Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About frankwayne
frankwayne
Path Finder
Member since:
03-17-2014
07-24-2025
Community Statistics
| Posts | 25 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 15 |
| Member Since | 03-17-2014 |
Activity Feed
- Got Karma for Re: Feature-Request: Add proxy-server for not directly connectecd SH. 07-24-2025 07:43 AM
- Posted Re: Feature-Request: Add proxy-server for not directly connectecd SH on Splunk Enterprise. 07-24-2025 06:46 AM
- Posted Time zone in Splunk Add-on for Google Cloud Platform on All Apps and Add-ons. 09-27-2023 10:15 AM
- Tagged Time zone in Splunk Add-on for Google Cloud Platform on All Apps and Add-ons. 09-27-2023 10:15 AM
- Got Karma for Re: Error with Splunk DB Connect app | Unable to communicate with task server; No module named urllib3 and other ERRORS. 03-09-2022 04:42 AM
- Posted Why does Splunk_TA_windows give CIM disk latency in milliseconds and read/write_latencies in seconds? on All Apps and Add-ons. 03-01-2022 07:37 AM
- Got Karma for Re: EMC Isilon App and Add-on for Splunk Enterprise: How to configure the app and add-on in distributed environment?. 06-30-2020 03:15 PM
- Karma Re: Code42 402 Errors for API calls for aplura_llc_supp. 06-05-2020 12:50 AM
- Karma Re: Filter time-based values from inputlookup by time picker range for peter_krammer. 06-05-2020 12:49 AM
- Karma Re: How to add the admin password required to start Splunk 7.1.0 in a scripted install? for xpac. 06-05-2020 12:49 AM
- Karma Re: Error with Splunk DB Connect app | Unable to communicate with task server; No module named urllib3 and other ERRORS for ktwingstrom. 06-05-2020 12:49 AM
- Karma Re: Error with Splunk DB Connect app | Unable to communicate with task server; No module named urllib3 and other ERRORS for hassanm. 06-05-2020 12:49 AM
- Karma Re: Metrics indexes missing in REST-API listing? for thaggie_splunk. 06-05-2020 12:49 AM
- Got Karma for Re: Error with Splunk DB Connect app | Unable to communicate with task server; No module named urllib3 and other ERRORS. 06-05-2020 12:49 AM
- Got Karma for Re: Error with Splunk DB Connect app | Unable to communicate with task server; No module named urllib3 and other ERRORS. 06-05-2020 12:49 AM
- Got Karma for Re: Error with Splunk DB Connect app | Unable to communicate with task server; No module named urllib3 and other ERRORS. 06-05-2020 12:49 AM
- Got Karma for Re: Error with Splunk DB Connect app | Unable to communicate with task server; No module named urllib3 and other ERRORS. 06-05-2020 12:49 AM
- Got Karma for Re: Errors running Qualys TA. 06-05-2020 12:49 AM
- Got Karma for Re: Errors running Qualys TA. 06-05-2020 12:49 AM
- Karma Re: Is there a way to write a script to download the latest Splunk version? for davespatz. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 2 | |||
| 0 |
07-24-2025
06:46 AM
1 Karma
Hello, @LoMueller, and thanks, @livehybrid. My contact information is in the TA's README and default/app.conf. I am leaving for a trip this week, but I will be back on August 18. I can add a configuration file to set up a proxy for Python. Please send me a reminder after the 18th, @LoMueller, and I will try to get that done for you.
... View more
09-27-2023
10:15 AM
All the timestamps in the JSON we receive are UTC, but the TA ignores the time zone in the ISO 8601 string, so it defaults to local time. Thus, all our events are timestamped several hours into the future. I noticed that the timestamps Google provides vary from millisecond to nanosecond precision, but trailing zeros are truncated before the "Z" is tacked on. This makes it difficult to specify a time format with a trailing time zone that will work for every event. But instead, shouldn't all the source types have TZ = UTC in props? Am I the only one with this problem?
... View more
Labels
- Labels:
-
troubleshooting
03-01-2022
07:37 AM
Windows disk performance latencies ("Avg. Disk sec/Transfer", etc.) are given in seconds. Splunk_TA_windows renders these for the CIM as: [Perfmon:LogicalDisk] EVAL-latency = if(counter=="Avg. Disk sec/Transfer",Value*1000,null()) EVAL-read_latency = if(counter=="Avg. Disk sec/Read",Value,null()) EVAL-write_latency = if(counter=="Avg. Disk sec/Write",Value,null()) Why is one given as milliseconds, but the others as seconds?
... View more
Labels
- Labels:
-
administration
-
configuration
-
search
02-21-2019
09:44 AM
When the input add-on calls the below API URL, it gets a 402 error. (About 100,000 at a time, in our case.) What is the missing licensing requirement? And how would you turn this off, if you weren't licensed for it?
https://<host>:4285/c42api/v3/SecurityEventsLocation?userUid=<some-uid>;
... View more
01-24-2019
12:41 PM
I'm not sure why anyone would want "a holistic view" of the credentials on the instance when they have nothing to do with the app in question. This was an poorly conceived requirement, in that case.
I can confirm that a newly created credential DOES NOT appear on the credential tab. I see THIRTY credentials on the credentials tab and exactly the same number after I add a new one. The new one is not in the list. This begets a new question: Is there a limit of 30 credentials on that page and does the uninformed decision to just list everything now prevent new credentials from appearing? There is no "next page" offered, so as far as I can tell, there is simply no credential created.
Other apps require the creation of a credential and then an input, which is associated with the pre-existing credential. (Those apps, by the way, don't show every other app's credentials. Just say'n.)
... View more
01-24-2019
11:42 AM
Other apps on the same instance have credentials. They display only the credentials created in the context of their app, not all the credentials on the instance. It seems, therefore, that it is the responsibility of the app designer to filter those credentials. That is not being done for the Code42 app.
... View more
01-24-2019
11:28 AM
I installed the input add-on (3.0.6) and on the /Application Configuration /Credentials tab, ALL of the credentials of ALL apps installed on the machine are listed. Why is the app listing credentials that don't belong to it? (I almost began deleting some before I realized what the app was doing.)
The app should only be showing credentials that belong to it.
Moreover, where can these credentials be used? The input configuration asks for a username and password, not a credential entry. When I enter a username and password, no credential is created. So, why does the app have a credential tab, other than to show us credentials for other apps?
... View more
01-24-2019
06:15 AM
The app was written by Crest Data Systems. They are the ones ignoring us, as far as I can tell.
... View more
12-07-2018
10:01 AM
Many (all?) of the sklearn algorithms support multi-threading using the n_jobs option. This is not exposed in Splunk, nor does fit or apply seem to use more than one thread. Why? Are there plans to do this?
For example, I was trying to improve the performance of RandomForestClassifier by making it multi-threaded, but n_jobs is not supported in RandomForestClassifier.py (not one of the 'ints' in out_params), nor is multi-threading an option in the UI's Settings tab for the MLTK.
... View more
11-30-2018
07:53 AM
1 Karma
My distsearch.conf change worked for a little while and then stopped (Splunk 7.1.2). I don't know why.
My current solution is to remove all occurrences of " isilon_index " in eventtypes.conf. The easiest way to proceed may be to copy default/eventtypes.conf into local/eventtypes.conf and remove just the macro from any lines that contain it.
... View more
11-09-2018
11:00 AM
2 Karma
My Environment
I have a heavy forwarder that collects REST data and a load-balanced set of heavy forwarders that collect syslog. These servers also collect other data; they are not dedicated to Isilon. I have a search head cluster that hosts the App and a multi-site indexer cluster.
My Installation
The heavy forwarder that collects REST data from the Isilon cluster node has the Add-on installed with the isilon_setup.py and macros.conf changes described below. Delete default/inputs.conf, default/eventgen.conf, and the samples/ directory.
The heavy forwarders that collect syslog have no Isilon app components installed. My general-purpose syslog collection is configured so that Isilon sources are source-typed as emc:isilon:syslog. You will have to set up something like what Crest supplied with their default/inputs.conf.
The indexers have no Isilon app components installed. Obviously they have indexes configured, one of which is for Isilon events.
The search head cluster has the Add-on and App installed with the distsearch.conf and macros.conf changes. Delete default/inputs.conf, default/eventgen.conf, and the bin/ and samples/ directories.
Changes
Create local/distsearch.conf containing:
[replicationSettings:refineConf]
replicate.macros = true
Why?: Search heads do not normally put macros into the bundles that they forward to their indexers. This changes that behavior. Don't bother putting the macro directly on your indexers; it has to come from your search tier as part of a search bundle. The locally defined macro is only used when you run the search on the indexer itself, like from the indexer's UI.
Create local/macros.conf containing:
[isilon_index]
definition = index=thenameofyourindex
iseval = 0
Why?: The 'isilon_index' macro is not defined in default/macros.conf (it should be IMO) and your searches will fail with errors because the macro is not defined. This does not only affect Isilon-related searches, but other searches that use certain tags and/or event types. Change the index name to match whatever you want to use as an index. The default name is 'isilon'. That's what the app sets if you do not provide an index name on the setup screen. That's also the index you are stuck with if you run setup again for the same node with a new index name. You must edit local/inputs.conf directly if you want to change the index after initial configuration – the setup screen will ignore an index name if one is already set (tested with v2.3).
Remove (comment) lines 145-148 of bin/isilon_setup.py:
#indexes = en.getEntities(['data', 'indexes'], count=-1, sessionKey=sessionKey)
#if not index in indexes.keys():
# logger.error("EMC Isilon Error: index %s does not exist" % index)
# raise Exception("EMC Isilon Error: index %s does not exist" % index)
Why?: The app insists that you have a local index on the heavy forwarder that you are using for collection. Why? Because the TA was written with a single-instance Splunk environment in mind, I guess. Crest is not unique in writing code that assumes that the index is defined on the local Splunk instance even if it doesn't make any sense. Splunk even does it. Mind-boggling. This code will cause the setup to fail with an error. It doesn't bother mentioning that it is failing because an index that you do not need does not exist, which would be helpful and not just frustrating. Of course, make sure the index exists on the indexer tier where REST data is heading.
... View more
08-29-2018
09:12 AM
I downvoted this post because it does not address the question at all.
... View more
08-29-2018
09:10 AM
2 Karma
My solution to this problem was to comment out lines 89-91 of qualys.py in the bin directory in the Add-on. This (bad) code checks to see if it is running on a search head and skips the work that we want done.
It would be nice if Qualys fixed the code with a ", input_name" before the closing parenthesis in line 90 so that %s gets filled in, but they can't even find the time to respond to your question. And we're commenting it out anyway. 🙂
For reference, the code to be removed is:
if server_info and server_info.is_search_head() and input_name != "qualys://knowledge_base":
qlogger.error("This setup is configured as Search Head. You should not run %s on Search Head. I am Exiting.")
continue
I hope this helps.
... View more
06-25-2018
06:15 PM
Can you provide an example of the events that are not getting indexed, especially the timestamps?
... View more
06-25-2018
02:31 PM
5 Karma
I noticed the same Python error about a missing library. My solution was to copy four libraries to /opt/splunk/etc/apps/splunk_app_db_connect/bin/: urllib3, chardet, certifi, and idna. I copied them from the Splunk_TA_box app I have installed. Not all of these are in /opt/splunk/lib/python2.7/site-packages/requests/packages.
I suppose you can download the Box app to get them or find them elsewhere online.
BTW, I'm running Splunk 7.0.3 and DBX 3.1.3.
... View more
04-19-2017
07:18 AM
2 Karma
It looks like there is now a regular ARM version of the UF (Universal Forwarder). It's confusing to have this old add-on, Forwarder for Linux ARM (Raspberry Pi), and a regularly updated UF build, especially since there's no mention here of the ARM version in the regular UF channel. Will this add-on be removed from Splunkbase now?
... View more
10-13-2016
09:35 AM
My temporary solution is to rewrite the index metadata. Thanks for the app!
props.conf
[duo:administrator]
TRANSFORMS-duo_administrator = duo_set_index
[duo:authentication]
TRANSFORMS-duo_authentication = duo_set_index
[duo:info_summary]
TRANSFORMS-duo_info_summary = duo_set_index
[duo:telephony]
TRANSFORMS-duo_telephony = duo_set_index
transforms.conf
[duo_set_index]
REGEX = .+
DEST_KEY = _MetaData:Index
FORMAT = some_index
... View more
10-13-2016
08:27 AM
That solution occurred to me, but I don't like it. It would be better to have a text box instead of a drop down for the index name.
... View more
10-13-2016
07:49 AM
The modular input only lists indexes on the local Splunk instance. The heavy forwarder where the add-on is installed sends events to a cluster. How do I specify an index that is not one of the local indexes, i.e. whatever index name I want?
... View more
12-04-2015
09:33 AM
2 Karma
I deprecated certain indexes on my indexer cluster and wanted to set them to read-only (using isReadOnly = true) to avoid receiving any new events inadvertently. When the bundle is rolled out, each peer restarts like it should, but shortly after maintenance mode is stopped, splunkd crashes on all the peers except one.
The crash report indicates an assert failure in DatabaseDirectoryManager::addReplicatedBucket(), "addReplicatedBucket request for readonly instance" (see below). I can't find any documentation indicating that one may not set a replicated index to read-only. Can anyone clarify?
[build aa7d4b1ccb80] 2015-12-04 10:38:48
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 63141 running under UID 0.
Crashing thread: ReplicationDataReceiverThread
Registers:
RIP: [0x00007F1BA20305D7] gsignal + 55 (/lib64/libc.so.6)
RDI: [0x000000000000F6A5]
RSI: [0x000000000000F706]
RBP: [0x00007F1BA2179128]
RSP: [0x00007F1B91BFC328]
RAX: [0x0000000000000000]
RBX: [0x00007F1BA357E000]
RCX: [0xFFFFFFFFFFFFFFFF]
RDX: [0x0000000000000006]
R8: [0xFEFEFEFEFEFEFEFF]
R9: [0x00007F1BA35C6F60]
R10: [0x0000000000000008]
R11: [0x0000000000000206]
R12: [0x0000000001891C20]
R13: [0x0000000001892C60]
R14: [0x0000000000000000]
R15: [0x00007F1B90A82458]
EFL: [0x0000000000000206]
TRAPNO: [0x0000000000000000]
ERR: [0x0000000000000000]
CSGSFS: [0x0000000000000033]
OLDMASK: [0x0000000000000000]
OS: Linux
Arch: x86-64
Backtrace:
[0x00007F1BA20305D7] gsignal + 55 (/lib64/libc.so.6)
[0x00007F1BA2031CC8] abort + 328 (/lib64/libc.so.6)
[0x00007F1BA2029546] ? (/lib64/libc.so.6)
[0x00007F1BA20295F2] ? (/lib64/libc.so.6)
[0x0000000000AD9864] _ZN24DatabaseDirectoryManager19addReplicatedBucketERK10CMBucketIdRK8PathnameR3Str + 388 (splunkd)
[0x0000000000B132D9] _ZN7Indexer19addReplicatedBucketERK10CMBucketIdRK8PathnamebP3Str + 153 (splunkd)
[0x0000000000A4135D] _ZN22S2SJournalFileReceiver12onFileClosedEPN21S2SBucketFileReceiver8FileInfoE + 973 (splunkd)
[0x0000000000A3F5C9] _ZN21S2SBucketFileReceiver16processFileSliceERK15CowPipelineDataRK4GuidR3Str + 921 (splunkd)
[0x0000000000A28E9A] _ZN22ReplicationDataChannel16s2sDataAvailableER15CowPipelineDataRK15S2SPerEventInfom + 1226 (splunkd)
[0x0000000000F479A9] _ZN11S2SReceiver8gotEventER15CowPipelineDataRK15S2SPerEventInfo + 137 (splunkd)
[0x0000000000E4FEC3] _ZN18StreamingS2SParser5parseEPKcS1_ + 8067 (splunkd)
[0x0000000000A22E30] _ZN16CookedTcpChannel7consumeER18TcpAsyncDataBuffer + 144 (splunkd)
[0x0000000000A23EB9] _ZN22ReplicationDataChannel7consumeER18TcpAsyncDataBuffer + 25 (splunkd)
[0x0000000000A235F4] _ZN16CookedTcpChannel13dataAvailableER18TcpAsyncDataBuffer + 52 (splunkd)
[0x000000000109A34E] _ZN10TcpChannel11when_eventsE18PollableDescriptor + 702 (splunkd)
[0x000000000100B535] _ZN8PolledFd8do_eventEv + 197 (splunkd)
[0x000000000100C2D7] _ZN9EventLoop3runEv + 1351 (splunkd)
[0x00000000010955F4] _ZN19Base_TcpChannelLoop7_do_runEv + 36 (splunkd)
[0x00000000010956A6] _ZN25SubordinateTcpChannelLoop3runEv + 134 (splunkd)
[0x000000000109F0EE] _ZN6Thread8callMainEPv + 62 (splunkd)
[0x00007F1BA23C3DF5] ? (/lib64/libpthread.so.0)
[0x00007F1BA20F11AD] clone + 109 (/lib64/libc.so.6)
Linux / <server-name> / 3.10.0-229.14.1.el7.x86_64 / #1 SMP Tue Aug 25 11:21:22 EDT 2015 / x86_64
Last few lines of stderr (may contain info on assertion failure, but also could be old):
Cannot open manifest file inside "<path>/db_1449246603_1449246602_17_88D6F8A1-D2CE-4CF0-8DF3-937D03D30A5E/rawdata": No such file or directory
Cannot open manifest file inside "<path>/db_1334071435_1334070628_18_88D6F8A1-D2CE-4CF0-8DF3-937D03D30A5E/rawdata": No such file or directory
Cannot open manifest file inside "<path>/db_1449247040_1449247027_88_88D6F8A1-D2CE-4CF0-8DF3-937D03D30A5E/rawdata": No such file or directory
splunkd: /home/build/build-src/ember/src/pipeline/indexer/DatabaseDirectoryManager.cpp:2429: bool DatabaseDirectoryManager::addReplicatedBucket(const CMBucketId&, const Pathname&, Str&): Assertion `0 && "addReplicatedBucket request for readonly instance"' failed.
... View more
05-19-2015
07:33 AM
Vielen dank, Martin. That settles it.
... View more
04-16-2015
08:47 AM
No, I'm afraid not. I will be redeploying all my indexers, search heads and the cluster master as Redhat instead. I will put the deployer on the cluster master, instead. I guess the Windows situation must remain a Splunk mystery.
... View more
04-09-2015
07:04 AM
Thank you for your reply, Martin. At first glance, your answer seemed right. However, as I look further, I'm not convinced.
The deployer in my case is not a cluster member (indeed, it cannot be a cluster member) and therefore is not subject to the restrictions on search head cluster members. You can see that the requirements for the deployer (http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/SHCsystemrequirements#Deployer_requirements) include Windows. I am running the deployer on my deployment server, which I want to be a Windows server.
I was not aware that Windows search head clusters are not supported. They are certainly configurable since I have a cluster with two Windows search heads. I will have to redeploy them as Linux servers.
However, I think (based on the documentation) that the Windows deployer should work. Am I missing something else?
... View more
04-08-2015
01:45 PM
I have a Windows 2012 R2 server with UAC disabled.
I've just installed Splunk Enterprise, placed an app in the $SPLUNK_HOME/etc/shcluster/apps/ directory,
and tried to deploy a bundle:
>splunk apply shcluster-bundle -target https://searchhead:8089
Warning: Depending on the configuration changes being pushed, this command migh
t initiate a rolling restart of the cluster members. Please refer to the docume
ntation for the details. Do you wish to continue? [y/n]: y
Your session is invalid. Please login.
Splunk username: admin
Password:
Error while creating deployable apps: Error moving tmp_staging_area="C:\Program
Files\Splunk\var\run\splunk\deploy.9f0aa64b5fe19f35.tmp" to dst="C:\Program File
s\Splunk\var\run\splunk\deploy": Access is denied.
Has anyone else seen this behavior?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-24-2025
06:26 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
