Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About vr2312
vr2312
Builder
Member since:
03-10-2015
2 weeks ago
Community Statistics
| Posts | 139 |
| Solutions | 15 |
| Karma Given | 45 |
| Karma Received | 15 |
| Member Since | 03-10-2015 |
Activity Feed
- Got Karma for Re: How can I completely delete a user in Splunk ES?. 09-07-2024 04:15 AM
- Got Karma for Re: How can I completely delete a user in Splunk ES?. 09-07-2024 02:40 AM
- Posted Re: How do I index data from a Cisco IPS? on All Apps and Add-ons. 09-01-2024 08:57 PM
- Posted Re: How can I completely delete a user in Splunk ES? on Splunk Search. 09-01-2024 06:38 PM
- Posted Re: Disabled/Deleted users are appearing in Investigators Panel in Enterpriser Security on Splunk Enterprise. 09-01-2024 06:13 PM
- Posted Re: Disabled/Deleted users are appearing in Investigators Panel in Enterpriser Security on Splunk Enterprise. 09-01-2024 06:12 PM
- Posted Re: Cant see export csv on my dashboard stiudio(splunk 9.2.1) on Installation. 08-22-2024 12:32 AM
- Posted Re: Cant see export csv on my dashboard stiudio(splunk 9.2.1) on Installation. 08-22-2024 12:00 AM
- Posted Disabled/Deleted users are appearing in Investigators Panel in Enterpriser Security on Splunk Enterprise. 08-21-2024 11:58 PM
- Tagged Disabled/Deleted users are appearing in Investigators Panel in Enterpriser Security on Splunk Enterprise. 08-21-2024 11:58 PM
- Posted Re: Configure and Use Enterprise Security Configuration Explorer on Installation. 06-10-2024 07:31 PM
- Posted Re: How to observe EPS for particular datasource from a Splunk UBA CLI? on Splunk User Behavior Analytics. 06-03-2024 09:25 PM
- Karma Re: How to get Splunk sendemail command to send multiple emails based on search results? for sirajnp. 06-03-2024 09:03 PM
- Posted How to observe EPS for particular datasource from a Splunk UBA CLI? on Splunk User Behavior Analytics. 09-21-2023 10:34 PM
- Tagged How to observe EPS for particular datasource from a Splunk UBA CLI? on Splunk User Behavior Analytics. 09-21-2023 10:34 PM
- Tagged How to observe EPS for particular datasource from a Splunk UBA CLI? on Splunk User Behavior Analytics. 09-21-2023 10:34 PM
- Posted Re: What defines an asset priority? on Splunk Enterprise Security. 09-04-2023 07:19 PM
- Tagged Re: What defines an asset priority? on Splunk Enterprise Security. 09-04-2023 07:19 PM
- Got Karma for Re: Why is one search head no longer communicating with indexers? Getting error "failed_because_BUNDLE_DATA_TRANSMIT_FAILURE". 06-29-2023 03:17 AM
- Posted Re: Why is the Web interface not available in splunk enterprise? on Installation. 09-15-2021 05:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
12-09-2018
06:41 PM
Also let us know from where did you deduce the log, cause its tough to understand as we can just give a broader perspective.
... View more
12-09-2018
06:40 PM
@prathapkcsc
From the logs i can deduce the following :
The queues are blocked and filled which is allowing no data to be searched or indexed
I would see if there is a resource intrusive search being run somewhere due to which the R/W operations are impacted.
You may do a quick restart of the box but that would just interrupt the search operation for a limited time and then initiate this issue again, only if the search is a continuous one.
... View more
12-07-2018
11:07 AM
@ddrillic Ah I get you now. You can still place it on the IDX as part of your keeping things Organized process. But the process work would still happen at the FW thus giving but no impact on your IDX.
As much as I have dealt with support (the top tier) and PS, they would want the processing to be occurring at the FW due to a high resource environment like ours. But when it comes to an aesthetic purpose, keeping it on IDX won't have much impact. We have been doing the same.
... View more
12-06-2018
03:02 PM
@bstimely Assuming you have a high performing IDX at the recipient end, i would perform the following analysis to make the changes
Check the pipelines at the UF, HF (If there is an intermediate HF) and IDX and see that there is no blocks causing the delay
If the clogging is in the HF, try to play around maxthrougput and parallelingestionpipelines ; also ensure that the HF performance is very minimal and it is utilizing less than 50% of resources so that there are no overhead when you enable these configurations
Play around the maxthroughput of UF and see if it allows forwarding of events from the UF faster.
... View more
12-06-2018
02:54 PM
Hello @ddrillic , if you have an Intermediate HF between the UF and IDX, then you would not need to place in the IDX. However, if the IDX does the data parsing and data indexing, you would need these.
... View more
12-05-2018
03:17 PM
Hey @teedilo , did you try installing the app from scratch and also ensuring there is no configurations that is created previously that are overriding the right transforms/props parameters ?
... View more
12-05-2018
03:14 PM
Okay, you would receive an email if there is an infrastructural issue with Splunk due to which searching and indexing operations get impacted. That is how it works, You might have to use this for better validity :
| eval delay = _indextime - _time
If there is a delay in indexing and the search results are triggering due to that, you can avoid those by using the above command in your search.
... View more
12-05-2018
03:09 PM
Yes, summary replication got back up again.
How are things with your issue ? Were the support helpful ? @dxu_splunk
... View more
12-05-2018
03:07 PM
@rajindurbal You can probably duplicate the inputs.conf and forward it to another index to check if data is being received. I assume you cannot see the mentioned index in the indexes.conf under the IDXs ?
... View more
12-03-2018
08:24 PM
Adding to @dantimola
You can use the below three ideas and tweak it to your requirements :
No internal logs generated for UFs, you can generate an hourly search and identify the time duration since the last data was forwarded. You can use tstats command to reduce search processing
Internal Logs for Splunk can be checked and correlated with TCPOutput to see if it is failing
Internal Logs for Splunk and correlate with connections being phoned in with the DS. A UF should communicate with DS everytime a DS is restarted (this is the default parameter)
Hope you also have an asset database that would make it easier to correlate and reach out to end server admins.
... View more
12-03-2018
08:16 PM
Hello @rajindurbal
Please ensure your account/role has the privileges to search for the index/host.
... View more
12-03-2018
06:35 PM
@pjr77
I would reccomend the following :
Disable the App from the GUI
Log in to the CLI of the Search Head, proceed to disabled_apps directory and locate the 0365 app directory
Proceed to inputs.conf file, there will be the stanza where the account name would be mentioned, the value must be present in account=XXXX
Commend out or remove the account name or replace it with the service account you are trying to use.Or you can remove the whole input and configure from scratch from the Web GUI.
Enable App from GUI
... View more
12-03-2018
06:21 PM
Try setting custom alerts which will trigger only when results are zero. In the alert actions tab.
... View more
12-03-2018
04:36 PM
I know this is an amateurish answer, but just checking if there are no firewall blocks between the URL and the requestor.
... View more
12-03-2018
04:33 PM
Hello @prakash007 , please ensure that there are logs present in the below locations :
Applications/apache-tomcat-8.0.23/logs
the same as the ones you have mentioned in your inputs.conf file.
If there are no logs available, please update the inputs.conf to the appropriate destinations.
Also check if you are able to receive internal logs from the Server onto splunk so that we can ensure the connectivity from the server to splunk is existent.
You can do that by running : index=_internal host=XXXX
... View more
12-03-2018
04:29 PM
So after a lot of pondering and digging deep, identified an underlying cause that was grabbing ore resources from the indexers. There was a search head which was replicated and was left from being managed. This search head was supposed to be decommissioned but was missed.
Hence, that search head, with both ES and a variety of Apps installed in it, was consuming to the searches and was messing with the performance of the indexers.
We removed the identified server, the replication job and performance of indexers came up just like that, without a scratch.
Strange that this one server gave us a lot of issues thus making us realize that every single instance needs to be accountable.
... View more
12-03-2018
02:49 PM
We moved the DS from a Windows Box to a Unix box and since then, the Powershell scripts have been failing at the Windows Destinations.
The Destination Host is running on Windows 2008 R2 hence we are using Powershell 2.
The following is the error code that we are receiving :
Error = Unable to initialize modular input "powershell2" defined inside the app "SA-ModularInput-Powershell";Introspecting Scheme=powersgell2:Unable to run "D:UniversalForwarder\etc\apps\SA-ModularInput-Powershell\windows_x86_63\bin\powershell2.exe --scheme"; exited with Code -1
The script is working fine as we have not made any changes to it after moving from a Windows Box
... View more
08-22-2018
11:30 PM
I do not think that would be applicable, but as i say, never say never. Go ahead and play around !
... View more
08-22-2018
11:29 PM
I reckon you would want to sort out the kvstore errors first, one search head at a time and then observe if this is still being observed.
... View more
08-22-2018
11:28 PM
You would want to use the clean command on the SH where you are observing the error. There is no need to stop all search heads to perform this on one particular Search Head.
... View more
08-16-2018
04:59 PM
Hello @moorvogi
You might want to resync/clean the KV Store by performing the following steps :
Stop the Search Head
Run this command locally : splunk clean kvstore --local
Start Search Head
... View more
08-16-2018
04:53 PM
I am not sure if KNIME can act as a Data Source for Splunk cause it is mostly the other way around.
You can look into the below external documentation for it and probably play around with Splunk DB Connect to role-reverse the requirement.
Use Splunk DB Connect to connect to KNIME, read data from KNIME and inject it into Splunk.
https://www.cdata.com/kb/tech/splunk-jdbc-knime.rst
... View more
08-16-2018
04:48 PM
@gkumarashanmugam
Are you by any chance using the trial version ?
Also as @richgalloway had suggested, try restarting the splunk instance after modifying the authorize.conf.
... View more
08-16-2018
04:44 PM
Hello @rchittip
From your error message, i can observe that the messages.conf has a missing stanza for LM_LICENSE:WARNINGS_GENERATED.
You might want to take a copy of the current setup and compare it with the one available under default.
This post must be able to guide you :
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Messagesconf
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Karma given to
