Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mikelanghorst
mikelanghorst
Motivator
Member since:
11-03-2010
2 weeks ago
Community Statistics
| Posts | 283 |
| Solutions | 20 |
| Karma Given | 359 |
| Karma Received | 223 |
| Member Since | 11-03-2010 |
Activity Feed
- Got Karma for Re: What are the ports that I need to open?. 07-28-2020 03:20 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-13-2020 10:52 PM
- Karma Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist" for LukeMurphey. 06-05-2020 12:49 AM
- Karma Re: New forwarder: An Admin password is required??? for xpac. 06-05-2020 12:49 AM
- Karma Re: Where to add certificate info for port 8089? for dwaddle. 06-05-2020 12:48 AM
- Karma Re: what could be the reason for some splunk sessions observed to be in the DDMMYYYY format ( ideally it is in MMDDYYYY format)? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: What are my options to specify the user to start splunk service as on linux for yannK. 06-05-2020 12:48 AM
- Karma Re: Community Supported apps - should they have an external repo for the community to assist in improving? for Damien_Dallimor. 06-05-2020 12:47 AM
- Karma Re: Filtering out 90% log events from indexing for dshpritz. 06-05-2020 12:47 AM
- Karma Re: Splunk installed failed to create splunk account on RHEL for grijhwani. 06-05-2020 12:47 AM
- Karma Re: How to write a search that returns the most recent event for a sourcetype on every host? for dwaddle. 06-05-2020 12:47 AM
- Karma Re: What special characters are available for use with rex and regex and what are their functions? for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: How to implement Splunk SSO with Google Authentication Proxy when the username is not an email address? for dwaddle. 06-05-2020 12:47 AM
- Karma Re: Why is a props.conf change on a universal forwarder not being applied in a multisite Splunk 6.2.0 indexer clustering environment? for gfuente. 06-05-2020 12:47 AM
- Karma Re: IP version agnostic regular expression for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: How to deploy the Splunk Add-on for Check Point OPSEC LEA in a multisite indexer cluster? for Chubbybunny. 06-05-2020 12:47 AM
- Karma Re: Export to PDF Unable to Save for spammenot66. 06-05-2020 12:47 AM
- Karma Re: Are Splunk consultants and Splunk developers the same? If not, what are the roles and responsibilities for both? for ChrisG. 06-05-2020 12:47 AM
- Karma Re: Are Splunk consultants and Splunk developers the same? If not, what are the roles and responsibilities for both? for alacercogitatus. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 1 |
04-18-2019
01:30 PM
On a forwarder it's rare that I've used it, other than checking the status of the tailingProcessor and such.
https://www.splunk.com/blog/2011/01/02/did-i-miss-christmas-2.html
... View more
11-10-2017
09:11 AM
Not sure I'd call it solved, when they say in there it then breaks on rhel 6.
... View more
11-07-2017
12:22 PM
I notice with RHEL 7 (7.3 at least), several of the scripts currently do not work.
- interfaces.sh: returns no data
- services.sh: doesn't return systemctl service status
Are these planned to be fixed soon? If I were to fix this locally, who should I forward suggested fixes?
... View more
10-20-2017
02:36 PM
Maybe I'm still new to SHC's, but I was expecting that since adding a new app typically required restarts, that it was doing this in the background when applying the shcluster-bundle.
Performing a rolling-restart did fix the problem for me, I'm on RHEL 7.
Thanks for your assistance Luke.
... View more
10-17-2017
03:03 PM
Both exist, and web.conf has that content on all 3 of my SHC nodes.
... View more
10-17-2017
02:42 PM
just more page not found messages:
2017-10-12 11:59:01,664 INFO [59dfbb75a77fadc4208750] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:34:02,935 INFO [59dfa78aec7f695c31cbd0] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:34:02,717 INFO [59dfa78ab57f695c31ce90] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:28:37,443 INFO [59dfa6456e7f695c57aa10] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:28:33,226 INFO [59dfa641357f695c57aa50] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:27:03,380 INFO [59dfa5e75f7f695c637710] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:27:03,315 INFO [59dfa5e74e7f698052f550] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
... View more
10-17-2017
02:20 PM
Ah, that gives something:
2017-10-16 11:22:00,555 INFO [59e4f8c88b7f1ae85b9d90] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
... View more
10-16-2017
09:10 AM
Also of note, in your troubleshooting suggestion:
index=_internal sourcetype="lookup_editor_controller"
Returns no results.
... View more
10-16-2017
08:48 AM
Running Splunk as root, and logged in as Admin. No lookup files can be viewed/opened in the app.
... View more
10-16-2017
08:46 AM
I'm not able to load any lookup files from any apps installed apps, nor create new.
... View more
10-16-2017
08:45 AM
I've only tried 2.7.1, then after seeing mention in github about a change for SHC I tried the git version as well. I'll try rolling back to a 2.6 when I have a few minutes for restarts.
... View more
10-13-2017
04:12 PM
Having the same issues here, even after pulling the latest from GIT.
... View more
04-28-2017
03:41 PM
1 Karma
wiping all data isn't really a realistic answer
... View more
08-30-2016
09:30 AM
Agreeing with jkat54 here, lower version numbers sending to higher is ok, it's the reverse to avoid.
... View more
07-19-2016
09:21 AM
After I upgraded my Splunk environment to 6.4.1, my users are reporting that they are repeatedly prompted as a new user would to take the tour for the app. I notice for users that are not getting it, under etc/users/username/app/local/ui-tour.conf will have a viewed = 1, while other users do not.
Any idea why this is occurring?
... View more
04-12-2016
10:58 AM
I can't explain why it was decided to have this field alias, but it's within the [opsec:ips] stanza
[opsec:ips]
...
FIELDALIAS-dvc_for_opsec = orig as dvc, orig as dvc_ip
FIELDALIAS-signature_for_ips = Protection_Name as signature
FIELDALIAS-src_for_opsec = orig as src, orig as src_ip
I'm not sure if the source formatting has changed or ??
... View more
04-08-2016
01:50 PM
For 6.3, the issue ended up being for me the versions of the SA-Hyrda and SA-Utils had gotten out of sync, therefore couldn't communicate to be able to start the port 8008 service
... View more
03-14-2016
09:35 AM
Same splunk version.
... View more
03-11-2016
07:09 PM
A few weeks ago the OS was updated, and the Splunk HF was updated to 6.3. This was Splunk VMWare 3.1.0, but have updated to 3.2.1 to no affect.
I noticed today that neither the performance, nor inventory data is being collected. In the logs I see messages about not being able to connect:
2016-03-11 19:07:11,366 ERROR [ta_vmware_collection_worker://theta:10258] Problem with hydra worker ta_vmware_collection_worker://theta:10258: [HydraGatewayAdapter] could not authenticate with gateway after 3 retries
Traceback (most recent call last):
File "/app/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_worker.py", line 507, in run
self.establishGateway()
File "/app/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_worker.py", line 428, in establishGateway
hga = HydraGatewayAdapter(self.node_path, self.session_key, self.gateway_uri)
File "/app/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_common.py", line 66, in init
self.authenticate_gateway()
File "/app/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_common.py", line 83, in authenticate_gateway
raise Exception("[HydraGatewayAdapter] could not authenticate with gateway after %s retries" % (str(retry)))
Exception: [HydraGatewayAdapter] could not authenticate with gateway after 3 retries
Other indications that it's should be connecting on port 8008, but there's no listening process. troubleshooting ideas, or resolution?
... View more
01-20-2016
07:29 PM
Officially, no 77.30 is not supported and my case regarding issues on 77.30 was closed as such.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Karma from
