About sgarvin55

sgarvin55 · ‎03-09-2017

I wanted to add another gotcha I figured out after running through this answers post. It seems in prior versions to 6.5.2, specifically 6.5.0 and 6.5.1 as tested this worked, but now fails in 6.5.2. Customers had the following setting in their server.conf after upgrade: [sslConfig] sslVersions = "tls" Customers whom upgraded to 6.5.2 found that KVSTORE wouldn't start, but splunkd.log didn't show any syntax issues. Only the mongod.log indicated something was wrong "unknown protocol". splunkd.log INFO loader - Server supporting SSL versions SSL3,TLS1.0,TLS1.1,TLS1.2 mongod.log E NETWORK [conn893] SSL: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol D NETWORK [conn893] SocketException: remote: 127.0.0.1:37578 error: 9001 socket exception [CONNECT_ERROR] Removing the double quotes from "tls" fixed the the above issue. So the correct syntax is now: [sslConfig] sslVersions = tls A bug has been created - SPL-138443

sgarvin55 · ‎02-21-2017

Please open a Splunk Support case and request the SHA-512 bits.

sgarvin55 · ‎02-21-2017

In my research concerning Hashes, the MD5 hash provided on our downloads page is 128bits. For example: 160 bits for SHA-1, 256 bits for SHA-256, 512 bits for SHA-512. How can we obtain the SHA-512 Hash?

sgarvin55 · ‎02-21-2017

Here's a screen shot of the page and were to find the MD5 link. Just do the steps 1. click on free splunk 2. click on uf 3. click on older versions 4. click on download 5. click on download md5 For Splunk 6.5.2 follow this link: https://www.splunk.com/en_us/download/universal-forwarder/thank-you-universalforwarder.html

sgarvin55 · ‎02-21-2017

Splunk publishes the checksum for the MD5 hash via the downloads page for the particular download you requested.

sgarvin55 · ‎10-05-2016

search is always "parsing...." after upgrading to 6.5 from 6.3.2 - SPL-129476 This is actually caused by stale files remaining in cache after the upgrade. If you haven't all ready done so, try clearing browser cache and retry the search. This has helped quite a few customers reporting this issue.

sgarvin55 · ‎02-18-2016

The value that changes the "server name" is under the server.conf file. Changing the name should be done in two places, inputs.conf and server.conf. The "host name" value is taken from the server, when the server was first created or changed at the OS level. There isn't a splunk config file that will change the "host name" value. Second, the data coming from the UF, will have the "server name" when it reaches the indexer and can be searched by host="mlp-da02" as in the example above.

sgarvin55 · ‎01-28-2016

This is a Known Issue SPL-107253 and is fixed in Splunk version 6.3.1

sgarvin55 · ‎06-26-2015

This is a Known Issue, SPL-94913 and fixed in Splunk 6.2.2.

sgarvin55 · ‎03-16-2015

This is most likely because the SSL certificate has been misconfigured. Check your $SPLUNK_HOME\etc\certs\your_name.pem file. Look for a line that resembles the following: -----END CERTIFICATE----------BEGIN CERTIFICATE----- This can cause some serious issues because it cannot be interpreted, as you might have noticed. How to Fix SSL PEM routines:PEM_read_bio:bad end line error To fix this issue, use a text editor of choice and create a line break between the two files, i.e. -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- Tip: Count five hyphens at the start and end of the text. You can now save the file and the error should be fixed!

sgarvin55 · ‎03-16-2015

ERROR SSLCommon - Can't read key file c:\program files\splunkuniversalforwarder\etc\certs\name.pem errno=151441510 error:0906D066:PEM routines:PEM_read_bio:bad end line.

sgarvin55 · ‎07-22-2014

Once the customer got in touch with Microsoft, he was able to narrow it down to the "Dfsr" performance counter using exctrlst.exe (see: http://blogs.technet.com/b/askperf/archive/2010/03/05/two-minute-drill-disabled-performance-counters-and-exctrlst-exe.aspx ). Once he disabled that counter all of their normal counters returned, and are now being forwarded correctly.

sgarvin55 · ‎07-22-2014

We are experiencing issues where some of our systems which appear to be configured properly will not forward certain windows performance monitor counters. The forwarders are controlled by a deployment server, and appear to be contacting the deployment server correctly, and forwarding windows event log events properly, but some or all performance monitor inputs do not get forwarded. Example of perfmon input in inputs.conf: [perfmon://Network Interface] _rcvbuf = 1572864 counters = Bytes Received/sec;Bytes Sent/sec disabled = 0 evt_dc_name = evt_dns_name = evt_resolve_ad_obj = 0 host = $decideOnStartup index = perfmon instances = * interval = 20 mode = multikv object = Network Interface One of the error messages we see in the splunkd.log after enabling DEBUG is: DEBUG ExecProcessor - Ran script: "D:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" , took 6.345292 seconds to run, 0 bytes read, exited with code -1

sgarvin55 · ‎01-07-2014

You can change the location of Splunk's internal log set by editing the #SPLUNK_HOME/etc/log.cfg file. For instance: I want to change the location of the splunkd.log and rename it. Look for the following entry: appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log You can change the location to something like: /var/log/splunk/splunk_indexer.log Disclaimer Splunk Support does not advise to do this as it can have adverse effects. One of which is likely to be the disruption of indexing internal logs.

sgarvin55 · ‎01-07-2014

I we would like to index these logs in a different directory (a directory other than the $SPLUNK_HOME/var/log/splunk). Indexer splunkd.log* as splunk_indexer_logs Indexer metrics.log* as splunk_indexer_metrics_logs Universal Forwarder splunkd.log as splunk_forwarder_logs Search Head splunkd.log as splunk_search_head_logs

sgarvin55 · ‎08-16-2013

This number can vary depending on the exact numbers of clients and app changes, as well as how many of the clients are hitting the deployment server at the same time. A rule of thumb being no more than 2000 clients hitting within a minute – after that – we have to start increasing the phone home interval. Generally somewhere in the region of 600 - 1200 seconds should be a good place to start. Deployments of 3000 potential clients should have a phone home interval of 5 - 8 mins. We do have customers with 15,000 clients who adjust 'phoneHomeIntervalInSecs' and 'handshakeRetryIntervalInSecs' parameters to be successful. You can also specify a different check-in interval on a per client, or per class basis by tuning the 'phoneHomeIntervalInSecs' and 'handshakeRetryIntervalInSecs' parameters in deploymentclient.conf - http://docs.splunk.com/Documentation/Splunk/latest/Admin/Deploymentclientconf

sgarvin55 · ‎08-16-2013

At times our Splunk Deployment server is unresponsive while other times it's slow to push out changes. We see Error messages with the following: DeploymentClient - Unable to send phonehome message to deployment server. Error status is: not_connected"

sgarvin55 · ‎06-13-2013

We checked the following as possible causes for this issue: outputs.conf for multiple entries using same port more than one instance of Splunk running Firewall issues Event Logs show: Audit Failure 6/10/2013 10:08:37 AM Microsoft Windows security auditing. 5157 Filtering Platform Connection Audit Success 6/10/2013 10:08:37 AM Microsoft Windows security auditing. 5156 Filtering Platform Connection Audit Failure 6/10/2013 10:08:37 AM Microsoft Windows security auditing. 5157 Filtering Platform Connection Audit Success 6/10/2013 10:08:37 AM Microsoft Windows security auditing. 5156 Filtering Platform Connection The issues was fixed by this Microsoft KB article: http://support.microsoft.com/kb/2654852

sgarvin55 · ‎06-13-2013

On several servers, the universal forwarder tries to open up two connections at the same time on the same outbound port. The first connection succeeds, and the second connection generates event id 5157 for splunkd.exe. This happens constantly all day. How can I correct this to stop generating these errors?

sgarvin55 · ‎01-02-2013

I went back to verify the OS that this customer was using and he was using: [System Summary] Item Value OS Name Microsoft Windows Server 2008 R2 Enterprise Version 6.1.7601 Service Pack 1 Build 7601 He did use the MS article to resolve HIS particular issue.

Posts	39
Solutions	8
Karma Given	63
Karma Received	97
Member Since	‎11-21-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How do I obtain the SHA-512 Hash for Splunk downlo...

How do I obtain the MD5 hash for UF downloads?

`How to Fix the below PEM routines:PEM_read_bio:ba...

Universal Forwarders not forwarding windows perfor...

Can I change the location of Splunk's internal log...

When managing large numbers of deployment clients,...

UF tries to open two connections at the same time ...

Splunk web throws "ResponseNotReady" error

Excel App for Admin and Power users only.

Splunk Field Extraction

Re: After upgrading to 6.5.0, KV Store will not st...

Re: How do I obtain the SHA-512 Hash for Splunk do...

How do I obtain the SHA-512 Hash for Splunk downlo...

Re: How do I obtain the MD5 hash for UF downloads?

How do I obtain the MD5 hash for UF downloads?

Re: Why are searches stuck at "finalizing job" aft...

Re: Need to hard code host reported by Universal F...

Re: Cisco Networks App for Splunk Enterprise: Why ...

Re: Why did my Splunkforwarder stop with the error...

Re: `How to Fix the below PEM routines:PEM_read_bi...

`How to Fix the below PEM routines:PEM_read_bio:ba...

Re: Universal Forwarders not forwarding windows pe...

Universal Forwarders not forwarding windows perfor...

Re: Can I change the location of Splunk's internal...

Can I change the location of Splunk's internal log...

Re: When managing large numbers of deployment clie...

When managing large numbers of deployment clients,...

Re: UF tries to open two connections at the same t...

UF tries to open two connections at the same time ...

Re: Splunk web throws "ResponseNotReady" error