About ggvaca

ggvaca · ‎02-27-2023

I noticed that when I downloaded the newest verison of Splunk Security Essentials 3.7.0, it is a SPL and not a TGZ like all of the other splunk apps are. We have it programmed when uploading this zipped file to take in TGZ and not SPL. Do I need to zip this as a TGZ? What's up with that? Thanks!

ggvaca · ‎01-26-2023

Thank you for the update! I hope they get it fixed soon!

ggvaca · ‎01-20-2023

Hello All, I just upgraded our Tenable App for Splunk to 6.0.3 to match our Tenable Add-On for Splunk that has been 6.0.3. When I upgraded the Tenable App for Splunk I started to get an error when I launched the Tenable App for Splunk: "A custom JavaScript error caused an issue loading your dashboard. See the developer console for more details." Is this a bug in the current version or something I need to change on our end? I'm not sure what's going on, but I open the developer console the only error that I get is this: TypeError: Cannot read properties of undefined (reading 'get') at setupMultiInput (eval at <anonymous> (dashboard_1.1.js:277:107834), <anonymous>:14:42) at eval (eval at <anonymous> (dashboard_1.1.js:277:107834), <anonymous>:33:13) at Object.execCb (eval at module.exports (common.js:1:1), <anonymous>:1658:33) at Module.check (eval at module.exports (common.js:1:1), <anonymous>:869:55) at Module.enable (eval at module.exports (common.js:1:1), <anonymous>:1151:22) at Module.init (eval at module.exports (common.js:1:1), <anonymous>:782:26) at eval (eval at module.exports (common.js:1:1), <anonymous>:1424:36 Thanks for your time!

ggvaca · ‎11-22-2022

Is there any documentation on specifically just upgrading a stand alone search head? I found documentation always for a cluster so I just want to make sure I document the correct steps for a change request before actually doing it.

ggvaca · ‎10-24-2022

Following this: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigureandinstallcertificatesforLogObserver Our current certificate is working, but is there anything I need to follow when using ACME. Once the certificate is in and working, what needs to be done? Do I need to just restart Splunk and expect it to work? Is there anything else needing to be done for them to be automatically be updated?

ggvaca · ‎08-19-2022

I am looking to upgrade our previous app that was https://splunkbase.splunk.com/app/291/ that has long not been updated since 2011. Upgrading to our new Splunk instance I am looking at our apps and trying to see which ones we want to migrate over. Since this app is so old and might not even make it to 9.0 when we move I am looking for another app. Currently I see this one: https://splunkbase.splunk.com/app/5482/#/overview which has been recently updated and looks promising, but it doesn't say that it is compatible with 9.0. While comparing I found this one: https://splunkbase.splunk.com/app/4183/#/overview that is compatible with 9.0, isn't Splunk supported nor has been updated since 2020. Is there a better MAXMIND kind of app or is there any advice on these current ones I found? Maybe the update for 9.0 on the second link just hasn't come out yet and it will soon? Need some community opinions and/or possibly creator updates for those apps? Thank you!

ggvaca · ‎07-06-2022

Isn't the session scheduler only on the splunkconf app? I cannot seem to get it on my computer nor does my phone have an option to just print the pdf.

ggvaca · ‎07-06-2022

Hey all, I have been needing a pdf of the .conf22 for this year to send to my job. I cannot download a pdf off the app. I need the full schedule from the Splunk university and the week conference. Where can I download this pdf to send off? Thanks!

ggvaca · ‎06-24-2022

Hello all, Referring to the previous post of: https://community.splunk.com/t5/Installation/Does-kvstore-upgrade-from-8-0-to-8-2-needs-to-be-done-on-the/m-p/603172#M11665 I had tried to upgrade our kvstore to wiredtiger on our license server/cluster master and our deployer. Here are the errors: Am I not supposed to be upgrading them then? I was following this advice from the previous community answer I received. Help? I am just trying to do this upgrade correctly. The reason I was doing this is because I was getting errors on our GUI about upgrading the kvstore after I had upgraded the search heads kvstore.

ggvaca · ‎06-23-2022

Hello, I am upgrading our splunk instance from 8.0 to 8.2. I noticed after following the kvstore upgrade which followed the upgrade to 8.2, which I did on our cluster heads, and they all have WiredTiger on them now. Logging into our cluster master, I get an error saying I need to upgrade the kvstore. This comes up like 30+ minutes after the upgrade. I look at the cluster master and run the same command for the kvstore status, and it says that it has the old kvstore on it still. Am I supposed to be going onto each box and upgrading the kvstore on them? The instructions said the search heads and so that's what I followed.

ggvaca · ‎03-22-2022

Hello, I am working on an old box that failed to upgrade to 8.2.x. We needed to download back to 8.0.3. I was trying to find the download on https://www.splunk.com/en_us/download/previous-releases.html?locale=en_us for linux, but I cannot find it anymore. I know we should be upgrading to a higher number by now, but we need to downgrade after a vm image didn't revert properly. Any help? Thanks!

ggvaca · ‎02-22-2022

What about leaving the variable storageEngineMigration=true in the server.conf? We use Git to store and run our files and I wasn't sure if this was a one and done situation after we upgrade or if we are going to want to push out this file to every system? It seems like this is a one and done once we upgrade.

ggvaca · ‎02-21-2022

I have upgraded to Splunk 8.2.3 recently in a test environment. The last step in upgrading our slightly outdated environment is to migrate the KVStore. I don't understand the directions. What system are we going into "the server.conf in the $SPLUNK_HOME/etc/system/local/ directory." Is it in the Deployer? Cluster Master? Any of the search heads we have? If that file is edited in one system, how is it being pushed to the search heads? Also could we leave the variable storageEngineMigration=true in that file or does it have to stay as false when not migrating? Thank you! @https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/MigrateKVstore

Posts	13
Solutions	0
Karma Given	8
Karma Received	0
Member Since	‎02-21-2022

Online Status	Offline
Date Last Visited	‎02-27-2023 04:27 PM

Splunk Security Essentials 3.7.0 a SPL and not a T...

Why is Tenable App for Splunk Upgrade to 6.0.3 Gon...

Upgrade a Stand Alone Search Head Documentation?

Is there anything else to be done to automate cert...

Question about Auto Update MaxMind Database

Where can I locate a pdf for the .conf22 Agenda?

Upgrading WiredTiger on our mgmt boxes- Why are we...

Does kvstore upgrade from 8.0 to 8.2 needs to be d...

Where can I find the download for Splunk 8.0.3 Ent...

How to complete a KVStore migration?