About adidibra

adidibra · ‎11-10-2022

I am trying the suggested command to retrieve passwords located in identities.conf but I do not get any output in the console. My DB Connect version is 3.7.0. Any suggestion, highly appreciated.

adidibra · ‎08-20-2021

Hello, I need some help where to look in order to diagnostic the issue I am facing. I am using v8.0.9 in a multisite search head cluster and indexer cluster. After more than 30 days of normal operation, the search heads are not parsing bluecoat logs. While I try the same search from the cluster master the parsing is done properly but from any of the search heads.... There has not done any change in the cluster but suddenly the parsing stopped working. Any ideas on where to focus my troubleshooting?

adidibra · ‎08-05-2021

Hello, I performed a "fresh" installation of ES 4.6.1 in a search head cluster through deployer. Splunk app version is 8.0.9. The apps for the ES were pulled from a repository solution to deployer and then pushed to the search cluster. When I try to open the content management it is stuck in blank and the Incident Review displaying "Operation Failed, Internal Error. __enter__" error. Is there any log file I might check and permission I need to change a this behavior is quite strange? Thank you in advance

adidibra · ‎08-02-2021

Hello, Good call. Someone changed the [general] pass and I was chasing my tail. Thanks

adidibra · ‎08-02-2021

Hello, I have implemented an indexer cluster with 16 nodes and attached the license after the cluster was up and running for approx 20 days. After applying the 1TB per day license, 15 nodes have been connected successfully with the license manager but only 1 is having issues and generation the following alert [idx001] Streamed search execute failed because: Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times I have tried some restarts and re-connection with the license manager from this node but still the message persists. Also in the license manager this is the only indexer missing even though the IP/DNS connectivity works Is there any possibility to force re-connection from this indexer?

adidibra · ‎04-06-2021

Hello, I need to move old logs for a specific logsource(host) to be indexed in another splunk cluster. When I use the dbinspect in the actual splunk cluster, for that specific index, the logs seems to be in the cold buckets. Is it possible to extract logs of a specific host from cold buckets so it can be moved to another splunk cluster?

adidibra · ‎04-06-2021

@tscroggins Thanks for the advice

adidibra · ‎03-12-2021

Hello, I am getting the following error while searching in splunk. Could not load lookup=LOOKUP-cisco_pix_severity_lookup Could not load lookup=LOOKUP-citrix_netscaler_availability_status Could not load lookup=LOOKUP-citrix_netscaler_ha_states Could not load lookup=LOOKUP-f5_icontrol_availability_status Could not load lookup=LOOKUP-f5_icontrol_ha_states I copied the apps from another splunk deployer and now I getting these errors. I see the lookup csv files are there but still the error persists. Am I missing something? Please advise. Thanks

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎03-11-2021

Online Status	Offline
Date Last Visited	‎11-10-2022 12:22 PM

Search Heads not parsing unexpectedly

Splunk Enterprise Security Content Management blan...

Splunk License Error After Proper Licensing

Extract logs for specific host in cold buckets

Error message while searching from the search head

Re: Splunk DB Connect: How can I recover MSSQL enc...

Search Heads not parsing unexpectedly

Splunk Enterprise Security Content Management blan...

Re: Splunk License Error After Proper Licensing

Splunk License Error After Proper Licensing

Extract logs for specific host in cold buckets

Re: Error message while searching from the search ...

Error message while searching from the search head