Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About masakazu
masakazu
Explorer
Member since:
02-19-2024
2 weeks ago
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 1 |
| Member Since | 02-19-2024 |
Activity Feed
- Got Karma for Re: Installation of SOAR 8.5 on RHEL 9.4. 2 weeks ago
- Posted Re: Installation of SOAR 8.5 on RHEL 9.4 on Splunk SOAR. 2 weeks ago
- Karma Re: Installation of SOAR 8.5 on RHEL 9.4 for phanTom. 2 weeks ago
- Posted Installation of SOAR 8.5 on RHEL 9.4 on Splunk SOAR. 2 weeks ago
- Tagged Installation of SOAR 8.5 on RHEL 9.4 on Splunk SOAR. 2 weeks ago
- Posted About the login banner in Web.conf on Splunk Enterprise. 01-14-2025 09:42 PM
- Tagged About the login banner in Web.conf on Splunk Enterprise. 01-14-2025 09:42 PM
- Posted Re: About installing Splunk Enterprise Security on Deployment Architecture. 12-05-2024 05:55 PM
- Posted About installing Splunk Enterprise Security on Deployment Architecture. 12-04-2024 11:03 PM
- Tagged About installing Splunk Enterprise Security on Deployment Architecture. 12-04-2024 11:03 PM
- Tagged About installing Splunk Enterprise Security on Deployment Architecture. 12-04-2024 11:03 PM
- Posted Splunk Security Essentials 3.8 failed to start. on Dashboards & Visualizations. 09-05-2024 10:07 PM
- Posted Re: Distributing APP from the deployment server to the index server on Splunk Enterprise. 07-18-2024 07:33 PM
- Karma Re: Distributing APP from the deployment server to the index server for Tom_Lundie. 07-18-2024 07:33 PM
- Posted Distributing APP from the deployment server to the index server on Splunk Enterprise. 07-16-2024 06:45 PM
- Tagged Distributing APP from the deployment server to the index server on Splunk Enterprise. 07-16-2024 06:45 PM
- Posted Re: About maintaining indexes.conf on Deployment Architecture. 04-17-2024 10:09 PM
- Karma Re: About maintaining indexes.conf for gcusello. 04-16-2024 10:05 PM
- Posted About maintaining indexes.conf on Deployment Architecture. 04-14-2024 11:17 PM
- Tagged About maintaining indexes.conf on Deployment Architecture. 04-14-2024 11:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
1 Karma
Thank you for your reply. In my environment, the server is completely isolated from the Internet, and FIPS mode is enabled. I am concerned about issues such as: ・Required packages cannot be downloaded during the installation process. ・Key files may not be usable due to security and encryption requirements related to FIPS compliance. I was therefore looking for any previous cases or success stories of installing Splunk SOAR 8.5 on RHEL 9.4, especially in a similar offline and FIPS-enabled environment. If this turns out to be too difficult, I may proceed with SOAR 7.x, since I have already successfully installed that version in my environment. Thank you for your assistance. Regats, 🐭
... View more
2 weeks ago
I attempted to install SOAR 8.5 on an offline RHEL 9.4 environment, but the installation failed with error messages such as: failed to decode key failed to get decryption key -1 The official documentation only mentions support for RHEL 9, but does not specify minor versions. Has Splunk officially validated SOAR 8.5 on RHEL 9.4? Is it possible to install SOAR 8.5 on RHEL 9.4, or is RHEL 9.4 not supported? Has anyone successfully installed SOAR 8.5 on RHEL 9.4, or encountered similar errors? Any guidance would be greatly appreciated. Thank you.
... View more
- Tags:
- SOAR
Labels
- Labels:
-
installation
01-14-2025
09:42 PM
I set up DoDBanner when logging in by putting the following in Web.conf. It was displayed in Splunk 9.2.1, but it was no longer displayed in Splunk 9.2.2.
$SPLUNK_HOME$\etc\system\local\web.conf
[settings]
login_content = <script>function DoDBanner() {alert("Hello World");}DoDBanner();</script>
Is DoDBanner no longer supported from a certain version?
... View more
- Tags:
- web.conf
12-05-2024
05:55 PM
PickleRick-san gcusello-san Thank you for response. As you pointed out, KVstore did not seem to be working properly. I reinstalled it with Fips-mode turned off and it worked fine. Is it impossible to install SplunkES on a Splunk Server running in Fips-mode?
... View more
12-04-2024
11:03 PM
https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity I installed Splunk Enterprise Security to verify operation, following the above manual, I installed and configured the initial settings. When I opened the incident view in the app's menu bar, an error message appeared saying "An error occurred while loading some filters." When I opened the investigation, an error message appeared saying "Unknown Error: FAiled to fetch KV Store." I can't display the incident review and investigation. Is anyone else experiencing the same issue?
... View more
Labels
- Labels:
-
Windows
09-05-2024
10:07 PM
Hi Splunkers, SplunkEnterprise : 9.2.2 Splunk Security Essentials : 3.8 (and 3.4) I installed Splunk Security Essentials 3.8, but I can’t launch the app due to a Custom JavaScript Error. I tried using an older version of SSE, but it didn’t resolve the issue. And I also enabled the ‘old version’ setting in the internal library, but it still didn’t help. If you know the solution please help........
... View more
Labels
- Labels:
-
javascript
07-18-2024
07:33 PM
Hi, Tom-san! Thank you for the advice. It seems the problem was that the "stateOnClient" setting was also in the app specification. When I removed that setting the error went away. [serverClass:<serverClassName>:app:<AppName>] stateOnClient = noop ←★ restartSplunkWeb = 0 restartsplunkd = 1 [serverClass:<serverClassName>] stateOnClient = noop whitelist.0 = server1 For reference, I would like to know if there is any other setting. As mentioned above, the DS server specifies serverRepositoryLocationPolicy and repositoryLocation for the cluster manager, so the DS-app is saved in manager-app. Is it possible to deploy the APP to the manager?
... View more
07-16-2024
06:45 PM
I'm trying to distribute an app from the deployment server to the index server via the cluster manager. In the cluster manager's deploymentclient.conf, it uses serverRepositoryLocationPolicy and repositoryLocation to receive the app in $SPLUNK_HOME$/etc/manager-apps and pushes it to peer-apps on the index server for distribution. Distribution to the index server was successful, but an install error message appears in the deployment server's internal log. Is there a setting to prevent items distributed to manager-apps from being installed?
... View more
- Tags:
- deployment
Labels
- Labels:
-
configuration
04-17-2024
10:09 PM
Grazie Signor Gcusello! 1. Create an APP with index.con in DS 2. After deploying to the manager, received by manager-app 3. peer received on peer-app. Also, is it standard specification for the manager server to receive data using manager-app? best regards
... View more
04-14-2024
11:17 PM
In an indexed cluster environment, I set the following stanza configuration in the deployment server's serverclass.conf file, but
[Server class: splunk_indexer_master_cluster]
stateOnClient = noop
Whitelist = <ClusterManagerA>
The _cluster folder under manager-app disappeared along with his Indexes.conf inside it. Fortunately, Indexes.conf remained in the cluster's peer app, so this was not a problem. If I want to use stateOnClient = noop, how should I maintain Indexes.conf deployed to the cluster on the cluster master?
... View more
- Tags:
- indexes.conf
Labels
- Labels:
-
indexer
02-19-2024
08:36 PM
I created an index in "manager-app\_cluster\local\indexes.conf" on the cluster master in a cluster environment. The index is now displayed in "peer_apps\_cluster\local\indexes.conf" of the cluster indexer, but I cannot select that index from other servers (deploy or sh's WebUI). Please tell me how to create an index in a cluster environment.
... View more
Labels
- Labels:
-
configuration
