About mommyfixit

mommyfixit · ‎06-12-2024

I have a new deployment of Splunk 9.2.1 Enterprise. We only have the Splunk servers running so far, other than one Universal Forwarder. I'm getting this error: The index processor has paused data flow. Too many tsidx files in idx=_internal bucket="/opt/splunk/var/lib/splunk/_internaldb/db/hot_v1_57" , waiting for the splunk-optimize indexing helper to catch up merging them. Ensure reasonable disk space is available, and that I/O write throughput is not compromised. I have 4TB of available disk space, so I have no idea what's going on. Any thoughts?

mommyfixit · ‎08-29-2022

Actually, although it is still sending events to the indexer, and the error is still there, it has quit communicating with the management server. So configuring server.conf the way I just did was definitely the wrong solution. I added the name of the management server to sslCommonNameToCheck and removed clientCert (since it had the indexer's cert path in there). This didn't help - I'm going to have to put server.conf back the way it was so it starts communicating with the management server again. I'm going to need some very specific guidance to get this working. Thanks!

mommyfixit · ‎08-29-2022

I went onto one of the Universal Forwarders and modified server.conf with the following: [sslConfig] enableSplunkdSSL = true sslVersions = tls1.2 sslVerifyServerCert = true sslCommonNameToCheck = (indexer server name) clientCert = (path to indexer certificate) sslRootCAPath = (path to indexer chain cert) This didn't make any difference. Same error message. The forwarder still works, but it is still giving me that message. Did I configure the right settings? Should the server.conf on the universal forwarders be a copy of the server.conf on the indexer, or is there something different between the two?

mommyfixit · ‎08-29-2022

We are getting this error on the Universal Forwards on Windows endpoints. Our rep didn't mention a server.conf on the endpoints...would that go in our forwarder outputs app? We configured the certs in outputs.conf, but there is no server.conf in that app. Yes, on the Indexer, we have server.conf configured with: enableSplunkdSSL = true serverCert = (our indexer's cert) sslRootCAPath = (our server chain)

mommyfixit · ‎08-15-2022

Our Splunk rep walked us through setting up SSL for our Splunk server communication with each other and for our Universal Forwarders to connect to our Indexer. However, we still get the warning X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA) In addition, Nessus scans find the default Splunk certificate on all of the systems with Universal Forwarders. We have SSL certificates created by our government agency's CA. I have verified that our indexer's server.conf is pointing sslRootCAPath to our CA's pem. I have verified that our indexer's inputs.conf is pointing serverCert at our server's pem. I have verified that our universal forwarders' outputs.conf have clientCert pointing at our server's pem, which is located on each system in C:\Program Files\SplunkUniversalForwarder\etc\auth. I have verified that our universal forwarders' outputs.conf have sslRootCAPath pointing at our CA's pem, which is located on each system in C:\Program Files\SplunkUniversalForwarder\etc\auth. Why do we still get this warning? Are we missing a setting somewhere?

mommyfixit · ‎04-08-2022

Would you please explain what you mean by "You can't filter by EventCode unless it is indexed." Our Windows event codes are whitelisted in inputs.conf with oswin listed as the index, and we have oswin configured in indexes.conf. I can see results if I just run index=oswin EventCode=8001. But it tells me I have 0 results if I run: | tstats values(host) where index=oswin AND EventCode=8001.

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-08-2022

Online Status	Offline
Date Last Visited	‎06-12-2024 06:40 PM

Why is X509 certificate default using warning?

Re: The index process has paused data flow. Too ma...

Re: Why is X509 certificate default using warning?

Re: Why is X509 certificate default using warning?

Re: Why is X509 certificate default using warning?

Why is X509 certificate default using warning?

Re: What is wrong with my tstats command?