About MichaelMcAleer

MichaelMcAleer · ‎12-01-2020

I've had a number of issues so far using vanilla Ubuntu & Splunk 8.x but so far they haven't impacted development so I can just continue on with limited functionality. Thanks for the detailed breakdown and answer!

MichaelMcAleer · ‎11-12-2020

Never had an issue running splunk as root user or installing as root user. Given Splunk creates these users during install, as with the /opt/splunk directory, how can I set ownership for a folder/user that doesn't exist yet?

MichaelMcAleer · ‎11-09-2020

Hi Splunk Community, I am building a Python modular input using the Splunk add-on builder tool and I want to add a custom configuration option 'performance_custom_metrics' which is optional and set only in inputs.conf, not via the data input UI configuration defined when building the add-on. Everything seems fine for the most part, but when I try to add a new data input I get the following error about the optional config option: The following required arguments are missing: performance_custom_metrics Because performance_custom_metrics is not defined in the add-on UI configuration I am not allowed to create inputs via the UI. Only manual creation via inputs.conf works as expected. I've set required_on_create and required_on_edit both to False when defining the argument in inputs.py: scheme.add_argument(smi.Argument( 'performance_custom_metrics', required_on_create=False, required_on_edit=False)) From solnlib/packages/splunklib/modularinput/argument.py #60: :param required_on_edit: ``Boolean``, whether this arg is required when editing an existing modular input of this kind. :param required_on_create: ``Boolean``, whether this arg is required when creating a modular input of this kind. Has anyone any idea what other option I need to set to make performance_custom_metrics an optional input parameter for my add-on?

MichaelMcAleer · ‎11-09-2020

Hi Splunk Community, I am building a Python modular input using the Splunk add-on builder tool and I want to add a custom configuration option 'performance_custom_metrics' which is optional and set only in inputs.conf, not via the data input UI configuration defined when building the add-on. Everything seems fine for the most part, but when I try to add a new data input I get the following error about the optional config option: The following required arguments are missing: performance_custom_metrics Because performance_custom_metrics is not defined in the add-on UI configuration I am not allowed to create inputs via the UI. Only manual creation via inputs.conf works as expected. I've set required_on_create and required_on_edit both to False when defining the argument in inputs.py: scheme.add_argument(smi.Argument( 'performance_custom_metrics', required_on_create=False, required_on_edit=False)) From solnlib/packages/splunklib/modularinput/argument.py #60: :param required_on_edit: ``Boolean``, whether this arg is required when editing an existing modular input of this kind. :param required_on_create: ``Boolean``, whether this arg is required when creating a modular input of this kind. Has anyone any idea what other option I need to set to make performance_custom_metrics an optional input parameter for my add-on?

MichaelMcAleer · ‎11-05-2020

Hi Splunk Community, Im trying to install Splunk on a new VM as part of funcitonal testing for an add-on, I would build these daily and havnt run into any issues before today with the process. Running on Ubuntu 20.04.1, all packages up to date as of today. During the initial dpkg -i phase the following error is reported but install completes anyway: cp: cannot stat '/opt/splunk/etc/regid.2001-12.com.splunk-Splunk-Enterprise.swidtag': No such file or directory I go through the process of starting splunk, accepting license, creating initial user, all fine, but when I get to the GUI and select 'browse more apps' I get the following error back: Error connecting: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name.. Your Splunk instance is specifying custom CAs to trust using sslRootCAPath configuration in server.conf's [sslConfig] stanza. Make sure the CAs in the appsCA.pem (located under $SPLUNK_HOME/etc/auth/appsCA.pem) are included in the CAs specified by sslRootCAPath. To do this, append appsCA.pem to the file specified by the sslRootCAPath parameter. Any idea what is going on here? I have another VM on the same host, identical network configuration, OS versions, its just been running for a few weeks. The Splunk env that is having issues is on a clean VM. I have tried this using the same install .deb from the working VM and again with the latest .deb from the Splunk website, both exhibit same issue so im thinking it may be a system package dependency. Thanks! Michael

MichaelMcAleer · ‎12-17-2019

Hi Alemarzu, Can you give some further information on your environment? What platform are you running Splunk on What Splunk version you are using What version of the add-on are you using Is the add-on working to collect metrics and you are only having issues with the sizer tool Thanks! Michael

MichaelMcAleer · ‎09-19-2018

I just abandoned the ITSI effort after having more questions than answers in the end, I cannot tell you if there has been any improvements in this space since I worked on a custom ITSI module but it would appear not if you are facing the same problem!

MichaelMcAleer · ‎05-30-2018

Yes we do require version 8.4 for VMAX for Splunk add-on 2.0 as we make use of new endpoints and performance metrics not available in 8.3. However, this will not explain the errors you are seeing as any requests to Unisphere to determine the version are failing due to the SSL certificate error so we don't even hit the version check. Do you want to get in contact with support directly at vmax.splunk.support@emc.com after you upgrade to 8.4 and we can assist you with a call if necessary? There are a few excerpts from your log snippet that warrant a closer look but outside of the scope of a public question board.

MichaelMcAleer · ‎05-28-2018

Hi Abhi, Thanks for posting the above question regarding SSL certs! It can be a tricky area but thankfully there are a few things that we can do to check for cert validity. First up is checking the command itself: $ openssl s_client -showcerts -connect <VMAX IP>:8443 </dev/null 2>/dev/null|openssl x509 -outform PEM ><VMAX IP>.pem Can you ensure that the IP address you are entering here is for the instance of Unisphere in your environment used for performance metrics collection? Also, instead of using the IP address try the hostname value instead, occassionally there can be issues with hostname resolution which can cause the error you are seeing 'Certificate did not match expected hostname'. $ openssl s_client -showcerts -connect {unisphere_host}:8443 </dev/null 2> \ /dev/null|openssl x509 -outform PEM >{unisphere_host}.pem When the cert has been pulled from Unisphere onto your Splunk instance, you can confirm that the cert is valid by running the command: $ openssl s_client -connect {unisphere_host}:8443 -CAfile {cert_name}.pem -verify 9 I think at this point if you are getting cert validation returning 'ok/valid' you should be able to get past the cert error you mentioned in your query, but if not let me know and ill help where I can. Thanks! Michael McAleer - VMAX for Splunk Developer

MichaelMcAleer · ‎05-28-2018

Hi Bawan, Firstly, my apologies for the length of time it has taken for you to get a response to this query, if you have any future queries contact vmax.splunk.support@emc.com and someone will get in contact usually within 24-48 hours. We don't currently support pulling data from the VMAX 20K model, only the VMAX-3 Hybrid series arrays or newer arrays. However, there is an option for getting syslog data from Solutions Enabler via UDP. I have mentioned it in my VMAX for Splunk 2.0 blog article in the section 'Pulling Data from VMAX-2 Series Arrays (not using the VMAX TA)'. Hope this helps! Michael McAleer - VMAX for Splunk Developer

MichaelMcAleer · ‎01-18-2018

These weren't out of the box services but services I had configured myself. As mentioned previously, the behavior is not confined to any one service, it was seen across multiple services at varying times. I did however get to the bottom of it, the issue is to do with monitoring lag, and what I believe to be a pretty big problem for end-users if they use ITSI services where entities are imported by way of a recurring search. Without getting into the specifics of the setup as it is irrelevant, lets say the system I was pulling KPIs from had what translated into 500 entities at the time of creating the module/services/entities etc. When I was defining the KPI base searches I had to set a monitoring lag, recommenced setting was 136 seconds. I left the ITSI module running away doing its own thing whilst I worked on other projects, but in the mean time the amount of entities increased to approx 2500 entities. The effect of all of these extra entities imported by recurring search meant that the monitoring lag increase immensely, with recommendations of 1600 seconds for the last service to have data pulled from the add-on feeding data to ITSI. Once I changed all the monitoring lag values to their new recommended settings there was no more issues with Unknown/NA/NaN values appearing at any level. This does raise a far more important question than what does NaN mean (no explanation anywhere....), are we expecting end-users to go and continually update the monitoring lag on the base searches as they have more entities added to ITSI? If so, this is really poor behavior from the feature, what if ITSI fails at a crucial time because there were more entities added resulting in increased monitoring lag. If not, is there a way to set ITSI to dynamically set the monitoring lag?

MichaelMcAleer · ‎01-17-2018

Hi Splunk Community, I am having some issues with an ITSI module I am building. Before I get into it, I have checked the advice given here and here but neither resolve the issue I am having. My dev VM also has 12 vCPUS and 16GB RAM so resources is not an issue, I have run the health check in the monitoring console also and can see no issues with skipped searches. Out of 12 services, I currently have 5 marked as N/A. These services are fed by an add-on which runs every 5 minutes to collect metrics. These metrics collection runs take somewhere in the region of 30s to 120s depending on environmental factors, but never anywhere near the 5 minute mark. To improve efficiency, I use KPI base searches, so there isn't an issue with resources, I'm sitting at about 4% CPU usage and 11% memory usage. When I click into the service I can see all service KPIs are marked as Unknown and NaN. The Entities for each KPI are showing as Normal and the alert_values have values associated. However, when I open up the KPIs in a deep-dive I am seeing 'No Data' for the past few hours. There is data, I have checked the events and they are recent as of a few minutes ago, and when I go to configure KPI under services, when defining the threshold values I can see the aggregate and per entity stats in there for right up until present, showing ITSI is picking up the data as intended in some manner. To make it more confusing, the services are not appearing as N/A as you would expect. During the metrics collection in the TA, it collects the metrics in the same manner each time, for one service after another. What I am seeing is services that are last in the metric collection run have health scores, but lesser services with less entities in the middle of the metrics collection run are showing N/A. So my question is, what is going on? And yes, I have had numerous occasions where all services were showing their health scores, this behaviour is a frequently occurring issue so i want to be able to warn end-users about it.

MichaelMcAleer · ‎10-11-2017

Just implemented this in a wider test and im still seeing the delay so I will unmark it as accepted answer. If a workable solution comes back I will post it here

MichaelMcAleer · ‎10-11-2017

So after some discussion with Splunk there was a solution found which is very close to the method above with appending a search to the original query however the change in creating the wilcard * option removes the delay in getting it to appear: <input type="dropdown" token="field1"> <label>Drilldown Menu - Select First From List</label> <fieldForLabel>uri_path_label</fieldForLabel> <fieldForValue>uri_path</fieldForValue> <selectFirstChoice>true</selectFirstChoice> <search> <query> index=_internal uri_path=* | head 10 | stats count by uri_path | eval uri_path_label=uri_path | append [| stats count | eval keys="*,a,foo,z" | makemv delim="," keys | mvexpand keys | eval uri_path_label = case(keys="*","All",true(),upper(substr(keys,1,1)) . substr(keys,2,len(keys))) | eval uri_path = keys] </query> <earliest>-5000@h</earliest> <latest>now</latest> </search> </input>

MichaelMcAleer · ‎10-11-2017

Hi @DalJeanis, thanks for the response, the issue wasn't with getting ALL to appear in the list but instead the order in which is appeared when the dashboard is loaded. In the sample above, using append within the query in such a way creates a delay before ALL appears as an option.

MichaelMcAleer · ‎10-06-2017

Thanks very much for all the help! I will reach out to the Splunk team and if I get an answer/solution I will post it here for everyone to see

MichaelMcAleer · ‎10-06-2017

Tried this again, unfortunately the option for ALL doesn't display either until clicked, it goes against the principal design plan of ease of usability for the end-user so I might have to leave it if it is not possible to have ALL at the end of the dynamic list. So is it just that static options are processed before dynamic options when constructing list options? I can get in contact with Splunk directly to see if there is a workaround I can apply within the app itself to change behavior

MichaelMcAleer · ‎10-06-2017

@niketnilay Thanks for the quick response! I tried this in a clean dashboard and the 'All' option does not appear in the list initially, but only once a manual choice has been made by the user. Is this expected behaviour? It would be good to see here options for 'INFO', 'WARN', 'ERROR', and 'ALL' when the user first clicks the dropdown expand button

MichaelMcAleer · ‎10-06-2017

Hi Splunk Users, I have a question around populating a dropdown menu with results from a table when a wildcard choice value is also an option. I don't have an issue creating the dropdown, or getting the wildcard value, but what I need to find out is how to make the default choice the first item returned from a list and not the wildcard ALL value. Example: <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="array_tok" searchWhenChanged="true"> <label>Array Serial</label> <search> <query>`storage_array` | dedup array_id | table array_id | sort desc</query> <earliest>-48h@h</earliest> <latest>now</latest> </search> <choice value="*">ALL</choice> <fieldForLabel>array_id</fieldForLabel> <fieldForValue>array_id</fieldForValue> </input> </fieldset> I have tried to use the selectFirstChoice tag and default tags here but with no success, I can get the dropdown to do nothing and no dashboard panels populate with data until the user makes a selection, but ideally I would like the top item in the search to be the default selection and the ALL choice to be the last at the bottom of the list. So when a user navigates to a dashboard, the first array_id returned is the default value for the dropdown. Any ideas? Thanks!

MichaelMcAleer · ‎09-15-2017

Thanks garethatiag! It took me aaaaages to find out what they problem was with my post-process search, no mention of field extraction in the examples and only a footnote in the documentation, once I followed your advice it fixed my problem

MichaelMcAleer · ‎09-15-2017

I wanted to add in alternative answer to this solution, the whole time I have been adding the drill down filters using source XML instead of the UI, from the source XML and query run everything looked fine there were no duplicates so I was lead to searching online for answers. The "Field for Label" or "Field for Value" were fine, no different from the examples shown in the dashboard examples app, but when I looked at the filter in UI mode I noticed that there were two 'ALL = ' key/value pairs listed whereas there wasn't in the source XML. Removed the second 'All=' option and cleared the 'duplicate values causing conflict error'

MichaelMcAleer · ‎03-20-2017

Hi Jerad, Could you please send a copy of that e-mail to Michael.Mcaleer@emc.com? The support alias is not functioning correctly at present, I will also update the support e-mail address on the add-on page to avoid any further confusion. Apologies for any inconvenience caused! Michael

MichaelMcAleer · ‎03-20-2017

Hi Jerad, The VMAX Array ID is the 12 digit numerical ID ie '000197222222', if this array is registered for performance data collection in Unisphere there should be no issues. If the array was only just registered you will have to wait a few hours before the array is ready to start reporting. If you like, you can e-mail at vmax.splunk.support@emc.com and we will be better able to help with your specific environment, and if possible a copy of the VMAX related logs from Splunk along with environment details i.e. VMAX type, array ID etc. Thanks! Michael

MichaelMcAleer · ‎03-20-2017

Hi There, Firstly let me apologise for the delay in my response, Friday was a public holiday so I am only getting back to work again this morning. Multiple arrays from the same instance of Unisphere can be added to Splunk using the 'Data Inputs' section of Splunk settings. Under the input category 'Dell EMC VMAX REST' you can add each array individually by the numerical array ID, this can be repeated for as many VMAX Hybrid & All-Flash systems as required. If you have multiple arrays spread across multiple instances of Unisphere, there is reference to distributed environments within the VMAX add-on documentation. In a distributed deployment, install the Splunk VMAX TA to your search heads and heavy forwarders. This TA does not support universal forwarders because the TA requires Python. The add-on does not need to be installed on indexers because it does not support universal forwarders or light forwarders, thus parsing occurs on the heavy forwarder rather than on indexers. A search head/heavy forwarder per instance of Unisphere will allow you to forward data from all your instances of Unisphere. For a detailed installation instructions, refer to "Installing add-ons" that describes how to install a Splunk add-on in the following deployment scenarios: • single-instance Splunk Enterprise • distributed Splunk Enterprise • Splunk Cloud • Splunk Light Thank you for your question, if you have any further questions, recommendations, or feedback concerning the VMAX add-on for Splunk, please do not hesitate to ask questions either here on Splunk Answers or via our direct support e-mail address vmax.splunk.support@emc.com. Michael

MichaelMcAleer · ‎11-24-2016

Confirming that the fix of switching worked perfectly : scheme.use_single_instance = True ==> scheme.use_single_instance = False Thanks Gordan!

Posts	29
Solutions	2
Karma Given	7
Karma Received	11
Member Since	‎11-21-2016

Online Status	Offline
Date Last Visited	‎12-01-2020 10:25 AM

Splunk Add-on Builder: Custom inputs.conf configur...

Splunk Add-on Builder: Custom inputs.conf configur...

Issues with Splunk 8.1 Install

Splunk ITSI Services showing N/A

Prevent delay in wildcard being in dropdown select...

Splunk TA TypeError for multiple data inputs

Re: Issues with Splunk 8.1 Install

Re: Issues with Splunk 8.1 Install

Splunk Add-on Builder: Custom inputs.conf configur...

Splunk Add-on Builder: Custom inputs.conf configur...

Issues with Splunk 8.1 Install

Re: VMAX integration

Re: Splunk ITSI Services showing N/A

Re: certificate mismatch error when configuring De...

Re: certificate mismatch error when configuring De...

Re: Is the VMAX Add-on for Splunk Enterprise capab...

Re: Splunk ITSI Services showing N/A

Splunk ITSI Services showing N/A

Re: Prevent delay in wildcard being in dropdown se...

Re: Prevent delay in wildcard being in dropdown se...

Re: Prevent delay in wildcard being in dropdown se...

Re: Prevent delay in wildcard being in dropdown se...

Re: Prevent delay in wildcard being in dropdown se...

Re: Prevent delay in wildcard being in dropdown se...

Prevent delay in wildcard being in dropdown select...

Re: Dashboard Base Search is not working for all p...

Re: Why does my drop-down say "Duplicate values c...

Re: Dell EMC VMAX Add-on for Splunk: How to duplic...

Re: Dell EMC VMAX Add-on for Splunk: How to duplic...

Re: Dell EMC VMAX Add-on for Splunk: How to duplic...

Re: Splunk TA TypeError for multiple data inputs