Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About msmadhu
msmadhu
Path Finder
Member since:
08-23-2022
4 weeks ago
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 08-23-2022 |
Activity Feed
- Posted Re: Splunk Remote Upgrader for Linux Universal Forwarders from Deployment Server on Deployment Architecture. 4 weeks ago
- Posted Re: Splunk Remote Upgrader for Linux Universal Forwarders from Deployment Server on Deployment Architecture. 4 weeks ago
- Posted Re: Splunk Remote Upgrader for Linux Universal Forwarders from Deployment Server on Deployment Architecture. 4 weeks ago
- Posted Re: Splunk Remote Upgrader for Linux Universal Forwarders from Deployment Server on Deployment Architecture. 09-24-2025 05:12 AM
- Posted Splunk Remote Upgrader for Linux Universal Forwarders from Deployment Server on Deployment Architecture. 09-23-2025 08:06 AM
- Posted Splunk Deployment Servers Clustering on Splunk Enterprise. 04-02-2025 06:28 AM
- Tagged Splunk Deployment Servers Clustering on Splunk Enterprise. 04-02-2025 06:28 AM
- Karma Re: Privilege checks for Script for muhammad_luthfi. 04-02-2025 06:22 AM
- Karma Re: Privilege checks for Script for muhammad_luthfi. 04-02-2025 06:22 AM
- Karma Re: Privilege checks for Script for PickleRick. 04-02-2025 06:22 AM
- Karma Re: Privilege checks for Script for isoutamo. 04-02-2025 06:22 AM
- Karma Re: Privilege checks for Script for muhammad_luthfi. 04-02-2025 06:22 AM
- Karma Re: Deployment server for gcusello. 04-02-2025 06:21 AM
- Posted Re: SSL certification configuration on Splunk HF on Splunk Enterprise. 02-26-2025 11:53 AM
- Posted SSL certification configuration on Splunk HF on Splunk Enterprise. 02-26-2025 10:59 AM
- Posted Re: Privilege checks for Script on Splunk Enterprise. 01-27-2025 03:29 AM
- Posted Re: Privilege checks for Script on Splunk Enterprise. 01-26-2025 09:27 PM
- Posted Re: Privilege checks for Script on Splunk Enterprise. 01-24-2025 08:08 AM
- Posted Re: Privilege checks for Script on Splunk Enterprise. 01-24-2025 07:56 AM
- Posted Privilege checks for Script on Splunk Enterprise. 01-24-2025 05:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
4 weeks ago
Hi @livehybrid Could u plz help on the fix, splunk_updater_launcher.sh[2216934]: /opt/splunkupgrader/bin/splunk_updater_launcher.sh: line 14: SPLUNK_HOME: unbound variable systemd[1]: splunk-upgrader.service: Main process exited, code=exited, status=1/FAILURE systemd[1]: splunk-upgrader.service: Failed with result 'exit-code'. systemd[1]: splunk-upgrader.service: Service RestartSec=100ms expired, scheduling restart. systemd[1]: splunk-upgrader.service: Scheduled restart job, restart counter is at 5. systemd[1]: Stopped Splunk Upgrader daemon that monitors for new UF packages to upgrade to. systemd[1]: splunk-upgrader.service: Start request repeated too quickly. systemd[1]: splunk-upgrader.service: Failed with result 'exit-code'. systemd[1]: Failed to start Splunk Upgrader daemon that monitors for new UF packages to upgrade to.
... View more
4 weeks ago
tail -15f upgrade.log 2025-12-01-11:11:00 INFO Checking insensitive config: MONITOR_PKG_INTERVAL_SEC= 2025-12-01-11:11:00 INFO Checking insensitive config: FWD_UPGRADE_TIMEOUT_SEC= 2025-12-01-11:11:00 INFO Checking insensitive config: FWD_UPGRADE_MAX_RETRY= 2025-12-01-11:11:00 INFO Checking insensitive config: ROTATE_HISTORY_LOG_DAYS= 2025-12-01-11:11:00 INFO Checking sensitive config: SPLUNK_UPDATER_USER= 2025-12-01-11:11:00 INFO Checking sensitive config: SPLUNK_UPDATER_GROUP= 2025-12-01-11:11:01 INFO Checking insensitive config: SPLUNK_HOME=/opt/splunkforwarder 2025-12-01-11:11:01 INFO Validating config SPLUNK_HOME=/opt/splunkforwarder
... View more
4 weeks ago
Hi @livehybrid ● splunk-upgrader.service - Splunk Upgrader daemon that monitors for new UF packages to upgrade to Loaded: loaded (/etc/systemd/system/splunk-upgrader.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Mon 2025-12-01 11:11:01 UTC; 40s ago Process: 2011130 ExecStart=/opt/splunkupgrader/bin/splunk_updater_launcher.sh (code=exited, status=1/FAILURE) Main PID: 2011130 (code=exited, status=1/FAILURE) Dec 01 11:11:01 xyz systemd[1]: splunk-upgrader.service: Service RestartSec=100ms expired, scheduling restart. Dec 01 11:11:01 xyz systemd[1]: splunk-upgrader.service: Scheduled restart job, restart counter is at 5. Dec 01 11:11:01 xyz systemd[1]: Stopped Splunk Upgrader daemon that monitors for new UF packages to upgrade to. Dec 01 11:11:01 xyz systemd[1]: splunk-upgrader.service: Start request repeated too quickly. Dec 01 11:11:01 xyz systemd[1]: splunk-upgrader.service: Failed with result 'exit-code'. Dec 01 11:11:01 xyz systemd[1]: Failed to start Splunk Upgrader daemon that monitors for new UF packages to upgrade to. drwxrwxrwx. 7 splunkupgrader splunkupgrader 88 May 23 2025 splunkupgrader 2025-12-01-11:14:57 Found files in /opt/splunkforwarder/etc/apps/splunk_app_uf_remote_upgrade_linux/bin/../local/packages. Will deliver them. 2025-12-01-11:14:57 Conf file from UF updater does not exist at "/opt/splunkupdater/info". The UF updater is likely not installed or running. 2025-12-01-11:14:57 Cancelling package delivery and waiting for next interval.
... View more
09-24-2025
05:12 AM
Hi @livehybrid Pushed UF upgrade files from Deployment server to UF and same files are reflecting in UF, but not upgraded No, service is not running, systemctl status splunk-upgrader.service Unit splunk-upgrader.service could not be found. UF: [root@xyz apps]# tree splunk_app_uf_remote_upgrade_linux/ splunk_app_uf_remote_upgrade_linux/ ├── bin │ ├── pkg_delivered │ └── SPLUNK_UPDATER_INTERNAL_deliver_pkg.sh ├── default │ ├── app.conf │ ├── inputs.conf │ ├── local_config │ └── packages │ ├── splunk-upgrader-linux-102.tgz │ └── splunk-upgrader-linux-102.tgz.sig ├── local │ ├── app.conf │ └── packages │ ├── checksums.txt │ ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz │ ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sha512 │ └── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sig ├── metadata │ └── local.meta └── VERSION 6 directories, 14 files /opt/splunkforwarder/bin/splunk version Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk:splunk /opt/splunkforwarder" Splunk Universal Forwarder 9.4.2 (build e9664af3d956)
... View more
09-23-2025
08:06 AM
We are attempting to upgrade Splunk Universal Forwarders using the UF Remote Upgrade Add-on. As per Splunk documentation, we have installed the add-on, placed the required upgrade packages in the appropriate directories and pushed the app to the target clients via the Deployment Server. However, the upgrade is not taking place and we are seeing the following error in the log file located at /opt/splunk/var/log/splunk/upgrader_package_delivery.log: Error log from /opt/splunk/var/log/splunk/upgrader_package_delivery.log 2025-09-22-14:22:10 Conf file from UF updater does not exist at "/opt/splunk/var/run/splunk/splunkupdater/info". The UF updater is likely not installed or running. 2025-09-22-14:22:10 Cancelling package delivery and waiting for next interval. 2025-09-22-14:23:10 Checking if any forwarder packages are available 2025-09-22-14:23:10 Found files in /opt/splunk/etc/deployment_apps/splunk_app_uf_remote_upgrade_linux/bin/../local/packages. Will deliver them. splunk_app_uf_remote_upgrade_linux/ ├── bin │ └── SPLUNK_UPDATER_INTERNAL_deliver_pkg.sh ├── default │ ├── app.conf │ ├── inputs.conf │ ├── local_config │ └── packages │ ├── splunk-upgrader-linux-102.tgz │ └── splunk-upgrader-linux-102.tgz.sig ├── local │ ├── app.conf │ ├── local_config.bkp │ └── packages │ ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz │ ├── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sha512 │ └── splunkforwarder-10.0.0-e8eb0c4654f8-linux-amd64.tgz.sig ├── metadata │ └── local.meta └── VERSION Note: Splunk enterprise is running with version 10.0.0 and UF is running with 9.4.2
... View more
Labels
- Labels:
-
forwarder management
04-02-2025
06:28 AM
Hi Please assist how to build Splunk deployment servers clustering with minimum requirement.
... View more
- Tags:
- clustering
Labels
- Labels:
-
configuration
02-26-2025
11:53 AM
As I mentioned, I already have the sslcertificate.pem file and have followed the steps outlined in the section 'Install and configure certificates on the Splunk Enterprise management port", but not working.
... View more
02-26-2025
10:59 AM
I have an SSL certificate .pem provided by my organization and I need to configure it in Splunk HF. Please assist with any document referrals or steps. I have already gone through the Splunk documentation below but had no luck https://docs.splunk.com/Documentation/Splunk/9.4.0/Security/ConfigureandinstallcertificatesforLogObserver
... View more
Labels
- Labels:
-
configuration
01-27-2025
03:29 AM
Selinux alerts is disabled and not getting on second point. But when i comment #NoNewPrivileges=Yes line from file /etc/systemd/system/SplunkForwarder.service. It will work. But not sure why Splunk service privilege is stoping this.
... View more
01-26-2025
09:27 PM
Yes, script is woking with "splunk cmd" also splunk cmd ./crio_simple_ps.sh
... View more
01-24-2025
08:08 AM
Yes, am getting output for below commands, sudo /usr/bin/crictl ps -a splunk cmd sudo /usr/bin/crictl ps -a
... View more
01-24-2025
07:56 AM
Yes, my script is working with sudo only below script for reference #!/bin/bash # Set the working directory to the script's directory cd "$(dirname "$0")" || exit 1 # Full paths for commands CRICTL_PATH="/usr/bin/crictl" # Adjust the path if necessary # Get container list container_list=$(sudo "$CRICTL_PATH" ps -a) echo "$container_list" | sed '1s/POD ID/POD_ID/g' IFS=$'\n' for container_info in $(echo "$container_list" | tail -n +2); do container_id=$(echo "$container_info" | awk '{print $1}') container_name=$(echo "$container_info" | awk '{print $4}') done ############## cat /etc/sudoers.d/splunk splunk ALL=(ALL) NOPASSWD: /usr/bin/crictl,/usr/bin/podman
... View more
01-24-2025
05:44 AM
Hello, team I've made script, which uses the sudo command. I've deployed it on my forwarders and I get the error: message from "/opt/splunkforwarder/etc/apps/app/bin/script.sh" sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges? Please help to fix this issue.
... View more
Labels
- Labels:
-
using Splunk Enterprise
03-13-2024
02:26 AM
Hi @kiran_panchavat , could you please help me on this...!!
... View more
03-08-2024
12:23 AM
@mochocki @jkat54 @kiran_panchavat need your assistance here.
... View more
03-07-2024
10:38 PM
Hi @kiran_panchavat , Thank you for your valuable response. Which input do I need to provide to collect the status of "App Services"? Options: Azure Metrics Azure Resource Azure Audit
... View more
03-07-2024
08:59 AM
Hi I am attempting to integrate Microsoft Azure with Splunk Enterprise to retrieve the status of App services. Could someone please provide a step-by-step guide for the integration? I have attached a snapshot for reference.
... View more
Labels
- Labels:
-
development
08-25-2022
03:17 AM
Hi All, How to Monitor Ping Status of Linux and Windows Servers in Splunk Enterprises.? Is there any Splunk supported Addon or script available ? Kindly help me on this. Thanks and Regards, Madhu M S
... View more
Labels
08-23-2022
06:46 PM
Hi @richgalloway , Thank you for your time. I have already gone through the link below and installed the "Metrics Add-on for Infrastructure" application in our stand alone Splunk Enterprise. Now trying to collect CPU, memory, process and etc. Metrics from client servers I already have Splunk Forward installed on it. So what are the configuration changes to be done on Splunk Forward Server as well as in Splunk Enterprise.
... View more
08-23-2022
10:43 AM
Hi All,
How to configure "Metrics add on for Infrastructure" application in Splunk enterprise as well in Splunk forwarder server? Appreciate if anyone can help on this.
... View more
- Tags:
- Linux Metrics
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
4 weeks ago
|
Karma given to
