About phadnett_splunk

phadnett_splunk · ‎03-01-2019

Hey all, this will be fixed in Splunk 7.2.5

phadnett_splunk · ‎03-01-2019

Hey all, just wanted to give you an update that this will be fixed in Splunk 7.2.5

phadnett_splunk · ‎01-31-2017

Could you check the OS level permissions on props.conf compared to inputs.conf after the App is pushed from the Deployment Server to make sure they are consistent?

phadnett_splunk · ‎01-31-2017

Hi DUThibault. A Universal Forwarder does not need to be configured as a Deployment Client in order to forward data to Splunk Enterprise. Inputs can be configured locally, instead of being pushed out by a Deployment Server. This is why it is marked as Optional under the instructions for sending data to a Splunk Enterprise indexer or indexer cluster.

phadnett_splunk · ‎01-31-2017

It sounds like you are trying to filter data at the Universal Forwarder level. I would recommend taking a look at the following Wiki page: https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F SEDCMD is done at the parsing phase, which takes place on a Heavyweight Forwarder or Indexer. So basically, SEDCMD cannot be used at the Universal Forwarder level.

phadnett_splunk · ‎01-31-2017

Hi mudragada, could you please clarify what you mean by "changes weren't picked up"? Is the issue that you are not seeing props.conf changes on the Universal Forwarder or that you are seeing the changes but they are not working properly?

phadnett_splunk · ‎09-09-2016

I suggest that you manually install the Splunk service by running the following command from the /bin directory: splunk enable boot-start You may have tried to upgrade Splunk with a user account that has does not have administrative privileges.

phadnett_splunk · ‎09-09-2016

We recently updated from Windows Server 2008 SP2 to 2008 R2 SP1 so we could upgrade from Splunk version 6.0 to 6.4. Now we are unable to start Splunk and we notice that the application isn't in the list of services.msc. Starting splunk server daemon (splunkd)... Splunkd: Unable to start the service: The specified service does not exist as an installed service. E:\Program Files\Splunk\bin>

phadnett_splunk · ‎09-07-2016

It is my understanding that the deployer fails-fast if the first member is down. If the second or later member is down, the deployer tries to push to remaining members, but then throws an error at the end. Essentially, there is no way to push a bundle if the first member is down. The point behind this is that we do not want to perturb the system when a member is down, and we particularly don't want to create baseline configuration inconsistency.

phadnett_splunk · ‎07-15-2016

Hello Splunk9999, sorry for the confusion, I meant the actual log file you are monitoring.

phadnett_splunk · ‎07-14-2016

Hello splunker9999, have you confirmed there are logs on the instance with timestamps outside of (12.00 AM to 12.59 AM) ?

phadnett_splunk · ‎07-14-2016

Hello rickrowe, normally you would report this by opening a Support case. What is the exact name of the App where you see this and how is Cisco spelled?

phadnett_splunk · ‎06-15-2016

Hello Daniel, did you recently perform an upgrade?

phadnett_splunk · ‎06-03-2016

Hi scottrunyon, autoLB defaults to true, so it is already configured and there is no need to set it manually. Hope this helps! http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf autoLB = true * Automatic load balancing is the only way to forward data. Round-robin method is not supported anymore. * Defaults to true.

phadnett_splunk · ‎05-25-2016

Hello apietersen, I am sorry you are having trouble configuring Splunk to ingest data. Have you followed the steps outlined in the document below? http://docs.splunk.com/Documentation/Forwarder/6.4.1/Forwarder/HowtoforwarddatatoSplunkCloud

phadnett_splunk · ‎05-25-2016

Hi philwhite, try using this search to find out if/when your license is expiring: |rest /services/licenser/licenses | eval created=strftime(creation_time,"%m/%d/%y %H:%M:%S")| eval expires=strftime(expiration_time,"%m/%d/%y %H:%M:%S") | eval "size (GB)" = round(quota/1024/1024/1024, 3) | table status, "size (GB)", created, expires, label You can always hit the rest endpoint to for the same information: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTlicenseExamples

phadnett_splunk · ‎05-25-2016

I think kchen is referring to the "S3 key prefix" which is the key_name parameter in the S3 input. Looking at your input.conf file, it does not appear you have this configured: http://docs.splunk.com/Documentation/AddOns/latest/AWS/S3 "The key prefix or full key name to scan for available files. The add-on searches all the objects in all directories under this key name. Leave blank to scan all files in the bucket."

phadnett_splunk · ‎05-24-2016

Hello Menahem, I am trying to understand your expectation better. Could you explain further about your meaning behind "no fields about that event (aka the header is like an event)" It is my understanding that the header of the file is used for field extractions. It would then be processed as a separate event and the fields that were extracted from the header will appear to the left under "Interesting Fields." Thanks

phadnett_splunk · ‎05-21-2016

@niklucky02 You could use a search like this to see each time a warning occurs for the pool. You have 5 or more warnings in a rolling 30-day period before a violation for the pool occurs. index=_internal sourcetype=splunkd component=LMStackMgr "A warning has been recorded for all members"

phadnett_splunk · ‎05-18-2016

The best way to do this is to monitor the 30 day License Usage Report View (LURV) in Settings > LIcensing > Usage Report > Previous 30 Days

phadnett_splunk · ‎05-18-2016

This might be caused by bucket conflicts. Do you find any results when searching the following? index=_internal component=DatabaseDirectoryManager conflicts

phadnett_splunk · ‎05-18-2016

Are there any messages in the UI that might help us determine why? Does this happen consistently, even during different times of the day?

phadnett_splunk · ‎05-18-2016

It looks like this is an issue might be the result of a bug (SPL-116968) that was corrected in Splunk version 6.3.5. This bug caused only the default squash_threshold value(2000) to be taken in consideration on the LicenseSlave.

phadnett_splunk · ‎05-13-2016

Try using the following in props.conf for your sourcetype: TIME_FORMAT = %Y-%m-%d

phadnett_splunk · ‎05-13-2016

One solution might be to create a new role (ie. user-system) with fewer capabilities than the normal 'user' role. Then have your 'system-account' role inherit this new 'user-system' role along with the capabilities assigned to it. Is this what you are looking to achieve?

Posts	26
Solutions	4
Karma Given	16
Karma Received	16
Member Since	‎08-18-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Unable to start Splunk on Windows after upgrading ...

What happens when using NFS storage for frozen buc...

Re: Why doesn't double-clicking highlight text in ...

Re: Why doesn't double-clicking highlight text in ...

Re: Why is props.conf in my deployment-app not get...

Re: How do I configure a Splunk Forwarder on Linux...

Re: Why is props.conf in my deployment-app not get...

Re: Why is props.conf in my deployment-app not get...

Re: Unable to start Splunk on Windows after upgrad...

Unable to start Splunk on Windows after upgrading ...

Re: How to deploy configurations to a Splunk 6.3.2...

Re: How to troubleshoot why data is only getting i...

Re: How to troubleshoot why data is only getting i...

Re: how to report a typo in splunk.

Re: Heavy Forwarder tier queues are full. How to d...

Re: Do I need to have autoLB on the search head?

Re: How do I edit my configurations to monitor Win...

Re: License Error when saving Alert (Valid license...

Re: Splunk App and Add-on for Amazon Web Services:...

Re: Splunk Add-on for Amazon Web Services: Exporti...

Re: How to find out how many license violations ha...

Re: How to find out how many license violations ha...

Re: How to troubleshoot why splunkd is not running...

Re: Why does the dashboard show no data, but openi...

Re: Higher value of squash_threshold no longer mak...

Re: How to set the timestamp format to YYYY-MM-DD?

Re: Is there a way to unimport roles or disable ca...