About masakazu

masakazu · ‎01-14-2025

I set up DoDBanner when logging in by putting the following in Web.conf. It was displayed in Splunk 9.2.1, but it was no longer displayed in Splunk 9.2.2. $SPLUNK_HOME$\etc\system\local\web.conf [settings] login_content = <script>function DoDBanner() {alert("Hello World");}DoDBanner();</script> Is DoDBanner no longer supported from a certain version?

masakazu · ‎12-05-2024

PickleRick-san gcusello-san Thank you for response. As you pointed out, KVstore did not seem to be working properly. I reinstalled it with Fips-mode turned off and it worked fine. Is it impossible to install SplunkES on a Splunk Server running in Fips-mode?

masakazu · ‎12-04-2024

https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity I installed Splunk Enterprise Security to verify operation, following the above manual, I installed and configured the initial settings. When I opened the incident view in the app's menu bar, an error message appeared saying "An error occurred while loading some filters." When I opened the investigation, an error message appeared saying "Unknown Error: FAiled to fetch KV Store." I can't display the incident review and investigation. Is anyone else experiencing the same issue?

masakazu · ‎09-05-2024

Hi Splunkers, SplunkEnterprise : 9.2.2 Splunk Security Essentials : 3.8 (and 3.4) I installed Splunk Security Essentials 3.8, but I can’t launch the app due to a Custom JavaScript Error. I tried using an older version of SSE, but it didn’t resolve the issue. And I also enabled the ‘old version’ setting in the internal library, but it still didn’t help. If you know the solution please help........

masakazu · ‎07-18-2024

Hi, Tom-san! Thank you for the advice. It seems the problem was that the "stateOnClient" setting was also in the app specification. When I removed that setting the error went away. [serverClass:<serverClassName>:app:<AppName>] stateOnClient = noop　　　←★ restartSplunkWeb = 0 restartsplunkd = 1 [serverClass:<serverClassName>] stateOnClient = noop whitelist.0 = server1 For reference, I would like to know if there is any other setting. As mentioned above, the DS server specifies serverRepositoryLocationPolicy and repositoryLocation for the cluster manager, so the DS-app is saved in manager-app. Is it possible to deploy the APP to the manager?

masakazu · ‎07-16-2024

I'm trying to distribute an app from the deployment server to the index server via the cluster manager. In the cluster manager's deploymentclient.conf, it uses serverRepositoryLocationPolicy and repositoryLocation to receive the app in $SPLUNK_HOME$/etc/manager-apps and pushes it to peer-apps on the index server for distribution. Distribution to the index server was successful, but an install error message appears in the deployment server's internal log. Is there a setting to prevent items distributed to manager-apps from being installed?

masakazu · ‎04-17-2024

Grazie Signor Gcusello! 1. Create an APP with index.con in DS 2. After deploying to the manager, received by manager-app 3. peer received on peer-app. Also, is it standard specification for the manager server to receive data using manager-app? best regards

masakazu · ‎04-14-2024

In an indexed cluster environment, I set the following stanza configuration in the deployment server's serverclass.conf file, but [Server class: splunk_indexer_master_cluster] stateOnClient = noop Whitelist = <ClusterManagerA> The _cluster folder under manager-app disappeared along with his Indexes.conf inside it. Fortunately, Indexes.conf remained in the cluster's peer app, so this was not a problem. If I want to use stateOnClient = noop, how should I maintain Indexes.conf deployed to the cluster on the cluster master?

masakazu · ‎02-19-2024

I created an index in "manager-app\_cluster\local\indexes.conf" on the cluster master in a cluster environment. The index is now displayed in "peer_apps\_cluster\local\indexes.conf" of the cluster indexer, but I cannot select that index from other servers (deploy or sh's WebUI). Please tell me how to create an index in a cluster environment.

Posts	9
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎02-19-2024

Online Status	Online
Date Last Visited	5 hours ago

About the login banner in Web.conf

About installing Splunk Enterprise Security

Splunk Security Essentials 3.8 failed to start.

Distributing APP from the deployment server to the...

About maintaining indexes.conf

How to create an index for use in a cluster enviro...

About the login banner in Web.conf

Re: About installing Splunk Enterprise Security

About installing Splunk Enterprise Security

Splunk Security Essentials 3.8 failed to start.

Re: Distributing APP from the deployment server to...

Distributing APP from the deployment server to the...

Re: About maintaining indexes.conf

About maintaining indexes.conf

How to create an index for use in a cluster enviro...

Join the Conversation