Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kamal2222ahmed
kamal2222ahmed
Explorer
Member since:
03-22-2014
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 03-22-2014 |
Activity Feed
- Karma Re: wget, or curl splunk applications for ChrisG. 06-05-2020 12:49 AM
- Karma Re: Linux Auditd: What is the best way to make /var/log/audit/audit.log accessible to a non-root Splunk forwarder? for pbunts. 06-05-2020 12:47 AM
- Karma Re: Splunk catalina.out for java.lang.OutOfMemoryError: PermGen space on remote VM for martin_mueller. 06-05-2020 12:46 AM
- Posted Re: splunk list monitor does not show directories on Monitoring Splunk. 11-02-2018 06:10 AM
- Posted Why does splunk list monitor not show directories? on Monitoring Splunk. 11-01-2018 04:34 PM
- Tagged Why does splunk list monitor not show directories? on Monitoring Splunk. 11-01-2018 04:34 PM
- Tagged Why does splunk list monitor not show directories? on Monitoring Splunk. 11-01-2018 04:34 PM
- Tagged Why does splunk list monitor not show directories? on Monitoring Splunk. 11-01-2018 04:34 PM
- Posted Re: Universal Forwarder shows up as both hostname and fqdn in search engine (Splunk Console) on Splunk Enterprise. 05-11-2018 09:05 PM
- Posted Re: wget, or curl splunk applications on Getting Data In. 05-11-2018 03:36 PM
- Posted wget, or curl splunk applications on Getting Data In. 05-11-2018 02:44 PM
- Tagged wget, or curl splunk applications on Getting Data In. 05-11-2018 02:44 PM
- Tagged wget, or curl splunk applications on Getting Data In. 05-11-2018 02:44 PM
- Tagged wget, or curl splunk applications on Getting Data In. 05-11-2018 02:44 PM
- Tagged wget, or curl splunk applications on Getting Data In. 05-11-2018 02:44 PM
- Posted Re: wget URL for apps on Splunk Search. 05-11-2018 01:29 PM
- Posted Re: Splunk Forwarder Data Verification on Knowledge Management. 04-13-2018 08:26 AM
- Posted Splunk Forwarder Data Verification on Knowledge Management. 04-12-2018 10:05 PM
- Tagged Splunk Forwarder Data Verification on Knowledge Management. 04-12-2018 10:05 PM
- Posted Re: How do I create Splunk users with Chef? on Security. 03-09-2018 01:13 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-02-2018
06:10 AM
So the questions is:
Why am i getting "[No directories monitored.]", when i have :
[root@chef-nonprod-fe1 local]# cat inputs.conf
[default]
[monitor:///var/log/]
[monitor:///var/log/audit/]
[monitor:///var/log/opscode/]
host = chef-nonprod-fe1.a.b.c
[root@chef-nonprod-fe1 local]# pwd
/opt/splunkforwarder/etc/system/local
... View more
11-01-2018
04:34 PM
$/opt/splunkforwarder/bin/splunk list monitor Monitored Directories: [No directories monitored.] Monitored Files: /var/log /var/log/audit /var/log/opscode /var/log/opscode/bookshelf/current
... View more
Labels
- Labels:
-
monitoring console
05-11-2018
09:05 PM
please paste the result of the following while logged in your source node, where UF is running
hostname -A
hostname -d
hostname -i
hostname -s
And your /etc/hosts file <- do not post this on a public forum... i wouldnt post the above without redacting some number of characters too.
... View more
05-11-2018
03:36 PM
Chris I am looking for the apps URLs e.g.
https://splunkbase.splunk.com/app/273/
https://splunkbase.splunk.com/app/1274/
etc etc
... View more
05-11-2018
02:44 PM
I need to install splunk apps using Chef cookbook, but i am unable to find a URL, that will let me use wget or curl, to download app
... View more
05-11-2018
01:29 PM
i second that, as i am using chef to setup apps for splunk on the target nodes
... View more
04-13-2018
08:26 AM
I added the forward-server, but still do not see any event. As for opening the port, that port is servicing hundreds if not thousands of hosts, so on the Enterprise Splunk Server, it is open. Is there any troubleshooting that i can do on the node/client end
... View more
04-12-2018
10:05 PM
I installed Splunk Forwarder on CentOS 7.4 using the following steps:
wget http://xxxxr/Splunk/splunkforwarder-6.6.4-00895e76d346-linux-2.6-x86_64.rpm
Run Splunk as the root user
/opt/splunkforwarder/bin/splunk enable boot-start --accept-license
/opt/splunkforwarder/bin/splunk set deploy-poll a.a.a.a:nnnn
service splunk start
/opt/splunkforwarder/bin/splunk add monitor /var/log
/opt/splunkforwarder/bin/splunk add monitor /opt/splunkforwarder/var/log/splunk
Then i login to Splunk UI, and in the search bar type host=hostname.a.b.c*
I get "No results yet found."
Is there a way to quickly verify that events are being received by Splunk?
... View more
- Tags:
- splunk-enterprise
03-09-2018
01:13 AM
group node['splunk']['user']['username'] do
gid node['splunk']['user']['uid'].to_i
system true if %w(linux).include?(node['os'])
end
user node['splunk']['user']['username'] do
comment node['splunk']['user']['comment']
shell node['splunk']['user']['shell']
gid node['splunk']['user']['username']
uid node['splunk']['user']['uid']
home node['splunk']['user']['home']
system true if %w(linux).include?(node['os'])
end
... View more
04-10-2014
07:01 PM
and this Works!, thanks basic config is SO simple in Splunk, quite amazing. I wish the documentation was more use case driven.
next .....:
extract , or plot only the PermGen log
Setup Notifications ( Email ) upon occurrence of Error
Setup another log parser to get application errors
Correlate the two errors temporally
... View more
04-10-2014
04:00 PM
so the username and password for the command :
/opt/splunkforwarder/bin/splunk add forward-server vm-staging.vm:9997
are local ? meaning, i can choose the password for user splunk, which would be local the forwarder ?
ok i used admin:changeme
/opt/splunkforwarder/bin/splunk add forward-server vm-jenkins-staging.3mhis.vm:9997
Splunk username: admin
Password:
Added forwarding to: vm-staging.vm:9997.
... View more
04-10-2014
10:34 AM
@martin_mueller
more /opt/splunkforwarder/etc/system/local/outputs.conf
forwardedindex.0.whitelist = .
forwardedindex.1.whitelist = _.
[tcpout:default_index] server=vm-staging.vm:9997
... View more
04-10-2014
10:20 AM
I tried to run add forward-server on the forwarder , with the same admin credentials as i use to login to the indexer, but getting error:
/opt/splunkforwarder/bin/splunk add forward-server vm-staging.vm:9997
Splunk username: admin
Password:
Login failed
... View more
04-10-2014
06:55 AM
I am trying to setup Splunk to monitor a remote tomcat instance ( catalina.out ) for messages like permGen Running out of Memory
Specifically:
Exception in thread "http-bio-8080-exec-36" java.lang.OutOfMemoryError: PermGen space
I was able to install Splunk on host A, and on B i have Tomcat running, plys Universal forwarder running with:
/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/inputs.conf
[monitor:///usr/share/apache-tomcat-7.0.47/logs]
sourcetype = access_common
/opt/splunkforwarder/etc/system/local/outputs.conf
forwardedindex.0.whitelist = .
forwardedindex.1.whitelist = _.
[tcpout:default_index] server=<server where splunk server is installed>:9997
So how do i :
1. Make sure the forwarder HAS Connectivity and is able send logs, some command command line utilities perhaps
2. How do i setup the receiver / splunk server ?
... View more
- Tags:
- tomcat
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
