About pkiripolsky

pkiripolsky · ‎11-29-2022

Apologies on that @phudinhha -- I usually separate out my indexes from downloadedTA/Apps and create my own app to contain all indexes so it didn't occur to me that this may happen. However, if your indexed data is being sent to separate indexers (i.e. your search head isn't an all in one), then the index is only gone from the search head but the data should still be on the indexer(s). You ought to be able to recreate the index on the search head and that will allow you to search against your indexed data on the indexers again.

pkiripolsky · ‎03-09-2018

Hi All, I have recently updated the Splunk Supporting Add-on for Active Directory to version 2.16 and after doing so, I'm no longer seeing the password stored for each connection on the configuration page. This is problematic when it comes to using the 'Test Connection' functionality as it fails without the password in there. What's odd though is that the password is definitely being updated and stored in the passwords.conf file under SA-ldapsearch/local as I'm able to manually run the | ldaptestconnection command and get back results in addition to running | ldapsearch queries. I'm also able to see the base 64 encoded password in the password.conf file. Has anyone else encountered this and do we know if there is a fix available? I'm running this add-on on top of Splunk Enterprise version 6.5.1 and I've made sure that the other distributions of this add-on in our environment are all upgraded to the newest version in addition to running on a version of Splunk 6.5.x or higher. Additionally, I've completely removed the Add-On and re-installed the new version and then tried to manually update everything but I keep running into the same issue. I thought that it may be due to the deprecated password setting under local\ldap.conf so I tried to include password = BINDDN_PASSWORD but again, no go and the same problem. Any other ideas or suggestions would be appreciated! Thanks in advance.

kheo_splunk · ‎05-09-2017

The current issue has been fixed in Windows TA 4.8.4 onwards, so please download the latest version Windows TA and test or try using the following Regex. blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"

pkiripolsky · ‎03-07-2017

Try editing the te_setup Config file directly. I too got the same error the first time I set it up but was able to get around it by editing the config file directly and restarting Splunk. My stanza looks something like this: [te_parameters] data_location = <Location where Data is to be written on local host> listening_port = <TE Enterprise Console Port> te_pass = <TE Enterprise Console Password> te_username = <TE Enterprise Console Username> use_forwarder_bool = 1 workflow_host = <IP Address> I'm using a Heavy Forwarder to pull my data in which is why you see the 'use_forwarder_bool=1'.

Posts	11
Solutions	0
Karma Given	19
Karma Received	2
Member Since	‎08-08-2016

Online Status	Offline
Date Last Visited	‎11-29-2022 03:20 PM

Updated the Splunk Supporting Add-on for Active Di...

Re: Amazon Web Services Add-on: s3 generic error -...

Updated the Splunk Supporting Add-on for Active Di...

Re: Splunk Add-on for Microsoft Windows: How to tr...

Re: splunk app for tripwire enterprise ?