Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Sathish28
Sathish28
Explorer
Member since:
08-29-2024
02-20-2025
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 08-29-2024 |
Activity Feed
- Posted Re: After search Splunk head migration VM to Physical server we are facing the below issue on Reporting. 02-20-2025 04:31 AM
- Posted Re: After search Splunk head migration VM to Physical server we are facing the below issue on Reporting. 02-20-2025 04:15 AM
- Posted Re: After search Splunk head migration VM to Physical server we are facing the below issue on Reporting. 02-20-2025 04:04 AM
- Posted After search Splunk head migration VM to Physical server we are facing the below issue on Reporting. 02-20-2025 03:46 AM
- Posted Splunk reload auth in Search head Error on Splunk Enterprise. 02-12-2025 07:06 AM
- Posted Unable to view Splunk KV store status on Splunk Enterprise. 01-21-2025 03:25 AM
- Posted Splunk Migration from VM box to Physical server v9.0.3 on Splunk Enterprise. 01-20-2025 05:53 AM
- Posted existing Real time alert is not triggering suddenly on Splunk Enterprise. 11-19-2024 07:00 AM
- Posted Re: Splunk Search Head physical server migration from old server to new physical server on Splunk Enterprise. 11-11-2024 03:40 AM
- Posted Splunk Version upgrade 9.0.3 to 9.1.0 on Splunk Enterprise. 11-11-2024 03:35 AM
- Posted Splunk Search Head physical server migration from old server to new physical server on Splunk Enterprise. 11-06-2024 07:15 AM
- Posted Re: After upgrading from 9.0.3 version to 9.1.0 Version facing the below Error (in Cluster Master, Search head) on Splunk Enterprise. 09-03-2024 03:17 AM
- Posted Re: After upgrading from 9.0.3 version to 9.1.0 Version facing the below Error (in Cluster Master, Search head) on Splunk Enterprise. 09-03-2024 01:45 AM
- Posted After upgrading from 9.0.3 version to 9.1.0 Version facing the below Error (in Cluster Master, Search head) on Splunk Enterprise. 09-02-2024 12:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
I changed the details to my email id, but I didn't receive any email after running the below search query in Search Head
... View more
I have logged in as admin User
... View more
for admin role that is enabled should I check all the other role ?
... View more
Recently we migrated Splunk search head from VM to physical machine. Splunk ES Version: 9.0.3 In Splunkd.log We could the below error and warnings ERROR SearchScheduler [3404833 SchedulerThread] - The maximum number of concurrent real-time searches for this user based on their role quota has been reached. ERROR script [3404833 SchedulerThread] - Error in 'sendemail' command: You do not have a role with the capability='run_custom_command' required to run this command='sendemail'. Contact your Splunk administrator to request that this capability be added to your role. WARN DispatchManager [3404833 SchedulerThread] - Search not executed: reason="The maximum number of concurrent real-time searches for this user based on their role quota has been reached." user=****** currenct_concurrency=6 concurrency_limit=6, search_id= "**************" WARN DispatchManager [3404833 SchedulerThread] - Failed to start search for sid="***************". Dropping failedtostart token at path=/apps/splunk/splunk/var/run/splunk/dispatch/********************** to expedite dispatch cleanup.
... View more
Labels
- Labels:
-
data model
-
saved search
-
scheduled search
02-12-2025
07:06 AM
Recently we migrated a server from Virtual Machine to Physical server We use LDAP authentication for user access for Splunk The users were able to login but did not have the same privileges when moved from VM to physical server I am able to login into Splunk Web UI but as a admin I am not able to view with admin privileges, So i tried to run the below command in the search head server ./splunk reload auth I got the below error Authorization Failed: b'<?xml version="1.0" encoding="UTF-8"?>\n<response>\n <messages>\n <msg type="ERROR">You (user=88888888) do not have permission to perform this operation (requires capability: change_authentication).</msg>\n </messages>\n</response>\n' Client is not authorized to perform requested action
... View more
Labels
01-21-2025
03:25 AM
We are migrating the Splunk 9.0.3 Search Head from Virtual box to Physical box. Splunk services were up and running in new Physical box but in Splunk Web UI, I was unable to login using the my authorized credentials and found the below error in Splunkd.log 01-21-2025 05:18:05.218 -0500 ERROR ExecProcessor [3275615 ExecProcessor] - message from "/apps/splunk/splunk/etc/apps/splunk_app_db_connect/bin/server.sh" action=task_server_start_failed error=com.splunk.HttpException: HTTP 503 -- KV Store initialization failed. Please contact your system administrator
... View more
Labels
01-20-2025
05:53 AM
Hi, for Splunk search head component I have copied the configuration files from old Virtual Machine box to New Physical server box . After which I started the Splunk services in new physical box, the Web UI is not loading up and getting the below message Waiting for web server at https://127.0.0.1:8000 to be available................WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details. . Done
... View more
11-19-2024
07:00 AM
Suddenly the real-time alert is not working for Splunk, can anyone help on this how to troubleshoot this issue
... View more
Labels
11-11-2024
03:40 AM
2. Search head must be able to contact CM, indexers and LM could you please tell me where to check the search head is connected with CM, indexers and LM in the existing old server and when we are migrating to the new server where to make the configurations changes to contact CM, indexers and LM
... View more
11-11-2024
03:35 AM
Hi All, I am planning to upgrade Splunk Enterprise app in production Our Splunk Environment has 1 - Cluster master 4 - indexer 1 - deployment server 1- Search Head 1- monitoring console 1- License Master is it possible to have the Search head in 9.0.3 version and the remaining Splunk server to be upgrade to 9.1.0 the search head role is provided to other servers also in our environment
... View more
Labels
11-06-2024
07:15 AM
We have plan to migrate the old physical server to new physical server and the server is a Search Head component in Splunk Environment. for the new physical server we will be receiving new IP address, my query is how to configure new IP to the existing Splunk Server Environment Our Splunk Environment has 1 - Cluster master 4 - indexer 1 - deployment server 1- Search Head 1- monitoring console 1- License Master DR Servers 1 - Search Head 1- Indexer
... View more
Labels
09-03-2024
03:17 AM
Thank you @PickleRick , Changed the master to Manager in Cluster and URi which worked
... View more
09-03-2024
01:45 AM
In Cluster Master : I find the below search splunk btool server list --debug | grep -i local/apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf [clustering] /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf available_sites = site1 /apps/splunk/splunk/etc/system/local/server.conf maintenance_mode = false /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf master_uri = clustermaster:one /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf mode = master /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf multisite = true /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf pass4SymmKey = ************** /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf replication_factor = 2 /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf search_factor = 1 /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf site_replication_factor = origin:1, total:2 /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf site_search_factor = origin:1, total:2 /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf [clustermaster:one] /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf master_uri = https:webaddress:8089 /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf multisite = true /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf pass4SymmKey = ***************** /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf [general] /apps/splunk/splunk/etc/system/local/server.conf pass4SymmKey = **************** /apps/splunk/splunk/etc/system/local/server.conf serverName = webaddress /apps/splunk/splunk/etc/apps/100_gnw_cluster_master_base/local/server.conf site = site1 /apps/splunk/splunk/etc/system/local/server.conf [kvstore] /apps/splunk/splunk/etc/apps/100_gnw_license_master/local/server.conf [license] /apps/splunk/splunk/etc/apps/100_gnw_license_master/local/server.conf master_uri = https:webaddress:8089 /apps/splunk/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_download-trial] /apps/splunk/splunk/etc/system/local/server.conf description = auto_generated_pool_download-trial /apps/splunk/splunk/etc/system/local/server.conf quota = MAX /apps/splunk/splunk/etc/system/local/server.conf slaves = * /apps/splunk/splunk/etc/system/local/server.conf stack_id = download-trial /apps/splunk/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_forwarder] /apps/splunk/splunk/etc/system/local/server.conf description = auto_generated_pool_forwarder /apps/splunk/splunk/etc/system/local/server.conf quota = MAX /apps/splunk/splunk/etc/system/local/server.conf slaves = * /apps/splunk/splunk/etc/system/local/server.conf stack_id = forwarder /apps/splunk/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_free] /apps/splunk/splunk/etc/system/local/server.conf description = auto_generated_pool_free /apps/splunk/splunk/etc/system/local/server.conf quota = MAX /apps/splunk/splunk/etc/system/local/server.conf slaves = * /apps/splunk/splunk/etc/system/local/server.conf stack_id = free /apps/splunk/splunk/etc/system/default/server.conf alert_store = local /apps/splunk/splunk/etc/system/default/server.conf suppression_store = local /apps/splunk/splunk/etc/system/default/server.conf conf_replication_summary.includelist.refine.local = (system|(apps/*)|users(/_reserved)?/*/*)/(local/...|metadata/local.meta) /apps/splunk/splunk/etc/system/local/server.conf [sslConfig] /apps/splunk/splunk/etc/system/local/server.conf sslPassword = *********************** In Deployment Server : I find the below Search /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf [clustering] /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf master_uri = clustermaster:one /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf mode = searchhead /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf [clustermaster:one] /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf master_uri = https://webaddress:8089 /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf multisite = true /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf pass4SymmKey = ************************* /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf [general] /apps/splunk/splunk/etc/system/local/server.conf pass4SymmKey = ************************* /apps/splunk/splunk/etc/system/local/server.conf serverName = webaddress /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf site = site1 /apps/splunk/splunk/etc/system/local/server.conf [kvstore] /apps/splunk/splunk/etc/system/local/server.conf [license] /apps/splunk/splunk/etc/system/local/server.conf master_uri = https://webaddress:8089 /apps/splunk/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_download-trial] /apps/splunk/splunk/etc/system/local/server.conf description = auto_generated_pool_download-trial /apps/splunk/splunk/etc/system/local/server.conf quota = MAX /apps/splunk/splunk/etc/system/local/server.conf slaves = * /apps/splunk/splunk/etc/system/local/server.conf stack_id = download-trial /apps/splunk/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_forwarder] /apps/splunk/splunk/etc/system/local/server.conf description = auto_generated_pool_forwarder /apps/splunk/splunk/etc/system/local/server.conf quota = MAX /apps/splunk/splunk/etc/system/local/server.conf slaves = * /apps/splunk/splunk/etc/system/local/server.conf stack_id = forwarder /apps/splunk/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_free] /apps/splunk/splunk/etc/system/local/server.conf description = auto_generated_pool_free /apps/splunk/splunk/etc/system/local/server.conf quota = MAX /apps/splunk/splunk/etc/system/local/server.conf slaves = * /apps/splunk/splunk/etc/system/local/server.conf stack_id = free /apps/splunk/splunk/etc/system/default/server.conf alert_store = local /apps/splunk/splunk/etc/system/default/server.conf suppression_store = local /apps/splunk/splunk/etc/system/default/server.conf conf_replication_summary.includelist.refine.local = (system|(apps/*)|users(/_reserved)?/*/*)/(local/...|metadata/local.meta) /apps/splunk/splunk/etc/system/local/server.conf [sslConfig] /apps/splunk/splunk/etc/system/local/server.conf sslPassword = *************************
... View more
09-02-2024
12:05 AM
Invalid key in stanza [clustermaster:one] in /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf, line 7: master_uri (value: https://<address>:8089). Invalid key in stanza [clustermaster:one] in /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf, line 8: pass4SymmKey (value: ***************************************). Invalid key in stanza [clustermaster:one] in /apps/splunk/splunk/etc/apps/100_gnw_cluster_search_base/local/server.conf, line 9: multisite (value: true)
... View more
Labels
- Labels:
-
configuration
-
using Splunk Enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-20-2025
09:49 AM
|
