Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About splunk_user_99
splunk_user_99
Explorer
Member since:
10-02-2019
02-26-2025
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 10-02-2019 |
Activity Feed
- Posted The external search command 'chatgpt' did not return events in descending time order, as expected. on Monitoring Splunk. 02-25-2025 03:22 PM
- Posted Re: Error Message when publishing models on Knowledge Management. 02-23-2025 02:43 PM
- Posted Error Message when publishing models on Knowledge Management. 02-07-2025 10:17 AM
- Posted Splunk dataset for download on Getting Data In. 02-03-2025 07:08 AM
- Karma Re: Splunk Not Recognizing Timestamps – What Settings Should I Use? for livehybrid. 02-02-2025 10:55 AM
- Posted Re: Splunk Not Recognizing Timestamps – What Settings Should I Use? on Getting Data In. 02-02-2025 10:54 AM
- Posted Splunk Not Recognizing Timestamps – What Settings Should I Use? on Getting Data In. 02-02-2025 04:00 AM
- Karma Re: Build a distributed search environment with trial version? for gcusello. 06-05-2020 12:50 AM
- Posted Re: Error: slave has more than 10 number of continous replication failures. Look at splunkd.log for details on why this is happening. on Monitoring Splunk. 12-09-2019 05:58 AM
- Posted Re: Error: slave has more than 10 number of continous replication failures. Look at splunkd.log for details on why this is happening. on Monitoring Splunk. 12-09-2019 05:56 AM
- Posted Re: Error: slave has more than 10 number of continous replication failures. Look at splunkd.log for details on why this is happening. on Monitoring Splunk. 12-09-2019 02:20 AM
- Posted Error: slave has more than 10 number of continous replication failures. Look at splunkd.log for details on why this is happening. on Monitoring Splunk. 12-06-2019 04:25 AM
- Tagged Error: slave has more than 10 number of continous replication failures. Look at splunkd.log for details on why this is happening. on Monitoring Splunk. 12-06-2019 04:25 AM
- Tagged Error: slave has more than 10 number of continous replication failures. Look at splunkd.log for details on why this is happening. on Monitoring Splunk. 12-06-2019 04:25 AM
- Posted Single Search Head/Single Indexer (distributed search) on Getting Data In. 11-27-2019 02:34 AM
- Tagged Single Search Head/Single Indexer (distributed search) on Getting Data In. 11-27-2019 02:34 AM
- Tagged Single Search Head/Single Indexer (distributed search) on Getting Data In. 11-27-2019 02:34 AM
- Tagged Single Search Head/Single Indexer (distributed search) on Getting Data In. 11-27-2019 02:34 AM
- Tagged Single Search Head/Single Indexer (distributed search) on Getting Data In. 11-27-2019 02:34 AM
- Posted Re: How to write admin credentials within the command on Splunk Search. 11-25-2019 03:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-25-2025
03:22 PM
Hi guys! I think this screenshot describes my problem pretty well. I just tried to play around with chatgpt and splunk but I didnt succeed. Does someone know what to do with this error message? Please help me out here. Best regards
... View more
02-23-2025
02:43 PM
Hi @tscroggins Sorry for the late response. I have the following version - 5.5.0 I also tried a private incognito browser session and I got the same problem that I cannot even choose a app when trying to publish a model. So I really dont know how to solve that. I just can open the model in search and then try to apply it on new data, but I do not know if this is the same.
... View more
02-07-2025
10:17 AM
Hi guys! I am getting the following error message when trying to publishing a model which I created in "Experiments". I do not know what this should mean? Does anyone has an idea? I would appreciate your help! Best regards!
... View more
Labels
- Labels:
-
data model
02-03-2025
07:08 AM
Hi Splunkers, does anyone know if I there are datasets free to download? More precisely, I would need some network traffic dataset including good and bad domains for some Splunk Machine Learning testing. I would appreciate every idea you have. Thanks in advance! BR
... View more
Labels
- Labels:
-
data
02-02-2025
10:54 AM
Hey Will, I just wanted to say a huge THANK YOU for your help! 🙌 Your suggestion to increase MAX_DAYS_AGO to 3000 completely solved my issue, and Splunk now correctly recognizes my timestamps. Honestly, I had been struggling with this for quite some time, and your solution saved me a lot of time and frustration. I really appreciate the effort you put into answering my question. Thanks again, and have a great day! 🚀 Best, Emil
... View more
02-02-2025
04:00 AM
Hello everyone, I’m having trouble getting Splunk to recognize timestamps correctly, and I hope someone can help me out. I’m importing an access log file, where the timestamps are formatted like this: [01/Jan/2017:02:16:51 -0800] here also a live output: However, Splunk is not recognizing these timestamps and instead assigns the indexing time. I have tried adjusting the settings in the sourcetype configuration (see screenshot) and have set the following values: • Timestamp format: %d/%b/%Y:%H:%M:%S %z • Timestamp prefix: \[ • Lookahead: 32 Unfortunately, the timestamps are still not recognized correctly. 👉 Do I need to modify props.conf or inputs.conf as well? 👉 Is my timestamp format correct, or should it be defined differently? 👉 Could there be another issue in my extraction settings? The log file looks like this: Should I maybe change the log file with some scripting in order to change the format? I would really appreciate any guidance! Thank you in advance. 😊 Best regards
... View more
Labels
- Labels:
-
CSV
-
field extraction
-
index
12-09-2019
05:58 AM
But anyway, thank you for your interest.
... View more
12-09-2019
05:56 AM
I have found the solution. There is a replication port for the communication between the indexers in a cluster. I have forgot to set a firewall rule for this port. After I set a rule for this port it worked.
... View more
12-09-2019
02:20 AM
06.12.19 16:03:19,216
12-06-2019 16:03:19.216 +0100 INFO CMRepJob - job=CMReplicationErrorJob bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8 failingGuid=4CAFFC9C-BD32-437D-B603-DFA3BD15DC50 srcGuid=42C2AF4B-A702-44F4-B450-1D0156387DE8 tgtGuid=4CAFFC9C-BD32-437D-B603-DFA3BD15DC50 succeeded
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 INFO CMSlave - bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8 src=42C2AF4B-A702-44F4-B450-1D0156387DE8 tgt=4CAFFC9C-BD32-437D-B603-DFA3BD15DC50 failing=4CAFFC9C-BD32-437D-B603-DFA3BD15DC50 queued replication error job
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 INFO CMReplicationRegistry - Finished replication: bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8 src=42C2AF4B-A702-44F4-B450-1D0156387DE8 target=4CAFFC9C-BD32-437D-B603-DFA3BD15DC50
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 WARN BucketReplicator - Failed to replicate warm bucket bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8 to guid=4CAFFC9C-BD32-437D-B603-DFA3BD15DC50 host=172.28.128.18 s2sport=9887. Connection failed
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 INFO BucketReplicator - Discarding replication data as QueueRef=guid=4CAFFC9C-BD32-437D-B603-DFA3BD15DC50 host=172.28.128.18 s2sport=9887 bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8 is deleted
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 WARN BucketReplicator - Connection failed
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 ERROR TcpOutputFd - Connection to host=172.28.128.18:9887 failed
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 WARN TcpOutputFd - Connect to 172.28.128.18:9887 failed. No route to host
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 INFO BucketReplicator - event=localReplicationFinished type=warm bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 INFO BucketReplicator - event=finishBucketReplication bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8 [et=1575639605 lt=1575639665 type=2]
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 INFO BucketReplicator - Replicating warm bucket bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8 node=guid=4CAFFC9C-BD32-437D-B603-DFA3BD15DC50 host=172.28.128.18 s2sport=9887 bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 INFO BucketReplicator - Starting replication of bucket bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8 to 172.28.128.18:9887;
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
06.12.19 16:03:19,214
12-06-2019 16:03:19.214 +0100 INFO BucketReplicator - event=startBucketReplication bucket bid=_audit~91~42C2AF4B-A702-44F4-B450-1D0156387DE8
host = indexer1
source = /opt/splunk/var/log/splunk/splunkd.log
sourcetype = splunkd
... View more
12-06-2019
04:25 AM
Hello,
I have created a distributed search environment. On my masternode im getting the error: replication factor and search factor not reached, because of the following errors on my indexers: "Error: slave has more than 10 number of continous replication failures. Look at splunkd.log for details on why this is happening."
So, does everyone know how to solve this problem? I have checked the connectivity between the indexers, and they are available one to each other. What else could it be? Any ideas?
Best regards.
... View more
11-27-2019
02:34 AM
Hi,
Is it possible to create a single search head instance ?
And or a single indexer instane? - Or are the instances by default indexers?
... View more
11-25-2019
03:52 AM
To be more specific, I wanted to add a licenser-localslave to a master through a command. When i execute the command, i was asked for my admin credentials of the splunk instance. But I want to automize this whole process through scripting and thats why i need a command where I could execute the command within the credentials.
... View more
11-25-2019
03:09 AM
Hello guys,
Is there any possibility to execute a CLI command within the credentials (username and password)?
Like, for the password it would be "--seed-passwd password123".
Is there anything like that for the username?
Thank you for your time.
... View more
11-19-2019
05:51 AM
Hello,
Is it possible to designate a different splunk instance as the master license server, but through the CLI?
not through the splunk webinterface
Thank you for your time.
... View more
11-13-2019
12:30 AM
Hello Giuseppe,
I have checked it through the link you have published, and I have seen that I have the Free Splunk version, where the distributed search feature is not supported. So I will need to ask for a new license.
Anyway, thanks a lot for the quick and helpful answer!
Best regards,
splunk_user_99
... View more
11-12-2019
11:15 PM
Hello, i wanted to build a distributed search environment with splunk with the trial license. But for example, every time i wanted to configure one of my two instances as search-peer, and after I put all my data in, I get a error message. Nothing else come to me in mind why this should not work, except the trial license problem.
What do you think?
... View more
Labels
- Labels:
-
license
10-02-2019
03:47 AM
I'm using VirtualBox as a Virtual machine with CentOS 7 on it. I have used a NAT-adapter with port forwarding and a Host-only adapter. On the NAT-adapter I used port-forwarding for connecting to ssh and for http. Everything worked fine. I have installed splunk successfully.
When starting splunk i get the note that the splunk web interface is available on the Host-only created IP-address and the port 8000. I tried to to get access to the splunk enterprise interface on my local machine and it worked.
But now i wanted to get access to it from another pc, to make the splunk interface "global". How should i do that? I tried to set some configurations in the splunk-launch.conf and the web.conf configurations but it didnt worked out. Then I tried to set off my Host-only adapter and then i get the 127.0.0.1 address for hosting, but then i could not get access from the localhost to. The browser sends then a message that no data can be sent.
I would be very thankfull if someone could help me out.
Other information: I use a proxy and a firewall
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-26-2025
02:41 PM
|
