About pkiripolsky

pkiripolsky · ‎11-29-2022

Apologies on that @phudinhha -- I usually separate out my indexes from downloadedTA/Apps and create my own app to contain all indexes so it didn't occur to me that this may happen. However, if your indexed data is being sent to separate indexers (i.e. your search head isn't an all in one), then the index is only gone from the search head but the data should still be on the indexer(s). You ought to be able to recreate the index on the search head and that will allow you to search against your indexed data on the indexers again.

pkiripolsky · ‎09-20-2018

Hey there, have you tried chmod'ing the permissions to 600 and deleting the lock file ( /opt/splunk/var/lib/splunk/kvstore/mongo/mongod.lock )? In my experience whenever this happens, the solution for me has been to chmod the mongo splunk key to 600, delete the lock file, and then reboot the whole server (not just the splunk service). Additionally, if you're still having issues check the permissions to make sure that the proper account owns/has access to mongo.

pkiripolsky · ‎09-20-2018

Hey there kristian, Not sure if you're still having this issue but I was able to resolve a very similar situation recently on my own environment. I had the same errors that you were seeing in the log stream which pointed me to the modinputs for this add on. Here's what I did: Add-on was installed on our search head so I stopped the search head Then, I went into /opt/splunk/var/lib/modinputs and deleted the following directories (rm -rf) aws_* (anything that started with aws basically) splunk_ta_aws_sqs I restarted the search head and disabled/re-enabled the aws inputs within the add-on. Shortly thereafter, I started getting events in again. I'd also like to point out that prior to going through these steps I had disabled and re-enabled the add-on and restarted my search head as well as re-entered in the input credentials but none of those helped me. I'm still not certain why this behavior occurred in the first place and why it broke in this particular way but this was the solution that helped me out. Cheers!

pkiripolsky · ‎03-09-2018

Hi All, I have recently updated the Splunk Supporting Add-on for Active Directory to version 2.16 and after doing so, I'm no longer seeing the password stored for each connection on the configuration page. This is problematic when it comes to using the 'Test Connection' functionality as it fails without the password in there. What's odd though is that the password is definitely being updated and stored in the passwords.conf file under SA-ldapsearch/local as I'm able to manually run the | ldaptestconnection command and get back results in addition to running | ldapsearch queries. I'm also able to see the base 64 encoded password in the password.conf file. Has anyone else encountered this and do we know if there is a fix available? I'm running this add-on on top of Splunk Enterprise version 6.5.1 and I've made sure that the other distributions of this add-on in our environment are all upgraded to the newest version in addition to running on a version of Splunk 6.5.x or higher. Additionally, I've completely removed the Add-On and re-installed the new version and then tried to manually update everything but I keep running into the same issue. I thought that it may be due to the deprecated password setting under local\ldap.conf so I tried to include password = BINDDN_PASSWORD but again, no go and the same problem. Any other ideas or suggestions would be appreciated! Thanks in advance.

pkiripolsky · ‎10-27-2017

Short answer, yes it can. You can set up an alert to trigger based on the number of results. So you can setup an alert to trigger if number of results returned is 0 or less than some arbitrary number. You can set this up when you save or edit the alert; it's called the "Trigger Conditions".

pkiripolsky · ‎08-24-2017

You can also use this CLI command to see which files were changed (if you have back-end access) ./splunk validate files

pkiripolsky · ‎03-07-2017

Try editing the te_setup Config file directly. I too got the same error the first time I set it up but was able to get around it by editing the config file directly and restarting Splunk. My stanza looks something like this: [te_parameters] data_location = <Location where Data is to be written on local host> listening_port = <TE Enterprise Console Port> te_pass = <TE Enterprise Console Password> te_username = <TE Enterprise Console Username> use_forwarder_bool = 1 workflow_host = <IP Address> I'm using a Heavy Forwarder to pull my data in which is why you see the 'use_forwarder_bool=1'.

pkiripolsky · ‎09-13-2016

Why don't you make a new blacklist for each of those events then? Something like the following: blacklist2 = EventCode="4688" blacklist3 = EventCode="4689"

pkiripolsky · ‎08-31-2016

I'm running into the same issue. Even when I comment out the blacklisting altogether for EventCode 4662, Splunk is still not indexing any 4662 events (junk or not). I've confirmed that there are other events coming in from the Windows Security Log so I don't believe that permissions are an issue here.

pkiripolsky · ‎08-17-2016

I downvoted this post because ms sql server doesn't follow traditional port assignment and generally uses dynamically assigned ports. this is directly from splunk troubleshooting: " many microsoft sql servers use dynamic ports instead of tcp/1433. work with your database administrator to identify the correct port, or see "verifying the port configuration of an instance of sql server" on the microsoft website."

pkiripolsky · ‎08-15-2016

I had a similar issue. Turns out that at the end of the JSON supplied by the TA, it was missing a , . It should look like this: .... ], "keyCredentials": [ { "usage": "Verify", "keyId": "yourkeyidhere", "value": "youvaluehere", "customKeyIdentifier": "yourcustomKeyhere", "type": "AsymmetricX509Cert" } ]**,** <------------Notice the "," .... But instead, the TA returns it like this: .... ], "keyCredentials": [ { "usage": "Verify", "keyId": "yourkeyidhere", "value": "youvaluehere", "customKeyIdentifier": "yourcustomKeyhere", "type": "AsymmetricX509Cert" } ] .... I changed that and it accepted my JSON file.

Posts	11
Solutions	0
Karma Given	19
Karma Received	2
Member Since	‎08-08-2016

Online Status	Offline
Date Last Visited	‎11-29-2022 03:20 PM

Updated the Splunk Supporting Add-on for Active Di...

Re: Amazon Web Services Add-on: s3 generic error -...

Re: KV Store process terminated abnormally (exit c...

Re: Amazon Web Services Add-on: s3 generic error -...

Updated the Splunk Supporting Add-on for Active Di...

Re: Can an alert be based on a search that runs bu...

Re: How to resolve messages about 'File Integrity ...

Re: splunk app for tripwire enterprise ?

Re: How to blacklist Windows Security Event Logs 4...

Re: Splunk Add-on for Microsoft Windows: How to tr...

Re: Splunk DB Connect 2: Why am I getting "Interna...

Re: Splunk Add-on for Micsrosoft Cloud Services: U...