About msmadhu

msmadhu · ‎09-24-2025

Hi @livehybrid Pushed UF upgrade files from Deployment server to UF and same files are reflecting in UF, but not upgraded No, service is not running, systemctl status splunk-upgrader.service Unit splunk-upgrader.service could not be found. UF: [root@xyz apps]# tree splunk_app_uf_remote_upgrade_linux/ splunk_app_uf_remote_upgrade_linux/ ├── bin │ ├── pkg_delivered │ └── SPLUNK_UPDATER_INTERNAL_deliver_pkg.sh ├── default │ ├── app.conf │ ├── inputs.conf │ ├── local_config │ └── packages │ ├── splunk-upgrader-linux-102.tgz │ └── splunk-upgrader-linux-102.tgz.sig ├── local │ ├── app.conf │ └── packages │ ├── checksums.txt │ ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz │ ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sha512 │ └── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sig ├── metadata │ └── local.meta └── VERSION 6 directories, 14 files /opt/splunkforwarder/bin/splunk version Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk:splunk /opt/splunkforwarder" Splunk Universal Forwarder 9.4.2 (build e9664af3d956)

msmadhu · ‎09-23-2025

We are attempting to upgrade Splunk Universal Forwarders using the UF Remote Upgrade Add-on. As per Splunk documentation, we have installed the add-on, placed the required upgrade packages in the appropriate directories and pushed the app to the target clients via the Deployment Server. However, the upgrade is not taking place and we are seeing the following error in the log file located at /opt/splunk/var/log/splunk/upgrader_package_delivery.log: Error log from /opt/splunk/var/log/splunk/upgrader_package_delivery.log 2025-09-22-14:22:10 Conf file from UF updater does not exist at "/opt/splunk/var/run/splunk/splunkupdater/info". The UF updater is likely not installed or running. 2025-09-22-14:22:10 Cancelling package delivery and waiting for next interval. 2025-09-22-14:23:10 Checking if any forwarder packages are available 2025-09-22-14:23:10 Found files in /opt/splunk/etc/deployment_apps/splunk_app_uf_remote_upgrade_linux/bin/../local/packages. Will deliver them. splunk_app_uf_remote_upgrade_linux/ ├── bin │ └── SPLUNK_UPDATER_INTERNAL_deliver_pkg.sh ├── default │ ├── app.conf │ ├── inputs.conf │ ├── local_config │ └── packages │ ├── splunk-upgrader-linux-102.tgz │ └── splunk-upgrader-linux-102.tgz.sig ├── local │ ├── app.conf │ ├── local_config.bkp │ └── packages │ ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz │ ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sha512 │ └── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sig ├── metadata │ └── local.meta └── VERSION Note: Splunk enterprise is running with version 10.0.0 and UF is running with 9.4.2

msmadhu · ‎04-02-2025

Hi Please assist how to build Splunk deployment servers clustering with minimum requirement.

msmadhu · ‎02-26-2025

As I mentioned, I already have the sslcertificate.pem file and have followed the steps outlined in the section 'Install and configure certificates on the Splunk Enterprise management port", but not working.

msmadhu · ‎02-26-2025

I have an SSL certificate .pem provided by my organization and I need to configure it in Splunk HF. Please assist with any document referrals or steps. I have already gone through the Splunk documentation below but had no luck https://docs.splunk.com/Documentation/Splunk/9.4.0/Security/ConfigureandinstallcertificatesforLogObserver

msmadhu · ‎01-27-2025

Selinux alerts is disabled and not getting on second point. But when i comment #NoNewPrivileges=Yes line from file /etc/systemd/system/SplunkForwarder.service. It will work. But not sure why Splunk service privilege is stoping this.

msmadhu · ‎01-26-2025

Yes, script is woking with "splunk cmd" also splunk cmd ./crio_simple_ps.sh

msmadhu · ‎01-24-2025

Yes, am getting output for below commands, sudo /usr/bin/crictl ps -a splunk cmd sudo /usr/bin/crictl ps -a

msmadhu · ‎01-24-2025

Yes, my script is working with sudo only below script for reference #!/bin/bash # Set the working directory to the script's directory cd "$(dirname "$0")" || exit 1 # Full paths for commands CRICTL_PATH="/usr/bin/crictl" # Adjust the path if necessary # Get container list container_list=$(sudo "$CRICTL_PATH" ps -a) echo "$container_list" | sed '1s/POD ID/POD_ID/g' IFS=$'\n' for container_info in $(echo "$container_list" | tail -n +2); do container_id=$(echo "$container_info" | awk '{print $1}') container_name=$(echo "$container_info" | awk '{print $4}') done ############## cat /etc/sudoers.d/splunk splunk ALL=(ALL) NOPASSWD: /usr/bin/crictl,/usr/bin/podman

msmadhu · ‎01-24-2025

Hello, team I've made script, which uses the sudo command. I've deployed it on my forwarders and I get the error: message from "/opt/splunkforwarder/etc/apps/app/bin/script.sh" sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges? Please help to fix this issue.

msmadhu · ‎03-13-2024

Hi @kiran_panchavat , could you please help me on this...!!

msmadhu · ‎03-08-2024

@mochocki @jkat54 @kiran_panchavat need your assistance here.

msmadhu · ‎03-07-2024

Hi @kiran_panchavat , Thank you for your valuable response. Which input do I need to provide to collect the status of "App Services"? Options: Azure Metrics Azure Resource Azure Audit

msmadhu · ‎03-07-2024

Hi I am attempting to integrate Microsoft Azure with Splunk Enterprise to retrieve the status of App services. Could someone please provide a step-by-step guide for the integration? I have attached a snapshot for reference.

msmadhu · ‎08-25-2022

Hi All, How to Monitor Ping Status of Linux and Windows Servers in Splunk Enterprises.? Is there any Splunk supported Addon or script available ? Kindly help me on this. Thanks and Regards, Madhu M S

msmadhu · ‎08-23-2022

Hi @richgalloway , Thank you for your time. I have already gone through the link below and installed the "Metrics Add-on for Infrastructure" application in our stand alone Splunk Enterprise. Now trying to collect CPU, memory, process and etc. Metrics from client servers I already have Splunk Forward installed on it. So what are the configuration changes to be done on Splunk Forward Server as well as in Splunk Enterprise.

msmadhu · ‎08-23-2022

Hi All, How to configure "Metrics add on for Infrastructure" application in Splunk enterprise as well in Splunk forwarder server? Appreciate if anyone can help on this.

Posts	18
Solutions	0
Karma Given	7
Karma Received	0
Member Since	‎08-23-2022

Online Status	Offline
Date Last Visited	3 weeks ago

Splunk Remote Upgrader for Linux Universal Forward...

Splunk Deployment Servers Clustering

SSL certification configuration on Splunk HF

Privilege checks for Script

Microsoft Azure App Service integration with Splun...

How to Monitor Ping Status of Linux and Windows Se...

How to configure Metrics add on for infrastructure...

Re: Splunk Remote Upgrader for Linux Universal For...

Splunk Remote Upgrader for Linux Universal Forward...

Splunk Deployment Servers Clustering

Re: SSL certification configuration on Splunk HF

SSL certification configuration on Splunk HF

Re: Privilege checks for Script

Re: Privilege checks for Script

Re: Privilege checks for Script

Re: Privilege checks for Script

Privilege checks for Script

Re: Microsoft Azure App Service integration with S...

Re: Microsoft Azure App Service integration with S...

Re: Microsoft Azure App Service integration with S...

Microsoft Azure App Service integration with Splun...

How to Monitor Ping Status of Linux and Windows Se...

Re: Metrics add on for infrastructure (Linux)

How to configure Metrics add on for infrastructure...

Are you a member of the Splunk Community?