Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About bigfatyeastroll
bigfatyeastroll
Path Finder
Member since:
08-19-2019
04-28-2025
Community Statistics
| Posts | 16 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 2 |
| Member Since | 08-19-2019 |
Activity Feed
- Posted Where can I find my current License Warning Count in the internal logs? on Splunk Enterprise. 04-28-2025 12:31 PM
- Got Karma for Why is there KVStore failure after upgrade to 9.0?. 02-05-2023 05:59 AM
- Karma Re: Help creating an alert based on number of events per field for nadlurinadluri. 07-01-2022 06:20 AM
- Karma Re: Help creating an alert based on number of events per field for ITWhisperer. 07-01-2022 06:20 AM
- Posted Help creating an alert based on number of events per field on Alerting. 06-30-2022 06:41 AM
- Posted Re: KVStore failure after upgrade to 9.0 on Splunk Enterprise. 06-29-2022 09:13 AM
- Posted Why is there KVStore failure after upgrade to 9.0? on Splunk Enterprise. 06-29-2022 08:57 AM
- Posted Updated to 9.0: Why the error"Could not load lookup=LOOKUP-splunk_security_essentials" during searches"? on Splunk Enterprise. 06-29-2022 07:32 AM
- Got Karma for Palo Alto app configuration page error. 08-23-2021 11:24 AM
- Posted Re: How to get audit plus manager logs into splunk enterprise security? on All Apps and Add-ons. 01-29-2021 01:56 PM
- Karma How to get audit plus manager logs into splunk enterprise security? for abhi04. 01-29-2021 01:55 PM
- Karma Rubrik - Splunk ID errors for DaleLong1993. 06-05-2020 12:50 AM
- Karma Re: How to separate hosts/other fields into other data indexes? for gcusello. 06-05-2020 12:50 AM
- Posted Re: How to adjust timestamps for some sources coming from the universal forwarder? on Getting Data In. 05-22-2020 11:29 AM
- Posted How to adjust timestamps for some sources coming from the universal forwarder? on Getting Data In. 05-22-2020 08:54 AM
- Tagged How to adjust timestamps for some sources coming from the universal forwarder? on Getting Data In. 05-22-2020 08:54 AM
- Tagged How to adjust timestamps for some sources coming from the universal forwarder? on Getting Data In. 05-22-2020 08:54 AM
- Tagged How to adjust timestamps for some sources coming from the universal forwarder? on Getting Data In. 05-22-2020 08:54 AM
- Posted Re: Palo Alto app configuration page error on All Apps and Add-ons. 05-14-2020 08:39 AM
- Posted Palo Alto app configuration page error on All Apps and Add-ons. 05-13-2020 01:50 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
04-28-2025
12:31 PM
I'd like to include this in an email alert. I've got various emails to alert when going over but I'd like to show the number of warnings in that 60 day rolling window.
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-30-2022
06:41 AM
We're looking to create an alert based on the number of failures based on a certain field (clientIP) per certain time frame. here is the search so far: sourcetype="access_combined" POST 401 "/cas/login" | stats count by clientip Basically, we only want to be alerted when the number of events from any unique clientIP hits 10 per minute. We have the alert to trigger if the number of results is greater than 9.
... View more
Labels
- Labels:
-
alert action
-
alert condition
06-29-2022
09:13 AM
Here are the following tails from the log files: root@splunk:/opt/splunk/var/log/splunk# tail mongod.log 2022-06-28T19:40:57.749Z F - [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager_openssl.cpp 987 2022-06-28T19:40:57.749Z F - [main] \n\n***aborting after fassert() failure\n\n 2022-06-28T20:26:48.752Z W CONTROL [main] net.ssl.sslCipherConfig is deprecated. It will be removed in a future release. 2022-06-28T20:26:48.763Z F NETWORK [main] The provided SSL certificate is expired or not yet valid. 2022-06-28T20:26:48.763Z F - [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager_openssl.cpp 987 2022-06-28T20:26:48.763Z F - [main] \n\n***aborting after fassert() failure\n\n 2022-06-29T15:04:51.137Z W CONTROL [main] net.ssl.sslCipherConfig is deprecated. It will be removed in a future release. 2022-06-29T15:04:51.149Z F NETWORK [main] The provided SSL certificate is expired or not yet valid. 2022-06-29T15:04:51.149Z F - [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager_openssl.cpp 987 2022-06-29T15:04:51.149Z F - [main] \n\n***aborting after fassert() failure\n\n root@splunk:/opt/splunk/var/log/splunk# tail splunkd.log 06-29-2022 11:11:14.993 -0500 WARN AuthorizationManager [44284 SavedSearchFetcher] - Unknown role 'winfra-admin' 06-29-2022 11:11:14.994 -0500 WARN AuthorizationManager [44284 SavedSearchFetcher] - Unknown role 'winfra-admin' 06-29-2022 11:11:14.994 -0500 WARN AuthorizationManager [44284 SavedSearchFetcher] - Unknown role 'winfra-admin' 06-29-2022 11:11:18.206 -0500 WARN HttpListener [44522 webui] - Socket error from 161.31.28.185:52910 while idling: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 06-29-2022 11:11:18.214 -0500 WARN HttpListener [44522 webui] - Socket error from 161.31.28.185:52911 while idling: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 06-29-2022 11:11:18.219 -0500 WARN HttpListener [44522 webui] - Socket error from 161.31.28.185:52912 while idling: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 06-29-2022 11:11:24.098 -0500 INFO ExecProcessor [44189 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_assist/bin/instance_id_modular_input.py" [assist::instance_id_modular_input.py:228] [get_server_roles] [65977] Fetched server roles, roles=['indexer', 'license_master', 'license_manager'] 06-29-2022 11:11:24.107 -0500 INFO ExecProcessor [44189 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_assist/bin/instance_id_modular_input.py" [assist::instance_id_modular_input.py:256] [get_cluster_mode] [65977] Fetched cluster mode, mode=disabled 06-29-2022 11:11:24.107 -0500 INFO ExecProcessor [44189 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_assist/bin/instance_id_modular_input.py" [assist::instance_id_modular_input.py:30] [should_run] [65977] should run test, sh=False 06-29-2022 11:11:26.891 -0500 INFO TailReader [44264 tailreader0] - Batch input finished reading file='/opt/splunk/var/spool/splunk/tracker.log'
... View more
06-29-2022
08:57 AM
1 Karma
After upgrading to Splunk 9.0 on a single instance, we occasionally get KV Store errors.
CLI status shows:
This member: backupRestoreStatus : Ready disabled : 0 featureCompatibilityVersion : An error occurred during the last operation ('getParameter', domain: '15', code: '13053'): No suitable servers found: `serverSelectionTimeoutMS` expired: [connection closed calling ismaster on '127.0.0.1:8191'] guid : E8254C08-B854-426C-B66D-7072D625D0F6 port : 8191 standalone : 1 status : failed storageEngine : mmapv1
I've looked on Splunk.com and googled but haven't found anything on single instances beyond reinstalling 9.0 which I've done twice.
... View more
Labels
- Labels:
-
upgrade
06-29-2022
07:32 AM
See title. Searches still run but it constantly throws that error during every search.
... View more
- Tags:
- error
- splunk-search
Labels
- Labels:
-
troubleshooting
01-29-2021
01:56 PM
I'd like to know as well, if anyone found anything.
... View more
05-22-2020
11:29 AM
That's already set accordingly, however, a few log sources from 1 host are still listed under the Search & Reporting as UTC.
... View more
05-22-2020
08:54 AM
I have a certain host that sends several logs from multiple sources using the Linux Universal Forwarder. Most of these logs are written in the host and then to Splunk as UTC although the host is configured with the correct local time. How do I get Splunk to display the local time zone instead of UTC?
... View more
05-14-2020
08:39 AM
I'm not familiar with the Browser Inspector but here's what I've found:
splunk.campus.uca.edu:8000/en-US/app/Splunk_TA_paloalto
https://splunk.campus.uca.edu:8000/static/fonts/proxima-regular-webfont.woff
https://splunk.campus.uca.edu:8000/static/fonts/inconsolata-regular.woff
... View more
05-13-2020
01:50 PM
1 Karma
Trying to configure the Palo Alto app and the config page does not load (404 not found).
I'm running Splunk Enterprise 8.0.2 and Palo Alto app and add-on 6.2.
... View more
03-25-2020
11:13 AM
The forwarder was not setup using the Domain Admin and using the Domain\Username style. Thank!
... View more
03-25-2020
07:21 AM
Could it be something in the setup during the installation of the Forwarder?
... View more
03-25-2020
07:04 AM
one of my team has installed the forwarder on a Windows client. running tcpdump on the backend of splunk enterprise shows:
08:32:06.990056 IP xxx.56097 > splunk.xxx.9997: Flags [P.], seq 777:895, ack 1, win 512, length 118
08:32:06.990080 IP splunk.xxx.9997 >xxx.56097: Flags [.], ack 895, win 2512, length 0
my receiver is enabled on port 9997 but Splunk is not indexing the data. I have other clients using the same setup and they are being indexed.
Thoughts/Suggestions?
... View more
01-13-2020
07:02 AM
Great, thanks!
Those 2 reasons you gave are the reasons I am separating them out. One group has multiple devices and some are only able to send to default syslog (which other groups have devices like this as well).
Since Splunk is not my main job role, I was hoping there would be an "easy" GUI way.
... View more
01-10-2020
06:23 AM
I've got several data indexes (only one server) already that are separated by forwarders or listener ports. However, I have several devices that can only send to the default syslog port. How can I "pull out" events and place them into different indexes?
Is there a way in the Splunk Enterprise GUI to do this?
... View more
Labels
- Labels:
-
index
08-19-2019
01:41 PM
I'm setting up the rubrik app,
(https://github.com/rubrikinc/rubrik-addon-for-splunk/blob/master/docs/quick-start.md)
and it's assuming I've got sourcetypes of rubrik (sourcetype="rubrik:eventfeed") coming in.
I do have logs coming from our rubrik cluster but they are not showing up as that.
Do I need to change something on the clusters, Splunk or edit the instructions?
Sorry, I'm a Splunk noob.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-28-2025
12:26 PM
|
Karma given to
