cluster? for athoma31. 06-05-2020 12:48 AM
- Got Karma for Re: Why are admin settings not accessible after upgrading the search head cluster environment to 6.4.1?. 06-05-2020 12:48 AM
- Got Karma for Difference between splunkd -p 8089 restart or splunkd -p 8089 start. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a REST API call to automate having the Distributed Management Console display any new indexers I have added to an indexer cluster?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a REST API call to automate having the Distributed Management Console display any new indexers I have added to an indexer cluster?. 06-05-2020 12:48 AM
- Got Karma for Re: Distributed Management Console Setup: Do I still need to forward _internal data to search peers, or do I just add each instance as a search peer to the DMC?. 06-05-2020 12:48 AM
- Got Karma for Re: Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?. 06-05-2020 12:48 AM
- Got Karma for Re: Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?. 06-05-2020 12:48 AM
- Got Karma for Re: Default root certificates for release pre 6.2 version for Splunk enterprise expire on July 21 2016. 06-05-2020 12:48 AM
- Karma Re: If I have an existing search head cluster with a replication factor of 3, should I increase this number when adding new search heads? for Richfez. 06-05-2020 12:47 AM
- Karma Re: Adding a new search head to an existing Search Head Cluster, if I want to add the same users from LDAP, can I just copy authorize.conf & authorization.conf? for msudhindra. 06-05-2020 12:47 AM
- Karma Re: How to create alerts for changes made on config files. for rroberts. 06-05-2020 12:47 AM
- Karma Is there an option to auto refresh the incident review in Splunk Enterprise Security app? for ksncksnc. 06-05-2020 12:47 AM
- Karma [SHC] Troubleshooting Configurations under Search Head Clustering for rbal_splunk. 06-05-2020 12:47 AM
- Karma Re: [SHC] Troubleshooting Configurations under Search Head Clustering for rbal_splunk. 06-05-2020 12:47 AM
- Karma Re: Why is cluster master reporting "Cannot fix search count as the bucket hasn't rolled yet.", preventing me from meeting my Search Factor? for LiquidTension. 06-05-2020 12:47 AM
- Karma Re: Why is cluster master reporting "Cannot fix search count as the bucket hasn't rolled yet.", preventing me from meeting my Search Factor? for rbal_splunk. 06-05-2020 12:47 AM
- Karma Whats the best way to learn Regex commands? for anushareddy6767. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 2 | |||
| 2 | |||
| 2 |
06-27-2016
10:59 AM
1 Karma
1) renewcert.zip scripts provided by splunk renews the certificates, so the order doesn't matter as long as they don't expire.
Please follow these two questions posted by Splunk team.
https://answers.splunk.com/answers/395886/for-splunk-enterprise-splunk-light-and-hunk-pre-63.html
https://answers.splunk.com/answers/7164/how-do-i-set-up-ssl-forwarding-with-new-self-signed-certificates-and-authentication.html
... View more
06-10-2016
10:32 PM
1 Karma
You should be forwarding internal logs to indexers and add all indexers/search heads as search peers in DMC.
... View more
06-10-2016
10:22 PM
1 Karma
What OS are you using and which version of splunk were you running before upgrading??
Did you try rolling-restart of the cluster??
its working fine for me, I'm using RHEL 6.7 and splunk 6.4.1 search head clustering, upgraded from splunk 6.3.4.
... View more
06-10-2016
10:09 PM
2 Karma
By default the indexers should be added to the DMC console as the DMC server is a search head to indexer cluster.
you can try https://localhost:8000/debug/refresh/ on the DMC server or restarting splunk on DMC.
... View more
05-02-2016
10:07 AM
2 Karma
Yes, you can work with a 6.4 SH cluster and 6.3.x indexer cluster by upgrading the cluster master to 6.4.
Cluster Master should be on the latest or same version as your search heads.
*Splunk Version Compatibility sequence:*
Cluster Master >=Searchheads >=Indexers >=Heavy Forwarders>=Universal Forwarders
... View more
03-21-2016
07:20 AM
1 Karma
When I do top -c1 on the indexers/Heavy Forwarders, splunkd process is running as follows
splunkd -p 8089 restart or splunkd -p 8089 start.
What is the difference between these two processes? & why is it different for same type of hosts (indexers)?
... View more
01-12-2016
07:51 AM
1 Karma
From: http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_version_compatibility
Cluster master should be upgraded before search heads, then indexers.
... View more
01-12-2016
07:00 AM
1 Karma
I have a deployment server, clustered Indexers, clustered search heads, heavy forwarders, & universal forwarders. All are running Splunk 6.2.7 and would like to upgrade to Splunk 6.3.2
I believe the compatibility sequence should be:
Cluster Master > Search Heads > Indexers > Heavy forwarders > Universal Forwarders and deployment server should be upgraded along with search heads or before cluster master.
I can't upgrade all servers on the same day. Please suggest compatibility of Splunk instances.
... View more
01-01-2016
04:06 PM
I was able to get the search results, but I need exact view in SOS app.
... View more
12-31-2015
10:03 AM
1 Karma
When I run the SOS dashboard Disk Usage from <URI:8000>/app/sos/index_disk_usage as a search, I get all the data and unable to get the dashboard view as seen in SOS. Is there any way to schedule the dashboard view of SOS directly?
... View more
We have an employee replacement and the saved searches & objects ownership was changed from $SPLUNK_HOME/etc/<app>/metadata/local.meta file and restarted splunkd. All the objects were accessible & reports are running fine under new employee's ID. But I still see LDAP error logs "User not found". He's still in the LDAP. I believe the errors in splunkd is caused by $SPLUNK_HOME/etc/users/<Employee-ID>. If I delete the folder , What is its impact?
... View more
12-01-2015
07:38 AM
1 Karma
Its a server error. Check directory permissions, make sure splunk user has permissions to access both locations.
... View more
11-26-2015
11:55 AM
3 Karma
Refer this link.
https://answers.splunk.com/answers/323356/kvstore-errors-does-not-start.html
... View more
11-26-2015
11:29 AM
4 Karma
use the following command on nix systems, which should return **ready/starting/failed/disabled*
curl -k -s https://localhost:8089/services/server/info | grep kvstore
... View more
The status of the replication factor and search factor on indexer cluster are fluctuating and would like to set up an alert. This happens due to bucket fixups pending. Can some one help me creating an alert when the master is fixing buckets and one of the search/replication factor is not met or when the master is trying to fix the buckets.
... View more
11-05-2015
04:21 AM
I was referring to search query to get results and create dashboards.
... View more
11-05-2015
04:18 AM
Version 6.3. The universal forwarders sends the syslog data and other oracledb data.
... View more
11-04-2015
06:04 PM
3 Karma
I've 5000 linux servers and I would like to do a splunk search to get their disk utilization. Its not possible to do a df on 5000 servers, I'm doing a dashboard for servers that crosses 85% utilization and schedule a PDF delivery to my email. What would be the best splunk search command to find the disk utilization %'s for splunk on all the servers and filter to servers greater than 85%.
... View more
10-19-2015
03:28 PM
2 Karma
I need to configure new search heads to an existing search head cluster, currently with a replication factor of 3. When I add the new search heads, should I increase the replication factor?
Please suggest me of any possible issues. Should I keep the replication factor as 3?
Command to configure the new search head:
./splunk init shcluster-config -auth admin:pw -mgmt_uri:mgmt_port <>:8089 -replication_port 8087 -replication_factor 3 -conf_deploy_url (ip of dep_server)-secret (pw)
Command to add to the cluster:
./splunk add shcluster-member -current_member_uri:mgmt_port (fqdn of any current member uri):8089
... View more
10-19-2015
03:05 PM
2 Karma
I am adding a new search head to the existing search head cluster. I want to add the same users to the new search head, from my LDAP. If I copy the authorize.conf & authorization.conf, will it allow the users to log in? Or should I go through the whole process from scratch?
Is it a good practice to keep these files on the Deployment server, so whenever a new server is added to the cluster, it automatically sends the config files?
... View more
In a corporate environment with multiple users, If someone changes a config file (lets say inputs.conf/server.conf). How to setup an alert for this scenario. How to find the user who did this?
Or
How to audit user activity and generate alerts when a critical file is modified?
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
Karma given to
