About masakazu

masakazu · ‎09-05-2024

Hi Splunkers, SplunkEnterprise : 9.2.2 Splunk Security Essentials : 3.8 (and 3.4) I installed Splunk Security Essentials 3.8, but I can’t launch the app due to a Custom JavaScript Error. I tried using an older version of SSE, but it didn’t resolve the issue. And I also enabled the ‘old version’ setting in the internal library, but it still didn’t help. If you know the solution please help........

masakazu · ‎07-18-2024

Hi, Tom-san! Thank you for the advice. It seems the problem was that the "stateOnClient" setting was also in the app specification. When I removed that setting the error went away. [serverClass:<serverClassName>:app:<AppName>] stateOnClient = noop　　　←★ restartSplunkWeb = 0 restartsplunkd = 1 [serverClass:<serverClassName>] stateOnClient = noop whitelist.0 = server1 For reference, I would like to know if there is any other setting. As mentioned above, the DS server specifies serverRepositoryLocationPolicy and repositoryLocation for the cluster manager, so the DS-app is saved in manager-app. Is it possible to deploy the APP to the manager?

masakazu · ‎07-16-2024

I'm trying to distribute an app from the deployment server to the index server via the cluster manager. In the cluster manager's deploymentclient.conf, it uses serverRepositoryLocationPolicy and repositoryLocation to receive the app in $SPLUNK_HOME$/etc/manager-apps and pushes it to peer-apps on the index server for distribution. Distribution to the index server was successful, but an install error message appears in the deployment server's internal log. Is there a setting to prevent items distributed to manager-apps from being installed?

masakazu · ‎04-17-2024

Grazie Signor Gcusello! 1. Create an APP with index.con in DS 2. After deploying to the manager, received by manager-app 3. peer received on peer-app. Also, is it standard specification for the manager server to receive data using manager-app? best regards

masakazu · ‎04-14-2024

In an indexed cluster environment, I set the following stanza configuration in the deployment server's serverclass.conf file, but [Server class: splunk_indexer_master_cluster] stateOnClient = noop Whitelist = <ClusterManagerA> The _cluster folder under manager-app disappeared along with his Indexes.conf inside it. Fortunately, Indexes.conf remained in the cluster's peer app, so this was not a problem. If I want to use stateOnClient = noop, how should I maintain Indexes.conf deployed to the cluster on the cluster master?

masakazu · ‎02-19-2024

I created an index in "manager-app\_cluster\local\indexes.conf" on the cluster master in a cluster environment. The index is now displayed in "peer_apps\_cluster\local\indexes.conf" of the cluster indexer, but I cannot select that index from other servers (deploy or sh's WebUI). Please tell me how to create an index in a cluster environment.

Posts	6
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎02-19-2024

Online Status	Offline
Date Last Visited	Monday

Splunk Security Essentials 3.8 failed to start.

Distributing APP from the deployment server to the...

About maintaining indexes.conf

How to create an index for use in a cluster enviro...

Splunk Security Essentials 3.8 failed to start.

Re: Distributing APP from the deployment server to...

Distributing APP from the deployment server to the...

Re: About maintaining indexes.conf

About maintaining indexes.conf

How to create an index for use in a cluster enviro...