Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rob_lamb
rob_lamb
Explorer
Member since:
09-29-2015
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 3 |
| Member Since | 09-29-2015 |
Activity Feed
- Karma Re: When adding a search peer I get error "In handler 'distsearch-peer': Error while sending public key to search peer: No route to host" for Jeremiah. 06-05-2020 12:47 AM
- Got Karma for Re: How do I configure custom sourcetypes on Universal Forwarders and Indexers?. 06-05-2020 12:47 AM
- Got Karma for Splunk DB Connect 2: Why am I getting Winsock 10053 error trying to validate connections to MS-SQL and MySQL databases?d. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect 2: Why am I getting Winsock 10053 error trying to validate connections to MS-SQL and MySQL databases?d. 06-05-2020 12:47 AM
- Posted Re: EventGen: Why is the app not appearing to generate events after modifying the .conf file? on All Apps and Add-ons. 10-03-2016 09:27 AM
- Posted EventGen: Why is the app not appearing to generate events after modifying the .conf file? on All Apps and Add-ons. 09-30-2016 12:51 PM
- Tagged EventGen: Why is the app not appearing to generate events after modifying the .conf file? on All Apps and Add-ons. 09-30-2016 12:51 PM
- Tagged EventGen: Why is the app not appearing to generate events after modifying the .conf file? on All Apps and Add-ons. 09-30-2016 12:51 PM
- Posted Re: How do I configure custom sourcetypes on Universal Forwarders and Indexers? on Getting Data In. 02-03-2016 07:47 AM
- Posted How do I configure custom sourcetypes on Universal Forwarders and Indexers? on Getting Data In. 02-02-2016 02:17 PM
- Tagged How do I configure custom sourcetypes on Universal Forwarders and Indexers? on Getting Data In. 02-02-2016 02:17 PM
- Tagged How do I configure custom sourcetypes on Universal Forwarders and Indexers? on Getting Data In. 02-02-2016 02:17 PM
- Tagged How do I configure custom sourcetypes on Universal Forwarders and Indexers? on Getting Data In. 02-02-2016 02:17 PM
- Tagged How do I configure custom sourcetypes on Universal Forwarders and Indexers? on Getting Data In. 02-02-2016 02:17 PM
- Posted Re: When adding a search peer I get error "In handler 'distsearch-peer': Error while sending public key to search peer: No route to host" on Deployment Architecture. 01-29-2016 03:43 PM
- Posted When adding a search peer I get error "In handler 'distsearch-peer': Error while sending public key to search peer: No route to host" on Deployment Architecture. 01-29-2016 10:53 AM
- Tagged When adding a search peer I get error "In handler 'distsearch-peer': Error while sending public key to search peer: No route to host" on Deployment Architecture. 01-29-2016 10:53 AM
- Tagged When adding a search peer I get error "In handler 'distsearch-peer': Error while sending public key to search peer: No route to host" on Deployment Architecture. 01-29-2016 10:53 AM
- Tagged When adding a search peer I get error "In handler 'distsearch-peer': Error while sending public key to search peer: No route to host" on Deployment Architecture. 01-29-2016 10:53 AM
- Posted Re: Splunk DB Connect 2: Why am I getting Winsock 10053 error trying to validate connections to MS-SQL and MySQL databases?d on All Apps and Add-ons. 10-27-2015 03:23 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-03-2016
09:27 AM
I have already downloaded and installed the "master" branch from GIT as the application "SA-Eventgen" per the tutorial instructions I have been using.
... View more
09-30-2016
12:51 PM
I am trying to run EventGen's tutorial 1 on a Windows host. Generated data is not going to my test index. I have tried modifying the .conf file to:
[search2.csv]
mode = replay
sampletype = csv
timeMultiple = 2
backfill = -15m
#backfillSearch = index=main sourcetype=splunkd
backfillSearch = index=cust1_index sourcetype=eventgen
index = cust1_index
sourcetype = eventgen
#outputMode = stdout
#outputMode = splunkstream
outputMode = modinput
splunkHost = localhost
splunkUser = admin
splunkPass =
When I look at eventgen.log after a reboot all I see is:
2016-09-30 12:26:36,206 INFO module='config' sample='null': Running as Splunk embedded
2016-09-30 12:26:36,503 INFO module='config' sample='null': Retrieving eventgen configurations from /configs/eventgen
When I search _internal for "eventgen" I see the event "Starting EventGen", followed by a series of GET and POST statements.
But no data is going to the index cust1_index.
... View more
02-03-2016
07:47 AM
1 Karma
I've added "sourcetype = soaptype" to my [soaptype] stanza on the indexer's props.conf per your note above, and restarted the indexer. I also cleaned up my outputs.conf file on my Universal Forwarder and restarted that.
When I dropped in a new file, the indexer picked it up and parsed it correctly. Thanks very much for the assistance!
... View more
02-02-2016
02:17 PM
I have two Linux VMs set up, one with a Universal Forwarder and one with an Indexer. I have a script that generates dummy data (on the forwarder) that needs a custom sourcetype set up in order to parse the events correctly.
On the Universal Forwarder props.conf is currently empty, and inputs.conf contains:
[monitor:///home/splunk/data/data1*.soap]
_TCP_ROUTING = SOAP
disabled = false
sourcetype = soaptype
On the Indexer, props.conf contains:
[soaptype]
BREAK_ONLY_BEFORE = <SOAP-ENV:Envelope
TIME_PREFIX = <ns1:dateRequested>
As of right now my events aren't making it into the indexer at all. If I remove the sourcetype from inputs.conf and props.conf, data appears, but it is splitting the events incorrectly.
Any suggestions? Many thanks!
... View more
01-29-2016
03:43 PM
I tried telnet and it failed. This made me realize that I hadn't opened port 8089. I did that, and I can now add the search peer. Thank you for the assistance.
... View more
01-29-2016
10:53 AM
I have two Linux VMs running on my Windows 7 box. I'm trying to configure one as a search peer and one as the search head. Inside their Linux environments, each box can ping the other on a VM internal network.
On the search head, I am trying to add a new search peer.
For the "Peer" field, I've typed in the search peer's IP address, with ":8089" appended.
For "Authentication" I've tried both an admin account on the search peer, as well as the Splunk admin account credentials for the search peer.
No matter what I try, I get the error in the question above. Any help would be appreciated.
... View more
10-27-2015
03:23 PM
1 Karma
OK. Turns out it appears to be related to the Python runtime error I was seeing. I fixed that via renaming my Python folder:
1) I uninstalled Splunk
2) I renamed my Python folder from:
C:\Python27
to:
C:\Python_old
3) I reinstalled Splunk with no errors
When I reinstalled/reconfigured DB Connect 2 I am now able to access MySQL without any of the Winsock errors that I have seen previously.
... View more
10-27-2015
03:21 PM
OK, I figured this one out. For some reason I had to rename my Python folder.
1) I uninstalled Splunk
2) I renamed my Python folder from:
C:\Python27
to:
C:\Python27_old
3) I reinstalled Splunk with no errors
... View more
10-26-2015
09:18 AM
Thank you for the feedback, but I may need a little more guidance.
Firewall: I'm using a Symantec firewall, auto configured by our IT department. A co-worker is able to get Splunk/DB Connect 2 working with the same firewall config, so I don't think that is the issue?
Splunk roles: I'm using the Admin login, with the following roles (the default roles + can_delete):
admin
can_delete (I know, not a best practice)
db_connect_admin
db_connect_user
Filesystem: My domain login is an admin on the laptop, so I'm not sure what permissions would need to be checked?
... View more
10-19-2015
10:17 AM
1 Karma
I have Splunk Enterprise installed on the same laptop as MS-SQL Server and MySQL. I'm trying to use Splunk DB Connect 2 to access the databases. In both cases I get "internal server error" messages when trying to validate and/or save connections. When I check splunkd.log, I see:
10-19-2015 09:32:31.036 -0700 ERROR HttpListener - Exception while processing request from 127.0.0.1 for /en-US/custom/splunk_app_db_connect/proxy/servicesNS/admin/-/db_connect/lookups?output_mode=json&count=-1&search=connection%3Dundefined&_=1445272313039: Connection closed by peer
10-19-2015 09:32:31.036 -0700 ERROR HttpListener - Handler for /en-US/custom/splunk_app_db_connect/proxy/servicesNS/admin/-/db_connect/lookups?output_mode=json&count=-1&search=connection%3Dundefined&_=1445272313039 sent a 0 byte response after earlier claiming a Content-Length of 251!
10-19-2015 09:33:22.178 -0700 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/nobody/splunk_app_db_connect/db_connect/connections/-/status: Winsock error 10053
10-19-2015 09:33:24.863 -0700 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/-/db_connect/explore/mySQL_Test: Winsock error 10053
10-19-2015 09:33:25.390 -0700 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/-/db_connect/explore/mySQL_Test: Winsock error 10053
Note that I am also seeing an R6034 error on startup with Python.EXE. Not sure if this is related, it is logged as a separate question.
... View more
10-19-2015
10:10 AM
I'm seeing the same issue. When I tried:
splunk.exe envvars > setSplunkEnv.bat & setSplunkEnv.bat
setSplunkEnv.bat is an empty file.
... View more
