Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dfgrtKJH
dfgrtKJH
Path Finder
Member since:
01-07-2019
12-22-2022
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 4 |
| Member Since | 01-07-2019 |
Activity Feed
- Got Karma for Re: error in savedsearches.conf. 08-03-2023 03:47 AM
- Posted Re: error in savedsearches.conf on Splunk Enterprise. 12-22-2022 01:06 AM
- Posted Re: error in savedsearches.conf on Splunk Enterprise. 11-08-2022 02:50 AM
- Posted Re: error in savedsearches.conf on Splunk Enterprise. 11-08-2022 01:42 AM
- Karma When will Splunk Enterprise 8.0.1 be released? for isbjorn. 06-05-2020 12:50 AM
- Karma Re: When will Splunk Enterprise 8.0.1 be released? for agneticdk. 06-05-2020 12:50 AM
- Karma Re: When will Splunk Enterprise 8.0.1 be released? for ffloimair. 06-05-2020 12:50 AM
- Karma Re: When will Splunk Enterprise 8.0.1 be released? for isbjorn. 06-05-2020 12:50 AM
- Got Karma for What's the correct way instead of editing etc/apps/search/bin/sendemail.py?. 06-05-2020 12:50 AM
- Got Karma for Re: When will Splunk Enterprise 8.0.1 be released?. 06-05-2020 12:50 AM
- Got Karma for Re: When will Splunk Enterprise 8.0.1 be released?. 06-05-2020 12:50 AM
- Posted Re: When will Splunk Enterprise 8.0.1 be released? on Splunk Enterprise Security. 12-13-2019 12:28 AM
- Posted Re: Dashboard PDF email failing on Splunk Search. 06-13-2019 12:28 AM
- Posted Re: Dashboard PDF email failing on Splunk Search. 05-08-2019 02:23 AM
- Posted Re: Dashboard PDF email failing on Splunk Search. 05-08-2019 01:33 AM
- Posted Re: Dashboard PDF email failing on Splunk Search. 05-08-2019 12:23 AM
- Posted Re: error STDERR on All Apps and Add-ons. 03-08-2019 12:21 AM
- Posted Re: What's the correct way instead of editing etc/apps/search/bin/sendemail.py? on Reporting. 01-08-2019 01:07 AM
- Posted What's the correct way instead of editing etc/apps/search/bin/sendemail.py? on Reporting. 01-07-2019 07:20 AM
- Tagged What's the correct way instead of editing etc/apps/search/bin/sendemail.py? on Reporting. 01-07-2019 07:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
11-08-2022
02:50 AM
1 Karma
In 9.0.2, I changed /opt/splunk/etc/apps/splunk_instrumentation/default/savedsearches.conf line 447 and removed the space at the end of the line after the "\" character. sha256sum /opt/splunk/etc/apps/splunk_instrumentation/default/savedsearches.conf e00229cf2b4fee8ecf2232d98358d1a32563bb7edf6a60ec2274e765fb51e22d edit /opt/splunk/splunk-9.0.2-17e00c557dc1-linux-2.6-x86_64-manifest restart splunk Problem solved. The changed file is now identical to the same file in version 9.0.1. @splunkPlease fix this typo in the file
... View more
11-08-2022
01:42 AM
Same Problem in 9.0.2: /opt/splunk/bin/splunk btool check --debug Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/savedsearches.conf
Invalid key in stanza [instrumentation.usage.tlsBestPractices] in /opt/splunk/etc/apps/splunk_instrumentation/default/savedsearches.conf, line 451: | append [| rest /services/configs/conf-pythonSslClientConfig | eval sslVerifyServerCert (value: if(isnull(sslVerifyServerCert),"unset",sslVerifyServerCert), splunk_server=sha256(splunk_server) | stats values(eai:acl.app) as python_configuredApp values(sslVerifyServerCert) as python_sslVerifyServerCert by splunk_server | eval python_configuredSystem=if(python_configuredApp="system","true","false") | fields python_sslVerifyServerCert, splunk_server, python_configuredSystem]
| append [| rest /services/configs/conf-web/settings | eval mgmtHostPort=if(isnull(mgmtHostPort),"unset",mgmtHostPort), splunk_server=sha256(splunk_server) | stats values(eai:acl.app) as fwdrMgmtHostPort_configuredApp values(mgmtHostPort) as fwdr_mgmtHostPort by splunk_server | eval fwdrMgmtHostPort_configuredSystem=if(fwdrMgmtHostPort_configuredApp="system","true","false") | fields fwdrMgmtHostPort_sslVerifyServerCert, splunk_server, fwdrMgmtHostPort_configuredSystem]
| append [| rest /services/configs/conf-server/sslConfig | eval cliVerifyServerName=if(isnull(cliVerifyServerName),"feature",cliVerifyServerName), splunk_server=sha256(splunk_server) | stats values(cliVerifyServerName) as servername_cliVerifyServerName values(eai:acl.app) as servername_configuredApp by splunk_server | eval cli_configuredSystem=if(cli_configuredApp="system","true","false") | fields cli_sslVerifyServerCert, splunk_server, cli_configuredSystem]
| stats values(*) as * by splunk_server | eval date=now() | makejson output=data | eval _time=date, date=strftime(date,"%Y-%m-%d") | fields data date _time).
... View more
12-13-2019
12:28 AM
2 Karma
Splunk Enterprise 8.0.1 was released on December 12, 2019.
See: https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Fixedissues
And: https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020
... View more
06-13-2019
12:28 AM
I can confirm this was fixed in 7.3.0.
Yes the changelog does not contains this bugfix, which is rather unprofessional in my optinion.
This thread can be closed.
... View more
05-08-2019
02:23 AM
solution if you do not have the old version:
create backup of /opt/splunk/etc/apps/search/bin/sendemail.py
open /opt/splunk/etc/apps/search/bin/sendemail.py (Splunk 7.2.6) with a editor as a user with write permissions.
remove line 1398 "logger.warn("search results is empty, no email will be sent")"
remove line 1397 "else:"
remove 4 spaces at the start of lines 1393-1396 (if, results=,else,results=)
remove line 1392 "if results:"
save file
test
... View more
05-08-2019
01:33 AM
Splunk Support:
I understand that your PDF scheduled from dashboards are no longer working on 7.2.6. I confirmed this is a known issue and we are actively working on finding a solution for it.
We have found two possible workarounds:
- Replace sendemail.py from 7.2.6 with the same file in your older version.
- Edit your saved search, in the "Search" field replace "| noop" with "| makeresults".
For the moment, the issue is still unresolved.
... View more
05-08-2019
12:23 AM
I have the same error.
Splunk 7.2.6
When sending Dashboard as pdf via mail (scheduled or with "send test email" command):
2019-04-25 12:00:00,368 -0400 WARNING sendemail:1398 - search results is empty, no email will be sent
When i open the Dashboard in Splunk i see that it is not empty...
... View more
01-08-2019
01:07 AM
Thank you for your answer! I tried these settings, but it was not successful. Still the same error. Is this path correct?
/opt/splunk/etc/system/local/limits.conf
As you can see the "[pdf] render_endpoint_timeout = " limit is only used in etc/system/bin/pdfgen_endpoint.py:518.
cd /opt/splunk
sudo grep -Hirn render_endpoint_timeout .
./etc/system/README/limits.conf.spec:2412:render_endpoint_timeout = <unsigned int>
./etc/system/bin/pdfgen_endpoint.py:518: self._timeoutDuration = int(settings.get('render_endpoint_timeout', self._timeoutDuration))
Übereinstimmungen in Binärdatei ./etc/system/bin/pdfgen_endpoint.pyc.
./etc/system/default/limits.conf:930:render_endpoint_timeout = 3600
./etc/system/local/limits.conf:13:render_endpoint_timeout = 10800
./lib/python2.7/site-packages/slim/config/conf-specs/limits.conf.spec:2212:render_endpoint_timeout = <unsigned int>
As i understand the python code in etc/apps/search/bin/sendemail.py it is not possible to change the value of PDFGEN_SIMPLE_REQUEST_TIMEOUT by a config parameter.
Edit: I restarted the splunk server with /opt/splunk/bin/splunk restart after the configuration changes.
... View more
I have a Dashboard that needs more than one hour for a complete generation. This Dashboard is configured for a scheduled PDF delivery via E-Mail. Once per month at the first day, at 2am. At 3am, I receive an E-Mail saying:
An error occurred while generating the PDF. Please see python.log for details.
In python.log the following lines are written:
ERROR __init__:499 - Socket error communicating with splunkd (error=('The read operation timed out',)), path = /services/pdfgen/render
ERROR sendemail:1152 - An error occurred while generating a PDF: Failed to fetch PDF (SplunkdConnectionException): Splunkd daemon is not responding: ("Error connecting to /services/pdfgen/render: ('The read operation timed out',)",)
INFO sendemail:134 - Sending email. subject="...", results_link="None", recipients="[u'...', u'...']", server="localhost"
I found a workaround using google and this forum:
I changed these two lines in etc/apps/search/bin/sendemail.py:
PDF_REPORT_SERVER_TIMEOUT = 1800 #was 600
PDFGEN_SIMPLE_REQUEST_TIMEOUT = 10800 #was 3600
PDFGEN_SIMPLE_REQUEST_TIMEOUT is now 3 hours, instead of 1 hour. Now, the dashboard is sent as a PDF via E-Mail correctly. This solution works, but there are 2 problems:
Splunk shows a warning: "Installed Files Integrity Checker: File Integrity checks found 1 files that did not match the system-provided manifest. Review the list of problems reported by the InstalledFileHashChecker in splunkd.log File Integrity Check View ; potentially restore files from installation media, change practices to avoid changing files, or work with support to identify the problem."
I think i will lose my changes to etc/apps/search/bin/sendemail.py on Splunk-updates, as it is a file distributed with Splunk and a source-code file, but no configuration file.
What is the correct solution for my problem?
In Line 1284 of etc/apps/search/bin/sendemail.py (splunk-7.2.3-06d57c595b80-Linux-x86_64.tgz) , the function "simpleRequest" is called. There the parameter timeout is set to PDFGEN_SIMPLE_REQUEST_TIMEOUT. If this parameter would not be set the function "simpleRequest" would use another value. This is defined in lib/python2.7/site-packages/splunk/rest/__init__.py line 418 and 419.
But, as the code is in 7.2.3, I think it is not possible to change this behaviour with a configuration file. Is this correct? Notice: that the other value defined in lib/python2.7/site-packages/splunk/rest/__init__.py:419 (SPLUNKD_CONNECTION_TIMEOUT) is also hardcoded.
Greetings
Felix
... View more
