Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ephemeric
ephemeric
Contributor
Member since:
03-25-2011
08-01-2022
Community Statistics
| Posts | 131 |
| Solutions | 7 |
| Karma Given | 8 |
| Karma Received | 31 |
| Member Since | 03-25-2011 |
Activity Feed
- Got Karma for Re: Can you disable the management port (8089) on clients via the Deployment Server?. 4 weeks ago
- Got Karma for Re: SELinux support. 06-14-2022 05:45 AM
- Got Karma for Re: SELinux support. 05-30-2022 04:29 AM
- Posted Re: SELinux support on Security. 05-30-2022 02:55 AM
- Got Karma for Re: splunk universal forwarder installation No users exist. Please set up a user. 11-17-2021 09:53 AM
- Posted Macro for Backslash Substitution on Splunk Search. 09-25-2021 11:47 AM
- Posted Re: Can you disable the management port (8089) on clients via the Deployment Server? on Deployment Architecture. 09-19-2021 05:39 AM
- Posted Re: How do I disable Transparent Huge Pages (THP) and confirm that it is disabled? on Monitoring Splunk. 09-14-2021 04:03 AM
- Posted Azure VM Metrics Dashboards on Dashboards & Visualizations. 09-13-2021 11:51 AM
- Posted Re: Splunk won't start after upgrading to 8.2.2 from 8.0.x on Installation. 09-02-2021 12:05 PM
- Got Karma for Re: Unable to forward data into splunk. 08-27-2021 08:04 AM
- Got Karma for Re: Unable to forward data into splunk. 08-27-2021 08:03 AM
- Got Karma for Re: Unable to forward data into splunk. 08-27-2021 08:03 AM
- Posted Re: Unable to forward data into splunk on Getting Data In. 08-27-2021 06:44 AM
- Posted Re: Unable to forward data into splunk on Getting Data In. 08-27-2021 03:15 AM
- Posted Re: Unable to forward data into splunk on Getting Data In. 08-27-2021 03:14 AM
- Posted Re: Unable to forward data into splunk on Getting Data In. 08-27-2021 02:47 AM
- Posted Re: Limit the events forwarded by Splunk Universal Forwarder (Minimise Data Use) on All Apps and Add-ons. 08-26-2021 03:35 AM
- Posted Re: Limit the events forwarded by Splunk Universal Forwarder (Minimise Data Use) on All Apps and Add-ons. 08-26-2021 03:15 AM
- Posted Re: Deploying SSL between Forwarder and Indexer on Deployment Architecture. 08-25-2021 03:44 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
05-30-2022
02:55 AM
1 Karma
I don't. I have not checked back on this topic in quite some time.
... View more
09-25-2021
11:47 AM
I have a macro that adds a backslash to an existing backslash: [backslash(1)]
args = arg
definition = replace("$arg$", "(\\\\)", "\\\\\\\\")
iseval = 1 This works: index=perfmon counter=`backslash(\processor)` This fails when the arg has spaces: index=perfmon counter=`backslash("\processor time")` The expanded search string: (counter=\\processor index=perfmon time) How do I get: index=perfmon counter="\\processor time" Oh please show me my stupidity as I have been banging my head on the desk for hours...
... View more
Labels
- Labels:
-
eval
09-19-2021
05:39 AM
1 Karma
I think the OP wants to secure the UFs. By default the UF binds `*:8089` which is an audit finding in most envs. To be sure, configure /opt/splunkforwarder/etc/splunk-launch.conf: SPLUNK_BINDIP=127.0.0.1
... View more
09-14-2021
04:03 AM
For RHEL7/CentOS7: /etc/default/grub.conf
GRUB_CMDLINE_LINUX="... transparent_hugepage=never" Make your GRUB config... Or non-persistent whilst running: yum install libhugetlbfs-utils.x86_64
hugeadm --thp-never
... View more
- Tags:
- For RHEL
09-13-2021
11:51 AM
What am I missing here? So we have the MSCS TA installed and the data from an Azure Storage Account is been ingested into Splunk as `mscs:vm:metrics` sourcetype. The `CounterName` field has several metric names present so that side looks good. I have looked high and low for preconfigured searches and dashboards for said sourcetype but to no avail. There is no Content Pack (yet?) in the ITSI app for Azure and SIM is cloud only. We are running on-prem only. So: one cannot do any dashboards for Azure VM metrics without SIM and paid for ITSI app?
... View more
Labels
- Labels:
-
timechart
09-02-2021
12:05 PM
You could change in `etc/splunk-launch.conf`: SPLUNK_DB=/tmp/splunk_db Just to see if you can get a clean start? I'm probably wrong but it looks like there is a problem binding to port 8000? This could be caused by other errors, like a filesystem problem? I haven't looked at errors like this for years as I am only now making a comeback to the world of Splunk.
... View more
08-27-2021
06:44 AM
1 Karma
Your UF has connected. By default a UF is not a deployment client, so you have no deployment clients as the GUI shows you. Search 'index="_internal"' and you'll see your UF data there. Do the `ss -ant | grep 9777` and you'll see your UF connected. Check metrics.log on your indexer and you'll see UF data there too.
... View more
08-27-2021
03:15 AM
08-26-2021 16:21:40.575 -0800 INFO AutoLoadBalancedConnectionStrategy [12416 TcpOutEloop] - Found currently active indexer. Connected to idx=192.168.0.21:9997, reuse=1. It has connected.
... View more
08-27-2021
02:47 AM
1 Karma
It is not recommended to run a UF and indexer/search head on a single VM but for testing and learning it might work. As the log shows: your UF has connected to the IDX. That is correct: your UF is not configured as a deployment client as you are not using a deployment server. Nothing wrong here. An example check for UF and IDX: # UF.
$> splunk list forward-server
Active forwards:
spl-idx-01.ephemeric.lan:9997
# IDX.
$> ss -ant | grep 9997
ESTAB 170697 0 10.10.50.206:9997 10.10.50.209:44208
... View more
08-26-2021
03:35 AM
Yes, copy the directory to the forwarders etc/apps.
... View more
08-26-2021
03:15 AM
Just copy the app to etc/apps on your Splunk image. Same thing as deploying said app. Just be forewarned: you lose the ability to do any updates after deployment using a DS. If there are any required changes... problem. You can also use a config management tool like Chef, Ansible, Puppet etc. If networking is an issue: have the indexer(s) and DS on the same host as that then only requires a single dest IP to ports 8089, 9997.
... View more
08-25-2021
03:44 PM
May I suggest using https://github.com/OpenVPN/easy-rsa? The concept is like so: - you generate a keypair for the client (SUF) - you generate a keypair for the server (receiver, indexer etc.) - the client and server each have the same CA cert So three files on the server and three files on the client in a single file. This is the simplest setup.
... View more
08-25-2021
10:39 AM
May we know what file this is? I would recommend against unpacking and repacking the rpm as pointed out. One can build a rpm but the process is complicated and *.spec files are convoluted at best. If I know the file you wish to include, which should be deployed via some other mechanism like Ansible, Chef, Puppet, I can offer advice. You can do a script with the rpm inline as an option.
... View more
08-25-2021
03:33 AM
I can only find: https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers WRT compatibility. Can anyone confirm compatibility between UFs and DSs?
... View more
08-24-2021
01:37 PM
Seems like your connection is broken somehow. You said that "some" of the UFs are failing. I think you meant apps are pulled from the DS, not pushed from the DS to UFs. Can you check your firewall log for any errors? Please try from your failing UF: echo '\n' | openssl s_client -connect <deployment-server>:8089
... View more
08-24-2021
11:56 AM
Please search for "discard events" on Answers. Many posts explaining how to do what you require.
... View more
08-24-2021
08:22 AM
I like it! Well said.
... View more
08-24-2021
08:19 AM
Why do you need to run Splunk in a container? It complicates everything. First, test your ulimit settings in a VM to see how and why things work the way they do. Remove as much as you can. Simplify. If you must use Docker, use the `--ulimit` option: $> grep -i limit /usr/lib/systemd/system/docker.service
LimitNOFILE=1048576
LimitNPROC=1048576
LimitCORE=infinity
$> ulimit -n
1024
$> docker run -it --ulimit nofile=64000:64000 alpine
/ # ulimit -n
64000
/ #
... View more
