Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Prakhar_shukla
Prakhar_shukla
Path Finder
Member since:
03-23-2017
06-05-2020
Community Statistics
| Posts | 45 |
| Solutions | 2 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 03-23-2017 |
Activity Feed
- Got Karma for Error while installing Splunk Enterprise security. 06-05-2020 12:48 AM
- Karma Re: How to install a splunk app? for mikelanghorst. 06-05-2020 12:46 AM
- Got Karma for Re: Replication Factor and Search Factor is never met on Cluster Master. 06-05-2020 12:46 AM
- Posted Re: How to install a splunk app? on All Apps and Add-ons. 05-11-2017 02:02 AM
- Posted Re: index replication in custom index on Getting Data In. 05-09-2017 09:26 AM
- Posted index replication in custom index on Getting Data In. 05-09-2017 03:48 AM
- Tagged index replication in custom index on Getting Data In. 05-09-2017 03:48 AM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 08:28 PM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 08:26 AM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 08:03 AM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 07:55 AM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 07:53 AM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 07:25 AM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 06:46 AM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 06:38 AM
- Posted Re: Error "Duplicate Servername" on Monitoring Splunk. 05-01-2017 12:57 AM
- Posted DB connect app DB health issue on All Apps and Add-ons. 04-28-2017 04:17 AM
- Tagged DB connect app DB health issue on All Apps and Add-ons. 04-28-2017 04:17 AM
- Posted Re: Failed to execute KV Store lookup on Splunk Enterprise Security. 04-26-2017 05:23 AM
- Posted Re: Failed to execute KV Store lookup on Splunk Enterprise Security. 04-26-2017 01:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-09-2017
09:26 AM
Hello Adonio,
Rep factor is 2. Search factor is 2. When I am trying to do search index=dap. Results are only coming from the IDX2 host where I forwarded it from HF. Index configuration is same in all indexer as pushed the config file from cluster master.
... View more
05-09-2017
03:48 AM
Hello,
i have created a new index DAP in cluster master and shared the configuration of this new indexes.conf with all peers.
i put the file in cluster master folder ../_cluster/local/ then distribute the bundle to all peer.
i have CM1 , IDX1,IDX2,IDX3 and IDX4.
Now from Heavy forwarder i am forwarding the data to IDX2 index name DAP. In search i am able to search the data,
My question here is - 1) why DAP index is not replicating? all the time in search head, i am getting my data from IDX2 DAP index, why not from other IDXs
2) Can i directly forward heavy forwarder data to cluster master index DAP? will it work?
My conf in HF is -
inputs.conf
[monitor:///tmp/Gov.csv]
disabled = false
index = dap
_TCP_ROUTING = DAP
outputs.conf-
[tcpout:DAP]
server = IDX2:9997
useACK = true
[tcpout-server://IDX2:9997]
... View more
- Tags:
- heavy-forwarder
05-01-2017
08:26 AM
What's current config is like. Please paste all detail like SH names and which indexer is linked with which search head
... View more
05-01-2017
08:03 AM
What's current config is like. Please paste all detail like SH names and which connectior is linked with which search head
... View more
05-01-2017
07:55 AM
What's current config is like. Please paste all detail like SH names and which connectior is linked with which search head
... View more
05-01-2017
07:53 AM
From your previous post figures where you put search head 6.4 that was showing error. I observed indexer are same in both search head. 192.168.88.130 and 192.168.88.131.
... View more
05-01-2017
07:25 AM
So its like 1 search head + 3 indexer at 6.3 and a search head + 3 indexer at 6.4.
Total 8 server, 2 different groups. Right?
Please pasted splunk.Log here from server.
... View more
05-01-2017
06:38 AM
Ok, let me get it clearly.! You have total 3 indexer and 2 search heads. Both are in different version. Do you have any counter master?
... View more
05-01-2017
12:57 AM
Hi khyoung7410,
what is the current set up of your splunk? where you seeing this error and is it for an indexer?
check the setting> distributed search> search peer detail and server.conf
... View more
04-28-2017
04:17 AM
i have installed DB connect on HF. so my database query data is going to indexer directly on indexer.
1) is there any way to index that database data in HF as well , just to see it in DB connect app
2) In HF > DB connect > DB Health app is not showing any data. i can not even select connect and operation from drop down.
also can anyone please suggest a use case of DB connect installed in HF, for better understanding.
... View more
- Tags:
- Splunk DB Connect
04-26-2017
05:23 AM
i have upgraded the splunk ES version to 4.7 and it seems to fixed the issue
... View more
04-26-2017
01:43 AM
KvStorestatus is starting for both the serach head.
... View more
04-26-2017
12:39 AM
thanks for quick response.
but how about data input. from where exactly it comes. Like core splunk we use Forwarder to indexer > then search head. or directly to splunk instance where ES is installed?
... View more
04-26-2017
12:18 AM
its been 3 days, after installation i did nothing in ES or splunk
... View more
04-26-2017
12:16 AM
I have installed Splunk ES in SH cluster and search head as mentioned in docs. i have also installed add-on in which index-operation is true in indexers. However i am not clear what to do next. for example, when i am checking in SH > ES > Asset center or Identify master it is showing data which is in sample csv look up. there look up are in SH.
now suppose i need to create a dash board in ES > SH for monitoring authentication activity of admin user on all splunk servers. from where i need to specify thing/data. in forwarder or in SH>ES ? how flow of data work in this case.
i could not find any doc with such detail.
... View more
04-26-2017
12:06 AM
it seems normal. Error is coming since i upgraded Enterprise and installed ES
04-26-2017 09:06:02.289 +0200 ERROR KVStoreLookup - Failed to create lookup context
04-26-2017 09:06:02.289 +0200 ERROR SearchOperator:inputcsv - Error in 'inputlookup' command: External command based lookup 'correlationsearches_lookup' is not available because KV Store initialization has not completed yet. Please try again later.
... View more
04-25-2017
03:32 AM
Since i upgrdaed splunk enterprise to 5.5.3 and installed Enterprise security app, i am getting following error continuously in splunkd.log.
Failed to execute KV Store lookups: External command based lookup 'action_history_lookup' is not available because KV Store initialization has not completed yet. Please try again later.
04-25-2017 12:27:02.312 +0200 ERROR SearchOperator:inputcsv - Error in 'inputlookup' command: External command based lookup 'correlationsearches_lookup' is not available because KV Store initialization has not completed yet. Please try again later.
and some other failed external commands.
... View more
04-20-2017
08:42 PM
it seems the errors are coming due to compatibility mismatch between splunk enterprise version and Enterprise security apps version that i have installed.
... View more
04-20-2017
03:23 AM
Error in log-
04-20-2017 12:16:27.454 +0200 ERROR ModularInputs - Introspecting scheme=app_permissions_manager: script running failed (exited with code 1).
04-20-2017 12:16:27.455 +0200 ERROR ModularInputs - Unable to initialize modular input "app_permissions_manager" defined inside the app "SplunkEnterpriseSecuritySuite": Introspecting scheme=app_permissions_
manager: script running failed (exited with code 1).
04-20-2017 12:16:27.660 +0200 ERROR ModularInputs - Introspecting scheme=es_deployment_manager: script running failed (exited with code 1).
04-20-2017 12:16:27.660 +0200 ERROR ModularInputs - Unable to initialize modular input "es_deployment_manager" defined inside the app "SplunkEnterpriseSecuritySuite": Introspecting scheme=es_deployment_mana
ger: script running failed (exited with code 1).
04-20-2017 12:16:27.867 +0200 ERROR ModularInputs - Introspecting scheme=ess_content_importer: script running failed (exited with code 1).
04-20-2017 12:16:27.867 +0200 ERROR ModularInputs - Unable to initialize modular input "ess_content_importer" defined inside the app "SplunkEnterpriseSecuritySuite": Introspecting scheme=ess_content_importe
r: script running failed (exited with code 1).
... View more
04-20-2017
01:23 AM
1 Karma
i have installed the ES app in one of the splunk instance and i am getting the following error message in web-
Unable to initialize modular input "ess_content_importer" defined inside the app "SplunkEnterpriseSecuritySuite": Introspecting scheme=ess_content_importer: script running failed (exited with code 1).
please help out to fix the issue.
... View more
- Tags:
- splunk-enterprise
04-11-2017
12:00 AM
it is most likely happening because of corrupted buckets, you can see them in cluster master webpage as well. to fix the issue you need to remove them. please see how to remove bucket in this post
https://answers.splunk.com/answers/184484/what-should-i-do-with-bad-buckets-in-a-clustered-e.html?sort=votes
... View more
04-10-2017
11:59 PM
it is most likely happening because of corrupted buckets, you can see them in cluster master webpage as well. to fix the issue you need to remove them. please see how to remove bucket in this post
https://answers.splunk.com/answers/184484/what-should-i-do-with-bad-buckets-in-a-clustered-e.html?sort=votes
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
