About SplunkNinja

SplunkNinja · ‎05-14-2024

I narrowed the issue down to an add-on and then updated to the latest version. This fixed the problem. Thanks for you help @gcusello and @PickleRick

SplunkNinja · ‎05-10-2024

I am seeing the following alert on the Searching and Reporting App and also within the InfoSec App for Splunk. [idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity I am not sure how to go about troubleshooting this further. Thx.

SplunkNinja · ‎01-09-2023

Thanks @richgalloway Yes - the outputs.conf on the SH did not have a reference to the SSL/TLS cert being used. I added the path to the cert file and password. it's now working 😀

SplunkNinja · ‎01-03-2023

I have a SH that is not part of SH Cluster. The SH is connected to an Index Cluster. I am seeing the following errors on the Indexers (W.X.Y.Z is the IP address of the SH) ERROR TcpInputProc [2317 FwdDataReceiverThread] - Error encountered for connection from src=W.X.Y.Z:46788. error:140760FC:SSLroutines:SSL23_GET_CLIENT_HELLO:unknown protocol I don't think there is a mismatch of sslVersions. Please help me troubleshoot this.

SplunkNinja · ‎12-19-2022

It seems that the KV Store is enabled by default on all servers. On non-SHs, if we set [kvstore] disabled = true and upgrade from Splunk 8.1.x to Splunk 9.0.x Will the Storage Engine migrate from MMAPv1 to WiredTiger? Will the Server Version upgrade to 4.2.17? I know that if [kvstore] disabled = false, the upgrade should migrate to WiredTiger and server version 4.2.17. I am just wondering if the migration and upgrade happen whether or not the kvstore is enabled. I may need to test this out in the lab 😀

SplunkNinja · ‎12-15-2022

One of my colleagues said we could be running different Splunk Enterprise versions on the CM and IDX Cluster. For example, he said that we could run the IDX Cluster at Splunk 9.0.x and the CM at Splunk 8.1.x. This does not sound like a Splunk best practice to me. But is it technically possible? Do all Indexers need to be running the same version of Splunk?

SplunkNinja · ‎12-09-2022

Hi PickleRick, This is a lab/dev environment so we don't really have an RTO/RPO. It would be great if you could list some options. Thanks!

SplunkNinja · ‎12-09-2022

Thanks 13tsavage. I had to use this command to extract to /opt/splunk/etc: tar -xzvf /opt/$HOSTNAME.tgz -C /

SplunkNinja · ‎12-01-2022

Thanks 13tsavage This is just a standalone SH. So, I believe I should be OK with archiving $SPLUNK_HOME/etc Would this be a good command to be used to restore: tar xzvf /opt/$HOSTNAME.tgz -C /opt/splunk/etc/

SplunkNinja · ‎11-30-2022

Thanks Rich. I have opened a Support case to further investigate.

SplunkNinja · ‎11-30-2022

What is the correct method to backup/restore Splunk Enterprise? I believe I can backup (Linux) using this command: tar czvf /opt/$HOSTNAME.tgz /opt/splunk/etc/

SplunkNinja · ‎11-29-2022

Hello Rich, I followed the 9.0.2 steps with the same results. My mongodb.log is showing issues with SSL. Not sure why we see - connecting with a certificate with cluster membership This is supposed to be a standalone SH. Not sure what to try next. Thanks. 2022-11-29T19:21:34.576Z W ACCESS [conn1] Client isn't a mongod or mongos, but is connecting with a certificate with cluster membership 2022-11-29T19:21:34.576Z I ACCESS [conn1] Successfully authenticated as principal CN=a.b.c.d,OU=xxx,O=yyy on $external from client 127.0.0.1:37278 2022-11-29T19:21:34.576Z I NETWORK [conn1] end connection 127.0.0.1:37278 (0 connections now open) mongodump 2022-11-29T19:21:35.588+0000 WARNING: --sslAllowInvalidCertificates and --sslAllowInvalidHostnames are deprecated, please use --tlsInsecure instead 2022-11-29T19:21:35.593Z I NETWORK [listener] connection accepted from 127.0.0.1:37284 #2 (1 connection now open) 2022-11-29T19:21:35.593Z I NETWORK [listener] connection accepted from 127.0.0.1:37286 #3 (2 connections now open) 2022-11-29T19:21:35.605Z E NETWORK [conn2] no SSL certificate provided by peer; connection rejected 2022-11-29T19:21:35.606Z I NETWORK [conn2] Error receiving request from client: SSLHandshakeFailed: no SSL certificate provided by peer; connection rejected. Ending connection from 127.0.0.1:37284 (connection id: 2) 2022-11-29T19:21:35.606Z I NETWORK [conn2] end connection 127.0.0.1:37284 (1 connection now open) 2022-11-29T19:21:35.606Z E NETWORK [conn3] no SSL certificate provided by peer; connection rejected 2022-11-29T19:21:35.606Z I NETWORK [conn3] Error receiving request from client: SSLHandshakeFailed: no SSL certificate provided by peer; connection rejected. Ending connection from 127.0.0.1:37286 (connection id: 3)

SplunkNinja · ‎11-29-2022

Hello everybody! My standalone SH Storage Engine did not migrate to WiredTiger after upgrade to Splunk 9.0.2. I then followed these steps: https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/MigrateKVstore Migrate the KV store after an upgrade to Splunk Enterprise 8.1.* or 8.2.* in a single-instance deployment Stop Splunk Enterprise. Do not use the -f option. Open server.conf in the $SPLUNK_HOME/etc/system/local/ directory. Edit the storageEngineMigration setting to match the following example: [kvstore] storageEngineMigration=true Save the server.conf file. To begin the migration, use the following command: splunk migrate kvstore-storage-engine --target-engine wiredTiger Starting KV Store storage engine upgrade: Phase 1 (dump) of 2: ..ERROR: Failed to migrate to storage engine wiredTiger, reason= How can I troubleshoot this further? Thanks.

Posts	13
Solutions	0
Karma Given	12
Karma Received	2
Member Since	‎06-11-2021

Online Status	Offline
Date Last Visited	‎05-15-2024 09:02 AM

[idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-th...

How to troubleshoot error with SH and index cluste...

Will KV Store Upgrade if Disabled?

CM and IDX Different Splunk Enterprise Versions?

What is the correct method to backup/restore Splun...

Storage Engine did not migrate to WiredTiger after...

Re: [idx-1,idx-2,sh-2] Could not load lookup=LOOKU...

[idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-th...

Re: How to troubleshoot error with SH and index cl...