Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About areber04
areber04
Explorer
Member since:
08-27-2013
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 08-27-2013 |
Activity Feed
- Got Karma for How to forward _internal events to indexer, but keep them locally on deployment server?. 04-21-2023 11:37 AM
- Got Karma for Why second serverclass.conf located in search app after restarting deployment server?. 06-05-2020 12:47 AM
- Got Karma for How to forward _internal events to indexer, but keep them locally on deployment server?. 06-05-2020 12:47 AM
- Posted How to forward _internal events to indexer, but keep them locally on deployment server? on Getting Data In. 08-21-2014 10:22 AM
- Tagged How to forward _internal events to indexer, but keep them locally on deployment server? on Getting Data In. 08-21-2014 10:22 AM
- Tagged How to forward _internal events to indexer, but keep them locally on deployment server? on Getting Data In. 08-21-2014 10:22 AM
- Tagged How to forward _internal events to indexer, but keep them locally on deployment server? on Getting Data In. 08-21-2014 10:22 AM
- Posted Re: Reload realtimeoutput.conf without restarting Splunkd on Getting Data In. 07-28-2014 01:18 PM
- Posted Re: Why is no output generated using Splunk Real-Time Output app? on All Apps and Add-ons. 07-28-2014 12:54 PM
- Posted Re: Errors feeding Arcsight with Splunk search results using Splunk Real-Time Output app on Splunk Search. 07-28-2014 12:47 PM
- Posted Re: Splunk Real-time output app. Dispatch directory not being cleaned up. on All Apps and Add-ons. 07-28-2014 12:34 PM
- Posted Re: Why second serverclass.conf located in search app after restarting deployment server? on Deployment Architecture. 07-17-2014 11:36 AM
- Posted Why second serverclass.conf located in search app after restarting deployment server? on Deployment Architecture. 07-17-2014 08:41 AM
- Tagged Why second serverclass.conf located in search app after restarting deployment server? on Deployment Architecture. 07-17-2014 08:41 AM
- Tagged Why second serverclass.conf located in search app after restarting deployment server? on Deployment Architecture. 07-17-2014 08:41 AM
- Posted Re: Reload realtimeoutput.conf without restarting Splunkd on Getting Data In. 05-19-2014 07:21 AM
- Posted Reload realtimeoutput.conf without restarting Splunkd on Getting Data In. 05-16-2014 08:56 AM
- Tagged Reload realtimeoutput.conf without restarting Splunkd on Getting Data In. 05-16-2014 08:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 1 | |||
| 0 |
08-21-2014
10:22 AM
2 Karma
I am working with the following architecture:
Search Head
Multiple Indexers
Deployment Server / License Master
We recently deployed a large number of forwarders and wanted to be able to allow other groups to see the deployment progress. Non-admin users don't have direct access to the Indexers or Deployment Server, so we are forwarding all of the internal events from the Deployment server to the indexers, so that we can create a dashboard to show how many devices for each serverclass or architecture have checked in. The deployment server is also designated as our License Master. The problem is that now the the "License Usage" page only goes back to the day that we enabled the event forwarding.
Is there any way to get the internal events forwarded on to the Indexers, but also keep them locally on the deployment server so we don't lose functionality from the License management?
... View more
07-28-2014
01:18 PM
To follow up on this:
https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/_reload appears to be the right command. The "restart" command produces an error: In handler 'script': The following required arguments are missing: script.
We are continuing testing to figure out how to get the _reload command to function consistently, but initial results show it working about 75% of the time. There have been several cases where only 3 or 4 out of 6 of our RTO inputs actually reload on a given indexer.
... View more
07-28-2014
12:54 PM
For scenario 1, does removing "search" from the string produce results?
... View more
07-28-2014
12:47 PM
You map the Splunk fields to the CEF fields, anything that isn't mapped to a CEF field (either manually via "cef_field_map" or automatically in ceftool.py) won't be in the CEF event.
The RTO app shows the fields that Splunk found during the search on the left and the CEF fields defined in ceftool.py on the right. I modified my ceftool.py to contain every CEF field that is defined in the CEF standard, since ceftool.py is missing a large number of them. I also mapped CIM standard fields to the majority of the CEF fields.
I believe that means that it is unable to resolve the hostname that you are using, though there are many reasons for gaierror to be thrown. Something is causing the socket to be unable to connect. Wrong port, wrong address, wrong permissions, could be many things.
... View more
07-28-2014
12:34 PM
Just wanted to confirm that we have seen the exact same behavior, usually after each indexer restart. We have the RTO running on a dozen indexers, with about 6 RTO stanzas. When the indexer is restarted (usually to reload the RTO...) we will see a huge spike in dispatch jobs. If left alone, we have seen it go up to over 3000 dispatch jobs on each indexer. We implemented a cron job to delete any "rt_" files in the dispatch directory after 4 hours. Under normal operation, there is only 1 "rt_" job for each RTO stanza.
... View more
07-17-2014
11:36 AM
The deployment server hasn't ended up as a deployment client, we also have it blacklisted. We did deploy a search app via deployment-apps to our search heads, but later deleted it. The search app was located under etc/deploymentapps/search-2. That stanza, or anything related to it doesn't show up in the suspicious serverclass.conf file.
... View more
07-17-2014
08:41 AM
1 Karma
I ran into an issue today after restarting my deployment server. After restarting, it would no longer load the "Forwarder Management" page, stating that there was an error in serverclass.conf. In the process of trying to find the error, I used btool to list the serverclass configurations. I noticed that there were a few stanzas located in "/opt/splunk/etc/apps/search/local/serverclass.conf". I never created this file and it only had about 6 stanzas in it, while my main serverclass.conf file in etc/system/local has over 80 stanzas.
I'm trying to prevent this issue from repeating, but I have no idea how the serverclass.conf file in etc/apps/search/local even came to exist. Any ideas?
... View more
05-19-2014
07:21 AM
I feel like I'm closer now
curl -k -u admin https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/%252Fopt%252Fsplunk%252Fetc%252Fapps%252FSplunkRealTimeOutput%252Fbin%252Fscripted_inputs%252Frtoutput.py%20917074b6-865f-4c08-9f53-1aa9b5c6d33f/_reload -d ''
Enter host password for user 'admin':
In handler 'script': Invalid custom action for this internal handler (handler: script, custom action: _reload, eai action: edit).
Not sure what I am missing
... View more
05-16-2014
08:56 AM
Is it possible to restart the RTO app without restarting Splunkd? We have the RTO app installed on each of our indexers to spread out the load, but bringing down Splunk for 5 minutes while it restarts just to update the output is impacting our users. I have tried using the REST API (servername:8089/services/apps/local/SplunkRealTimeOutput/_reload) but I receive a message on the indexer stating that "realtimeoutput" and "web" require a restart for the changes to take effect. I have also tried using the "enable" and "disable" REST calls, but the result is the same.
Is it possible to reload these configurations without restarting the entire indexer?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
