Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vsai0718
vsai0718
Path Finder
Member since:
08-20-2019
04-16-2021
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 08-20-2019 |
Activity Feed
- Got Karma for Re: edit server.conf on multiple servers. 12-09-2020 02:25 PM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 02-26-2020 07:26 AM
- Posted Re: edit server.conf on multiple servers on Deployment Architecture. 02-14-2020 07:08 AM
- Posted Re: How to find root cause and solution for Unable to distribute to peer named xxxxxxxxxxxxx at uri= xxxxx on Splunk Enterprise Security. 02-12-2020 02:22 PM
- Posted Re: WinEvent whitelist not working on Getting Data In. 02-12-2020 02:10 PM
- Posted Re: edit server.conf on multiple servers on Deployment Architecture. 02-12-2020 01:58 PM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 02-12-2020 01:49 PM
- Posted Re: windows application log files. on Getting Data In. 01-28-2020 03:13 PM
- Posted Re: How can I break events within events . on Splunk Search. 01-27-2020 01:23 PM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-27-2020 12:08 PM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-27-2020 11:33 AM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-27-2020 11:32 AM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-27-2020 11:28 AM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-27-2020 07:13 AM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-25-2020 10:35 AM
- Posted Re: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-25-2020 08:39 AM
- Posted Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-24-2020 01:27 PM
- Tagged Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-24-2020 01:27 PM
- Tagged Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-24-2020 01:27 PM
- Tagged Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. on Getting Data In. 01-24-2020 01:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
02-26-2020
07:26 AM
The error was solved, when I increased the ulimits for open files of indexers to the recommended 64000 initially it 4096.
... View more
02-14-2020
07:08 AM
1 Karma
Then ansible-playbook would be a good idea, if the change is static among all the servers
... View more
02-12-2020
02:22 PM
First try whether the connectivity between the search head and indexer is active. You can test it by
telnet index_ip 8089
If it is talking two way, then it might me the system resources issue.
... View more
02-12-2020
02:10 PM
Even we had the same issue, but once we had a monitor stanza for the Security.evtx path in inputs.conf. The logs started coming in for the events that you've whitelisted.
... View more
02-12-2020
01:58 PM
What are these servers, if those are forwarders maybe with deployment server or by making a ansible playbook to change what ever you're trying to change.
If it is the same thing you're trying to change and the servers are forwarders talking to deployment server then it is easy to do it by deployment server. Or else ansible playbook will be the best way
... View more
02-12-2020
01:49 PM
The IOPS are above the recommended specs but our ulimits for open files was less but even after increasing them. The error is still present. As of now for the problematic indexers I have quarantined. But I'm looking for a solution so that I can resolve the issue.
Do you know anyother solutions that might be able to resolve this.
Thanks
... View more
01-28-2020
03:13 PM
You need to add WindEventLog:Application stanza before monitor.
For Example:
[WinEventLog:Application]
disabled = 0
start_from = oldest
current_only = 0
... View more
01-27-2020
12:08 PM
I'm not sure what is best to be run as. But all other indexers and also this indexer was running as root from the beginning which is long time back. I was receiving this error as of now only on one of the indexer in the cluster.
... View more
01-27-2020
11:33 AM
Then how did you solve it?
... View more
01-27-2020
11:32 AM
We haven't restarted any of the search heads recently, and the permissions for the /opt/splunk/var/run/searchpeers/ is
on the search heads it is splunk
on the indexers it is root
which I think are correct as it should be
... View more
01-27-2020
11:28 AM
Well, I see that none of the search heads bundle is on the indexer and in the deployer's bundle the app for which the error is given that app does not exist. So, as you said may be indexer doesn't have the required bundle. What might be the issue or any remediation for this?
... View more
01-27-2020
07:13 AM
Yes, all the apps are present in the $SPLUNK_HOME/var/run/searchpeers location. I see the bundle from the deployer and in that all the apps, present on the search are here too.
... View more
01-25-2020
10:35 AM
Currently, I've stopped splunk on that indexer as it is giving the error to the every search. Not particularly one search. Even if I search the index which is not in that indexer, search head is giving me that error.
... View more
01-25-2020
08:39 AM
No, I was looking on the search head.
The search.log on the problem indexer, I found in dispatch folder multiple search heads remote searches directories.
In the search.log,
This is the common log entries I found for ERROR
ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Application does not exist: <app_name_which_exists>
But all entries app_names were different which were created long back. None of the app's were created recently.
... View more
01-24-2020
01:27 PM
Hi,
In one of our indexer clusters which we query from a search head cluster, only one of the indexers is giving this error while running a search. The error I'm getting is:
<indexer_hostname>Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
When going through search.log, for that particular indexer. All I can find is:
INFO DistributedSearchResultCollectionManager - Connecting to peer=<indexer> connectAll 0 connectToSpecificPeer 1
INFO DistributedSearchResultCollectionManager - Successfully created search result collector for peer=<indexer> in 0.002 seconds
And there aren't any ERROR in the search.log.
Although I found some errors in splunkd.log for the same indexer which is as below:
ERROR DistBundleRestHandler - Problem untarring file: /opt/splunk/var/run/searchpeers/xxx.bundle
WARN DistBundleRestHandler - There was a problem renaming: /opt/splunk/var/run/searchpeers/xxx.tmp -> /opt/splunk/var/run/searchpeers/xxxx: Directory not empty
I have seen some of the previous answers, stating that there might be not enough free space available in that particular indexer, but when checked, there is still 40% more available space.
I couldn't figure out what was the problem as there was no ERROR in the search.log. I'm on Splunk 7.1.3
Thanks in advance.
... View more
10-28-2019
01:11 PM
Is there any firewall blocking the communication between the server and HEC's server. Try telnet from the server you're looking to send the logs to the HEC. If it is good, debug it by using curl for HEC
curl -k http://IP_of_HEC_host:8088/services/collector -H 'Authorization: Splunk token' -d '{"sourcetype": "sourcetype_of_HEC_configured", "event":"Hello, World!"}'
... View more
10-28-2019
12:58 PM
What kind of instance is it. If it is an EC2, try stopping and starting the instance. Then go to the terminal and start the splunk.
... View more
10-23-2019
01:36 PM
Check whether the mail server that is being used currently to send the triggered alert, is a correct one with respect to your environment. If it is correct, check with your company's network team that whether any firewall is blocking.
... View more
08-27-2019
10:00 AM
You can try this one
| rename _raw AS _temp field4 AS _raw | extract pairdelim="?&" kvdelim="=" | rename _raw AS field4 _temp AS _raw
... View more
08-27-2019
09:58 AM
| rename _raw AS _temp field4 AS _raw | extract pairdelim="?&" kvdelim="=" | rename _raw AS field4 _temp AS _raw
You can try this, it extracts all the nested key, value pairs at search time
... View more
