Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Mfmahdi
Mfmahdi
Path Finder
Member since:
02-14-2023
05-18-2025
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 02-14-2023 |
Activity Feed
- Karma Re: Why am I getting Invalid key in stanza [clustermaster:one] for ITWhisperer. 05-19-2025 02:33 AM
- Karma Re: Why am I getting Invalid key in stanza [clustermaster:one] for isoutamo. 05-19-2025 02:33 AM
- Karma Re: KV Store initialization has been not completed yet in SHC for livehybrid. 05-18-2025 01:58 AM
- Posted Re: KV Store initialization has been not completed yet in SHC on Getting Data In. 04-28-2025 10:53 PM
- Posted KV Store initialization has been not completed yet in SHC on Getting Data In. 04-28-2025 01:47 AM
- Posted Why am I getting Invalid key in stanza [clustermaster:one] on Installation. 04-21-2024 04:58 AM
- Tagged Why am I getting Invalid key in stanza [clustermaster:one] on Installation. 04-21-2024 04:58 AM
- Posted How to drop specific lines from an event not the whole event on Getting Data In. 03-04-2024 08:00 AM
- Posted How to make the Palo Alto App work on Getting Data In. 11-13-2023 02:31 AM
- Posted Re: How to create a dashboard to show the use activity on Dashboards & Visualizations. 08-20-2023 05:31 AM
- Posted Re: How to create a dashboard to show the use activity on Dashboards & Visualizations. 08-14-2023 03:31 AM
- Posted Re: How to create a dashboard to show the use activity on Dashboards & Visualizations. 08-14-2023 01:18 AM
- Posted How to create a dashboard to show the use activity on Dashboards & Visualizations. 08-13-2023 06:48 AM
- Karma Re: Getting an Error setting up Clustering for thambisetty. 07-18-2023 03:22 AM
- Posted Re: Bad regex value on Splunk Enterprise. 07-17-2023 12:09 AM
- Posted Re: Bad regex value on Splunk Enterprise. 07-16-2023 06:13 AM
- Posted Re: Bad regex value on Splunk Enterprise. 07-16-2023 02:45 AM
- Posted Bad regex value on Splunk Enterprise. 07-16-2023 02:44 AM
- Posted Re: Access Splunk from different Vlan on Splunk Enterprise. 04-11-2023 06:37 AM
- Posted Is it possible to access Splunk from different Vlan? on Splunk Enterprise. 04-10-2023 07:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-28-2025
10:53 PM
Hi livehybrid, Thank you for pointing that out to me. Regarding your suggested solution. It was very helpful. I checked the mongod.log using the following command: tail -n 200 $SPLUNK_HOME/var/log/splunk/mongod.log The output clearly showed the issue: 2025-03-27T10:16:32.087Z W NETWORK [main] Server certificate has no compatible Subject Alternative Name. This may prevent TLS clients from connecting
2025-03-27T10:16:32.087Z F NETWORK [main] The provided SSL certificate is expired or not yet valid.
2025-03-27T10:16:32.087Z F - [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager_openssl.cpp 1182
2025-03-27T10:16:32.087Z F - [main]
***aborting after fassert() failure It turned out that the server SSL certificate had expired. Here are the steps I took to resolve the issue: 1- Backed up the existing certificate: cp $SPLUNK_HOME/etc/auth/server.pem $SPLUNK_HOME/etc/auth/server.pem.bak 2- Generated a new self-signed certificate: splunk createssl server-cert -d $SPLUNK_HOME/etc/auth -n server (This creates a new server.pem valid for 2 years.) 3- restart splunk ./splunk restart 4- Verified KV Store status: splunk show kvstore-status #####Note for Search Head Cluster#### Since we’re running a SH cluster, I made sure to: Copy the new server.pem to all search head members. Restart Splunk on each node. These steps fully resolved the issue, and the KV Store is now functioning as expected.
... View more
04-28-2025
01:47 AM
Dears,,, The KV Store initialization on our search head cluster was previously working fine. However, unexpectedly, we are now encountering the error: "KV Store initialization has not been completed yet", and the KV Store status shows as "starting." I attempted a rolling restart across the search heads, but the issue persists. Kindly provide your support to resolve this issues @gcusello @woodcock Thank you in advance.
... View more
Labels
- Labels:
-
indexer
04-21-2024
04:58 AM
Dears, kindly support why am I getting Invalid key in stanza [clustermaster:one] in /opt/splunk/etc/apps/org_cluster_search_base/local/server.conf, pass4SymmKey in my search heads cluster i make sure that the same passkey in SHC and the deployer is the same. Thank you
... View more
Labels
- Labels:
-
search head
03-04-2024
08:00 AM
we are getting WAF log and the events are very big we need to drop some lines from the events that has no meaningful value not the whole event. @gcusello thank you in advance.
... View more
Labels
- Labels:
-
data
-
props.conf
-
transforms.conf
11-13-2023
02:31 AM
Dears, kindly, support to make paloalto app to work the logs are coming to environment but the app is not working as you can see in pictures thank you in advance
... View more
Labels
- Labels:
-
data
08-20-2023
05:31 AM
we do have access to all the logs, we have PowerShell , sysmon and linux ... we need to know is any user is uploading file through PowerShell or sysmon or any data source that usually the SOC can monitor. we need to create a dashboard that shows any files activity @ITWhisperer thank you in advance
... View more
08-14-2023
03:31 AM
I 'm not allowed to search any logs. but what we are looking for is a dashboard that show is any user is uploading files in our environment @ITWhisperer
... View more
08-14-2023
01:18 AM
we logs from linux and windows but most of our servers they are linux @ITWhisperer
... View more
08-13-2023
06:48 AM
How to create a dashboard to show the activities of the users specially uploading files. Kindly
... View more
Labels
- Labels:
-
dashboard
07-16-2023
02:44 AM
Hi there Every time when I restart my indexers I'm getting what you see in the attachment and this goes for all my 12 indexers how this can be fixed and the fix should be done from manage node or for each indexer can any one help please thanks in advance
... View more
Labels
- Labels:
-
installation
-
troubleshooting
04-10-2023
07:21 AM
Our Splunk environment is working specific vlan our management want to have to Splunk moved to out of band management or move some management servers of Splunk to different vlan and access the management servers through ssh by using out band management is this can be Done?
Thank you in advance
... View more
Labels
- Labels:
-
using Splunk Enterprise
02-15-2023
01:42 AM
Thanks you are a start. it worked
... View more
02-14-2023
10:00 PM
I need to upgrade IBM was add-on I'm getting No spec file as you can see from attached. any one can help how to solve it. Thank you in advance
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-18-2025
01:56 AM
|
