About jdastmalchi_spl

jdastmalchi_spl · ‎09-10-2015

The first issue will be addressed in DB connect 2.1 as DBX-2108. For the second issue there have been improvements to this area but this may still be the correct approach as if you follow the documentation it recommends to nitially set up some identity and connection then deploy the app which means you will automatically deploy identity.dat

jdastmalchi_spl · ‎05-01-2015

This is No longer a limitation and version 6.1.7 or later should support longer lists.

jdastmalchi_spl · ‎05-01-2015

This is No longer a limitation and version 6.1.7 or later should support longer lists.

jdastmalchi_spl · ‎03-23-2015

SPL-92698 was fixed in 6.2.1

jdastmalchi_spl · ‎11-21-2014

Both are known issues and will be addressed SPL-93439 for "." & SPL-93453 for "@"

jdastmalchi_spl · ‎11-18-2014

in server.conf you have a key "pass4SymmKey" under the General stanza "[general]" this is not to be mistaken with the pass4SymKey used for clustering. This pass4SymmKey is used in the license master/slave communication. So you may have set this password in $SPLUNK-HOME/system/local/server.conf [general] pass4SymmKey = test If you set this in 6.1.4 after restarting splunk it saves it as plain text and does not get encrypted, however the same password in 6.2 after restart will get encrypted and will look something like this "pass4SymmKey = $1$W5xMFCIb8FGj”. As long as you understand this and respect the difference it will work, if you suspect this is wrong and copy paste the encrypted pass to the license master this will break the communication as the behaviorrs are different.

jdastmalchi_spl · ‎11-18-2014

I have License master splunk version 6.1.4. I have now installed 6.2 version on some servers and these servers don't work as license slaves with 6.1.4 license master. Is there a version incompatibility? Does the license master need to be the same version? I get these errors on the license master: 11-18-2014 09:38:42.363 +0000 ERROR LMHttpUtil - signature mismatch between computed and actual for uri /services/masterlm/usage 11-18-2014 09:38:42.363 +0000 ERROR LMMasterRestHandler - path=/masterlm/usage: invalid signature on request from ip=10.73.1.206

jdastmalchi_spl · ‎11-14-2014

Please don't use appServerPorts=0 as a final fix, Legacy mode can be used as an interim workaround to minimize intruption to your service but the main underlying issue needs to be investigated and addressed.

jdastmalchi_spl · ‎10-30-2014

It's an answer because it doesn't work in compatibility mode, the error is a little harsh and suggests it won't work with the browser at all however the issue is as simple as turning compatibility mode off.

jdastmalchi_spl · ‎10-29-2014

Bruch can you please provide the information I requested on the case to follow up.

jdastmalchi_spl · ‎10-29-2014

This is a known issue mentioned here and the work around is to stop splunkd service and splunkweb service manually before upgrade. http://answers.splunk.com/answers/176994/upgrade-to-62-fails-on-windows-7-with-error-while.html Note that the short cut after upgrade may not work , and you may need to directly use your browser for connecting to splunk UI.

jdastmalchi_spl · ‎10-28-2014

Splunk engineering team is looking at this as a known issue SPL-92480 however as a work around manually stopping splunk services before running the msi should allow a correct upgrade. my migration.log.2014-10-28.17-28-48 only contains the below lines : Migrating to: VERSION=6.2.0 BUILD=237341 PRODUCT=splunk PLATFORM=Windows-x86 ERROR while running rename-cluster-app migration.

jdastmalchi_spl · ‎10-28-2014

I have tried to upgrade to 6.2 on windows 7 and my installation fails with below message "Splunk Enterprise Setup Wizard ended prematurely because of an error" Looking in %SPLUNK_HOME%\var\log\splunk\migration.log% reveals this cryptic error: ERROR while running rename-cluster-app migration

jdastmalchi_spl · ‎10-28-2014

Check if you are using "compatibility mode" or document mode is set to ie7. You can find document mode under settings "F12 Developer Tools". You need to make sure any compatibility mode is off , ie 9 and higher will work.

jdastmalchi_spl · ‎10-28-2014

I have upgraded to 6.2 and now when I go to splunkweb with ie10 I get a black page with this error "This browser is not supported by Splunk. Please refer to the list of Supported Browsers."

jdastmalchi_spl · ‎10-06-2014

set the display.visualizations.show = 0 for that saved search inside the savedsearches.cof. This answers post also may help http://answers.splunk.com/answers/132453/pdf-chart-does-not-display-statistics-correctly.html

jdastmalchi_spl · ‎09-12-2014

This looks like a known issue fixed in 6.1.4. SPL-86189 http://docs.splunk.com/Documentation/Splunk/6.1.3/ReleaseNotes/KnownIssues

jdastmalchi_spl · ‎08-18-2014

With the assumption that the events in the logs that are within 2 minutes of eachother this should give you the infor you want. replace <myappname> and <mydashboard> with the appropriate app_name and dashboard_name. index=_internal source=*/web_access.log* | search "/app/" AND "POST" |rex "\/\/\w+\:\d{4}\/en-US\/app\/(?<app>\w+)\/(?<view_name>\w+)" |search app="<myappname>" AND view_name="<mydashboard>" | transaction referer maxspan=2m |table _time,app,view_name,user,form_email or index=_internal source=*/web_access.log* | search "/app/" AND "POST" |rex "\/\/\w+\:\d{4}\/en-US\/app\/(?<app>\w+)\/(?<view_name>\w+)" |search app="<myappname>" AND view_name="<mydashboard>" | transaction referer maxspan=2m |timechart count(form_email) by user

jdastmalchi_spl · ‎04-22-2014

When there is a transforming search, splunk always includes chart and table in the generated pdf. The default value for display.visualizations.show in 'default/savedsearches.conf' is 1 which makes a chart to appear in the generated pdf. If you just want the statistical table to appear in pdf the solution is to set the display.visualizations.show = 0 in 'savedsearches.conf' for that specific search to get only statistical table in the pdf. If you wish you to change this for all your generated pdf files you can change this globally in $SPLUNK-HOME/etc/system/local/savedsearches.conf

jdastmalchi_spl · ‎02-04-2014

try this 1- go to internet Explorer's menue and chose F12 Developertools 2- on the pop up the apears make sure the document mode is set to IE8 and not IE7. 3- let the page reload then go back to the field extraction page and now mouse over the button should not break anything.

jdastmalchi_spl · ‎11-15-2013

you can use command ./splunk clean locks as an alternative to step2.

jdastmalchi_spl · ‎10-23-2013

This is a known issue SPL-75535 and fixed in 6.0.1 for version 6.0 workaround is : ./splunk cmd python $SPLUNK-HOME/lib/python2.7/site-packages/splunk/clilib/info_gather.py --exclude */passwd

jdastmalchi_spl · ‎10-23-2013

The flags such as exclude as explained in http://docs.splunk.com/Documentation/Splunk/6.0/Troubleshooting/ContactSplunkSupport don't work for version 6.0. ./splunk diag --exclude */passwd Command error: '*/passwd' is not a valid command. Please run 'splunk help' to see the valid commands.

jdastmalchi_spl · ‎04-05-2013

I've set up a new windows cluster, but one of my nodes seems to be in a continual restart. When I looked in splunkd.log, I found the following messages near each restart: 04-03-2013 08:43:37.608 +0200 INFO CMSlave - successfully moved bundle from 'C:\Program Files\Splunk\var\run\splunk\cluster\remote-bundle\b080fa58dab1dff841b292814b7f6c5e-1364971417' to 'C:\Program Files\Splunk\etc\slave-apps' 04-03-2013 08:43:37.608 +0200 INFO loader - Downloaded new bundle from the cluster master. Restarting splunkd... I've noticed that the slave-apps folder, where the configuration is supposed to end up, is empty. Has anyone seen this, and if so, how can I resolve the problem?

jdastmalchi_spl · ‎03-04-2013

Here is a question I've received, would appreciate help. What I would like to do is set a scheduled Email that will be sent once a week, the Email will contain the graphs & tables from a specific Dashboard. The graphs in that dashboard will be based on a specific client. I would like to use a saved search in order to get the clients list from the data and then forward it to the scheduled report one by one. So basically what I’ll have is a "template" dashboard/Report that will send the report as an Email per client on a weekly basis." Is it feasible? If yes - how can this be done?

Posts	25
Solutions	7
Karma Given	52
Karma Received	101
Member Since	‎07-12-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Why is my 6.2 license slave not working with my 6....

Upgrade to 6.2 fails on windows 7 with "ERROR whil...

Browser Unsupported on IE after upgrade to 6.2

splunk diag command doesn't work with --exclude in...

Why is my windows cluster peer node continually re...

Automatic weekly report e-mails based on dynamic c...

Re: Splunk DB Connect 2: Identities and Connection...

Re: Jobs page limit to number of users

Re: Jobs page limit to number of users

Re: Why site doesn't load trying to access Splunk ...

Re: Splunk 6.2 upgrade issue -- users can no longe...

Re: Why is my 6.2 license slave not working with m...

Why is my 6.2 license slave not working with my 6....

Re: Why site doesn't load trying to access Splunk ...

Re: Browser Unsupported on IE after upgrade to 6.2

Re: Why am I getting "Splunk Enterprise setup wiza...

Re: Why am I getting "Splunk Enterprise setup wiza...

Re: Upgrade to 6.2 fails on windows 7 with "ERROR ...

Upgrade to 6.2 fails on windows 7 with "ERROR whil...

Re: Browser Unsupported on IE after upgrade to 6.2

Browser Unsupported on IE after upgrade to 6.2

Re: Removing charts from scheduled PDF reports?

Re: What is: ERROR BucketMover - sizeBytes=xxx can...

Re: How to monitor Splunk dashboard usage using in...

Re: PDF chart does not display statistics correctl...

Re: Can not extract fields in Splunk 6 with IE8

Re: Splunk will not start and is waiting for confi...

Re: splunk diag command doesn't work with --exclud...

splunk diag command doesn't work with --exclude in...

Why is my windows cluster peer node continually re...

Automatic weekly report e-mails based on dynamic c...

Are you a member of the Splunk Community?