Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Apps and Add-ons
- :
- About mikelanghorst
mikelanghorst
Motivator
Member since:
11-03-2010
03-25-2024
Community Statistics
| Posts | 285 |
| Solutions | 20 |
| Karma Given | 359 |
| Karma Received | 227 |
| Member Since | 11-03-2010 |
Activity Feed
- Got Karma for Re: What are the ports that I need to open?. 03-17-2022 07:11 AM
- Got Karma for Re: What are the ports that I need to open?. 08-18-2021 05:28 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-19-2021 09:48 AM
- Got Karma for Re: What are the ports that I need to open?. 07-28-2020 03:20 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-13-2020 10:52 PM
- Karma Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist" for LukeMurphey. 06-05-2020 12:49 AM
- Karma Re: New forwarder: An Admin password is required??? for xpac. 06-05-2020 12:49 AM
- Karma Re: Where to add certificate info for port 8089? for dwaddle. 06-05-2020 12:48 AM
- Karma Re: what could be the reason for some splunk sessions observed to be in the DDMMYYYY format ( ideally it is in MMDDYYYY format)? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: What are my options to specify the user to start splunk service as on linux for yannK. 06-05-2020 12:48 AM
- Karma Re: Community Supported apps - should they have an external repo for the community to assist in improving? for Damien_Dallimor. 06-05-2020 12:47 AM
- Karma Re: Filtering out 90% log events from indexing for dshpritz. 06-05-2020 12:47 AM
- Karma Re: Splunk installed failed to create splunk account on RHEL for grijhwani. 06-05-2020 12:47 AM
- Karma Re: How to write a search that returns the most recent event for a sourcetype on every host? for dwaddle. 06-05-2020 12:47 AM
- Karma Re: What special characters are available for use with rex and regex and what are their functions? for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: How to implement Splunk SSO with Google Authentication Proxy when the username is not an email address? for dwaddle. 06-05-2020 12:47 AM
- Karma Re: Why is a props.conf change on a universal forwarder not being applied in a multisite Splunk 6.2.0 indexer clustering environment? for gfuente. 06-05-2020 12:47 AM
- Karma Re: IP version agnostic regular expression for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: How to deploy the Splunk Add-on for Check Point OPSEC LEA in a multisite indexer cluster? for Chubbybunny. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 |
11-10-2017
09:11 AM
Not sure I'd call it solved, when they say in there it then breaks on rhel 6.
... View more
11-07-2017
12:22 PM
I notice with RHEL 7 (7.3 at least), several of the scripts currently do not work.
- interfaces.sh: returns no data
- services.sh: doesn't return systemctl service status
Are these planned to be fixed soon? If I were to fix this locally, who should I forward suggested fixes?
... View more
10-20-2017
02:36 PM
Maybe I'm still new to SHC's, but I was expecting that since adding a new app typically required restarts, that it was doing this in the background when applying the shcluster-bundle.
Performing a rolling-restart did fix the problem for me, I'm on RHEL 7.
Thanks for your assistance Luke.
... View more
10-17-2017
03:03 PM
Both exist, and web.conf has that content on all 3 of my SHC nodes.
... View more
10-17-2017
02:42 PM
just more page not found messages:
2017-10-12 11:59:01,664 INFO [59dfbb75a77fadc4208750] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:34:02,935 INFO [59dfa78aec7f695c31cbd0] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:34:02,717 INFO [59dfa78ab57f695c31ce90] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:28:37,443 INFO [59dfa6456e7f695c57aa10] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:28:33,226 INFO [59dfa641357f695c57aa50] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:27:03,380 INFO [59dfa5e75f7f695c637710] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:27:03,315 INFO [59dfa5e74e7f698052f550] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
... View more
10-17-2017
02:20 PM
Ah, that gives something:
2017-10-16 11:22:00,555 INFO [59e4f8c88b7f1ae85b9d90] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
... View more
10-16-2017
09:10 AM
Also of note, in your troubleshooting suggestion:
index=_internal sourcetype="lookup_editor_controller"
Returns no results.
... View more
10-16-2017
08:48 AM
Running Splunk as root, and logged in as Admin. No lookup files can be viewed/opened in the app.
... View more
10-16-2017
08:46 AM
I'm not able to load any lookup files from any apps installed apps, nor create new.
... View more
10-16-2017
08:45 AM
I've only tried 2.7.1, then after seeing mention in github about a change for SHC I tried the git version as well. I'll try rolling back to a 2.6 when I have a few minutes for restarts.
... View more
10-13-2017
04:12 PM
Having the same issues here, even after pulling the latest from GIT.
... View more
04-12-2016
10:58 AM
I can't explain why it was decided to have this field alias, but it's within the [opsec:ips] stanza
[opsec:ips]
...
FIELDALIAS-dvc_for_opsec = orig as dvc, orig as dvc_ip
FIELDALIAS-signature_for_ips = Protection_Name as signature
FIELDALIAS-src_for_opsec = orig as src, orig as src_ip
I'm not sure if the source formatting has changed or ??
... View more
04-08-2016
01:50 PM
For 6.3, the issue ended up being for me the versions of the SA-Hyrda and SA-Utils had gotten out of sync, therefore couldn't communicate to be able to start the port 8008 service
... View more
03-14-2016
09:35 AM
Same splunk version.
... View more
03-11-2016
07:09 PM
A few weeks ago the OS was updated, and the Splunk HF was updated to 6.3. This was Splunk VMWare 3.1.0, but have updated to 3.2.1 to no affect.
I noticed today that neither the performance, nor inventory data is being collected. In the logs I see messages about not being able to connect:
2016-03-11 19:07:11,366 ERROR [ta_vmware_collection_worker://theta:10258] Problem with hydra worker ta_vmware_collection_worker://theta:10258: [HydraGatewayAdapter] could not authenticate with gateway after 3 retries
Traceback (most recent call last):
File "/app/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_worker.py", line 507, in run
self.establishGateway()
File "/app/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_worker.py", line 428, in establishGateway
hga = HydraGatewayAdapter(self.node_path, self.session_key, self.gateway_uri)
File "/app/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_common.py", line 66, in init
self.authenticate_gateway()
File "/app/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_common.py", line 83, in authenticate_gateway
raise Exception("[HydraGatewayAdapter] could not authenticate with gateway after %s retries" % (str(retry)))
Exception: [HydraGatewayAdapter] could not authenticate with gateway after 3 retries
Other indications that it's should be connecting on port 8008, but there's no listening process. troubleshooting ideas, or resolution?
... View more
01-20-2016
07:29 PM
Officially, no 77.30 is not supported and my case regarding issues on 77.30 was closed as such.
... View more
01-20-2016
07:28 PM
The response I've gotten is that 77.30 is not supported, and I've gotten no response as to when it may be supported.
... View more
01-20-2016
07:27 PM
where did you get the LEA 2.10?
Could you provide more details, was it the full 2.10 app you're using?
... View more
11-24-2015
04:13 PM
I'd ask the easy question first. Are you searching in index=wineventlog? Or have your role to search all internal indexes?
This response likely doesn't rate as an answer yet.
... View more
10-12-2015
02:52 PM
Asking the most basic question: Did you actually configure inputs?
Edit: The Splunk_TA_windows inputs aren't actually enabled when you download them from SplunkBase.
... View more
10-12-2015
02:45 PM
It's not asking about SPLUNK_HOME, but rather $HOME, of the user splunk runs as.
... View more
08-07-2015
09:42 AM
splunksurekha -
Are you either running the search on your License Master or are you sure that the license master is forwarding to your indexers? Looking at the license log itself it going to be to be difficult, since it's only reporting in small increments. Something like the search kendrickt gives is what you'll need to show how it adds up.
... View more
05-13-2015
10:47 AM
Absolutely, I wouldn't want it a requirement by any means. But maybe something in the submission asking "Is there an external repository" as a gentle nudge so that the submitter considers it.
Thanks for the feedback Damien.
... View more
05-13-2015
10:07 AM
edit: typo, replacing approving with improving
... View more
05-13-2015
10:05 AM
2 Karma
As time goes on I see that some of the community supported apps languish behind, not being updated to support later splunk versions If they're going to be community supported, shouldn't we have them in an available external code repository like github?
For a widely known vendor that intends to support it long term this may not be a huge issue, but i've even seen times where Splunk apps could use something to allow easier improvement by users (Splunk_TA_nix scripts for example). Though they've been receptive in the past for improvements sent by mail. But for community supported apps I think it would be very helpful to have an external repo where other users could more easily assist in improving/maintaining these apps.
Yes, I'd agree that it should be a decision made by the submitter, but should it be encouraged to have this?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-25-2024
05:29 PM
|
Karma given to
