Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vksplunk1
vksplunk1
Explorer
Member since:
03-02-2021
yesterday
Community Statistics
| Posts | 27 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-02-2021 |
Activity Feed
- Posted What are some best practices to migrate Splunk from prim to Azure Cloud? on Splunk Enterprise. 03-07-2023 07:08 AM
- Posted Re: Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file on Getting Data In. 10-27-2022 12:13 PM
- Tagged Re: Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file on Getting Data In. 10-27-2022 12:13 PM
- Posted Re: Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file on Getting Data In. 10-27-2022 11:37 AM
- Posted Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file? on Getting Data In. 10-27-2022 09:45 AM
- Posted How to generate data using JSON format sample file? on Getting Data In. 10-27-2022 09:17 AM
- Posted For evengen, Can I place the sample file in a separate directory under samples directory? on All Apps and Add-ons. 10-17-2022 10:35 AM
- Posted Splunk 9 Universal Forwarder getting "[App Key Value Store migration] " error after upgrade from Splunk 8.2.4 on Splunk Enterprise. 09-20-2022 01:47 PM
- Got Karma for Re: How to split data to multiple indexes on the same indexer (index1,index2) from one input source from one Heavyforwar. 09-15-2022 06:31 PM
- Posted Re: Heavy Forwarder Unable to send data to Indexer on Splunk Enterprise. 06-24-2022 12:00 PM
- Posted How to enable Web UI in Indexer on Splunk Enterprise. 06-24-2022 08:57 AM
- Posted Re: Heavy Forwarder Unable to send data to Indexer on Splunk Enterprise. 06-24-2022 06:25 AM
- Posted Re: Heavy Forwarder Unable to send data to Indexer on Splunk Enterprise. 06-23-2022 01:36 PM
- Posted Re: Heavy Forwarder Unable to send data to Indexer on Splunk Enterprise. 06-23-2022 12:16 PM
- Posted Re: Heavy Forwarder Unable to send data to Indexer on Splunk Enterprise. 06-22-2022 01:08 PM
- Posted Why is heavy forwarder unable to send data to indexer? on Splunk Enterprise. 06-22-2022 11:52 AM
- Posted Re: How to split data to multiple indexes on the same indexer (index1,index2) from one input source from one Heavyforwar on Getting Data In. 06-15-2022 06:22 AM
- Posted Re: How to split data to multiple indexes on the same indexer (index1,index2) from one input source from one Heavyforwar on Getting Data In. 06-14-2022 09:59 PM
- Posted Re: How to split data to multiple indexes on the same indexer (index1,index2) from one input source from one Heavyforwar on Getting Data In. 06-14-2022 11:04 AM
- Posted How to split data to multiple indexes on the same indexer (index1,index2) from one input source from one Heavyforwarder on Getting Data In. 06-14-2022 10:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-07-2023
07:08 AM
Hi ,
We are planning to migrate Splunk from prim to Azure Cloud . The on prim is a distributed environment with 1 SH/DS, 1 IDX, 2 HFs & 2 UFs.
We are thinking of leaving HFs and UFs on prim and move SH & IDX to Azure cloud(only to use Azure Cloud VMs). Any issues with this approach Vs moving all splunk components to Azure Could.
Thank you in advance for your su
... View more
Labels
10-27-2022
12:13 PM
Here is part of the 1st event in the exported file: testindex,"/opt/splunk/var/log/cdm/events/events.log","testindex:testsourcetype","1665554739.952,root_host=""test.server.domain.com"",comp_id=""1234444"",check_checklist_name=""test name"",check_disa_cki_id="""",......
... View more
- Tags:
- heavyforwarder
10-27-2022
11:37 AM
Here is part of the 1st event in the exported file: testindex,"/opt/splunk/var/log/cdm/events/events.log","testindex:testsourcetype","1665554739.952,root_host=""test.server.domain.com"",comp_id=""1234444"",check_checklist_name=""test name"",check_disa_cki_id="""",......
... View more
10-27-2022
09:45 AM
Hi ,
Splunk adding additional double quotes when I export the data as csv . When I use the exported file as eventgen sample file, it causing parsing issues used when insert events using the sample file.
Any suggestions to this issue
... View more
Labels
- Labels:
-
CSV
-
data
-
field extraction
-
modular input
10-27-2022
09:17 AM
Hi ,
We have an add-on which will JSON format for data input. I can export the data as JSON format.
Could you please let me know how to generate events using Eventgen with the exported JSON sample file.
... View more
Labels
- Labels:
-
data
-
heavy forwarder
-
JSON
10-17-2022
10:35 AM
Hello Hi,
For evengen, Can I place the sample file in a separate directory under samples directory:
e,g: /opt/splunk/etc/apps/SA-Eventgen/samples/my-samples/test1-sample.csv
If I can place the sample file like above, where can I specify the location of the test1-sample.csv in eventgen.conf?
Thank you in advance for your help
... View more
Labels
- Labels:
-
configuration
09-20-2022
01:47 PM
Hi , Splunk 9 Universal Forwarder getting "[app key value store migration collection data is not available] " error after upgrade from Splunk 8.2.4. Splunk is not starting app key value store migration collection data is not available Why is UF is looking for KV Store ? Any suggestion to resolve it
... View more
Labels
- Labels:
-
upgrade
06-24-2022
12:00 PM
Thank you again. Where can I find the password sslPassword for OUTPUTS.CONF [tcpout:sndIndexers] server = xx.xx.xx.xx:9996 sslPassword =
... View more
06-24-2022
08:57 AM
Hi Good Morning , Web UI in indexer is not starting though the following setting in place in ..../system/default/web.conf [settings] # enable/disable the appserver startwebserver = 1 # First party apps: splunk_dashboard_app_name = splunk-dashboard-studio # enable/disable splunk dashboard app feature enable_splunk_dashboard_app_feature = true # port number tag is missing or 0 the server will NOT start an http listener # this is the port used for both SSL and non-SSL (we only have 1 port now). httpport = 8000 Then added a ..../system/local/web.conf with the following to see if it enable but still the web UI is disabled: enableSplunkWebSSL = true Any help is greatly appreciated
... View more
Labels
- Labels:
-
administration
-
configuration
06-24-2022
06:25 AM
Thank you for looking in to it. I furthur looked in to the logs and found errors from indexer(s) also: On Heavy Forwarder: ==================== 06-22-2022 13:24:03.471 -0400 ERROR TcpOutputFd [19320 TcpOutEloop] - Read error. Connection reset by peer 06-22-2022 13:24:03.472 -0400 ERROR TcpOutputFd [19320 TcpOutEloop] - Read error. Connection reset by peer 06-22-2022 13:24:03.472 -0400 ERROR TcpOutputFd [19320 TcpOutEloop] - Read error. Connection reset by peer 06-22-2022 13:24:03.472 -0400 WARN AutoLoadBalancedConnectionStrategy [19320 TcpOutEloop] - Applying quarantine to ip=xx.xx.xx.xx port=9996 _numberOfFailures=2 06-22-2022 13:24:03.473 -0400 ERROR TcpOutputFd [19320 TcpOutEloop] - Read error. Connection reset by peer 06-22-2022 13:24:03.473 -0400 WARN AutoLoadBalancedConnectionStrategy [19320 TcpOutEloop] - Applying quarantine to ip=yy.yy.yy.yy port=9996 _numberOfFailures=2 On Indexers: ============== TcpInputProc [27164 FwdDataReceiverThread] - Error encountered for connection from src=xxxxx error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
... View more
06-23-2022
01:36 PM
It's in TRANSFORMS.CONF: [xxxx] REGEX=xxxxxx DEST_KEY=_TCP_ROUTING FORMAT=sndIndexers [yyyy] REGEX=yyyyy DEST_KEY=_TCP_ROUTING FORMAT=tstIndexers
... View more
06-23-2022
12:16 PM
Thank you for looking in to. Here is OUTPUTS.CONF: [tcpout:sndIndexers] server = indexer1:9996 sslPassword = <<Password>> [tcpout:tstIndexers] server = indexer2:9996 sslPassword = <<password2>>
... View more
06-22-2022
01:08 PM
Thank you for your response. If configure to send data to only one indexer it's working fine. This is an issue only when HF outputs.conf to send data to multiple indexers based on a REGEX
... View more
06-22-2022
11:52 AM
Hi Good Afternoon,
Our Heavy Forwarder is unable to forward to one of the indexer but able to send data another indexer. Here is what I saw in splunkd.log of Heavy Forwarder:
06-22-2022 13:24:03.471 -0400 ERROR TcpOutputFd [19320 TcpOutEloop] - Read error. Connection reset by peer 06-22-2022 13:24:03.472 -0400 ERROR TcpOutputFd [19320 TcpOutEloop] - Read error. Connection reset by peer 06-22-2022 13:24:03.472 -0400 ERROR TcpOutputFd [19320 TcpOutEloop] - Read error. Connection reset by peer 06-22-2022 13:24:03.472 -0400 WARN AutoLoadBalancedConnectionStrategy [19320 TcpOutEloop] - Applying quarantine to ip=xx.xx.xxx.xxx port=9996 _numberOfFailures=2 06-22-2022 13:24:03.473 -0400 ERROR TcpOutputFd [19320 TcpOutEloop] - Read error. Connection reset by peer 06-22-2022 13:24:03.473 -0400 WARN AutoLoadBalancedConnectionStrategy [19320 TcpOutEloop] - Applying quarantine to ip=yy.yy.yy.yy port=9996 _numberOfFailures=2
... View more
Labels
- Labels:
-
troubleshooting
06-15-2022
06:22 AM
1 Karma
Thank you for the response. Regardless of the REGEX ins transforms.conf in HF, the data always sending to the index in inputs.conf Seems like splunk not allowing to overide index specified in inpouts.conf TRANSFORMS.conf ====== #[cdmops] #REGEX=.*service=cdmops2.* #DEST_KEY=_MetaData:Index #FORMAT=cdmops #[cdmops2] #REGEX=.*service=cdmops2.* #DEST_KEY=_MetaData:Index #FORMAT=cdmops2 Data: ===== 2022/06/01 10:45:50 service=cdmops server=node3 score=50 seq=55041 2022/06/01 10:45:50 service=cdmops2 server=node1 score=17 seq=55042
... View more
06-14-2022
09:59 PM
Thank you for the response. To make it clear, I am NOT trying to split the event. I am trying to send the events from the same source to same indexer but to a different INDEXE( index1 or index2 based on the regex )
... View more
06-14-2022
11:04 AM
Here is my correct INPUTS.conf. Missing index in the earlier inouts.conf INPUTS.CONF ====== [monitor:///opt/splunk/var/log/testData] disabled = false host = Haveyforwarder1 index = index1
... View more
06-14-2022
10:57 AM
Hi, Could you please let me know How to split data to multiple indexes on the same indexer (index1,index2) from one input source from one Heavyforwarder I tried with the following configuration but all the data going to once index that is defined in inputs.conf. If I remove index from inputs.conf all the events are going to main index. Thank you in ad Here my configuration and data: INPUTS.CONF ====== [monitor:///opt/splunk/var/log/tesData] disabled = false host = heaveforwarder1 PROPS.CONF =========== [source::///opt/splunk/var/log/tesData] TRANSFORMS-routing=vendorData,secureData TRANSFORMS.conf ========== [vendorData] REGEX=5617605039838520 DEST_KEY=_MetaData:Index FORMAT=index1 [secureData] REGEX=6794850084423218 DEST_KEY=_MetaData:Index FORMAT=index2 testdata: [08/June/2022:18:23:07] VendorID=5038 Code=C AcctID=5617605039838520 [08/June/2022:18:23:22] VendorID=9109 Code=A AcctID=6794850084423218
... View more
Labels
- Labels:
-
heavy forwarder
11-19-2021
09:01 AM
Hi - I can not down down load app from Splunk base from server. Could you please let me know how to down load app on to my laptop from Splunk base . One I down load I want to move it to search head server(not accessible from outside) and install on it Thank you
... View more
Labels
- Labels:
-
configuration
11-09-2021
07:25 AM
Hi - Unable to login to Search Head Web UI using the password set for admin user during the installation. Could you please let me know how to reset the password for "Admin" user? Thank You
... View more
Labels
- Labels:
-
configuration
-
installation
