About deyeo

deyeo · ‎05-25-2014

Either ignore it since its warning messages. Or upgrade to the new F5 apps and/or upgrade to the newer Splunk version 5 and above.

deyeo · ‎05-25-2014

Either ignore it since its warning messages. Or upgrade to the new F5 apps and/or upgrade to the newer Splunk version 5 and above.

deyeo · ‎11-05-2012

instead of storing the cisco firewall logs into "summary" index. i would like to store in a index called "firewall". other than creating the index "firewall", and adding index = firewall into the local/inputs.conf, what else must i do?

deyeo · ‎04-30-2012

You need to transfer the owner of the saved search to another valid user before deleting the owner's user account. I had to edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata /local.meta config file that has old owner’s ID and change each occurrence of that to the new ower’s ID. Splunk needs to be restarted for these changes to take effect. This is a major hidden flaw with Splunk. Because a lot of Splunk administrators do NOT know that before deleting a user and assume that the saved searches will continue to run at the scheduled frequency.

deyeo · ‎04-05-2012

A user created many searches, and the searches are private. Since these searches belong to the owner, before deleting this user account, i've changed the permission from "Private" to "This App" and assigned to the appropriate roles. However, after doing so, the scheduled searches have stopped running on the scheduled frequency. Why is it so? i'm running on Splunk 4.2.5

deyeo · ‎12-06-2011

This is the reply i've gotten from Splunk Support: I believe we cannot have this kind of feature at the moment, I can help to file an enhancement request for that if the product team will provide this kind of feature. I think it is worth having of the ports binding to 2 difference of IP addresses. Thanks for your suggestion.

deyeo · ‎11-22-2011

My server has 2 IP addresses and i need to bind the splunk web to 1 IP and the splunk daemon to the other IP address. i configure the server.socket_host setting in web.conf. the splunk web indeed has bind to the IP address However, when i modify $SPLUNK_HOME/etc/splunk-launch.conf to include the SPLUNK_BINDIP attribute and value, the splunk web is no longer bound to the IP that i specified in web.conf but is now bound to the IP i specified in splunk-launch.conf How do i ultimately get to bind the web and daemon to 2 different IP addresses?

deyeo · ‎09-07-2011

i've upgraded my splunk 4.1 heavy forwarder to 4.2.2 more than 60days ago. this splunk also has PDF Report Server App running. Splunk web is also disabled. Recently, when i start my splunk, i noticed this message: "Your license is expired. Please login as an administrator to update the license." Please advise what i should do? ~/bin/splunk list licenser-pools auto_generated_pool_download-trial description:auto_generated_pool_download-trial quota:MAX slaves: * stack_id:download-trial used_bytes:0 auto_generated_pool_forwarder description:auto_generated_pool_forwarder quota:MAX slaves: * stack_id:forwarder used_bytes:0 auto_generated_pool_free description:auto_generated_pool_free quota:MAX slaves: * stack_id:free used_bytes:0

deyeo · ‎05-05-2011

oh gosh. tmeader, you are right. i think it is this command that is the culprit: ~/bin/splunk add forward-server xx.xx.xx.xx:9997 it writes into this file: ~/etc/system/local/outputs.conf to contain [tcpout] defaultGroup = xx.xx.xx.xx_9997 disabled = false [tcpout:xx.xx.xx.xx_9997] server = xx.xx.xx.xx:9997 [tcpout-server://xx.xx.xx.xx:9997] i have to manually change it to: [tcpout] disabled = false indexAndForward = 0

deyeo · ‎05-05-2011

have enabled SSLv3 on splunk 4.2.1 index server and universalforwarder 4.2.1, universalforwarder doesn't seem to be able to communicate to the index server. please advise what can i do? On Universalforwarder 4.2.1's splunkd.log: 05-05-2011 07:07:53.276 -0400 INFO TcpOutputProc - Connection to xx.xx.xx.xx:8089 closed. Read error. Connection reset by peer 05-05-2011 07:07:53.282 -0400 INFO TcpOutputProc - Connected to idx=xx.xx.xx.xx:8089 On Splunk Index server 4.2.1's splunkd.log: 05-05-2011 07:23:12.649 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54521 05-05-2011 07:23:12.650 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54525

deyeo · ‎05-03-2011

Everytime a email alert is sent, it contains a CSV file (as attachment) that only contains 101 rows even though the actual total number of events is more than 101. Any advise on how to ensure that the CSV file contains all the events even if the number of events exceeds 101?

deyeo · ‎04-25-2011

Hi, after installing the F5 app using the Splunk 4.2 web interface (not through unzipping manually in ..etc/apps folder), when i restart Splunk, i get this warning message (before configuring the F5 app): Checking conf files for typos... Possible typo in stanza [connection_failed] in /opt/splunk/etc/apps/SplunkforF5/default/eventtypes.conf, line 3: viewstate.resultView = normalView Possible typo in stanza [connection_success] in /opt/splunk/etc/apps/SplunkforF5/default/eventtypes.conf, line 7: viewstate.resultView = normalView Since the current version of the F5 app is older than the release of Splunk version 4.2, is the current F5 app compatible with Splunk 4.2?

deyeo · ‎04-24-2011

I need to install PDF server app on a separate machine from my index server/master license server Is PDF server App supported on Splunk 4.2 UNIVERSAL Forwarder? or i need to install it on the heavy forwarder? If PDF server App is supported only on the Splunk heavy forwarder? Since i have disabled the Splunk web to reduce footprint, how do I manually (using CLI or VI the configuring files) install the Splunk license and convert it to slave license server pointing to the master license server (on a separate machine)

deyeo · ‎04-18-2011

that is strange. it does not work for me. take note that it is splunk 4.2 universal forwarder which is a separate installer (splunkforwarder-4.2-96430-xxxx) file from the usual splunk installer, and it installs by default at /opt/splunkforwarder and not the usual /opt/splunk based on the path that you given, it does not seem that you have tested on splunk 4.2 UNIVERSAL FORWARDER

deyeo · ‎04-18-2011

not exactly viable. because Splunk must be running in order to run the CLI command. And the moment i start & run my Splunk, the Splunk default port would have immediately conflict with existing TCP8089 (before i can even run the CLI command). Is there a way to change the management port on the first time Splunk starts up (so that it never ever run on TCP8089)?

deyeo · ‎04-18-2011

How do i change the 4.2 universal forwarder's management port from 8089 to other ports (to prevent conflict with existing port tcp 8089 on my server). in 4.1, we can change it in the web.conf but it does not work in 4.2 universal forwarder.

deyeo · ‎04-14-2011

how about the $SPLUNK_HOME/etc/system/default/server.conf file which contains the following: In 4.1.x, [applicationsManagement] url = http://www.splunkbase.com/api/apps loginUrl = http://www.splunkbase.com/api/account:login/ can they be nulled without any negative impact to Splunk?

deyeo · ‎04-14-2011

I would like to disable external UI URIs. yes, i'm paranoid about security. I saw in the ../splunk/etc/system/default/web.conf file that this can possibility be done. external UI URIs serviceFormPostURL = http://headlamp.splunk.com/event/add userRegistrationURL = https://www.splunk.com/index.php/pre_reg?destination=prod_reg userEntTrialRegistrationURL = https://www.splunk.com/index.php/sign_up?destination=prod_reg userResendRegistrationURL =https://www.splunk.com/index.php/pre_reg?destination=prod_resend updateCheckerBaseURL = https://quickdraw.splunk.com/js/ docsCheckerBaseURL=https://quickdraw.splunk.com/help Are there any impact if they are disabled? How do i disable them? Directly comment these lines in the default web.conf?

deyeo · ‎04-07-2011

removing or modifying the CherryPy header will affect the PDFserver ability to generate PDF. thus, you need to modify the PDFserver code at ../splunk/etc/apps/pdfserver/bin/pdfhandler.py Comment out these 3 lines to not check for the existence of CherryPy header: if 'CherryPy' not in response.get('server', ''): logger.warn("Remote web server at %s doesn't appear to be running CherryPy" % version_url) return False

deyeo · ‎04-07-2011

And also check the ../splunk/var/log/splunk/python.log on the PDFserver to see the exact errors

deyeo · ‎04-07-2011

An error occurred while generating a PDF of this report: Failed to generate PDF: PDF server at https://xx.xx.xx.xx:xxxx/services/pdfserver/renderpdf returned error: Remote host does not look like a Splunk server; aborting PDF generation Anyone knows what is the problem?

deyeo · ‎04-05-2011

the closet file that i can locate is: ..\splunk\lib\python2.6\site-packages\cherrypy_cprequest.py is this the correct file?

deyeo · ‎04-04-2011

openssl s_client -connect x.x.x.x:xxxx -ssl2 -no_ssl3 -no_tls1 If SSLv2 is not supported, it should give some error like this: Loading 'screen' into random state - done CONNECTED(00000774) 5708:error:1406D0CB:SSL routines:GET_SERVER_HELLO:peer error no cipher:.\ssl\s2_pkt.c:682: 5708:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:.\ssl\s2_pkt.c:430:

deyeo · ‎04-04-2011

which particular py file contains the Splunkweb CherryPy header ?

deyeo · ‎04-04-2011

i've configured that in the local directory instead of the default directory. so how can we verify that it is indeed only SSL version 3?

Posts	30
Solutions	2
Karma Given	0
Karma Received	25
Member Since	‎02-20-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Change the index name of Splunk_CiscoFirewalls

delete owner of scheduled searches

Bind separate IP for Web & Daemon

license expired after upgrade to 4.2

universalforwarder 4.2.1 unable to connect to inde...

CSV 101 rows only

Any Compatibility issues with Splunk 4.2

does the PDF server run on the universal forwarder...

change universal forwarder 4.2 mgmt port

Disable external UI URIs

Re: Any Compatibility issues with Splunk 4.2

Re: Any Compatibility issues with Splunk 4.2

Change the index name of Splunk_CiscoFirewalls

Re: delete owner of scheduled searches

delete owner of scheduled searches

Re: Bind separate IP for Web & Daemon

Bind separate IP for Web & Daemon

license expired after upgrade to 4.2

Re: universalforwarder 4.2.1 unable to connect to ...

universalforwarder 4.2.1 unable to connect to inde...

CSV 101 rows only

Any Compatibility issues with Splunk 4.2

does the PDF server run on the universal forwarder...

Re: change universal forwarder 4.2 mgmt port

Re: change universal forwarder 4.2 mgmt port

change universal forwarder 4.2 mgmt port

Re: Disable external UI URIs

Disable external UI URIs

Re: Splunk Web & Splunkd HTTP Server response head...

Re: aborting PDF generation

aborting PDF generation

Re: Splunk Web & Splunkd HTTP Server response head...

Re: Is there a way to disable SSL v2 for the forwa...

Re: Splunk Web & Splunkd HTTP Server response head...

Re: Is there a way to disable SSL v2 for the forwa...