Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nurtdi
nurtdi
Path Finder
Member since:
04-13-2011
07-30-2020
Community Statistics
| Posts | 22 |
| Solutions | 2 |
| Karma Given | 6 |
| Karma Received | 4 |
| Member Since | 04-13-2011 |
Activity Feed
- Karma Re: Why all my scheduled searches have stopped running without any apparent reason? for mzax. 06-05-2020 12:46 AM
- Karma cooked connection timed out? for suhprano. 06-05-2020 12:46 AM
- Karma Re: cooked connection timed out? for Ayn. 06-05-2020 12:46 AM
- Karma Problem logging into splunk for lain179. 06-05-2020 12:46 AM
- Got Karma for get host from fileshare. 06-05-2020 12:46 AM
- Got Karma for Re: What does the warning message mean in forwarder management ?. 06-05-2020 12:46 AM
- Karma How do I suppress web page pop-up when I uninstall Splunk? for hacktastic. 06-05-2020 12:45 AM
- Karma Re: How do I suppress web page pop-up when I uninstall Splunk? for Ed. 06-05-2020 12:45 AM
- Got Karma for Large number of errors processing data from forwarders over SSL. 06-05-2020 12:45 AM
- Got Karma for change indexer - point forwarder to another index server.. 06-05-2020 12:45 AM
- Posted Re: cooked connection timed out? on Getting Data In. 05-13-2019 08:00 AM
- Posted Re: cooked connection timed out? on Getting Data In. 05-13-2019 07:54 AM
- Posted Re: Splunk Universal Forwarder, 8089 management port SSL certificate expired on Getting Data In. 03-31-2017 07:21 AM
- Posted Re: Problem logging into splunk on Security. 07-23-2014 12:04 PM
- Posted Re: Problem logging into splunk on Security. 07-23-2014 11:30 AM
- Posted Re: Problem logging into splunk on Security. 07-23-2014 08:42 AM
- Posted Re: Deployment Server Behind HTTPS Proxy on Deployment Architecture. 04-27-2014 10:07 PM
- Posted Re: What does the warning message mean in forwarder management ? on Deployment Architecture. 04-22-2014 06:52 PM
- Posted Re: cooked connection timed out? on Getting Data In. 08-28-2013 09:04 AM
- Posted Re: cooked connection timed out? on Getting Data In. 05-30-2012 04:51 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 |
05-13-2019
08:00 AM
you can check cert validity and details using openssl:
openssl x509 -enddate -noout -in your_cert.pem
or
echo | openssl s_client -showcerts -connect your_splunk_server:port
... View more
05-13-2019
07:54 AM
please check the documentation: https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/ConfigureSplunkforwardingtousesignedcertificates
... View more
03-31-2017
07:21 AM
I downvoted this post because no solution - not an answer
... View more
07-23-2014
12:04 PM
Yes! I see the issue with AD users.
the search-heads have same error as in original question. and it is not a single server that has an issue.
This search 'index=_* "action=login status=failure" | stats count by user reason date_month date_mday date_wday date_hour host' sorts it out and I can see different users and different hosts with the error - all intermittent.
... View more
04-22-2014
06:52 PM
1 Karma
I have the same issue in Splunk v.6.0.3, "splunk reload deploy-server" and "splunk restart" did not help. As for suggestion: "Have you attempted to restart the splunkforwarder to which the apps are being downloaded?" - there is no easy way to find which forwarder is doing it...
... View more
08-28-2013
09:04 AM
We now manage our splunk distributed search infrastructure with puppet.
To solve the problem I had deleted all search peers from each search head and then re-added them on each.
Here is a snippet from the script to run on search head:
search_peer_list="splunkidx1 splunkidx2"
splunk_pswd="splunkadminpassword"
for indexer_name in ${search_peer_list}
do
${splunk_home}/bin/splunk add search-server -host ${indexer_name}:8089 -auth admin:${splunk_pswd} -remoteUsername admin -remotePassword ${splunk_pswd}
done
... View more
05-30-2012
04:51 PM
found the issue - missing indexer cert
I wish it was easier to find in the forwarder log why connection was timing out...
closing the case. thank you!
... View more
05-30-2012
02:45 PM
Thank you for your response, Ayn. I have both forwarder and receiver to use ssl... and I have done it many times... not sure what is different this time.
I have case opened, will see:
Description: WARN TcpOutputProc - Cooked connection to ip=xx.xx.xx.xx:9992 timed out
forwarder:
-bash-3.2# cat outputs.conf
[tcpout]
defaultGroup = splunkssl-LB
[tcpout:splunkssl-LB]
server = splunk06:9992
compressed = true
[tcpout-server://splunk06:9992]
sslCertPath = $SPLUNK_HOME/etc/certs/forwarder.pem
sslCommonNameToCheck = indexer
sslPassword = xxxxxxxxxxxxxxxx
sslRootCAPath = $SPLUNK_HOME/etc/certs/cacert.pem
sslVerifyServerCert = true
receiver:
# HOST
[default]
host = splunk06
[SSL]
password = xxxxxxxxxxxxxxxxxxx
requireClientCert = true
rootCA = $SPLUNK_HOME/etc/certs/cacert.pem
serverCert = $SPLUNK_HOME/etc/certs/indexer.pem
[splunktcp-ssl://9992]
compressed = true
... View more
05-30-2012
02:18 PM
having the same issue, data is not being forwarded. did you find what was the issue?
... View more
11-22-2011
04:59 AM
Thank you for your answer. Although it did not work...
The solution was quite simple - I just needed to use static host = server1 in each stanza.
Thanks.
... View more
11-21-2011
12:39 PM
1 Karma
Hello,
I have multiple inputs.conf entries
...
[monitor://\\server1\share$\mylog.log]
sourcetype = MYLOG
index = mylog
host_segment = 1
...
this creates host = share$ on index server...
changing to host_segment = 0 did not work.
how can I get hostname out of fileshare (\\server\share$\log)?
please help.
thank you.
... View more
- Tags:
- host_segment
10-11-2011
08:11 AM
did you find an answer? I need to uninstall on 150 servers and I need to disable this...
... View more
10-11-2011
08:07 AM
Did you find an answer? I need to do the same... 150 servers to uninstall. Thanks.
... View more
05-23-2011
09:18 PM
thank you for your help! I still did not get it to work, but I know it is SSL Certs issue now. My typo was in inputs.conf on server B and I simply overlooked an error 'Can't read certificate file'...
... View more
05-23-2011
09:01 PM
Well, it is embarrassing to admit... I had a small typo in inputs.conf
... View more
05-23-2011
07:50 PM
The roles are not defined yet, all done under admin role.
I have generated the SSL certs and keys (really good answer on SSL setup is here: http://splunk-base.splunk.com/answers/7164/how-do-i-set-up-ssl-forwarding-with-new-self-signed-certificates-and-authentication), no errors connecting forwarder to index server (although I suspect the problem might be here somewhere).
thank you, ildus
... View more
05-23-2011
02:16 PM
1 Karma
Hi,
I have one index server "A" and another one "B".
For a while I had few forwarders to send data to "A" (each forwarder data to specific index).
Now, I need to point one of the forwarders (let's call it "C") to "B".
I have added an index of "C" to "B" (same as on "A"), changed "C"'s outputs.conf to send data to "B", restarted both B and C...
I see connection from C to B, but no data is being sent.
To add some complexity - using SSL, so the data is encrypted and compressed.
I cannot find any traces of the problem in the logs, even in debug mode.
If you had been there - Your help is greatly appreciated!
Thank you, ildus
... View more
04-13-2011
08:28 PM
1 Karma
The data is being indexed, but a lot of errors in splunkd.log
this is a snippet of log after running splunk indexer in debug mode:
04-13-2011 15:54:08.135 ERROR TcpInputProc - Error encountered for connection from src=xxx.xxx.xxx.xxx:2744. Success
04-13-2011 15:54:08.135 DEBUG StatusMgr - Updating status for TcpInputProcessor
04-13-2011 15:54:08.135 INFO StatusMgr - destPort=9992, eventType=connect_close, sourceHost=xxx.xxx.xxx.xxx, sourceIp=xxx.xxx.xxx.xxx, sourcePort=2744, statusee= TcpInputProcessor
04-13-2011 15:54:08.135 ERROR TcpInputProc - Error encountered for connection from src=xxx.xxx.xxx.xxx:3473. Success
04-13-2011 15:54:08.135 DEBUG StatusMgr - Updating status for TcpInputProcessor
04-13-2011 15:54:08.135 INFO StatusMgr - destPort=9992, eventType=connect_close, sourceHost=xxx.xxx.xxx.xxx, sourceIp=xxx.xxx.xxx.xxx, sourcePort=3473, statusee= TcpInputProcessor
04-13-2011 15:54:08.342 DEBUG StatusMgr - Updating status for TcpInputProcessor
04-13-2011 15:54:08.342 INFO StatusMgr - destPort=9997, eventType=connect_close, sourceHost=xxx.xxx.xxx.xxx, sourceIp=xxx.xxx.xxx.xxx, sourcePort=61588, statusee=T cpInputProcessor
04-13-2011 15:54:08.399 DEBUG StatusMgr - Updating status for TcpInputProcessor
04-13-2011 15:54:08.553 ERROR TcpInputProc - Error encountered for connection from src=xxx.xxx.xxx.xxx:2575. Success
04-13-2011 15:54:08.553 DEBUG StatusMgr - Updating status for TcpInputProcessor
04-13-2011 15:54:08.553 INFO StatusMgr - destPort=9992, eventType=connect_close, sourceHost=xxx.xxx.xxx.xxx, sourceIp=xxx.xxx.xxx.xxx, sourcePort=2575, statusee= TcpInputProcessor
Thank you,
Ildus
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-30-2020
12:41 PM
|
