About jmrubio

jmrubio · ‎08-12-2024

So this issue was being caused by an fapolicyd deny all rule. Once I moved the rule out of the /etc/fapolicyd/rules.d, it let me upgrade Splunk.

jmrubio · ‎08-12-2024

Hello! I am trying to upgrade to the latest version of Splunk Enterprise 9.3 on a RHEL 8 server, but I am getting this error message after accepting the license. Any one seen this error? I have checked the permissions, and they are all fine. Thanks! Fatal Python error: init_fs_encoding: failed to get the Python codec of the filesystem encoding Python runtime state: core initialized Traceback (most recent call last): File "<frozen importlib._bootstrap>", line 1007, in _find_and_load File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 680, in _load_unlocked File "<frozen importlib._bootstrap_external>", line 846, in exec_module File "<frozen importlib._bootstrap_external>", line 982, in get_code File "<frozen importlib._bootstrap_external>", line 1039, in get_data PermissionError: [Errno 1] Operation not permitted: '/opt/splunk/lib/python3.9/encodings/__init__.py'

jmrubio · ‎03-01-2024

I am having trouble clearing a STIG that requires file permissions, ownership, and group membership of system files and commands match the vendor values. It is hitting on pretty much all of the splunk files, but I am not sure what it means when it says it has to match the vendor values. Any help is much appreciated!

jmrubio · ‎02-13-2024

@richgalloway So I just have to create an index wit the same name on the indexers?

jmrubio · ‎02-13-2024

Hello! I am trying to send data to Splunk using UDP, I tried to set it up using the documentation and seen a few videos on how to set it up but can't get it right. I have the data coming into my HF from network devices and then should be sent to my indexers. After going through the set up I get this error message "Search peer splunk_indexer_02 has the following message: Received event for unconfigured/disabled/deleted index=<index> with source="source::udp:514" host="host::xx.xx.xx.xx" sourcetype="sourcetype::<sourcetype>. So far received events from 2 missing index(es)." I created a new index during the set up but there is no data to search.

jmrubio · ‎02-09-2024

I have to work with what I have so it's going from the hf to the indexers. Thanks for the response @gcusello !!

jmrubio · ‎02-09-2024

Hello! I am trying to send syslogs to splunk from network devices using udp. I have one heavy forwarder and two indexers, does it matter which indexer i set up to listen for the data?

jmrubio · ‎02-07-2024

I will try this out. Thanks!

jmrubio · ‎02-07-2024

@richgalloway Is there any way to not have to use a separate syslog server?

jmrubio · ‎02-07-2024

Hello! I wanted to ask what is the best way/configuration to get network device logs directly into splunk? Thanks in advance!

jmrubio · ‎10-23-2023

Three years later and this worked! Thanks!!

jmrubio · ‎09-18-2023

Is that the only way to get the data in? This is a production server and I don't think I will be able to disable/stop firewalld.

jmrubio · ‎09-18-2023

Hello @gcusello, I tried ss -na | grep 8000 and it returned: tcp LISTEN 0 128 *:8000 *:*

jmrubio · ‎09-18-2023

Hello @isoutamo , Sorry for the late response. So in the splunkd.logs all of the messages are - WARN TcpOutputProc [16779 indexerPipe] - The TCP output processor has paused the data flow. Forwarding to host_dest=<IP> inside output group default-autolb-group from host_src=Splunk_Heavy_Forwarder has been blocked for blocked_seconds=355350. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. And the last message in the splunkd_access.log is from June : ( I am trying to connect to the HF through the web, and the cURL command returned a 303 error "The resource has moved temporarily"

jmrubio · ‎09-13-2023

Hello @gcusello, Firewalld is running, and I do not see anything disabling web interface in server.conf. The "trustedIP" is commented out, but I do not know if that matters.

jmrubio · ‎09-13-2023

I am getting a 500 internal server error when I try to connect to the HF GUI. I ran firewall-cmd --list-ports, and it shows 8000/tcp. I also checked web.conf, and it shows enableSplunkWebSSL = 1, as well as httport = 8000. What else can I check? I appreciate the help in advance!

Posts	16
Solutions	1
Karma Given	7
Karma Received	0
Member Since	‎07-31-2023

Online Status	Offline
Date Last Visited	‎01-30-2025 09:35 AM

Error installing Splunk 9.3 on RHEL 8 server

STIG requires file permissions, ownership, and gro...

UDP data input

Which indexer should I send data to?

Network device logs

Why Can't I connect to heavy forwarder GUI?

Re: Error installing Splunk 9.3 on RHEL 8 server

Error installing Splunk 9.3 on RHEL 8 server

STIG requires file permissions, ownership, and gro...

Re: UDP data input

UDP data input

Re: Which indexer should I send data to?

Which indexer should I send data to?

Re: Network device logs

Re: Network device logs

Network device logs

Re: kvstore certificate renewal is not working...

Re: Can't connect to heavy forwarder GUI

Re: Can't connect to heavy forwarder GUI

Re: Can't connect to heavy forwarder GUI

Re: Can't connect to heavy forwarder GUI

Why Can't I connect to heavy forwarder GUI?

Join the Conversation