Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About slipinski
slipinski
Loves-to-Learn Everything
Member since:
07-10-2018
01-24-2022
Community Statistics
| Posts | 41 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-10-2018 |
Activity Feed
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-17-2021 05:59 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-17-2021 01:51 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-17-2021 01:33 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-17-2021 12:06 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-16-2021 12:59 PM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-16-2021 11:55 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-16-2021 06:17 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-16-2021 03:46 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-16-2021 12:45 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-16-2021 12:03 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-15-2021 06:51 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-15-2021 06:41 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-15-2021 06:36 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-15-2021 06:28 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-15-2021 04:24 AM
- Posted Re: HF doesn't accept traffic from UF on Getting Data In. 11-15-2021 03:56 AM
- Posted HF doesn't accept traffic from UF on Getting Data In. 11-15-2021 03:54 AM
- Posted Re: How to split access.log data on Getting Data In. 03-09-2021 06:29 AM
- Posted How to split access.log data on Getting Data In. 03-03-2021 05:31 AM
- Tagged How to split access.log data on Getting Data In. 03-03-2021 05:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-17-2021
05:59 AM
The thing is that the network isn't being managed by me. I was just told to take advantage of HF (UF doesn't have access to the internet) and make everything up and running. But according to the customer, who is managing the network, there is nothing that could block communication between HF and UF.
... View more
11-17-2021
01:51 AM
My bad. It's typo. The second output is from HF. Anyway I'm pasting it here again: [splunktcp] _rcvbuf = 1572864 acceptFrom = * connection_host = ip host = $decideOnStartup index = default route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue [splunktcp://9997] _rcvbuf = 1572864 connection_host = 10.24.118.91 disabled = false host = $decideOnStartup index = discol
... View more
11-17-2021
01:33 AM
From UF [syslog] maxEventSize = 1024 priority = <13> type = udp [tcpout] ackTimeoutOnShutdown = 30 autoLBFrequency = 30 autoLBVolume = 0 blockOnCloning = true blockWarnThreshold = 100 cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256 compressed = false connectionTTL = 0 connectionTimeout = 20 defaultGroup = default-autolb-group disabled = false dropClonedEventsOnQueueFull = 5 dropEventsOnQueueFull = -1 ecdhCurves = prime256v1, secp384r1, secp521r1 forceTimebasedAutoLB = false forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = (_audit|_introspection|_internal|_telemetry) forwardedindex.filter.disable = false heartbeatFrequency = 30 indexAndForward = false maxConnectionsPerIndexer = 2 maxFailuresPerInterval = 2 maxQueueSize = auto readTimeout = 300 secsInFailureInterval = 1 sendCookedData = true sslQuietShutdown = false sslVersions = tls1.2 tcpSendBufSz = 0 useACK = false useClientSSLCompression = true writeTimeout = 300 [tcpout-server://172.23.11.216:9997] [tcpout:default-autolb-group] disabled = false server = 172.23.11.216:9997 sslPassword = password From UF [splunktcp] _rcvbuf = 1572864 acceptFrom = * connection_host = ip host = $decideOnStartup index = default route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue [splunktcp://9997] _rcvbuf = 1572864 connection_host = 10.24.118.91 disabled = false host = $decideOnStartup index = discol I've only just added connection_host setup , but it didn't make any difference. Logfile: 11-17-2021 09:31:50.643 +0000 WARN TcpOutputProc [18893 parsing] - The TCP output processor has paused the data flow. Forwarding to host_dest=172.23.11.216 inside output group default-autolb-group from host_src=ldcrapnvvip10 has been blocked for blocked_seconds=47000. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. 11-17-2021 09:32:26.647 +0000 ERROR TcpOutputFd [18894 TcpOutEloop] - Read error. Connection reset by peer 11-17-2021 09:32:26.648 +0000 ERROR TcpOutputFd [18894 TcpOutEloop] - Read error. Connection reset by peer 11-17-2021 09:32:26.648 +0000 WARN AutoLoadBalancedConnectionStrategy [18894 TcpOutEloop] - Applying quarantine to ip=172.23.11.216 port=9997 _numberOfFailures=2
... View more
11-17-2021
12:06 AM
inputs.conf file from $SPLUNK_HOME/etc/apps/search/local [splunktcp://9997] disabled = false Forget my ignorance, but should I add this stanza to $SPLUNK_HOME/etc/system/local/inputs.conf file as well?
... View more
11-16-2021
12:59 PM
@PickleRick I double-checked TLS/SSL configuration on both sides. Looks like default setting and it's the same. I've check memory utilization on HF and it's quite high: 96% memory is consumed. Could it be a culprit?
... View more
11-16-2021
11:55 AM
@PickleRick ACK/RST packet turns up after 3-way handshake. I caught some TLSv1 packets. Looks like TLS hello packet from UF towards HF, so your guess related to TLS mismatch can be right.
... View more
11-16-2021
03:46 AM
Yes, there is. However, HF replys to UF with [RST,ACK] packets. This generally means that port is closed, but in reality it isn't. As I mentioned before, I can telnet to HF on port 8089.
... View more
11-16-2021
12:45 AM
[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = 172.23.11.216:9997 [tcpout-server://172.23.11.216:9997] 172.23.11.216 is obviously address of HW.
... View more
11-16-2021
12:03 AM
index=_internal host=<hostname_Heavy_Forwarder> OK
index=_internal host=<hostname_Universal_Forwarder> Nothing
index=* host=<hostname_Universal_Forwarder> Nothing @gcusello Only data from HF are visible in the cloud.
... View more
11-15-2021
06:51 AM
I added one logfile to being monitored under HF and can see results in a cloud.
... View more
11-15-2021
06:36 AM
Yes, I allowed traffic on these 3 ports, just to be on safe side firewall-cmd --zone=public --permanent --add-port=8000/tcp firewall-cmd --zone=public --permanent --add-port=9997/tcp firewall-cmd --zone=public --permanent --add-port=8089/tcp
... View more
11-15-2021
04:24 AM
Hi @gcusello. I think I did, but currently doesn't have access to webgui. Can I confirm these settings in CLI? regards, Sz
... View more
11-15-2021
03:56 AM
Below is input config of HF. /opt/splunk/etc/system/default/inputs.conf [SSL] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf allowSslRenegotiation = true /opt/splunk/etc/system/default/inputs.conf cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 /opt/splunk/etc/system/default/inputs.conf ecdhCurves = prime256v1, secp384r1, secp521r1 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/system/default/inputs.conf sslQuietShutdown = false /opt/splunk/etc/system/default/inputs.conf sslVersions = tls1.2 /opt/splunk/etc/system/default/inputs.conf [batch:///opt/splunk/var/run/splunk/search_telemetry/*search_telemetry.json] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf crcSalt = <SOURCE> /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = _introspection /opt/splunk/etc/system/default/inputs.conf log_on_completion = 0 /opt/splunk/etc/system/default/inputs.conf move_policy = sinkhole /opt/splunk/etc/system/default/inputs.conf sourcetype = search_telemetry /opt/splunk/etc/system/default/inputs.conf [batch:///opt/splunk/var/spool/splunk] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf crcSalt = <SOURCE> /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/system/default/inputs.conf move_policy = sinkhole /opt/splunk/etc/system/default/inputs.conf [batch:///opt/splunk/var/spool/splunk/...stash_hec] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf crcSalt = <SOURCE> /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/system/default/inputs.conf move_policy = sinkhole /opt/splunk/etc/system/default/inputs.conf sourcetype = stash_hec /opt/splunk/etc/system/default/inputs.conf [batch:///opt/splunk/var/spool/splunk/...stash_new] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf crcSalt = <SOURCE> /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/system/default/inputs.conf move_policy = sinkhole /opt/splunk/etc/system/default/inputs.conf queue = stashparsing /opt/splunk/etc/system/default/inputs.conf sourcetype = stash_new /opt/splunk/etc/system/default/inputs.conf time_before_close = 0 /opt/splunk/etc/system/default/inputs.conf [batch:///opt/splunk/var/spool/splunk/tracker.log*] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = _internal /opt/splunk/etc/system/default/inputs.conf move_policy = sinkhole /opt/splunk/etc/system/default/inputs.conf sourcetype = splunkd_latency_tracker /opt/splunk/etc/system/default/inputs.conf [blacklist:/opt/splunk/etc/auth] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/system/default/inputs.conf [blacklist:/opt/splunk/etc/passwd] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/system/default/inputs.conf [fschange:/opt/splunk/etc] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf delayInMills = 100 /opt/splunk/etc/system/default/inputs.conf disabled = false /opt/splunk/etc/system/default/inputs.conf filesPerDelay = 10 /opt/splunk/etc/system/default/inputs.conf followLinks = false /opt/splunk/etc/system/default/inputs.conf fullEvent = false /opt/splunk/etc/system/default/inputs.conf hashMaxSize = -1 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/system/default/inputs.conf pollPeriod = 600 /opt/splunk/etc/system/default/inputs.conf recurse = true /opt/splunk/etc/system/default/inputs.conf sendEventMaxSize = -1 /opt/splunk/etc/system/default/inputs.conf signedaudit = true /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf [http] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf ackIdleCleanup = true /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf allowSslCompression = true /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf allowSslRenegotiation = true /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf dedicatedIoThreads = 2 /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf disabled = 1 /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf enableSSL = 1 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf maxSockets = 0 /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf maxThreads = 0 /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf port = 8088 /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf sslVersions = *,-ssl2 /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf useDeploymentServer = 0 /opt/splunk/etc/system/default/inputs.conf [monitor:///opt/splunk/etc/splunk.version] /opt/splunk/etc/system/default/inputs.conf _TCP_ROUTING = * /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = _internal /opt/splunk/etc/system/default/inputs.conf sourcetype = splunk_version /opt/splunk/etc/apps/introspection_generator_addon/default/inputs.conf [monitor:///opt/splunk/var/log/introspection] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/apps/introspection_generator_addon/default/inputs.conf index = _introspection /opt/splunk/etc/system/default/inputs.conf [monitor:///opt/splunk/var/log/splunk] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = _internal /opt/splunk/etc/system/default/inputs.conf [monitor:///opt/splunk/var/log/splunk/license_usage_summary.log] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = _telemetry /opt/splunk/etc/system/default/inputs.conf [monitor:///opt/splunk/var/log/splunk/splunk_instrumentation_cloud.log*] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = _telemetry /opt/splunk/etc/system/default/inputs.conf sourcetype = splunk_cloud_telemetry /opt/splunk/etc/system/default/inputs.conf [monitor:///opt/splunk/var/log/watchdog/watchdog.log*] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = _internal /opt/splunk/etc/apps/search/local/inputs.conf [monitor:///var/log/secure] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/apps/search/local/inputs.conf disabled = false /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/apps/search/local/inputs.conf index = discol /opt/splunk/etc/system/default/inputs.conf [script] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf host = $decideOnStartup /opt/splunk/etc/system/default/inputs.conf index = default /opt/splunk/etc/system/default/inputs.conf interval = 60.0 /opt/splunk/etc/system/default/inputs.conf start_by_shell = true
... View more
11-15-2021
03:54 AM
Hi Splunk chaps, I'm facing problem with feeding HF from UF (HF is sending data to the cloud and this works fine). I can exclude network or firewall issue - both servers are reachable from opposite side. Below is a chunk of log errors from UF : 11-15-2021 11:12:57.024 +0000 INFO DC:DeploymentClient [6735 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 11-15-2021 11:13:09.024 +0000 INFO DC:DeploymentClient [6735 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 11-15-2021 11:13:10.140 +0000 WARN HttpPubSubConnection [6734 HttpClientPollingThread_97C72192-9F2D-4883-830A-776376593AC1] - Unable to parse message from PubSubSvr: 11-15-2021 11:13:10.140 +0000 INFO HttpPubSubConnection [6734 HttpClientPollingThread_97C72192-9F2D-4883-830A-776376593AC1] - Could not obtain connection, will retry after=70.985 seconds. 11-15-2021 11:13:17.695 +0000 WARN TcpOutputProc [3551 parsing] - The TCP output processor has paused the data flow. Forwarding to host_dest=172.23.11.216 inside output group default-autolb-group from host_src=ldcrapnvvip10 has been blocked for blocked_seconds=446600. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. Please see output debug from UF. /opt/splunkforwarder/etc/system/default/outputs.conf [syslog] /opt/splunkforwarder/etc/system/default/outputs.conf maxEventSize = 1024 /opt/splunkforwarder/etc/system/default/outputs.conf priority = <13> /opt/splunkforwarder/etc/system/default/outputs.conf type = udp /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf [tcpout] /opt/splunkforwarder/etc/system/default/outputs.conf ackTimeoutOnShutdown = 30 /opt/splunkforwarder/etc/system/default/outputs.conf autoLBFrequency = 30 /opt/splunkforwarder/etc/system/default/outputs.conf autoLBVolume = 0 /opt/splunkforwarder/etc/system/default/outputs.conf blockOnCloning = true /opt/splunkforwarder/etc/system/default/outputs.conf blockWarnThreshold = 100 /opt/splunkforwarder/etc/system/default/outputs.conf cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256 /opt/splunkforwarder/etc/system/default/outputs.conf compressed = false /opt/splunkforwarder/etc/system/default/outputs.conf connectionTTL = 0 /opt/splunkforwarder/etc/system/default/outputs.conf connectionTimeout = 20 /opt/splunkforwarder/etc/system/local/outputs.conf defaultGroup = default-autolb-group /opt/splunkforwarder/etc/system/default/outputs.conf disabled = false /opt/splunkforwarder/etc/system/default/outputs.conf dropClonedEventsOnQueueFull = 5 /opt/splunkforwarder/etc/system/default/outputs.conf dropEventsOnQueueFull = -1 /opt/splunkforwarder/etc/system/default/outputs.conf ecdhCurves = prime256v1, secp384r1, secp521r1 /opt/splunkforwarder/etc/system/default/outputs.conf forceTimebasedAutoLB = false /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf forwardedindex.0.whitelist = .* /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf forwardedindex.1.blacklist = _.* /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf forwardedindex.2.whitelist = (_audit|_introspection|_internal|_telemetry) /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf forwardedindex.filter.disable = false /opt/splunkforwarder/etc/system/default/outputs.conf heartbeatFrequency = 30 /opt/splunkforwarder/etc/system/default/outputs.conf indexAndForward = false /opt/splunkforwarder/etc/system/default/outputs.conf maxConnectionsPerIndexer = 2 /opt/splunkforwarder/etc/system/default/outputs.conf maxFailuresPerInterval = 2 /opt/splunkforwarder/etc/system/default/outputs.conf maxQueueSize = auto /opt/splunkforwarder/etc/system/default/outputs.conf readTimeout = 300 /opt/splunkforwarder/etc/system/default/outputs.conf secsInFailureInterval = 1 /opt/splunkforwarder/etc/system/default/outputs.conf sendCookedData = true /opt/splunkforwarder/etc/system/default/outputs.conf sslQuietShutdown = false /opt/splunkforwarder/etc/system/default/outputs.conf sslVersions = tls1.2 /opt/splunkforwarder/etc/system/default/outputs.conf tcpSendBufSz = 0 /opt/splunkforwarder/etc/system/default/outputs.conf useACK = false /opt/splunkforwarder/etc/system/default/outputs.conf useClientSSLCompression = true /opt/splunkforwarder/etc/system/default/outputs.conf writeTimeout = 300 /opt/splunkforwarder/etc/system/local/outputs.conf [tcpout-server://172.23.11.216:9997] /opt/splunkforwarder/etc/system/local/outputs.conf [tcpout:default-autolb-group] /opt/splunkforwarder/etc/system/local/outputs.conf disabled = false /opt/splunkforwarder/etc/system/local/outputs.conf server = 172.23.11.216:9997 Any ideas what blocks it? thanks in advance, Sz
... View more
Labels
- Labels:
-
heavy forwarder
-
universal forwarder
03-09-2021
06:29 AM
Hi manjunathmeti, Thanks for your effort. Your query extracts field1 correctly, but field2 is empty. No idea why.
... View more
03-03-2021
05:31 AM
Hello Splunkers, I've got a problem with data splitting. I would like to split data into separate lines. Please take a look at my data: 10.62.19.11 - - [03/Mar/2021:12:49:02 +0100] "POST /api/setModernServices HTTP/1.1" 200 1315 0.154 0.148 "http://10.69.10.170/radio/web/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36" "{header:{id:0},data:{entries:[{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.33,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.3,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.39,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.7,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.39,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.18,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.39,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.8,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.39,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.21,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.30,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.57,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.20,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.39,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.29,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.41,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.23,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.42,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.43,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.24,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.44,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.39,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true}},{scheduleInfo:{type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition\x I want to have data split like below: 10.62.19.11 - - [03/Mar/2021:12:49:02 +0100] type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.33,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.58,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true
10.62.19.11 - - [03/Mar/2021:12:49:02 +0100]
type:once,startTimestamp:1614772142364,endTimestamp:8999999999000},serviceDefinition:{descriptor:{label:,desc:},dests:[{destId:virtual.46.0.3,destName:}],groupOrder:1,profileId:7637a321-8628-47d3-92e8-5fd85b54aa6b,skipReuseJoinId:true,routing:p2mp,srcId:virtual.96.0.39,tags:[LastOnAirId:null,EmerOnAirId:null],type:connection,force:true I suppose I need to use mvexpand in combination with static regex, but I cannot find correct formula. Could you help please.
... View more
Labels
- Labels:
-
field extraction
01-12-2021
01:00 PM
Hello, Is there any possibility to pool SNMP data in cloud environment? Can I use UF to make a queries for particular OID? Do I need to run SNMP Modular input add-on on UF? thanks in advance, Szymon
... View more
Labels
- Labels:
-
configuration
-
installation
-
troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-24-2022
05:03 AM
|
