Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About venkateshparank
venkateshparank
Path Finder
Member since:
10-07-2019
08-27-2025
Community Statistics
| Posts | 44 |
| Solutions | 3 |
| Karma Given | 3 |
| Karma Received | 3 |
| Member Since | 10-07-2019 |
Activity Feed
- Got Karma for Re: How to find stopped service ?. 03-11-2024 10:41 PM
- Got Karma for Re: Why are splunk binaries creating under /usr/bin automatically?. 03-11-2024 10:33 AM
- Posted Re: How to find stopped service ? on Deployment Architecture. 03-11-2024 10:29 AM
- Karma Re: Splunk no longer accessible from iPad for PickleRick. 04-03-2023 02:24 AM
- Posted Why is Splunk no longer accessible from iPad? on Splunk Enterprise. 04-03-2023 01:29 AM
- Posted Re: Why is Splunk service using Off-site (external) NTP queries? on Installation. 03-24-2023 12:23 AM
- Karma Re: Why is Splunk service using Off-site (external) NTP queries? for Tom_Lundie. 03-24-2023 12:23 AM
- Karma Re: splunk binaries creating under /usr/bin automatically for richgalloway. 03-23-2023 12:26 PM
- Posted Re: Why are splunk binaries creating under /usr/bin automatically? on Monitoring Splunk. 03-23-2023 12:25 PM
- Posted Re: splunk service is using Off-site (external) NTP queries on Installation. 03-23-2023 12:23 PM
- Posted Re: splunk service is using Off-site (external) NTP queries on Installation. 03-23-2023 10:51 AM
- Posted Re: splunk service is using Off-site (external) NTP queries on Installation. 03-23-2023 07:40 AM
- Posted Why is Splunk service using Off-site (external) NTP queries? on Installation. 03-23-2023 05:38 AM
- Posted Why are splunk binaries creating under /usr/bin automatically? on Monitoring Splunk. 03-20-2023 07:46 AM
- Tagged Why are splunk binaries creating under /usr/bin automatically? on Monitoring Splunk. 03-20-2023 07:46 AM
- Posted Why am I getting duplicate values? on Splunk Enterprise. 08-26-2020 11:34 PM
- Posted Re: Install Certificate over 8089 port on Getting Data In. 08-21-2020 08:21 AM
- Posted Re: Install Certificate over 8089 port on Getting Data In. 08-21-2020 08:08 AM
- Posted Re: Install Certificate over 8089 port on Getting Data In. 08-21-2020 07:25 AM
- Posted Re: Install Certificate over 8089 port on Getting Data In. 08-21-2020 06:02 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-11-2024
10:29 AM
1 Karma
Try something below: index=<indexname> ("ess service") |transaction host startswith="The ess service entered the stopped state." endswith="The ess service entered the running state." maxspan=30m |search NOT <field>="The ess service entered the running state." |table host
... View more
04-03-2023
01:29 AM
Is there a reason why the Splunk is no longer works from an iPad? Its not working from any browser.
There is an error SSL_PROTOCOL_ERROR
Splunk version is 8.2.7
It works fine from all other devices.
... View more
03-24-2023
12:23 AM
That's great @Tom_Lundie , Thank you for sharing details. This is helpful. We have many servers in our environment but only few are having this issue. I identified that Splunk_TA_nix version which we have on these servers is very old, the serves which are having latest version doesn't have any issue. There was slight difference in time.sh between 6.x and 8.x version. So will try to upgrade and validate. if still issue exists, will update the script as you mentioned. Thanks again for the wonderful suggestion and accepted it as solution.
... View more
03-23-2023
12:25 PM
1 Karma
There was an automation in backend within AWS AMI to install older version. That was the issue and we are able to update the backend code. Thank you for the response
... View more
03-23-2023
12:23 PM
Yea @Tom_Lundie , We have environment variable set for SPLUNK_HOME and it is UF. I have also tried by giving complete path instead of SPLUNK_HOME but still no results.
... View more
03-23-2023
10:51 AM
@Tom_Lundie Here is the output [root@server ~]# systemctl is-active ntpd active [root@server ~]# systemctl is-active chronyd unknown [root@server ~]# grep -re "gac\.edu" $SPLUNK_HOME/etc [root@server ~]# grep -re "gac\.edu" $SPLUNK_HOME [root@server ~]# grep -re "versadns\.com" $SPLUNK_HOME/etc [root@server ~]# grep -re "versadns\.com" $SPLUNK_HOME [root@server ~]#
... View more
03-23-2023
07:40 AM
We have RHEL 7 Linux 3.10.0-1160.83.1.el7.x86_64 We do not have chrony.conf on server: cat /etc/chrony.conf cat: /etc/chrony.conf: No such file or directory
... View more
03-23-2023
05:38 AM
splunk service is using offsite (external) NTP queries. ntp.domain.com is our internal NTP domain and we have configured the same on our server under /etc/ntp.conf We could see that ntp configuration is being used in Splunk_TA_nix app under time.sh script and further verified I see it is configured with NTP internal domain as “ntp.domain.com” under /etc/ntp.conf. But still splunk is using Offsite NTP queries. Any idea why splunk is using offsite NTP queries ? [splunk@hostname bin]$ ls -lrt | grep -ir ntp time.sh:if [ -f /etc/ntp.conf ] ; then ============================================ [splunk@hostname bin]$ cat /etc/ntp.conf | grep ntp.domain.com restrict -6 ::1 pool ntp.domain.com iburst
... View more
03-20-2023
07:46 AM
We had an EC2 instance become inaccessible via the AWS Session Manager.
Root cause was the main volume filling-up with various splunkfowarder-x.x.x RPM files in /usr/bin/
Yesterday the filesystem was cleaned-up, but today there's another copy of that RPM in the /usr/bin/ directory.
Does anyone know why is this happening ?
... View more
08-26-2020
11:34 PM
We are ingesting AWS data through HF and I am seeing duplicate values for each field as shown in screenshot.
Few of the fields shows correct single value but most of the fields have double values.
I have added below settings in props.conf but no luck.
KV_MODE = none AUTO_KV_JSON = false INDEXED_EXTRACTIONS = json
... View more
Labels
08-21-2020
08:21 AM
I reset SSL password, now i see below error only: The certificate generation script did not generate the expected certificate file:C:\%ProgramFiles%\SplunkUniversalForwarder\etc\auth\ufcert.pem. Splunkd port communication will not work. 08-21-2020 08:13:53.406 -0700 ERROR loader - SSL certificate generation failed.
... View more
08-21-2020
08:08 AM
I see below error when i manually try to decrypt, i got below error: No bootstrap configuration available for: \etc Invalid setting for server.conf/[general]/legacyCiphers Failed to write splunk.secret '\etc\auth\splunk.secret' file. errno=The handle i s invalid. File stat cannot be obtained on \etc\auth\splunk.secret. Unable to get file status for mod-time on file \etc\auth\splunk.secret error:00000000:lib(0):func(0):reason(0) AES-GCM Decryption failed! Splunkd.log: 08-21-2020 07:37:30.442 -0700 ERROR loader - win-service: Error running pre-flight-checks (_pclose returned 4). 08-21-2020 07:37:30.442 -0700 ERROR loader - win-service: Here is the output from running pre-flight-checks: 08-21-2020 07:37:30.442 -0700 ERROR loader - error:00000000:lib(0):func(0):reason(0) 08-21-2020 07:37:30.442 -0700 ERROR loader - AES-GCM Decryption failed! 08-21-2020 07:37:30.442 -0700 ERROR loader - Decryption operation failed: AES-GCM Decryption failed! 08-21-2020 07:37:30.442 -0700 ERROR loader - The certificate generation script did not generate the expected certificate file:C:\%ProgramFiles%\SplunkUniversalForwarder\etc\auth\ufcert.pem. Splunkd port communication will not work. 08-21-2020 07:37:30.442 -0700 ERROR loader - SSL certificate generation failed. 08-21-2020 07:37:30.442 -0700 ERROR loader - <<<<< EOF (pre-flight-checks) Decryption operation failed: AES-GCM Decryption failed! Decryption operation failed: AES-GCM Decryption failed!
... View more
08-21-2020
07:25 AM
I placed .pem file under C:\Program Files\SplunkUniversalForwarder\etc\auth\ and added below in server.conf under C:\Program Files\SplunkUniversalForwarder\etc\system\local [sslConfig] enableSplunkdSSL = true serverCert = C:\Program Files\SplunkUniversalForwarder\etc\auth\ufcert.pem When i try restart UF, the service is not starting. it starts and stops quickly.
... View more
08-21-2020
06:02 AM
This is for UF. Usually we dont need to access management port 8089 via browser. I have disabled the HTTP port as well. But our management wants to have it open and install self generated certificate. Please suggest.
... View more
08-20-2020
08:25 PM
When i try to access server through 8089 where Forwarder is installed, i am seeing Invalid certificate. "This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store." How can i install self certification for 8089 port.
... View more
Labels
- Labels:
-
universal forwarder
08-16-2020
12:18 PM
Yes, Search Head restart and Resyn manually has been done already. Still seeing same repetative warnings
... View more
08-16-2020
01:00 AM
@irishmanjb index=abc ErrorCode=* |bin span=5m _time | stats count by ErrorCode,_time|where count>=10 Try above query. It should work.
... View more
08-16-2020
12:44 AM
@Karthik index IN ( A B C) ERROR This will give the results from all 3 indexes when ERROR word is visible in events. or index=A OR index=B OR index=C ERROR Even above query also wil give the same results.
... View more
08-16-2020
12:38 AM
@surekhasplunk You have log file myfile_ddmmyyyy.log under /asbc/logs/*.log on server and you have given below stanza right ? Please check if you gave below stanza in inputs.conf [monitor:///asbc/logs/*.log] disabled = 0 crcSalt = <SOURCE> sourcetype = _json index = abc Please check below once above stanza is added: 1) Are you using deployment server ? If yes, make sure you have added the server in serverclass.conf 2) Make sure the deployment server details are corret in deploymentclient.conf 3) Make sure the Splunk Forwarder is up and running. Try restart 4) Verify if the port 8089 is open 5) Verify you are able to connect to deployement server through 8089 using telnet from server
... View more
08-16-2020
12:24 AM
Can anyone help why we are seeing these WARN in logs and how to fix permanently. We are performing manual resync whenever count of events is > 5 in 15mins time range using below query: index=_internal host=searchhead* component=ConfReplicationThread log_level=WARN "Cannot accept push" |bin span=15m _time|stats max(consecutiveErrors) as count by host,_time|where count>5 LOGS: ========== WARN ConfReplicationThread - Error pushing configurations to captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in acceptPush: Non-200 status_code=400: ConfReplicationException: Cannot accept push with outdated_baseline_op_id=8d89fca5ef4520b00b8ffe8b1366a178b92b52fb; current_baseline_op_id=a948f0e3f0fcae707ce37ca7d7a73" ConfReplicationThread - Error pushing configurations to captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in acceptPush: Non-200 status_code=400: ConfReplicationException: Cannot accept push with outdated_baseline_op_id=66098bdc22c2bcacf951fb104558db365ac64820; current_baseline_op_id=085e675e4c9d8c9fafabee" ConfReplicationThread - Error pulling configurations from captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in fetchFrom, at=a6a747e7138353bd07873f04fe90f2c9b4564567: Network-layer error: Connect Timeout" ConfReplicationThread - Error pulling configurations from captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in fetchFrom, at=a6a747e7138353bd07873f04fe90f2c9b4564567: Network-layer error: Connect Timeout" ConfReplicationThread - Error pulling configurations from captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in fetchFrom, at=a6a747e7138353bd07873f04fe90f2c9b4564567: Network-layer error: Connect Timeout" ============= Even tried to reduce the max_push count to 50 (default is 100). How can we resolve this permanently ? ============== WARN ConfMetrics - single_action=PUSH_TO took wallclock_ms=1525! Consider a lower value of conf_replication_max_push_count in server.conf on all members. WARN ConfMetrics - single_action=PUSH_TO took wallclock_ms=2644! Consider a lower value of conf_replication_max_push_count in server.conf on all members. WARN ConfMetrics - single_action=PULL_FROM took wallclock_ms=2011! Consider a lower value of conf_replication_max_pull_count in server.conf on all members. WARN ConfMetrics - single_action=PULL_FROM took wallclock_ms=1778! Consider a lower value of conf_replication_max_pull_count in server.conf on all members. Below are the settings in server.conf conf_replication_max_push_count = 50 conf_replication_purge.period = 3h conf_replication_period = 10 we do not want to do resync everytime. splunk resync shcluster-replicated-config
... View more
Labels
08-14-2020
09:53 PM
Can anyone help why we are seeing these WARN in logs and how to fix permanently. We are performing manual resync whenever count of events is > 5 in 15mins time range using below query: index=_internal host=searchhead* component=ConfReplicationThread log_level=WARN "Cannot accept push" |bin span=15m _time|stats max(consecutiveErrors) as count by host,_time|where count>5 LOGS: ========== WARN ConfReplicationThread - Error pushing configurations to captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in acceptPush: Non-200 status_code=400: ConfReplicationException: Cannot accept push with outdated_baseline_op_id=8d89fca5ef4520b00b8ffe8b1366a178b92b52fb; current_baseline_op_id=a948f0e3f0fcae707ce37ca7d7a73" ConfReplicationThread - Error pushing configurations to captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in acceptPush: Non-200 status_code=400: ConfReplicationException: Cannot accept push with outdated_baseline_op_id=66098bdc22c2bcacf951fb104558db365ac64820; current_baseline_op_id=085e675e4c9d8c9fafabee" ConfReplicationThread - Error pulling configurations from captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in fetchFrom, at=a6a747e7138353bd07873f04fe90f2c9b4564567: Network-layer error: Connect Timeout" ConfReplicationThread - Error pulling configurations from captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in fetchFrom, at=a6a747e7138353bd07873f04fe90f2c9b4564567: Network-layer error: Connect Timeout" ConfReplicationThread - Error pulling configurations from captain=https://searchhead01.domain.com:8089, consecutiveErrors=1 msg="Error in fetchFrom, at=a6a747e7138353bd07873f04fe90f2c9b4564567: Network-layer error: Connect Timeout" ============= Even tried to reduce the max_push count to 50 (default is 100). How can we resolve this permanently ? ============== WARN ConfMetrics - single_action=PUSH_TO took wallclock_ms=1525! Consider a lower value of conf_replication_max_push_count in server.conf on all members. WARN ConfMetrics - single_action=PUSH_TO took wallclock_ms=2644! Consider a lower value of conf_replication_max_push_count in server.conf on all members. WARN ConfMetrics - single_action=PULL_FROM took wallclock_ms=2011! Consider a lower value of conf_replication_max_pull_count in server.conf on all members. WARN ConfMetrics - single_action=PULL_FROM took wallclock_ms=1778! Consider a lower value of conf_replication_max_pull_count in server.conf on all members. Below are the settings in server.conf conf_replication_max_push_count = 50 conf_replication_purge.period = 3h conf_replication_period = 10 we do not want to do resync everytime. splunk resync shcluster-replicated-config
... View more
Labels
07-11-2020
03:00 PM
@islam If the solution helps you, then an upvote would be appreciated.
... View more
06-21-2020
08:42 AM
Peer node is not adding to Cluster. When we check the logs in Indexer, we saw above warn.
... View more
06-21-2020
06:02 AM
How to fix that error.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-27-2025
05:07 AM
|
