About konradwawryn

konradwawryn · ‎03-07-2014

Hi, after upgrade from 5 to 6 I see double menus in the Splunk admin panel. Does anybody knows why ? http://picpaste.com/splunk-double-WP9tpjZt.PNG Thanks in advance for Your support. Konrad

konradwawryn · ‎03-07-2014

Hi Martin, could You please provide more details ? I dont know where to search for AdvancedXML ... Thanks in advance for Your support. Cheers Konrad

konradwawryn · ‎03-06-2014

Hello Splunk Team, could You please tell me how to disable that annoing Splunk errors on the dashboards dedicated for the clients. Nobody is interesting that Splunk Master license server has issues and problems with authentication - nobody except Splunk admin. How to disable it ? In release 5 half of the user screen was populated by errors important for administrator but completly out of scope for splunk users. In the release 6 is the same story. How to disable it errors messages in Splunk web panel ? Thanks in advance for Your support. Konrad

konradwawryn · ‎10-09-2013

HI, I would like to put search output to google maps. At the momement I`m not talking about geoip or something similar used to network tracking. I simply would like to visualize data on google maps. Script from my server generating this kind of output which is send to SPlunk indexer: App City A - Running App City B - Not running App City C - Running etc.etc. For each city I would like to create marker on googlemaps page with information: "Running" or "Not Running". How to do it ? I suspect that is not possible with Splunk. I`m using Splunk 5 with googlemaps module. THanks in advance for support Konrad

konradwawryn · ‎05-10-2013

thanks for Your feedback. Unfortunately, I`m not able to paste here text... crapy "answers script... " Here You have a link to my configuration file: http://justpaste.it/2lec

konradwawryn · ‎05-08-2013

Hi Gurus, I have connected Splunk server to my Active Directory server. I see LDAP groups and everything seems to be fine... but I cant login as user from selected Active Directory group. In the splunkd.log file I see this: 05-08-2013 22:18:12.304 +0200 ERROR AuthenticationManagerLDAP - user="konrad" has matching LDAP groups with strategy="AD", but none are mapped to Splunk roles 05-08-2013 22:18:12.304 +0200 ERROR UserManagerPro - LDAP Login failed, could not find a valid user="konrad" on any configured servers In my opinion it looks like wrong role mapping. How to configure role mapping in the proper way using Splunk gui ? In this case Splunk documentation is not perfect for me. Maybe somebody could support me and tell me what to do ? greetings from Europe Konrad

konradwawryn · ‎04-11-2013

I have connected 30 machines with application servers to Forwarder. We had a delay in Splunk indexers. Thats why I extended that parameter. This swap is strange. Could it be that Splunk storing data to index in swap memory ?

konradwawryn · ‎04-11-2013

Last days I increased thruput parameter on 2 splunkforwarders: [thruput] maxKBps = 4096 From 256kbps to 4096kbps. Do You think that could be a reason of swapping ?

konradwawryn · ‎04-11-2013

Hi, I have a problem with my server. Since few weeks we have high load on the server. Today I saw for the first time SWAP on the server. The funny thing is that I still have free RAM memory on the server. Do You know why Splunk swapping ? Would be great if somebody could support me and tell me how to reduce swap.

konradwawryn · ‎03-22-2013

Me also 🙂 Does anybody knows how to configure ?

konradwawryn · ‎03-22-2013

Hi, since few days I m trying to configure access to *NIX application to my external users. I m using that application to monitor my linux servers located in the cloud. To keep separate data for each group of the servers I created dedicated indexes and users. Each user have access only to his own index. Problem: I m login with user "teama", I m clicking on *UNIX app. Next from the top menu I`m choosing: CPU -- > CPU by host And it seems that is not working. In index for that user I see CPU data. It seems that *UNIX app searching by default in "os" index. How to change it ? I need to setup for each user different default index. Maybe somebody could support me ?

konradwawryn · ‎01-30-2013

Maybe somebody knows the answer. How to install *nix app on the splunkforwarder... ?

konradwawryn · ‎01-29-2013

Hi, I would like to install *nix application for splunkforwader - hostA. Could You please tell me how to do it ? hostA(Universal splunk forwarder) ---> hostB(splunk forwarder) ---> hostC SPLUNK Server On the hostA I have installed splunkforwarder to transfer application server logs. With *nix application I can also monitor operating system, but how to configure it ?

konradwawryn · ‎01-14-2013

Thanks for Your help 🙂 Its working.

konradwawryn · ‎01-14-2013

Hi, I cant forward Tomcat logs because of this strange error. This is development server so content of tomcat/logs is changing very often - sometimes we need to remove all logs to create new ones. How to disable checksum feature for development logs ? 01-14-2013 15:13:33.882 +0100 ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/home/application/tomcat/logs/catalina.out). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

konradwawryn · ‎01-08-2013

Appserver cannot forward directly to webpanel because it is located in DMZ. I need to transfer logs using machine(some kind of gateway) which have an access to DMZ and LAN. Appserver(DMZ) --- firewall = port 8089/9997 open --> logforwarder(DMZ) --- firewall between DMZ and LAN = port 8089/9997 open --> webpanel(LAN) I would like to know how to configure inputs.conf and outputs.conf files on that first two machines.

konradwawryn · ‎01-08-2013

Hi, it would be great if somebody could help me. Since few hours I`m trying to configure log forwarder, but without result. This is my scenario: (1)ApplicationServer --> (2)SomeServer with Splunkforwarder --> (3)Splunk server (1)hostname:appserver Application server(Tomcat) generating logs. On the same machine I have installed Splunkforwarder which forwarding(not working at the moment) logs to machine (2). (2)hostname:logforwarder Someserver with Splunkforwarder - this machine needs to receive all logs from machine (1) and forward it to machine number (3) (3)hostname:webpanel Splunk server - webpanel Maybe somebody could paste here content of inputs.conf / outputs.conf for appserver , logforwarder. I would like to finaly establish connection between that machines. Thanks in advance for Your help.

Posts	18
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎11-27-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

after upgrade to 6 - double menu entries...

Annoing splunk system errors on all dashboards

How to put search result to google map ?

active directory - how to map user to role ?

Splunk server swapping - why ?

customized *NIX app for external users

*nix app for splunkforwarder - how to install ?

Checksum for logs ? How to disable ?

log forwarding doesnt work, linux

after upgrade to 6 - double menu entries...

Re: Annoing splunk system errors on all dashboards

Annoing splunk system errors on all dashboards

How to put search result to google map ?

Re: active directory - how to map user to role ?

active directory - how to map user to role ?

Re: Splunk server swapping - why ?

Re: Splunk server swapping - why ?

Splunk server swapping - why ?

Re: Unix app for multi-tenancy in cloud environmen...

customized *NIX app for external users

Re: *nix app for splunkforwarder - how to install ...

*nix app for splunkforwarder - how to install ?

Re: Checksum for logs ? How to disable ?

Checksum for logs ? How to disable ?

Re: log forwarding doesnt work, linux

log forwarding doesnt work, linux