About Nawab

Nawab · ‎12-16-2024

I edited the datamodel using web UI, also I just edited a macro and it is reflected in the cluster

Nawab · ‎12-16-2024

I have just added a field in datamodel which i need to use in my searches. this field is duplicated in 2 SHs but in 1 SH that field is not available. Cluster health is Okay, and if I change any thing on dashboards or corelation search it is reflected in all SHs

Nawab · ‎12-16-2024

I dont think this is related to my case. if change is replicated with in 2 SH, why changes are not replicated on 1 SH, all 3 SH are sending logs to indexers

Nawab · ‎12-16-2024

yes, sh is sending logs to indexers

Nawab · ‎12-16-2024

I have a SHC of 3 search heads. I changed some fields in data model of 1 sh. it is replicated on 2nd SH, but 3rd SH does not have the same fields. Even though that SH was the captian. I ran resync command but still the same issue.

Nawab · ‎11-20-2024

I have solved this issue. to get the notables accross SHC, you need to send notable data to an index in indexer cluster using outputs.conf once data is sent, new notables will be available in all SHs

Nawab · ‎11-20-2024

I have deployed a SH cluster and two SHs, every thing is working fine till now. Now I have added a new member to the cluster, all configurations are replicated. But the apps are not replicated. Q1: will the apps be replicated on new member automatically or should I run deploy bundle command on deployer. Q2: when I run the command from deployer, I get network layer error and Splunk service is stopped automatically.

Nawab · ‎11-03-2024

So now the issue is, Some alarms triggered in 1 sh and others trigger in 2nd sh

Nawab · ‎11-03-2024

shcluster status is up. If notable should trigger on only on and correlation searches only run on 1 search head, what is the point of having a shcluster. Also what will happen of reports that use notable data. How will I control searches to be run on only 1 sh.

Nawab · ‎11-01-2024

Did you find solution to this? my problem is that it will trigger on all shc members and when i assign notable from on sh it is not reflected on other shs

Nawab · ‎10-30-2024

I found the solution. It was Pass4symmkey issue, I had some special charaters in my pass4symmkey due to which there was a difference is passwords. to check use below commands. splunk btool server list shcluster --debug | grep -i pass4symmkey ( this will give you your password on spunk) splunk show-decrypted --value 'pass4symmkey' (this will decrypt the key) now verify the pass key it will surely be a missmatch.

Nawab · ‎10-30-2024

I have 3 new splunk enterprise. 2 are acting as search heads and 1 is acting as deployer. I have successfully made them as a cluster and can even push user and search configs but when i push app or add-ons from deployer i get below error. Error in pre-deploy check, uri=https://x.x.x.x8089/services/shcluster/captain/kvstore-upgrade/status, status=401, error=No error even the password is correct for deployer which is also same for both SHs. What could be the issue here PS: I know splunk recommend to use 3 SH and 1 deployer. I tried it as well but have same issue.

Nawab · ‎10-23-2024

still facing this issue

Nawab · ‎10-22-2024

I am checking this time from the backend of splunk, i am tailing the file splunkd.log and it shows a different time than system time

Nawab · ‎10-21-2024

I have setup splunk, the machine has 15:26 as local time, but when I check splunkd.log time it is 20:26. why is there a difference in time b/w local time and splunkd.log time?

Nawab · ‎10-20-2024

I am trying to deploy SH cluster, but when I run below command ./splunk init shcluster-config -auth <username>:<password> -mgmt_uri <URI>:<management_port> -replication_port <replication_port> -replication_factor <n> -conf_deploy_fetch_url <URL>:<management_port> -secret <security_key> -shcluster_label <label> But I am getting below error WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details. Login failed but when I do below config I get below error [sslConfig] cliVerifyServerName = true sslVerifyServerCert = true ERROR: certificate validation: self signed certificate in certificate chain Couldn't complete HTTP request: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

Nawab · ‎10-06-2024

We have an issue where we created a default frozen folder instead of frozen for each index, now we have some data in our frozen folder and we want to resotre it back to searchable data. how can i identify the index name of that data or if i cant identify the index name how to restore it to a random index.

Nawab · ‎09-02-2024

Here I mean HF 1 is working as DS for UFs acting as DCs. Other HF i.e HF 2, is not working as DS for UFs acting as DCs, but rather forwarding the clients info to MC I dont want my MC to act as DS, I want my HFs to act as DS. Why one is working correctly, other is not

Nawab · ‎09-02-2024

So to be clear, We have different sites, where we deployed different HFs which will also act as DS, not DC. These HFs are connected with single MC to get licensing and stuff, these HFs cant communicate with each other so they dont know anything about each other. Now the senario is, We have 2 HF, which are only initial deployments, connecting with indexers as outputs.conf. will act as DS, one HF is connecting properly with uf and acticing as DS, second is not and forwarding the traffic to our MC which is used for licensing

Nawab · ‎09-01-2024

I have a deployment, where 2 HF's are acting as DS. and they are both connected to MC for licensing at port 8089. In HF 1 i tried to connect some Deployment Client (DC) and they were successfully connected to HF. In HF 2 I tried the same method, bur DC are connecting to Monitoring console instead of DS. Why is this behaviour happening.

Nawab · ‎08-11-2024

Thanks for your answer, let me do it and check if it works. Also why are you doing ssl on inputs.conf as per docs it should be done on outsputs of HF

Nawab · ‎08-11-2024

We have below deployement, UF ----> HF ----> IDX Uf are sending data to Hf and Hf is acting as and Intermediatry forwarder between UF and IDX. Now we want to do TLS b/w splunk components. can we do TLS between HF and IDX and leave UFs. Will UF data will also be TLS complient? If not will UF still sends data to IDXs or we will stop receiving logs all together?

Nawab · ‎07-30-2024

The issue in my case is the field i am look at is computername instead of host. below is the deployement. All windows servers ----> forwarder server ----> splunk in splunk host will be forwarder server i.e 1 instead of the backend servers sending data. these queries work on host source sourcetype and index fields.

Nawab · ‎07-29-2024

I have a deployment where multiple computers are sending logs to a WEF server using WEF(windows event forwarding). I tried to map ComputerName field to host name field but failed to do so. Now I want to create an alert if any of the computer is not sending logs to splunk. how can i do so. The method defined by splunk is based on index,host and sourcectype field, which will remain same for all computers in our case.

Nawab · ‎07-23-2024

Hi Manall, I want to use NAS as read storage i.e as cold not hot. BTW its work fine with me till now

Posts	64
Solutions	1
Karma Given	4
Karma Received	3
Member Since	‎04-13-2022

Online Status	Offline
Date Last Visited	‎12-18-2024 06:57 AM

Datamodel replication issue in SHC

Network Error: Connection reset by peer

Error in Pre-deploy check

Splunk internal logs time not correct

SH cluster

Restore frozen data if index is unknown

Deployment client phoning to Management console in...

TLS between splunk components

How to find computers which stopped sending logs

Datamodel field rename

Re: Datamodel replication issue in SHC

Re: Datamodel replication issue in SHC

Re: Datamodel replication issue in SHC

Re: Datamodel replication issue in SHC

Datamodel replication issue in SHC

Re: Splunk ES on SHC notable issue

Network Error: Connection reset by peer

Re: Splunk ES on SHC notable issue

Re: Splunk ES on SHC notable issue

Re: Splunk ES on SHC notable issue

Re: Error in Pre-deploy check

Error in Pre-deploy check

Re: Cannot read properties of undefined (reading '...

Re: Splunk internal logs time not correct

Splunk internal logs time not correct

SH cluster

Restore frozen data if index is unknown

Re: Deployment client phoning to Management consol...

Re: Deployment client phoning to Management consol...

Deployment client phoning to Management console in...

Re: TLS between splunk components

TLS between splunk components

Re: How to find computers which stopped sending lo...

How to find computers which stopped sending logs

Re: Use NAS as cold storage