About seandevo

seandevo · ‎09-17-2015

Hi Amit, It looks like your windows pathway in your monitor stanzas have foward slashes as opposed to backslashes. From my experience, the pathways in windows use backslashes instead of forward slashes (which linux uses). Have you verified that correct pathways of your directory? If it is a windows directory, the monitor path should look like so: [monitor://D:\Data\pages-ErrorLogs]

seandevo · ‎09-16-2015

I believe field extractions have an absolute requirement of selecting a certain sourcetype for performing these extractions. One reason why I could think a global extraction (even if limited to a single index) would be problematic is unnecessary load on Spunk scanning through copious amounts of events to find out that there was no regex match. I assume that you have events from multiple events from different sourcetypes that you want the same field extraction to be applied to? -Sean

seandevo · ‎10-13-2014

I figured out why the ports were not working. AWS already provides a public IP and public domain name that will work even though the original install of splunk will give it a private IP host. Long story short, when installing Splunk and starting it up for the first time, your webUI can be accessed with: publicIP:8000 found on your AWS EC2 instance dashboard. No need for 'SPLUNK_BINDIP' command.

seandevo · ‎10-07-2014

I am currently hosting an Amazon Linux OS (EC2) on AWS, which is the same service that Splunk U uses. After sucessfully downloading and installing Splunk as a root user and starting it up for the first time, I changed the IP address of the default IP to the Public IP address AWS EC2 provided by adding the following line to /opt/splunk/etc/splunk-launch.conf: SPLUNK_BINDIP:111.222.333.444 I also changed the mgmt ip and port under /opt/splunk/etc/system/local/web.conf: When I tried to ./splunk restart, I get the error message saying: "Checking http port [111.222.333.444:8000]: already bound. ERROR: The HTTP Port [8000] is already bound. Splunk needs to use this port. Even if I change the Port, it gives me the same error (with the new port number). I checked "netstat -anp" and there was no port shown to be bound to the instance. On the AWS side, I configured the security group to allow inbound connetion to TCP 8000, 8089, 80, and 443. Still no luck. Anyone have advice? Thanks Best Regards, Sean Devo, Systems Engineer pm2NET

seandevo · ‎09-17-2014

I had the same problem, try just typing: sudo ./splunk add monitor /var/log/ It should prompt you for root [sudo] password and then your splunk credentials that were set up. Worked for me Good luck!

Posts	5
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎07-14-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

No Available Splunk Web Ports on AWS Instance

Re: Why am I unable to monitor files from a Window...

Re: Is there a way to configure an index wide prop...

Re: No Available Splunk Web Ports on AWS Instance

No Available Splunk Web Ports on AWS Instance

Re: "Can't create directory" on add monitor