About himaniarora20

himaniarora20 · ‎06-03-2024

I did actually.. Just found out that you need to try with the indexer instead of Search Head. And also, attach an IAM role to your Splunk server, and use the ARN of that same role to attach to your Splunk config.

himaniarora20 · ‎05-16-2024

I am in a bit of a fix right now and getting the below error when I am trying to add a new input to Splunk using this document https://docs.splunk.com/Documentation/AddOns/released/AWS/Setuptheadd-on Note: The Splunk instance is in a different account than the S3 bucket. Error response received from the server: Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [400]: Bad Request -- An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied". See splunkd.log/python.log for more details. I have created an AWS role to allow the user residing in account where my S3 bucket is and the permissions are like below Trust relationship: The user contains s3full access and AssumeRole policy attached to it. Splunk config: The IAM role still shows undiscovered: Are there any changes required at the Splunk instance level in the other account so that it could access the policy? TIA for your help!

himaniarora20 · ‎03-06-2024

Thanks for your reply. But I have a few questions since I am new to this. 1. In which server should I add the custom Add on (Forwarder or DS?) We have hundreds of forwarders pointing to the indexer right now. Do we need to change all of them? 2. And since you are saying I shall remove the already existing files in $SPLUNK_HOME/etc/system/local folder, what shall be the contents of the newly added custom add on files? 3. Also, the indexer discovery feature needs to be installed in the DS right?

himaniarora20 · ‎03-06-2024

Thanks for your reply. But I have a few questions since I am new to this. 1. In which server should I add the custom Add on (Forwarder or DS?) We have hundreds of forwarders pointing to the indexer right now. Do we need to change all of them? 2. And since you are saying I shall remove the already existing files in $SPLUNK_HOME/etc/system/local folder, what shall be the contents of the newly added custom add on files? 3. Also, the indexer discovery feature needs to be installed in the DS right?

himaniarora20 · ‎03-06-2024

Hi Team, We have a search head cluster and indexer cluster in our current Splunk environment. The data to the indexer earlier was provided by multiple forwarders which had the endpoint for the Indexer. Now, since it is a multi-indexer architecture, we need a common point for the forwarder to point the data Please provide suggestions on how to set up the forwarders -> Deployment Server ->Cluster master architecture. I came across this one. But confused with the meaning of deployment client https://community.splunk.com/t5/Deployment-Architecture/How-to-set-up-new-deployment-server-in-a-clustered-environment/m-p/514847 Thanks in advance!

himaniarora20 · ‎11-30-2023

Then what should I do for getting the server up on HTTP?

himaniarora20 · ‎11-30-2023

were you ever able to figure this out? I am facing the same issue

himaniarora20 · ‎11-30-2023

I have tried the steps and created the certificate using these three documents: https://docs.splunk.com/Documentation/Splunk/9.1.2/Security/Howtoself-signcertificates https://docs.splunk.com/Documentation/Splunk/9.1.2/Security/HowtoprepareyoursignedcertificatesforSplunk https://docs.splunk.com/Documentation/Splunk/9.1.2/Security/ConfigureSplunkforwardingtousesignedcertificates web.conf [settings] enableSplunkWebSSL = 1 privKeyPath = /opt/splunk/etc/auth/mycerts/myServerPrivateKey.key serverCert = /opt/splunk/etc/auth/mycerts/myServerCertificate.pem server.conf [sslConfig] enableSplunkdSSL = true sslRootCAPath = /opt/splunk/etc/auth/mycerts/myCertAuthCertificate.pem sslPassword = <encrypted> inputs.conf [default] host = splunkpoc2.company.com [splunktcp-ssl:9997] disabled = 0 [SSL] serverCert = /opt/splunk/etc/auth/mycerts/myServerCertificate.pem sslPassword = $7$UeC5PhW3bITaydrFnqv0+iOwOC+ItQN/CDEZcvtLovDBwTJt requireClientCert = true sslVersions = *,-ssl2 sslCommonNameToCheck = indexerpoc1.company.com,indexerpoc2.company.com Splunk Web comes up correctly but again the HTTP is not getting redirected to https:

himaniarora20 · ‎11-30-2023

I am trying to set up POC for Splunk indexing and the manager node is up, but runs on an HTTP link (Certificate is not there yet) instead of HTTPS. While configuring the peer when I provide the address of master node, I am getting the below error: Is there a way to bypass this or create a dummy certificate for Splunk?

himaniarora20 · ‎11-22-2023

Splunk Enterprise (shows the correct version) automatically redirects to Splunk cloud (Unknown_version) post logging in again. Is there any way to stop this redirect?

himaniarora20 · ‎11-22-2023

@splunk Is there any solution for this?

himaniarora20 · ‎11-20-2023

How to get rid of Splunk UNKNOWN_VERSION on splunk UI. This is happening on all the browsers (Chrome, Edge, Firefox) and clearing the cache does not help Login into splunk and observe version by mouse over on tab Refresh the page it will be shown correctly Now logout and login again Observe version by mouse over on tab. It again shows UNKNOWN_VERSION

himaniarora20 · ‎08-17-2023

How to change the architecture from a single indexer to an indexer cluster with indexer management? I need an overview of what configuration files need to be changed to change the architecture from single to multiple Splunk indexers. This shall also include an indexer manager server.

Posts	13
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎08-17-2023

Online Status	Offline
Date Last Visited	‎09-04-2024 06:31 AM

Getting Access Denied for Splunk Add-on for AWS

How to set a deployment server between Forwarders ...

How to bypass https in peer configuration and use ...

Unknown version is shown on first login and even a...

How to change the architecture from a single index...

Re: Getting Access Denied for Splunk Add-on for AW...

Getting Access Denied for Splunk Add-on for AWS

Re: How to set a deployment server between Forward...