About mikehodges01

mikehodges01 · ‎03-30-2017

I used to get the output of splunk.exe version and put it in a file that I distributed with the app, then issue that same command in my script on the target machine and dump the output to a temp file, and then use Windows fc to compare the files. If they're different, run the upgrade. Now I'm upgrading to a Powershell script that uses a regex match to pull the version from etc\splunk.version on the target machine and the MSI I include in the app to see if they're the same. [regex]$regex = "\d\.\d\.\d"

mikehodges01 · ‎03-13-2017

I'm doing exactly this. Write a script and refer to it in an inputs.conf. I have an app folder "WinUpdate", then I have "default" and "bin". In \default is an inputs.conf that says [script://..\bin\installer.bat]. Under \bin I place the forwarder MSI and an install script that checks the currently installed version of Splunk against a copy of splunk.version I put in \bin as well. If they're different, the script executes and upgrades the UFs. Get a little creative! Splunk can do almost anything you need it to do. This method works perfectly for me.

mikehodges01 · ‎11-12-2015

I'm also seeing "SSL_write failed. Broken pipe" in my splunkd.log on my search head, several seconds before the bundle errors show up. I'm guessing this has something to do with it?

mikehodges01 · ‎11-10-2015

Well I tried changing that setting to 600 seconds and I'm still getting this error. I guess I'll dive into modifying the bundle to reduce the size. According to the logs it's only 30 MB. Both these servers are on the same subnet.

mikehodges01 · ‎11-09-2015

I'm having the same issue. Did anyone figure out what's going on?

mikehodges01 · ‎04-13-2015

I upgraded from 6.1.3 to 6.2.1 recently and noticed that some of my universal forwarders stopped sending certain logs. Upon further inspection, I noticed that it stopped sending logs that were specified with wildcards in the folder name, eg, c:\folder*logs\logs\* . In splunkd.log I see that it adds a watch on path c:\ . I know that Splunk is supposed to parse c:\folder*logs\logs\* into something along the lines of [monitor://c:\] whitelist = folder*logs\logs\* but this doesn't seem to be working anymore. I had to specify actual folder names to get it to work. Does anyone have any ideas? Or am I just crazy? Thanks!

mikehodges01 · ‎07-25-2012

That didn't seem to work for me. I ran rmdir /s c:\program files\splunkuniversalforwarder\var\lib\splunk\fishbucket splunk restart on a universal forwarder and the old data was not re-indexed. Am I missing a step or something? However, I did manage to achieve my ends by uninstalling and reinstalling the universal forwarder. I suppose this solution will suffice for now but I'd still like to find a way to re-index anything I want without having to re-install the universal forwarder.

mikehodges01 · ‎07-25-2012

I'm getting ready to finalize a Splunk install and roll it out for use... during my testing phase I added a bunch of data to my index that I don't need (eg, via syslog, WMI, legacy machines, etc). What I'd like to do, to conserve disk space and clean up my searches, is clean the entire index on my indexer and re-index everything from my universal forwarders (at this point only 5 or 6 machines). I've figured out that I can mount a remote filesystem on my indexer and use btprobe to look at the remote files, but I don't know what I need to put in for the -d argument to get the forwarder to send all its old data again. I've tried resetting the keys I get from the default folder that contains btree_index.dat, and I've tried doing it for the actual log file keys - but the indexer spits out a key and says "record not found". I know I could just remove the information from searches but I'd really like to be able to get the disk space back by starting fresh, and I'd like to know how to re-capture old log information should I ever need to in the future... it just seems like something kinda important in my environment. Thanks for any help you may be able to give me!

mikehodges01 · ‎07-02-2012

Ok, I answered my own question. For anyone else out there wondering about something similar, all folders that contain apps MUST be on the same folder level, and on the initial deployment server, that MUST be /SPLUNK_HOME/etc/deployment-apps. What I had was three folders with the "apps" for my 1st tier (for example, SPLUNKHOME/etc/deployment-apps/App/default/whatev.conf), and then two folders, each with three "apps", for the other two tiers (so, for example, SPLUNKHOME/etc/deployment-apps/Tier2/App/default/whatev.conf). As soon as I moved ALL the folders out of those last two and up one level into /SPLUNKHOME/etc/deployment-apps and changed my serverclass.conf to reflect the new locations, everything started working. So it appears you can have tiered deployment, with automatic replication working thanks to the "reloadDSOnAppInstall = true" parameter as long as you don't ever nest your app directories. Keep in mind also that the "apps" that need to be deployed to a client/server should be installed ONLY in the default directory, /SPLUNK_HOME/etc/apps, in order for "reloadDSOnAppInstall = true" to function. Use repositoryLocation on the client/servers' serverclass.conf to specify where its clients should get their content. DO NOT change the default installation directory by using targetRepositoryLocation or this won't work. I'm on Splunk 4.3.2, and I'm surprised Splunk hasn't fixed this one yet!

mikehodges01 · ‎07-02-2012

I have a three-tier tiered deployment environment setup. On my 2 deployment clients that also are deployment servers, I have put reloadDSOnAppInstall = true to deploymentclient.conf. I was getting some errors in my splunkd.log about failing to install the apps on the client/server. I found this thread - http://splunk-base.splunk.com/answers/10500/tiered-deployment-servers-is-it-possible - and abandoned using targetRepositoryLocation and instead specifying the default app "install" directory, /SPLUNK_HOME/etc/apps, as my repositoryLocation for the 2 deployment client/servers. The errors have stopped showing up in splunkd.log but it seems that I am still unable to get a file to move even one step in my deployment chain, unless I go to all three deployment servers and use the ./splunk reload deploy-server command. So the problem is that replication is working, but it appears that the reloadDSOnAppInstall clause in my deploymentclient.conf is doing absolutely nothing. Please help!

Posts	10
Solutions	1
Karma Given	0
Karma Received	9
Member Since	‎06-12-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

After upgrading from Splunk 6.1.3 to 6.2.1, why di...

btprobe and re-indexing data

Three tier deployment topology not working right

Re: How to upgrade Splunk forwarders from a deploy...

Re: How to upgrade Splunk forwarders from a deploy...

Re: Problem replicating config (bundle) to search ...

Re: Problem replicating config (bundle) to search ...

Re: Problem replicating config (bundle) to search ...

After upgrading from Splunk 6.1.3 to 6.2.1, why di...

Re: btprobe and re-indexing data

btprobe and re-indexing data

Re: Three tier deployment topology not working rig...

Three tier deployment topology not working right