Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About emallinger
emallinger
Communicator
Member since:
07-07-2020
01-16-2025
Community Statistics
| Posts | 83 |
| Solutions | 10 |
| Karma Given | 15 |
| Karma Received | 6 |
| Member Since | 07-07-2020 |
Activity Feed
- Karma Re: Re-arranging Apps menu in Splunk 9.2.x for verbal_666. 08-29-2024 06:03 AM
- Posted TrackMe - tenant tile not visible and active tenant = 0 on All Apps and Add-ons. 05-16-2024 05:40 AM
- Tagged TrackMe - tenant tile not visible and active tenant = 0 on All Apps and Add-ons. 05-16-2024 05:40 AM
- Posted Re: HTTP Event Collector Connection Actively Refused after upgrading from 9.0.5 to 9.1.1 (No Token Found) on Getting Data In. 02-06-2024 05:10 AM
- Karma Re: HTTP Event Collector Connection Actively Refused after upgrading from 9.0.5 to 9.1.1 (No Token Found) for C_Lawrence. 02-06-2024 05:10 AM
- Karma HTTP Event Collector Connection Actively Refused after upgrading from 9.0.5 to 9.1.1 (No Token Found) for C_Lawrence. 02-06-2024 03:04 AM
- Posted Re: HTTP Event Collector Connection Actively Refused after upgrading from 9.0.5 to 9.1.1 (No Token Found) on Getting Data In. 02-06-2024 03:02 AM
- Posted Re: HTTP Event Collector Connection Actively Refused after upgrading from 9.0.5 to 9.1.1 (No Token Found) on Getting Data In. 02-06-2024 02:48 AM
- Got Karma for Re: Effects of a kvstore resync on a search head cluster. 12-14-2023 12:15 PM
- Posted Re: Effects of a kvstore resync on a search head cluster on Deployment Architecture. 12-14-2023 09:05 AM
- Got Karma for Re: Effects of a kvstore resync on a search head cluster. 12-14-2023 08:34 AM
- Posted Re: Effects of a kvstore resync on a search head cluster on Deployment Architecture. 12-14-2023 08:31 AM
- Posted Re: Failed to load source for MC KPI Indicator visualization on All Apps and Add-ons. 08-18-2023 08:07 AM
- Karma Re: How to resolve error "Replication-related issue: Cannot move asset lacking a pre-existing asset ID"? for jt_rocks. 08-10-2023 01:35 AM
- Posted Re: Using Splunk HEC and validating Certificates on Getting Data In. 02-09-2023 11:11 PM
- Posted Re: How to Load Balanced HEC entrypoint with indexer ack on Getting Data In. 02-09-2023 11:09 PM
- Got Karma for Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk?. 11-18-2022 04:16 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-18-2022 03:10 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 04:43 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 04:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-16-2024
05:40 AM
Hello, I'm using TrackMe Free Edition 2.0.92 on my test env (single instance with 2 UF on debian 11). I'm able to create vtenant, but I do not see any of them on the Vtenant page : Yet, they are listed in the configuration tab : I cannot access the "pop in" to manage any of the tenant specs. This behaviour was already in place with previous version of trackme v2. I checked logs, trackme logs, restarted the instance, updated the app, checked the browser logs (har files), removed then installed again the app, tried to remove banner, deactivated then reactivated library restrictions, checked limits : all without success. I don't have any more ideas. My prod env is distributed and do not have the issue. I'm sure I did something wrong somewhere, but I cannot pinpoint where. Could you please suggest some leads ? Thanks, Ema
... View more
Labels
- Labels:
-
administration
02-06-2024
05:10 AM
Hi, yes, that's exactly what I did and that fixed the issue in my case :). Thanks ! Ema
... View more
02-06-2024
03:02 AM
Found it : https://splunk.my.site.com/customer/s/article/SSL-enabled-inputs-stopped-receiving-data-after-upgrade-from-Splunk-version-8-x-to-version-9-x
... View more
02-06-2024
02:48 AM
Hello, Same symptoms here upgrading from 9.0.5 to 9.1.3... Did you find out what was the workaround ? What did you do ? Thanks ! Ema
... View more
12-14-2023
09:05 AM
1 Karma
Hi again, You can backup one collection at a time. And yes, you have to "unshedule" all the report that fill your kvstore collections. That can be a bit long and painful. I only had 2 collections so it was not a strech in my case. I had to migrate the kvstore from one SH to another, and I used a backup file. Never tried to sync 2 instances sorry. I would suggest you try to backup the kvstore in the state you are and then try to restore it on a test SH. If this works => clean both your kvstore SHs and restore there. If not, I'm afraid I would do it all over again : clean it all and then painfully fill again your collections with data. If you still possessed the pertaining data, you can calculate again the collection, at a fast pace for past periods even if it is long. There will definititely be a small service interruption for these collections, but in the end you'll win. And for later, when you have succeeded to get you kvstore back up and running, I would suggest you add a backup task planned (each day for example). On another matter : why is your kvstore failing to start ? There should be some insight in `/opt/splunk/var/log/splunk/mongod.log`. Maybe it's just a renew of the certificate for mongo that is needed (probably too easy that one, but who knows...) Regards, Ema
... View more
12-14-2023
08:31 AM
1 Karma
HI, Had recently to clean --local and resync without much success due to some difficulties for the kvstore to acknowledge they were in the same cluster... Some conf are very persistent when you move a SH from a SHC to another SHC. My mistake on that. In the end : we - backup the correct kvstore - clean kvstore on all instances - restore kvstore and resync => good as new ! Ema
... View more
08-18-2023
08:07 AM
HEllo, Same here on splunk version 9.1.0.2. Plus, displays : Plus, I've errors on debug console : Some js files seems to be blocked because of the X-Content-Type Options that are still installation defaults. Does anyone have any info on this topic ? Thanks ! Ema
... View more
02-09-2023
11:11 PM
Hi, Did you find what was wrong ? I have a similar behaviour : curl with ssl to send HEC events works fine, but from a python app, not so well : Socket error while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Any idea ? Thanks Ema
... View more
02-09-2023
11:09 PM
Hi all, Problem solved, finally. It was all jumbled on conf files (too many tests with too many confs). Wiping out and starting anew did the trick.
... View more
11-18-2022
03:10 AM
1 Karma
Hi again, @gut1kor Found another way to set host per event with props.conf and TRANSFORMS : [sourcetype_name] TRANSFORMS-register=name [name] SOURCE_KEY=_raw REGEX = server:(\w+) # capturing regex adated to your data DEST_KEY = MetaData:Host FORMAT = host::$1 Need to be tested. Regards, Ema
... View more
11-17-2022
04:43 AM
Ok, I understand. That means it got improved in the version you are using ! Because in the past, I had some data sources where host, source and other splunk default fields had been used and it got all merged. unfortunately, the data didn't meant the same thing, so it was a problem. In that case, I think the alias is your best bet.
... View more
11-17-2022
04:14 AM
@gut1kor Not sure I follow you : - in the file, in each event if the field name is "host" it should be available just fine, no ? OR - you need to put it in your inputs.conf with the monitor stanza => as an option "host = ..." if it is the same one for all the data in the file. Otherwise, I would suggest adding an alias between host and extracted host for your sourcetype. What do you think ?
... View more
11-17-2022
03:19 AM
1 Karma
Hello, I think only the content of "event" in your example should be written in a file for a forwarder input monitor. "time" and "host" are metadata that can be used in HEC entry but are not strictly necessary in files. The host value in file monitor will be either the default hostname of the forwarder or the one you set in the monitor stanza for this particular file. I have both entry types, and I can confirm the format is different. In file : JSONL with only the content of your "event" example In HEC entry points : same format as yours with a bunch of metadata, like sourcetype for the indexer to be able to correctly index the data source. So you should make SURE that there is a timestamp/date field IN the event (and not outside of if as per your example). Try it and post the results ? Regards, Ema
... View more
11-17-2022
01:32 AM
Hello all ! I agree with @gcusello. Depending on the behaviour you wish to create, maybe you'll have to create the alerts and only send the results (via mail ?) to users. Or share only the result in a particular app, developped for that purpose on which users only have read access. In that case, you are doing the job of creating and managing alerts, so it might not be the desired effect. Happy splunking ! Ema
... View more
11-17-2022
12:40 AM
Hi everyone, With the help of a newly found splunker friend ;-), the solution is here : https://vbrainstorm.com/splunk-blog-series-setting-up-hec-on-multiple-splunk-heavy-forwarders/ Work around is : - do not use SplunkDBConnect as well as HEC with DS on the same machine (monoinstance case) OR - If you have to : 1/ use a copy of splunk_httpinput app in deployment-apps for DS to use 2/ Untick "use DS" on the HEC general settings => DB Connect will now work just fine Thanks ! Ema
... View more
11-03-2022
08:51 AM
Hi everyone,
I'm struggling with SplunkDB connect and HEC.
I have a monoinstance splunk that has all roles. I have multiple UF and use deployment server with HEC.
I'm currently trying to use SplunkDB connect on that instance to read some DB data and write it in an index and I keep having the error message : "Unsupported or unrecognized SSL message".
I checked the port (8088), seems fine. SSL is enabled on HEC and splunkd. (default parameters)
I wonder if it is possible that splunk db connect uses HEC entry on localhost:8088 if I have deported the HEC entry on the UFs with "useDeploymentServer".
Could it explain the ssl error ?
I tried to use dbx_settings.conf but it does not seems to use my second entry :
[hec]
maxRetryWhenHecUnavailable = 3
hecUris = localhost:8088,splunk-hec.qualgend:8088
Logs sample :
127.0.0.1 - - [03/nov./2022:15:30:08 +0000] "GET /api/taskserver HTTP/1.1" 200 414 "-" "python-requests/2.25.0" 2
2022-11-03 16:30:00.286 +0100 [Scheduled-Job-Executor-4] DEBUG c.s.d.s.dbinput.recordreader.DbInputRecordReader - action=closing_db_reader task=rising_mcipe_qualif
2022-11-03 16:30:00.286 +0100 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=mcipe_qualif jdbc_url=null db_read_time=0 hec_record_process_time=3 format_hec_success_count=69 status=FAILED input_name=rising_mcipe_qualif batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2022-11-03_04:30:00 end_time=2022-11-03_04:30:00 duration=21 read_count=69 write_count=0 error_count=0
2022-11-03 16:30:00.285 +0100 [Scheduled-Job-Executor-4] INFO org.easybatch.core.job.BatchJob - Job 'rising_mcipe_qualif' finished with status: FAILED
2022-11-03 16:30:00.285 +0100 [Scheduled-Job-Executor-4] ERROR org.easybatch.core.job.BatchJob - Unable to write records
javax.net.ssl.SSLException: Unsupported or unrecognized SSL message
at java.base/sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:451)
at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
Afficher toutes les 35 lignes
2022-11-03 16:30:00.285 +0100 [Scheduled-Job-Executor-4] ERROR c.s.d.s.dbinput.recordwriter.CheckpointUpdater - action=skip_checkpoint_update_batch_writing_failed
javax.net.ssl.SSLException: Unsupported or unrecognized SSL message
at java.base/sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:451)
at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
Afficher toutes les 35 lignes
2022-11-03 16:30:00.285 +0100 [Scheduled-Job-Executor-4] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
javax.net.ssl.SSLException: Unsupported or unrecognized SSL message
at java.base/sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:451)
at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
Afficher toutes les 35 lignes
2022-11-03 16:30:00.279 +0100 [Scheduled-Job-Executor-4] INFO c.s.d.s.dbinput.recordwriter.HttpEventCollector - action=writing_events_via_http_event_collector record_count=69
2022-11-03 16:30:00.279 +0100 [Scheduled-Job-Executor-4] INFO c.s.d.s.dbinput.recordwriter.HttpEventCollector - action=writing_events_via_http_event_collector
2022-11-03 16:30:00.279 +0100 [Scheduled-Job-Executor-4] INFO c.s.dbx.server.dbinput.recordwriter.HecEventWriter - action=write_records batch_size=69
Do you have any idea what I did wrong ? Any clue would be greatly appreciated !
Thanks in advance,
Ema
... View more
- Tags:
- splunkdb
Labels
- Labels:
-
HTTP Event Collector
-
modular input
11-03-2022
01:12 AM
1 Karma
Hi, I started to and found out in the process that it is a false positive. Here : https://splunkcommunities.force.com/customer/s/article/DB-Connect-False-Positive-Message-Not-Compatible-with-Python-3 Happy splunking, Ema
... View more
11-02-2022
07:59 AM
Hi everyone, Last version of 6 days ago does not seem to be python 3 ready yet either ... "Latest Version 3.11.0 - October 28, 2022" Weird... As we need to move to version 9 soon in order to not fall out of the train. We'll see... Ema
... View more
07-27-2022
08:09 AM
Hi there, Had a similar issue with Io:Wait being way too sensitive and not being able to deactivate it. Had the same answer about SPL-213405. Wait and see ! Ema
... View more
06-21-2022
01:33 AM
Hello, I'm trying to experiment sending data indexed in splunk to activeMQ. I'll probably need to use JMS Messaging Modular Input (yet to be tested, because I'm trying to output). Did someone do that already ? Could you share some feedback ? Thanks ! Ema
... View more
Labels
- Labels:
-
modular input
05-18-2022
01:28 AM
Hello, I made some progress : in order to use persistence, the load balancer need to be able to read the flow. So instead of puting the certificate on the forwarder, I put it on the load balancer. At least, now curl to the load balancer works fine. Except the connexion is rejected : I keep having this message : * SSL certificate verify ok.
* OpenSSL SSL_write: Connexion ré-initialisée par le correspondant, errno 104
* Failed sending HTTP POST request
* Connection #0 to host splunk-hec.test left intact
curl: (55) OpenSSL SSL_write: Connexion ré-initialisée par le correspondant, errno 104 I'm lost as to how I'm supposed to configure the inputs.conf/server.conf on the forwarders. Could'nt find any doc with examples about that, yet this is a validated HEC tier in splunk validated architecture documents. Does anyone have a suggestion ? Thanks in advance, Ema
... View more
05-06-2022
06:57 AM
Hello, I wonder if there is an answer to that question ? I'm stuck on it as well. Thanks, Ema
... View more
05-03-2022
05:46 AM
Hi, Tested with cookie persistence and sticky persistence : could not make the thing work. I do not know what's wrong. There is not Server Hello sent to answer the Client Hello in any of the tries. I'm lost... Any idea ? Thanks ! Eglantine
... View more
05-02-2022
02:01 AM
Hi again, use persistent session in the LB might be an option. Was it tested that way ? Thanks Ema
... View more
05-02-2022
01:13 AM
Hi, Yes, but with 2 answers, how am I supposed to know which one is correct ? I think it might be necessary to know which forwarder sent the ackId, in order to be able to identify the info I need. Suppose I do. Yet, I could keep asking the LB and never go back again to the forwarder which sent the ackID (hypothetically). I don't think this reasonning can be used as a fix. We might be missing some point in the "how to do that".. Regards, Ema
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-16-2025
09:21 AM
|
