About nvij_splunk

nvij_splunk · ‎08-18-2020

Check if firewall running? external firewall maybe? iptables routing messing things up? can you see the data reaching the box with tcpdump? The issue was resolved by disabling the SELinux firewall.

nvij_splunk · ‎08-18-2020

only able to receive logs sent by localhost and not from external hosts.

nvij_splunk · ‎08-18-2020

try to set sysctl net.ipv4.all.rp_filter=0 https://knowledge.broadcom.com/external/article/168060/packets-silently-dropped-due-to-rpfilter.html https://access.redhat.com/solutions/53031

nvij_splunk · ‎08-18-2020

data is coming in only for source types sc4s: events and sc4s: fallback. There are multiple compatible devices like (cisco ASA) set up to send data via UDP 514 at the server and nothing is being sent to Splunk. Does anyone have any ideas on how to troubleshoot this? (podman with systemd) There are 2 network interfaces

nvij_splunk · ‎08-18-2020

Check this: https://splunk-connect-for-syslog.readthedocs.io/en/1.9.0/configuration/#override-index-or-metadata-based-on-host-ip-or-subnet-compliance-overrides

nvij_splunk · ‎08-18-2020

I want to route Syslog events to different indexes based on hostname, best to do this on indexer with transforms?

nvij_splunk · ‎08-18-2020

Yes, should be fine just not tested. Make the following change for ubuntu16 #Ubuntu 16 path ExecStartPre=/bin/bash -c "/bin/systemctl set-environment SC4SHOST=$(hostname -s)" #ExecStartPre=/usr/bin/bash -c "/usr/bin/systemctl set-environment SC4SHOST=$(hostname -s)"

nvij_splunk · ‎08-18-2020

Hi, is it possible to run SC4S temporarily in Ubuntu 16? Doesn´t appear as supported but I'm not sure if it's also incompatible. Podman appears to be only available in ubuntu 18 but docket is available for 16

nvij_splunk · ‎08-06-2019

Try this - jdbc:jtds:sybase://hostname:port/database

nvij_splunk · ‎07-12-2018

I am new to app development. I am not able to find out a way to add default token model to my js. It will be really helpful if you can guide me.

Posts	10
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎07-12-2018

Online Status	Offline
Date Last Visited	‎11-13-2024 12:35 PM

Unable to receive data from external host

data type other than sc4s:events and sc4s:fallback...

send data to different indexes splunk connect for ...

SC4S on Ubuntu16?

Re: Unable to receive data from external host

Unable to receive data from external host

Re: data type other than sc4s:events and sc4s:fall...

data type other than sc4s:events and sc4s:fallback...

Re: send data to different indexes splunk connect ...

send data to different indexes splunk connect for ...

Re: SC4S on Ubuntu16?

SC4S on Ubuntu16?

Re: Why is DBConnect for Sybase giving the followi...

Re: How to call a python script from an html view?

Are you a member of the Splunk Community?