About smellpit

smellpit · ‎01-17-2017

The problem was something simple: once I started using ./local instead of ./default the .conf files have been working as expected. I know about the precedence rules & the general "don't use ./default" rule-of-thumb. I still thought ./default would be OK since it is in the hierarchy & there are Splunk PDF deployment-app examples that use ./default. And I'd think that at least the first ./default deployment would do something as opposed to apparently nothing (at least for .conf files). Thanks everyone for your help & input.

smellpit · ‎01-15-2017

I had seen "I can't find my data!" before but this time it (almost) fits. Briefly (well, not, but frustration wants to answer everything): Are you running Splunk Free? No, trial license. And the indexers aren't slaving the master license but that should not matter (see next "Example case"). Was the data added to a different index? "Example case" (a Splunk example) delivers to "main" but my test cases haven't delivered to other indexes. Do your permissions allow you to see the data? All Linux-sample log files are splunk:splunk (processes user:group). What about issues related to time? Cannot see a relation: "All time" works, but only(!?) for the "Example case" /var/log/messages file. Are you using forwarders? Yes, which works fine w/ "Example case(!)" log file. Are you using search heads? Yes, and searches do see new and existing indexer data. Are you still logged in and under your license usage? Yes. Are you using a scheduled search? No. Check your search query; Are you using NOT, AND, or OR? Don't need to: 'index="whatever"' is enough to check (un)available data. Are you extracting fields? Doesn't need to get that far. This must be something simple or (very) esoteric; thanks in advance.

smellpit · ‎01-13-2017

I am fresh to Splunk Enterprise so I must be missing something simple. To summarize: what does a deployment application actually do? I see the "deployment": the files are copied from the search head/DS to the specified forwarder(s). Everything about "Forwarder management" appears to be working as expected, being configured with the web GUI and/or the CLI files. I have separate Linux instances for 6.5.1 search head, indexers, forwarders, and have been through the Updating SE Instances 6.5.1 PDF several times. To rephrase, the ./deployment-apps files are deployed but then what? Descriptions mention deployment of arbitrary content, script and configuration files. Setting aside the if/when/how for running(?) script files, configuration files are the concern here. I've seen text and other Answers posts that imply the deployment of, say, an inputs.conf file to a forwarder will affect the data it looks at, ingests. I can see how that configuration deployment would make sense when there are many forwarders that want to do about the same thing Details here: * Deployment server & clients show as connected with ./splunk CLI show/list deploy commands. * Automated deployment and manual "reload deploy-server" have both been done. * As said earlier, the files are being deployed to the clients. * Fresh "qwerty" index. * An inputs.conf is set-up & deployed to a forwarder for an existing log file: Deployment server cat $SPLUNK_HOME/etc/deployment-apps/qwerty-app/default/inputs.conf [monitor:///opt/log/junk] disabled = false index = qwerty whitelist = *.log Forwarder [splunk qwerty-app]$ cat /opt/splunkforwarder/etc/apps/qwerty-app/default/inputs.conf [monitor:///opt/log/junk] disabled = false index = qwerty whitelist = *.log Log file on forwarder [splunk]$ ls -al /opt/log/junk/* -rw------- 1 splunk splunk 864674 Jan 13 22:35 /opt/log/junk/crunch.log Shouldn't the new "qwerty" index now have crunch.log data? The forwarder splunkd process was set to restart following the app deployment; restarting it and the search head again made no difference. I've also tried the conf with & without the 'host' parameter (didn't think it'd matter). Any assistance would be greatly appreciated.

smellpit · ‎12-24-2016

I'm a brand new Splunk user. I've seen you can have just an Enterprise install, no forwarders, monitoring local data only (off-topic to expand on the "only"). Since the single install handles search head & indexer duties (right?), I've been trying to install a forwarder on the same Enterprise box but can't get it to connect. I also tried a separate box for just the forwarder & netstat did say "9997" ESTABLISHED on both machines; still no forwarder data connection. If a forwarder does need an indexer, could the indexer & forwarder be on the same machine? I'd tend to think yes but then again... Thanks!

Posts	4
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎12-24-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Problem trying to use deployment-apps

Does a forwarder need to connect through an indexe...

Re: Problem trying to use deployment-apps

Re: Problem trying to use deployment-apps

Problem trying to use deployment-apps

Does a forwarder need to connect through an indexe...