About sombhtr239

sombhtr239 · ‎08-07-2023

Hello, None of the above statement hold true for me. Our VM's are hosted in GCP, and we have 3 SH member in the SHC and 3 IDX. The issue is observed only in 1 peer, while the other works fine. Tried the setting mentioned above. Also, removed and reconfigured the problematic SH. The issue persists. If anyone has resolved the issue, please suggest steps to resolve this issue.

sombhtr239 · ‎12-27-2021

Anyone having solution please help

sombhtr239 · ‎12-27-2021

I am also facing the same problem. Server IOPS is 2000, still getting IOWAIT and ingesting latency error very frequently and then it goes away.

sombhtr239 · ‎12-13-2021

Hello, I am trying this for the first time and installed sc4s in my HF server, connected the sc4s with HF using HEC URL and token. As checked I am receiving data for sc4s events from HF. However when the syslog is being forwarded from netscaler over ports not receiving any data. Apart from installation of sc4s and updating the hec url and token, I have enabled UDP port- 514 in iptables to accept data. Really appreciate if anyone can help me in resolving this.

sombhtr239 · ‎11-15-2021

I found this issue more with the server. Every time we reboot the server, it failed to turn on. Finally created a new VM which resolve the problem. Thanks all for your contribution. Issue resolved now.

sombhtr239 · ‎11-11-2021

We are trying to scale up our environment and the other 2 SH peer are running on SE8.0.5, hence tried both 8.0.5 and 8.1.0. Will check /var/log/messages; however already changed permission for /opt/splunk . Tried to run via systemctl as well to No go as of now.

sombhtr239 · ‎11-11-2021

Tried steps already, its still not working. We tried the following to no go: 1) Tried to start splunk as splunk user did not go 2) Kept filesystem with Splunk and tried to start splunk with root did not work. 3) Tried to enable systemctl did not work.

sombhtr239 · ‎11-11-2021

We tried to install splunk 8.1.0 and after untarring the file tried to start splunk both as root and splunk user via /opt/splunk/bin/splunk start Error comes up as execve: Operation not permitted while running command /opt/splunk/bin/splunkd Any urgent help is appreciated

sombhtr239 · ‎11-05-2021

Please try to route the data first based upon your tcpoutputproc, for example: [WinEventLog://System] _TCP_ROUTING = splunkidxA,splunkidxB indexer = A As the data is received in both the indexer, try to drop unecessary event from the indexer using props and transforms. Hope this helps.

sombhtr239 · ‎04-26-2021

Hi , I need to setup SSL for all my UF communicate securely both with my indexer and deployment server. I have gone through the link: https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf , which is definitely useful. However need to know can I use the same certificate for outputs.conf and server.conf

Posts	10
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎08-17-2020

Online Status	Offline
Date Last Visited	‎12-13-2023 11:29 AM

Unable to receive data vis splunk connect for sysl...

Why is there an error when trying to start Splunk ...

Setup SSL from UF to both Indexer and Deployment S...

Re: Why is the replication status on distributed s...

Re: Ingestion Latency after updating to 8.2.1

Re: Ingestion Latency after updating to 8.2.1

Unable to receive data vis splunk connect for sysl...

Re: Unable to start splunk first time

Re: Unable to start splunk first time

Re: Unable to start splunk first time

Why is there an error when trying to start Splunk ...

Re: Universal Forwarder sending two sets of Window...

Setup SSL from UF to both Indexer and Deployment S...