Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About emallinger
emallinger
Communicator
Member since:
07-07-2020
09-25-2023
Community Statistics
| Posts | 77 |
| Solutions | 10 |
| Karma Given | 12 |
| Karma Received | 4 |
| Member Since | 07-07-2020 |
Activity Feed
- Posted Re: Failed to load source for MC KPI Indicator visualization on All Apps and Add-ons. 08-18-2023 08:07 AM
- Karma Re: How to resolve error "Replication-related issue: Cannot move asset lacking a pre-existing asset ID"? for jt_rocks. 08-10-2023 01:35 AM
- Posted Re: Using Splunk HEC and validating Certificates on Getting Data In. 02-09-2023 11:11 PM
- Posted Re: How to Load Balanced HEC entrypoint with indexer ack on Getting Data In. 02-09-2023 11:09 PM
- Got Karma for Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk?. 11-18-2022 04:16 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-18-2022 03:10 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 04:43 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 04:14 AM
- Got Karma for Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk?. 11-17-2022 04:09 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 03:19 AM
- Posted Re: How can I Delete Option for Alerts? on Alerting. 11-17-2022 01:32 AM
- Karma Re: Can someone explain Apps deployed via deployment server (indexer cluster) vs Apps deployed via deployer (shcluster)? for gkas99. 11-17-2022 01:15 AM
- Karma Re: Add license slave in server.conf in apps for isoutamo. 11-17-2022 12:47 AM
- Posted Re: How to fix SplunkDB "Unsupported or unrecognized SSL message"? on Getting Data In. 11-17-2022 12:40 AM
- Karma Re: Getting "unsupported certificate purpose" ERROR when enabling SSL on management port with requireClientCert = true for vtalanki. 11-17-2022 12:35 AM
- Posted How to fix SplunkDB "Unsupported or unrecognized SSL message"? on Getting Data In. 11-03-2022 08:51 AM
- Got Karma for Re: When gets splunk db connect python 3 ready?. 11-03-2022 05:25 AM
- Posted Re: When gets splunk db connect python 3 ready? on All Apps and Add-ons. 11-03-2022 01:12 AM
- Karma Re: When gets splunk db connect python 3 ready? for richgalloway. 11-02-2022 09:08 AM
- Posted Re: When gets splunk db connect python 3 ready? on All Apps and Add-ons. 11-02-2022 07:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-18-2023
08:07 AM
HEllo, Same here on splunk version 9.1.0.2. Plus, displays : Plus, I've errors on debug console : Some js files seems to be blocked because of the X-Content-Type Options that are still installation defaults. Does anyone have any info on this topic ? Thanks ! Ema
... View more
02-09-2023
11:11 PM
Hi, Did you find what was wrong ? I have a similar behaviour : curl with ssl to send HEC events works fine, but from a python app, not so well : Socket error while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Any idea ? Thanks Ema
... View more
02-09-2023
11:09 PM
Hi all, Problem solved, finally. It was all jumbled on conf files (too many tests with too many confs). Wiping out and starting anew did the trick.
... View more
11-18-2022
03:10 AM
1 Karma
Hi again, @gut1kor Found another way to set host per event with props.conf and TRANSFORMS : [sourcetype_name] TRANSFORMS-register=name [name] SOURCE_KEY=_raw REGEX = server:(\w+) # capturing regex adated to your data DEST_KEY = MetaData:Host FORMAT = host::$1 Need to be tested. Regards, Ema
... View more
11-17-2022
04:43 AM
Ok, I understand. That means it got improved in the version you are using ! Because in the past, I had some data sources where host, source and other splunk default fields had been used and it got all merged. unfortunately, the data didn't meant the same thing, so it was a problem. In that case, I think the alias is your best bet.
... View more
11-17-2022
04:14 AM
@gut1kor Not sure I follow you : - in the file, in each event if the field name is "host" it should be available just fine, no ? OR - you need to put it in your inputs.conf with the monitor stanza => as an option "host = ..." if it is the same one for all the data in the file. Otherwise, I would suggest adding an alias between host and extracted host for your sourcetype. What do you think ?
... View more
11-17-2022
03:19 AM
1 Karma
Hello, I think only the content of "event" in your example should be written in a file for a forwarder input monitor. "time" and "host" are metadata that can be used in HEC entry but are not strictly necessary in files. The host value in file monitor will be either the default hostname of the forwarder or the one you set in the monitor stanza for this particular file. I have both entry types, and I can confirm the format is different. In file : JSONL with only the content of your "event" example In HEC entry points : same format as yours with a bunch of metadata, like sourcetype for the indexer to be able to correctly index the data source. So you should make SURE that there is a timestamp/date field IN the event (and not outside of if as per your example). Try it and post the results ? Regards, Ema
... View more
11-17-2022
01:32 AM
Hello all ! I agree with @gcusello. Depending on the behaviour you wish to create, maybe you'll have to create the alerts and only send the results (via mail ?) to users. Or share only the result in a particular app, developped for that purpose on which users only have read access. In that case, you are doing the job of creating and managing alerts, so it might not be the desired effect. Happy splunking ! Ema
... View more
11-17-2022
12:40 AM
Hi everyone, With the help of a newly found splunker friend ;-), the solution is here : https://vbrainstorm.com/splunk-blog-series-setting-up-hec-on-multiple-splunk-heavy-forwarders/ Work around is : - do not use SplunkDBConnect as well as HEC with DS on the same machine (monoinstance case) OR - If you have to : 1/ use a copy of splunk_httpinput app in deployment-apps for DS to use 2/ Untick "use DS" on the HEC general settings => DB Connect will now work just fine Thanks ! Ema
... View more
11-03-2022
08:51 AM
Hi everyone,
I'm struggling with SplunkDB connect and HEC.
I have a monoinstance splunk that has all roles. I have multiple UF and use deployment server with HEC.
I'm currently trying to use SplunkDB connect on that instance to read some DB data and write it in an index and I keep having the error message : "Unsupported or unrecognized SSL message".
I checked the port (8088), seems fine. SSL is enabled on HEC and splunkd. (default parameters)
I wonder if it is possible that splunk db connect uses HEC entry on localhost:8088 if I have deported the HEC entry on the UFs with "useDeploymentServer".
Could it explain the ssl error ?
I tried to use dbx_settings.conf but it does not seems to use my second entry :
[hec]
maxRetryWhenHecUnavailable = 3
hecUris = localhost:8088,splunk-hec.qualgend:8088
Logs sample :
127.0.0.1 - - [03/nov./2022:15:30:08 +0000] "GET /api/taskserver HTTP/1.1" 200 414 "-" "python-requests/2.25.0" 2
2022-11-03 16:30:00.286 +0100 [Scheduled-Job-Executor-4] DEBUG c.s.d.s.dbinput.recordreader.DbInputRecordReader - action=closing_db_reader task=rising_mcipe_qualif
2022-11-03 16:30:00.286 +0100 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=mcipe_qualif jdbc_url=null db_read_time=0 hec_record_process_time=3 format_hec_success_count=69 status=FAILED input_name=rising_mcipe_qualif batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2022-11-03_04:30:00 end_time=2022-11-03_04:30:00 duration=21 read_count=69 write_count=0 error_count=0
2022-11-03 16:30:00.285 +0100 [Scheduled-Job-Executor-4] INFO org.easybatch.core.job.BatchJob - Job 'rising_mcipe_qualif' finished with status: FAILED
2022-11-03 16:30:00.285 +0100 [Scheduled-Job-Executor-4] ERROR org.easybatch.core.job.BatchJob - Unable to write records
javax.net.ssl.SSLException: Unsupported or unrecognized SSL message
at java.base/sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:451)
at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
Afficher toutes les 35 lignes
2022-11-03 16:30:00.285 +0100 [Scheduled-Job-Executor-4] ERROR c.s.d.s.dbinput.recordwriter.CheckpointUpdater - action=skip_checkpoint_update_batch_writing_failed
javax.net.ssl.SSLException: Unsupported or unrecognized SSL message
at java.base/sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:451)
at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
Afficher toutes les 35 lignes
2022-11-03 16:30:00.285 +0100 [Scheduled-Job-Executor-4] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
javax.net.ssl.SSLException: Unsupported or unrecognized SSL message
at java.base/sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:451)
at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
Afficher toutes les 35 lignes
2022-11-03 16:30:00.279 +0100 [Scheduled-Job-Executor-4] INFO c.s.d.s.dbinput.recordwriter.HttpEventCollector - action=writing_events_via_http_event_collector record_count=69
2022-11-03 16:30:00.279 +0100 [Scheduled-Job-Executor-4] INFO c.s.d.s.dbinput.recordwriter.HttpEventCollector - action=writing_events_via_http_event_collector
2022-11-03 16:30:00.279 +0100 [Scheduled-Job-Executor-4] INFO c.s.dbx.server.dbinput.recordwriter.HecEventWriter - action=write_records batch_size=69
Do you have any idea what I did wrong ? Any clue would be greatly appreciated !
Thanks in advance,
Ema
... View more
- Tags:
- splunkdb
Labels
- Labels:
-
HTTP Event Collector
-
modular input
11-03-2022
01:12 AM
1 Karma
Hi, I started to and found out in the process that it is a false positive. Here : https://splunkcommunities.force.com/customer/s/article/DB-Connect-False-Positive-Message-Not-Compatible-with-Python-3 Happy splunking, Ema
... View more
11-02-2022
07:59 AM
Hi everyone, Last version of 6 days ago does not seem to be python 3 ready yet either ... "Latest Version 3.11.0 - October 28, 2022" Weird... As we need to move to version 9 soon in order to not fall out of the train. We'll see... Ema
... View more
07-27-2022
08:09 AM
Hi there, Had a similar issue with Io:Wait being way too sensitive and not being able to deactivate it. Had the same answer about SPL-213405. Wait and see ! Ema
... View more
06-21-2022
01:33 AM
Hello, I'm trying to experiment sending data indexed in splunk to activeMQ. I'll probably need to use JMS Messaging Modular Input (yet to be tested, because I'm trying to output). Did someone do that already ? Could you share some feedback ? Thanks ! Ema
... View more
Labels
- Labels:
-
modular input
-
other
05-18-2022
01:28 AM
Hello, I made some progress : in order to use persistence, the load balancer need to be able to read the flow. So instead of puting the certificate on the forwarder, I put it on the load balancer. At least, now curl to the load balancer works fine. Except the connexion is rejected : I keep having this message : * SSL certificate verify ok.
* OpenSSL SSL_write: Connexion ré-initialisée par le correspondant, errno 104
* Failed sending HTTP POST request
* Connection #0 to host splunk-hec.test left intact
curl: (55) OpenSSL SSL_write: Connexion ré-initialisée par le correspondant, errno 104 I'm lost as to how I'm supposed to configure the inputs.conf/server.conf on the forwarders. Could'nt find any doc with examples about that, yet this is a validated HEC tier in splunk validated architecture documents. Does anyone have a suggestion ? Thanks in advance, Ema
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-25-2023
10:56 AM
|
