About mello920

yeahnah · ‎10-20-2022

Hi @youngec Splunk passed me this released fix a few days ago, but I've not had the chance to try it yet. ------------------ The patch for this issue has been released in the following version 8.2.7.2. I have pasted the links below as per the engineering team. https://download.splunk.com/products/splunk/releases/8.2.7.2/linux/splunk-8.2.7.2-394c9ab9e27e-linux-2.6-amd64.deb https://download.splunk.com/products/splunk/releases/8.2.7.2/linux/splunk-8.2.7.2-394c9ab9e27e-linux-2.6-x86_64.rpm https://download.splunk.com/products/splunk/releases/8.2.7.2/linux/splunk-8.2.7.2-394c9ab9e27e-Linux-x86_64.tgz I also want to inform you that Splunk version 8.2.9(sustain/scootaloo) which has the bug fixed will be released in November month. ------------------------- Note, I checked and 8.2.7.2 is not yet up on the Splunk official download site. Check for any potential compatibility issues here: https://docs.splunk.com/Documentation/Splunk/8.2.7/Indexer/Systemrequirements#Splunk_Enterprise_version_compatibility

ChrisW-TX · ‎09-15-2022

I have a similar issue to this, the exact same behavior as above for a Centrify SAML authenticated Splunk instance, however it happens at 15 minutes on the dot whether you're using the session or not. Non-SAML Splunk Web sessions don't have this issue. If you try to do anything in the window as shown above, like refresh, you get an ugly error from the Centrify Connector: Of course we've engaged Centrify/Delinea but they aren't convinced it's not a problem on Splunk side. I've verified Splunk is not restarting and there is no timeout or TTL setting I can find that equates to 15 minutes. Also can't find any events concerning the disconnect in internal Splunk logs or ingested Delinea logs. Unfortunately this behavior makes our users reluctant to rely on the SAML Sessions.

mello920 · ‎05-19-2022

Hello, I have verified that sourcetype=aws:config is being ingested from AWS according to https://docs.splunk.com/Documentation/AWS/6.0.3/User/Topology. Still, nothing shows up under the Topology tab. The troubleshooting documentation references this: check that the Config: Topology Data Generator saved search is enabled I've looked for this saved search and it doesn't exist. I found other references on the Community saying that the Topology Data Generator search isn't found. Is that an error on Splunk's part for putting that in the documentation or am I missing something? Any help is greatly appreciated! V/r, mello920

Siddharth · ‎05-17-2022

I would suggest to create a new dashboard without any JS and CSS and check if it is happening in that new dashboard as well. If you don't mind can you also share the XML code for this

isoutamo · ‎05-06-2022

Good to find the real root cause. FYI: there are one another same kind of MC issue on 8.1.9 Monitoring Console issues where it shows some values as N/A instead of correct ones. r. Ismo

gcusello · ‎05-05-2022

Hi @mello920, good for you, please accept one answer for the other people of Community (also your one!) Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated by all the Contributors 😉

mello920 · ‎05-05-2022

Figured it out after getting Splunk OnDemand Support. Our WAF in the F5 was blocking all the Rest API Calls. Once we had our network engineer make an exception to policy, the error went away. Can create/clone dashboards again.

mello920 · ‎04-14-2022

So figured it out! In my attempts to upgrade the SH (no Splunk experience lol), I thought I needed to update the Pass4SymmKey on all three servers (SH, Idx, HF). Didn't know that each UF in each Windows/Linux box has a similar configuration setup in terms of directories like the main servers. Realized that they also use the Pass4SymmKey. So uninstalled/reinstalled the UFs. I can see them all now in Forwarder Management. Thank you though!!!