Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mookiie2005
mookiie2005
Communicator
Member since:
03-01-2013
12-11-2024
Community Statistics
| Posts | 90 |
| Solutions | 5 |
| Karma Given | 14 |
| Karma Received | 67 |
| Member Since | 03-01-2013 |
Activity Feed
- Posted OTEL splunk_hec receiver how to handle invalid tokens on Getting Data In. 12-11-2024 07:37 AM
- Posted Re: Splunk upgrade from 7.3.3 to 8.0.6 fails with "WARNING: web interface does not seem to be available!" on Installation. 11-07-2024 12:43 PM
- Got Karma for Re: Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations?. 11-29-2022 11:09 PM
- Got Karma for Re: Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations?. 09-13-2022 05:28 AM
- Got Karma for Re: Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations?. 08-26-2022 10:09 AM
- Posted Re: Splunk integration with thousandeyes on Other Usage. 03-15-2022 06:03 AM
- Got Karma for What is the latest stable release of splunk 8.x? I have heard of some stability issues.. 10-13-2021 04:10 PM
- Posted Re: 500 Internal Server Error on All Apps and Add-ons. 08-18-2021 06:59 AM
- Posted Splunk 8.x and aws app python compatibility on All Apps and Add-ons. 05-12-2021 05:28 AM
- Posted What is the latest stable release of splunk 8.x? I have heard of some stability issues. on Splunk Enterprise Security. 04-23-2021 10:59 AM
- Got Karma for How to route and filter data on the Heavy Forwarder to separate indexer groups?. 11-04-2020 07:10 AM
- Posted Issue with alert running from DMC for memory overrun. on Monitoring Splunk. 09-17-2020 08:14 AM
- Got Karma for Re: Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations?. 07-08-2020 05:17 AM
- Karma Re: Modular input not showing on settings>Data inputs for ishaanshekhar. 06-05-2020 12:48 AM
- Karma Re: How to route and filter data on the Heavy Forwarder to separate indexer groups? for sk314. 06-05-2020 12:48 AM
- Got Karma for Re: How can Splunk index a file without a file extension?. 06-05-2020 12:48 AM
- Got Karma for How can Splunk index a file without a file extension?. 06-05-2020 12:48 AM
- Got Karma for How to route and filter data on the Heavy Forwarder to separate indexer groups?. 06-05-2020 12:48 AM
- Karma Re: Routing Data to specific index based on filename for Ayn. 06-05-2020 12:47 AM
- Karma Re: How do you handle deployments in search head clustering if you are no longer able to use a deployment server? for Steve_G_. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
12-11-2024
07:37 AM
Hello All, I am trying to build a open telemetry collector for splunk_hec receiver. I am able to get it working and route the data to a tenant based on the token value sent in. What I wanted to do was have a way to handle invalid tokens. Obviously I do not want to ingest traffic with an invalid token, but I would like visability into this. Is anyone aware of a way to log some sort of message to indicate that a bad token was sent in and what that token value was and log that to a specific tenant. Here is an example confiog like: - set(resource.attributes["log.source"], "otel.hec.nonprod.fm-mobile-backend-qa") where IsMatch(resource.attributes["com.splunk.hec.access_token"], "9ff3a68d-XXXX-XXXX-XXXX-XXXXXXXXXXXX") Can I do an else or a wild card value? - set(resource.attributes["log.source"], "otel.hec.nonprod.fm-mobile-backend-qa") where IsMatch(resource.attributes["com.splunk.hec.access_token"], "********-****-****-*********") Or some other way to log a message to the otel collector with info like host or ip and the token value that was sent? I am just looking into gaining visibility into invalid token data sent.
... View more
- Tags:
- OTEL
Labels
- Labels:
-
HTTP Event Collector
11-07-2024
12:43 PM
Just wanted to add that we experienced this issue as well with splunk 9.1.4 and 9.1.5. Thanks for this info this was down for over a month for us!
... View more
03-15-2022
06:03 AM
How did you configure the address for the SAAS, I am not seeing where that is supposed to be inputted/configured?
... View more
08-18-2021
06:59 AM
We are experiencing a similar issue after upgrading t splunk 8.1.4. Did you ever find a resolution?
... View more
05-12-2021
05:28 AM
Is the Python for Scientific Computing app (https://splunkbase.splunk.com/app/2882/) version 2.0.x is compatible with the AWS app? The aws app documentation specifically mentions the use of Python for Scientific Computing app V1.2. Can anyone confirm that on an 8.1.3 system we can run the AWS app using the Python for Scientific Computing app (https://splunkbase.splunk.com/app/2882/) version 2.0.X? Can anyone who upgraded to 8.x and is using the AWS app chime in?
... View more
Labels
- Labels:
-
configuration
-
upgrade
04-23-2021
10:59 AM
1 Karma
What is the latest stable release of splunk 8.x? We are planning a version upgrade from 7.3.5 to 8.x. I have heard of some instances where stability issues were seen on 8.x. Does anyone know of the latest stable version?
... View more
Labels
- Labels:
-
risk analysis
-
upgrade
09-17-2020
08:14 AM
Hello,
We have an alert in place that uses the REST API to determine when a server is using to much memory and then the server is restarted. It had been working great, however last week we had an alert come through that listed every box connected to the DMC. This caused some restarts that created an issue. When trying to look at the stats for the machines at the time of the alert, none of the servers show meeting that condition. Am I doing something wrong here?
We are using the below search:
| rest splunk_server_group=dmc_group_* /services/server/status/resource-usage/hostwide
| eval percentage=round(mem_used/mem,3)*100
| where percentage > 90
| fields splunk_server, percentage, mem_used, mem
| rename splunk_server AS ServerName, mem AS "Physical memory installed (MB)", percentage AS "Memory used (%)", mem_used AS "Memory used (MB)"
| rex field=ServerName "\s*(?<ServerName>\w+[\d+]).*"
| table ServerName
| sort - ServerName
| stats list(ServerName) as ServerName delim=","
| nomv ServerName
... View more
Labels
11-27-2018
07:55 AM
We are continually seeing an error - "ImportError: No Module named site". No tests seem to execute.
Here are the contents of our .bat file to launch our .py script:
@echo off
set PYTHONPATH="C:\Python 3.7"
set LD_LIBRARY_PATH="C:\Python 3.7\Lib"
set CLASSPATH="C:\Python 3.7\Scripts\Splunk Scripts\selenium-2.43.1\selenium-server-standalone-.jar"
set SELENIUM_SERVER_JAR="C:\Python 3.7\Scripts\Splunk Scripts\selenium-2.43.1\selenium-server-standalone-.jar"
set SELENIUM_SERVER_JAR
python "D:\Program Files\Splunk\etc\apps\splunk-app-synthetic\bin\SFIALoginProd_p7.py"
I could not find a windows example of the bin file referenced in the instructions:
https://splunkbase.splunk.com/app/1880/#/details
Thanks!
... View more
05-24-2017
10:23 AM
I downvoted this post because we are running splunk 6.4.0 and have the same issue.
... View more
12-13-2016
07:09 AM
I appreciate everyone who contirbuted to this issue. What I ended up finding/figuring out is that the above errors were actually a symptom of a much larger issue. When I could not find any reason log entries were not being sent over, I checked the internal logs and found that some in fact did get over into the splunk instance. This istance had been reporting being near or at the maximum concurrent searches. Once I looked at the logs and combined this issue with users reporting that logs were not getting indexed for display on their dashboards, but when I would look into it the data was there. Eventually I decided to take a look at teh indexer and that is when I found that all teh queues, indexing, typing, parsing, and merging were all at or nearly constantly at 100%. Once I saw that everything started to make sense, the indexer is backed up and cannot keep up with volume, at this point I am assuming an issue with IOPS as the hardware is well within the splunk specifications, except for disk, as Our group was not involved/consulted on the install and all we have been told is that it is tier 1 storage, but at the moment we have no idea how many IOPS that offers. That is what we are investigating now.
... View more
11-30-2016
05:23 AM
This is very good information. It turned out that for some reason the Heavy Forwarders we were trying to send the data to the separate instance was actually refusing the data on port 9997. We changed this to 9996 and opened that port on the HF and that resolved the issue. This was particularly frustrating as we had established communication between our indexers and the HF of the other instance in an earlier test, but settings were changed on the HF which cause this issue for us.
... View more
11-22-2016
04:47 AM
I downvoted this post because this does not address the issue.
... View more
11-10-2016
12:17 PM
2 Karma
We need to route and filter data on the heavy forwarder. We are having trouble configuring the routing of security logs to a Splunk instance specifically for security logs and the main Enterprise instance.
We want to direct certain logfiles to our main indexers and/or a separate Splunk instance specifically for security. We want to send security data to the security instance and send windows application/system logs to both sets of indexers. We created an app on the heavy forwarder, however, it does not seem to be working as expected.
Here is our props.conf:
[WinEventLog:Application]
TRANSFORMS-routing_Windows_=Windows_GIS_data_app
[WinEventLog:Security]
TRANSFORMS-routing_Windows_=Windows_GIS_data_sec
[WinEventLog:System]
TRANSFORMS-routing_Windows_=Windows_GIS_data_sys
Main index
[Perfmon:CPU Load]
TRANSFORMS-routing_Windows_=Windows_splunk_main_data
[Perfmon:Available Memory]
TRANSFORMS-routing_Windows_=Windows_splunk_main_data
[Perfmon:Free Disk Space]
TRANSFORMS-routing_Windows_=Windows_splunk_main_data
Perfmon index
[Perfmon:PhysicalDisk]
TRANSFORMS-routing_Windows_=Windows_splunk_perfmon_data
[Perfmon:CPU]
TRANSFORMS-routing_Windows_=Windows_splunk_perfmon_data
[Perfmon:Memory]
TRANSFORMS-routing_Windows_=Windows_splunk_perfmon_data
[Perfmon:MemoryStats]
TRANSFORMS-routing_Windows_=Windows_splunk_perfmon_data
[Perfmon:CPUTime]
TRANSFORMS-routing_Windows_=Windows_splunk_perfmon_data
[Perfmon:FreeDiskSpace]
TRANSFORMS-routing_Windows_=Windows_splunk_perfmon_data
Here is our transforms.conf:
[Windows_GIS_data_app]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = ALL_INDEXERS
[Windows_GIS_data_sec]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = GIS_INDEXERS
[Windows_GIS_data_sys]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = ALL_INDEXERS
[Windows_splunk_main_data]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = FARMERS_MAIN_INDEXERS
[Windows_splunk_perfmon_data]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = FARMERS_INDEXERS
Here is our outputs.conf:
[indexAndForward]
index=true
selectiveIndexing=true
[GIS_INDEXERS]
indexAndForward = true
[tcpout:GIS_INDEXERS]
server=10.148.186.83:9997, 10.148.186.84:9997
[ALL_INDEXERS]
indexAndForward = true
[tcpout:ALL_INDEXERS]
server=10.142.114.13:18017, 10.148.186.83:9997, 10.148.186.84:9997
[FARMERS_INDEXERS]
indexAndForward = true
[tcpout:FARMERS_INDEXERS]
server=10.142.114.13:18015
[FARMERS_MAIN_INDEXERS]
indexAndForward = false
[tcpout:FARMERS_MAIN_INDEXERS]
server=10.142.114.13:18013
Can anyone help to resolve the issue?
... View more
09-22-2016
10:59 AM
I downvoted this post because this can be done with route and filtering:
http://docs.splunk.com/documentation/splunk/6.4.3/forwarding/routeandfilterdatad
... View more
09-01-2016
05:18 AM
1 Karma
I gave everyone who responded 25 points! Thanks again guys!
... View more
09-01-2016
05:16 AM
Wow I feel really embarrassed, turns out the logfile path provided had "Microsoft" spelled wrong! Always the little things. Thanks to all that replied with assistance!
... View more
08-26-2016
12:50 PM
Nothing in the windows logs.
... View more
08-26-2016
07:15 AM
I should point out that teh logs in question are SQL server logs if that makes a difference.
... View more
08-26-2016
07:14 AM
It should, it is running under my user and I am able to open the files in question.
... View more
08-26-2016
04:39 AM
37 Karma
This happened to us a lot after we upgraded to splunk 6.4 version, We ended up needing to use the deployment command "splunk reload deploy-server -timeout 200" where 200 is 200 seconds. You are just telling splunk to give the deployment a little more time before it times out. This could be required if you are deploying a large number of apps to a large number of servers. Hope that helps!
... View more
08-25-2016
12:41 PM
1 Karma
I have several servers with SQL logs that are in the format:
sqlerror
sqlerror.1
sqlerror.2
I have tried all kinds of wildcard variations, but I cannot get Splunk to index these files. I can see from the internal logs that Splunk says it is watching the file, yet it never indexes any data from it. Anyone face a similar issue?
... View more
02-09-2016
08:15 AM
We have a lot of searches that run to ensure we are receiving data from a Splunk forwarder and that it is still running. To do this, we have a search set up for each forwarder checking against the internal logs:
index="_internal" source="*metrics.log" group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | search sourceHost="phpdbo01"
The above alerts us when the forwarder phpdbo01 is down/not sending information back to indexers. One of the issues we have is that we want to have a default message come through, if Splunk attempts to run a search and the indexers are down, we would like for a message such as "Splunk indexers are down please resubmit your search once they come back up", because in many cases, as with the alert above, we are looking for an absence of data to trigger an alert. When the above search runs and the indexers are down, Splunk returns 0 results and so sends out an alert that the phpdbo01 forwarder is down. I was trying to work with the below, but I am not having a great deal of luck:
index="_internal" source="*splunkd.log" host="pl-wlmsplpp01" "Unable to distribute to peer named" | rex field=_raw "Unable to distribute to peer named (?.*):\d+ at " | eval status=if(indexer=="pl-wlmsplpp04" OR indexer=="pl-wlmsplpp03","Down","Up") | eval search_result = if(status!="Down",[search index="_internal" source="*metrics.log" group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | search sourceHost="phpdbo01"], "Indexer is down. please run search again at a later date") | table search_result
Unfortunately, I have been unable to get the above working. Can anyone help or have you already done something similar that could be adapted?
... View more
11-04-2015
08:19 AM
How did you remove the deployment monitor? Did you delete the folder within splunk\etc\apps? Or disable it through the apps management GUI?
... View more
06-03-2015
07:38 AM
This does not help at all? Splunk is only retaining the alerts for however long you have set them to be retained. We do not want to retain the results of every alert perpetually so they are still on the _audit index. What I need is a way to log alert triggers to a separate index where we can maintain the alert name, and alert time it triggered. Anyone have a practical way to do this?
... View more
06-01-2015
07:25 AM
I want to create a way to log the alert name and trigger time to a log file and retain that information for 6 months - not the actual search results, just the name of the alert and time/date it was triggered. Has anyone done this before? You can save the search results and set a custom retention time for that, but in our case we don't want the search results, just the log of the alert trigger time. Please let us know if anyone has done something like this before or has an idea how to do it.
Thanks,
Sean
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-11-2024
03:50 PM
|
