About willsy

willsy · ‎07-15-2021

Good morning, So if i did your search without specifically asking for that EventRecordID i have the three sources XmlWinEventLog:Application XmlWinEvenLog:Security XmlWinEventLog:System If however i do the same with that specific EventRecordID it is only aligned to source; XmlWinEventLog:Security Which means that it is coming from only one source.

willsy · ‎07-14-2021

Hey codebuilder, the source is in the second pic, it shows all source and sourcetypes are the same for all dupicates. i am using the standard windows app, there is no log rotating or zip as it is purely the windows events being monitored.

willsy · ‎07-14-2021

hello, i am monitoring windows event logs and ingesting them to my indexers, the issue is that even with a unique EventRecordID i am seeing multiple events in Splunk, sometimes up to 28. second to that, when i complete the two searches in the picture i can see that the same event is being indexed multiple times (14) between 13:33:31 and 13:36:00 any help on how to rectify this issue is greatly appreciated. please see attached the two searches showing multiple indexed results and also multiple indexed times.

willsy · ‎06-11-2021

still works 7 years later. champion

willsy · ‎06-11-2021

You are a scholar and a gent, 7 years on and what you put is still being helpful. Thank you so much

willsy · ‎05-26-2021

hello, thank you so much, this sorted it however the network ramifications was not expected, the data that is usually 200 events an hour went up to 45000 and saturated out license, but its fine. thank you

willsy · ‎05-03-2021

Hello, Could someone tell me what i am required to do to sort this issue out please? I have inputs going into my HF however it seems as though my HF index queue is blocked and backing up the rest of my queues. 05-03-2021 09:25:58.559 +0100 INFO Metrics - group-queue, name=indexqueue, blocked=true, max_size_kb=500, current_size_kb=499, current_size=1307, largest_size=1500, smallest_size=170 i assume (if you assume it makes an ass out of you and me) that i need to change the server.conf max size however i just want to check before i go balls deep on what the repercussions are and what i should change. Please note that i am not actually indexing any data and purely forwarding them on to a third party system. obviously if i am wrong then please tell me. Any help is greatly appreciated.

willsy · ‎10-29-2020

Hi @inventsekar what does that search specifically tell me? i am hoping that it is the hosts that are being forwarded by the HF if that is the case then bosh, my stuff works as it is meant to and your search gets the karma.

willsy · ‎10-29-2020

Hello, Are there searches or any log files that will tell me what is being forwarded from my heavy forwarder? I have a multi site, clustered splunk environment that ingests all its own personal logs first but then sends all of the data to a third party via a heavy forwarder and data diode. I do not have access to the data once they have been sent from the HF so i cannot assess what has been sent. Are there any splunk techniques, searches, log files i can view from my heavy forwarder to determine what data have been sent to the data diode? I can provide config files if required.

willsy · ‎10-08-2020

So if thats the case, how do i have two different stanzas when that is the information that i am gathering? That stanza is the location of the information, it is the file path to the information that i need.

willsy · ‎10-08-2020

hello, i am trying to send wineventlogs from my machines to my clustered indexer and also send the same event logs but in Xml format to a heavy forwarder for third party. my inputs.conf looks like this [WinEventLog://security] disabled = 0 index = xxxx renderXml = false [WinEventLog://security] disabled = 0 renderXml = true _TCP_ROUTING = heavy1 my outputs.conf is the following [tcpout:group1] indexerDiscovery = idxc1 autoLBVolume = 65536 [indexer_discovery:idxc1] master_uri = https://serverip:serverport pass4SymmKey = xxxx cxn_timeout = 300 [tcpout:heavyforwarder] defaultGroup = heavy1 [tcpout:heavy1] server = serverip:serverport does anyone know why it now does not send to my clustered indexers? know that i did put _TCP_ROUTING = group1 under the non Xml event logs in inputs.conf and still didnt work. cheers in advance

willsy · ‎08-01-2020

So this is actually a really simple solution to one i believed to be alot harder. i checked all of my network firewalls, GPO firewalls, host based firewalls and it turned out the data diode was not actually accepting anything on that particular port. I would also point out that if you are trying to send data from splunk to a third party i would HIGHLY advise going down the heavy forwarder route. much cleaner simpler and far far less hassle.

willsy · ‎07-15-2020

Hello, i have the following error on my cluster masters (XXXXA13) web gui. Search peer XXXXP13 has the following message: The TCP output processor has paused the data flow. Forwarding to host_dest= inside output group group1 from host_src=XXXXP13 has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data On the deployment server XXXXP13 i have the following error message on the web gui. The TCP output processor has paused the data flow. Forwarding to host_dest= inside output group group1 from host_src=XXXXXP13 has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data If i then have a look at splunkd on the deployment server i have the following errors IndexerDiscoveryHeartbeatThread - Error in Indexer Discovery communication. Verify that the pass4SymmKey set under [indexer_discovery:group1] in 'outputs.conf' matches the same setting under [indexer_discovery] in 'server.conf' on the Cluster Master. [uri=https://XXXXXA13:8089/services/indexer_discovery http_code=502 http_response="Unauthorized"] WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to host_dest= inside output group group1 from host_src=XXXXXP13 has been blocked for blocked_seconds=158470. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. Any help is greatly appreciated. This only happened after upgrading to 8.4.1

willsy · ‎06-22-2020

Hello, I have an index cluster and would like to send ALL data to a non splunk third party end point. is this possible? this is the props.conf however for an index cluster where should i configure these files? the second configuration is the transforms.conf the final configuration is the outputs.conf [syslog] TRANSFORMS-routing = routeAl [routeAll] REGEX=(.) DEST_KEY=_TCP_ROUTING FORMAT=Everything [tcpout] defaultGroup=nothing [tcpout:Everything] disabled=false sendCookedData=false server=10.1.12.1:10514 my concern is that i actually just want to forward all of my data. is there a particular configuration needed for this? or any ideas? many thanks Willsy

willsy · ‎06-22-2020

Hey mate, just wondering how you got along with this? im having the same issue at the moment, i have multiple sites and multiple clustered indexers needing to send to one specific indexer.

willsy · ‎05-09-2020

hello, i have yes, the main reason for the index=* is for obfuscation whilst i asked the question, hence X_number and X_token again. I believe i have found out what is causing it, although i do not know the fix for it. If i complete the search in "fast mode" i get no results, which is by deafult what dashbaords are set up for. so i believe i have to set the dashbaord up to search in verbose mode. OR ammend the search query

willsy · ‎05-09-2020

Hello, i have what i believe is a basic search and what should work however it doesnt seem to display anything when i search for it. Effectively what i want it to do is, when you type in X number that will pass into the search as X_token and then search for the number you have just input. could i have some guidance on this please. Covid_19 <input type="text" token="X_token" searchWhenChanged="false"> <label>Enter X number for individual information</label> </input> <panel> <table> <search> <query>index=* $X_token$ | table "X number" "First Name" Surname "Mobile Number" Cell Role</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel>

willsy · ‎02-10-2020

Hello, Just to confirm I have sold the problem. So after I upgraded my search heads to 8.01 I noticed I could not see the web GUI. I looked at my splunkd.log and said my application server was at fault. I don't have an application server but this I took for my deployment server but that it was an application that was the issue. i looked at the web_service.log and noticed down the bottom that there was a particular application stopping my whole search head environment from working. For me this was the splunk for nix application and TA. steps i did to rectify the issue. 1) looked into splunkd.log and saw the application server fault 2) looked into web_services.log and it literally told me which application was at fault 3) i stopped my search heads and deployment server 4) on the deployment server i moved the unix application into disabled applications 5) on the unix application app.conf i also set it to disable to make sure. 6) restarted my deployment server 7) restarted my search heads 8) logged into my search head web GUI if anyone is having a similar issue i can go into detail of files etc. but yea, all sorted.

willsy · ‎02-09-2020

Hello. After upgrading from 7.3 to 8.01 my search heads no longer work. It will not load up the search head web page. Any ideas? If I load from a backup back to 7.3 all of my real time indexed data is there and still working and I can search it all. If no ideas. Is there a way to keep the config but apply it to a new search head? Effectively rebuilding the search head from scratch but with a 8.01 build on it? Either will suffice. Many thanks in advance

willsy · ‎11-01-2019

I am trying to map my datacentre cabinet heat locations to their respective cabinets on a top down view of the datacentre using visio. Is there a way to map my temperature to the correct rack location without using Lat/Long?

Posts	36
Solutions	3
Karma Given	5
Karma Received	2
Member Since	‎12-06-2018

Online Status	Offline
Date Last Visited	‎08-24-2021 07:24 AM

duplicate events, multiple indexed times

Heavy Forwarder blocked indexqueue

Trouble-shooting events forwarded from a heavy for...

winEventLogs and XmlWinEventLogs _TCP_ROUTING

The TCP output processor has paused the data flow.

index cluster sending all data to third party

Form/Dashboard token for search

Search heads cannot connect to web login after 8.0...

Map heat locations without Lat / Long

Splunk forwarder behind a one way data diode. UDP ...

Re: duplicate events, multiple indexed times

Re: duplicate events, multiple indexed times

duplicate events, multiple indexed times

Re: Why is cluster master stuck at "Bundle validat...

Re: Why is cluster master stuck at "Bundle validat...

Re: Heavy Forwarder blocked indexqueue

Heavy Forwarder blocked indexqueue

Re: Trouble-shooting events forwarded from a heavy...

Trouble-shooting events forwarded from a heavy for...

Re: winEventLogs and XmlWinEventLogs _TCP_ROUTING

winEventLogs and XmlWinEventLogs _TCP_ROUTING

Re: The TCP output processor has paused the data f...

The TCP output processor has paused the data flow.

index cluster sending all data to third party

Re: Forward indexed logs from an Indexer Cluster t...

Re: Form/Dashboard token for search

Form/Dashboard token for search

Re: Search heads cannot connect to web login after...

Search heads cannot connect to web login after 8.0...

Map heat locations without Lat / Long