About daymar_23

daymar_23 · ‎09-27-2021

Hello All: I have problems with my application where I am configuring the following stanza in the inputs.config file (C:\Program Files\SplunkUniversalForwarder\etc\apps\ope_web_api\default): https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Specifyinputpathswithwildcards [monitor://D:\package\...\version\Admin\APIS\log] disabled = 0 index = ope_web_api sourcetype = api_logs ignoreOlderThan = 1d I have Splunk Cloud 8.2.2 version. If I change the ... by the name of the file it works fine: [monitor://D:\package\ABC\version\Admin\APIS\log] disabled = 0 index = ope_web_api sourcetype = api_logs ignoreOlderThan = 1d But I need the ... because not always is the same file name. Does somebody know what I am missing here? Regards.

daymar_23 · ‎06-04-2021

Well, it doesn't work 😞 I will submit a case with the support team to know what else I can do. Thanks for your help @s2_splunk

daymar_23 · ‎06-03-2021

Hello @s2_splunk Here are the steps to workaround the issue: 1. Stop Splunk. 2. Set server.conf:listenOnIPv6 = no. 3. Perform KVstore migration by executing: ./splunk migrate migrate-kvstore. 4. Set server.conf:listenOnIPv6 = yes. 5. Start Splunk. Do I have to start splunk and after that try again with the Update from 7.2.1 to 8.1.4 not working? Or before start splunk?

daymar_23 · ‎06-03-2021

Hello! I was trying to update my splunk version from 7.2.1 to 8.1.4, I made all the steps required here: https://docs.splunk.com/Documentation/Splunk/8.1.2/Installation/AboutupgradingREADTHISFIRST?utm_medium=email&utm_source=splunk&utm_campaign=FY22Q1_GLBL_RTN_CUS_PLT_EN_7273EOS_Em2Apr21 and Here https://docs.splunk.com/Documentation/Splunk/8.1.2/Installation/UpgradeonWindows But after run the Upgrade Splunk Enterprise using the GUI installer my Splunk is broken. In the splunk.log file there is the following: Finished generating checksums for datamodel and report acceleration bucket summaries for all indexes. [App Key Value Store migration] Checking if migration is needed. Upgrade type 1. This can take up to 600seconds. WARN: [App Key Value Store migration] Service(36) terminated before the service availability check could complete. Exit code 14, waited for 2 seconds. App Key Value Store migration failed, check the migration log for details. After you have addressed the cause of the service failure, run the migration again, otherwise App Key Value Store won’t function. [App Key Value Store migration] Checking if migration is needed. Upgrade type 2. This can take up to 600seconds. WARN: [App Key Value Store migration] Service(36) terminated before the service availability check could complete. Exit code 14, waited for 0 seconds. App Key Value Store migration failed, check the migration log for details. After you have addressed the cause of the service failure, run the migration again, otherwise App Key Value Store won’t function. [DFS] Performing migration. [DFS] Finished migration. But I review the migration.log and there are not more information: Generating checksums for datamodel and report acceleration bucket summaries for all indexes. If you have defined many indexes and summaries, summary checksum generation may take a long time. Processed 3 out of 36 configured indexes. Processed 6 out of 36 configured indexes. Processed 9 out of 36 configured indexes. Processed 12 out of 36 configured indexes. Processed 15 out of 36 configured indexes. Processed 18 out of 36 configured indexes. Processed 21 out of 36 configured indexes. Processed 24 out of 36 configured indexes. Processed 27 out of 36 configured indexes. Processed 30 out of 36 configured indexes. Processed 33 out of 36 configured indexes. Processed 36 out of 36 configured indexes. Finished generating checksums for datamodel and report acceleration bucket summaries for all indexes. [App Key Value Store migration] Checking if migration is needed. Upgrade type 1. This can take up to 600seconds. WARN: [App Key Value Store migration] Service(36) terminated before the service availability check could complete. Exit code 14, waited for 2 seconds. App Key Value Store migration failed, check the migration log for details. After you have addressed the cause of the service failure, run the migration again, otherwise App Key Value Store won’t function. [App Key Value Store migration] Checking if migration is needed. Upgrade type 2. This can take up to 600seconds. WARN: [App Key Value Store migration] Service(36) terminated before the service availability check could complete. Exit code 14, waited for 0 seconds. App Key Value Store migration failed, check the migration log for details. After you have addressed the cause of the service failure, run the migration again, otherwise App Key Value Store won’t function. [DFS] Performing migration. [DFS] Finished migration. Can somebody help me please? I already tried to delete the mongod.lock file and run the upgrade again but it didn't work

daymar_23 · ‎02-05-2021

Thanks @saravanan90 Sorry, but I am new using splunk. So what do you mean by HF/Indexer? My local props.config looks like: [iis] MAX_DAYS_AGO=2 TRANSFORMS-null = setnull,setNotFound And under what label do I have to put the ignoreOlderThan = 2d in my local inputs.conf? Thanks for your reply.

daymar_23 · ‎02-05-2021

Hello All! I am configuring Splunk in different servers to send the IIS Logs. I am doing it by adding the IIS Log Folder as a Data Input -> Files & Directories. But in the IIS Log File there is old Logs, and I only want that send to splunk Logs from no more that two days. I already configured in the .props.config the MAX_DAYS_AGO=2, but it doesn't work. I have tried in these ways: With the file in ...\etc\system\local\props.config [iis] MAX_DAYS_AGO=2 ---------------- Didn't work [default] MAX_DAYS_AGO=2 ------------------Didn't work Changing the Default in the ..\etc\system\default\props.config [default] MAX_DAYS_AGO=2 ------------------Didn't work Restarting the Splunk service every time when I made the change Could somebody say me what I am missing? Thanks

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎02-02-2021

Online Status	Offline
Date Last Visited	‎09-27-2021 12:06 PM

Wildcard ... not working in my stanza

Splunk Update from 7.2.1 to 8.1.4 not working

Don't forward old IIS Logs to Splunk

Wildcard ... not working in my stanza

Re: Splunk Update from 7.2.1 to 8.1.4 not working

Re: Splunk Update from 7.2.1 to 8.1.4 not working

Splunk Update from 7.2.1 to 8.1.4 not working

Re: Don't forward old IIS Logs to Splunk

Don't forward old IIS Logs to Splunk

Are you a member of the Splunk Community?