About dkozinn

dkozinn · ‎07-22-2022

Interesting that you did that. My instance of Splunk runs on a small Ubuntu server (no GUI) and I access from any number of different systems, but always using "admin" as a user ID when I have to log in.

dkozinn · ‎07-22-2022

For the license I have (Dev/Test), I can only have one user, which by default is "admin". I'd changed that, and from the information that I got, the user name not being "admin" on a Dev/Test instance is what causes the problems. Note that this has nothing to do with the account on the machine that it's running on; This is the user that you provision within Splunk itself (Settings->Users).

dkozinn · ‎07-22-2022

I'd forgotten about this post, I did get an resolution: For devtest instances, it turns out that a number of functions don't work properly if you've changed the name of the user to anything other than "admin". Once I changed it back to admin not only did history start working, but an issue I'd had with mail not being delivered got fixed as well. Let me know if that fixes the issue for you.

dkozinn · ‎03-10-2022

@trashyroadz wrote In Advance Settings for the alert, the server is changed from 'localhost' to your organization's email server (for me, mail.splunk.com). I think this depends on your local email setup. In my case, my local machine is running it's own mail server (Postfix) and has an upstream server that it talks to for delivery off the local machine. It works fine with either localhost or mymachine.example.com:25 in that field.

dkozinn · ‎03-09-2022

Following-up on my follow-up, I noticed a few errors when restarting splunk, and to make a long story short, found that I'd copied some things from the original user directory to the admin user directory as root but never changed the file ownership. As a result, it seems that Splunk wasn't able to read those files. Running chown -R splunk:splunk from $SPLUNK_ETC/users/admin fixed that, and now I'm seeing the old saved searches, etc.

dkozinn · ‎03-09-2022

I wish this was a VM as I'd just take a snapshot before trying this. Obviously it's easy enough to save and restore the files, but I don't know what happens internally in Splunk and as mentioned before, I'd rather not have to build the per-user stuff again from scratch if I can help it.

dkozinn · ‎03-08-2022

To be honest @trashyroadz I was surprised that anyone found this and followed up after all this time, so it's much appreciated. You might have missed the other half of my last message: Rather than try to recreate saved searches, alerts, etc., can I copy everything under ./etc/users/olduser to ./etc/users/admin? I tried copying a few things but I suspect there are things I'm missing (stuff under various metadata directories?). I haven't done anything I care about after I modified the username so I don't care if anything there gets blown away.

dkozinn · ‎03-08-2022

Thank you so much for following up on this. I modified the username in passwd and finally alerts are working. As a bonus, I believe that may have fixed an issue with search history always being blank despite the etc/users/myuser/search/myhost.csv file being populated. I hadn't checked that in a while so I can't be 100% sure this was the fix, but it is working now. Rather than try to recreate saved searches, alerts, etc., can I copy everything under ./etc/users/olduser to ./etc/users/admin? I tried copying a few things but I suspect there are things I'm missing (stuff under various metadata directories?). I haven't done anything I care about after I modified the username so I don't care if anything there gets blown away.

dkozinn · ‎10-21-2020

Regarding your earlier comments about the hard-coded username in the code, on my system I've changed the default name of the administrative user. To be honest, I don't recall if I was prompted to do that or if I did it for some other reason. Could that be somehow involved?

dkozinn · ‎10-21-2020

There are a large number of files under $SPLUNK_HOME owned by root, though not all. On my machine, splunkd is running through systemd as root. Would I still need to change the ownership of those files?

dkozinn · ‎10-20-2020

Thanks for digging into this @benhooper . I'd started digging into this and got stuck due to the same lack of documentation that you mentioned.

dkozinn · ‎09-30-2020

I was not able to get the 404 error. I used the exact curl command you suggested, going to 127.0.0.1 using the same userid/password that I use to log in. Splunk itself runs as root on my machine, so I can't use that for credentials, but the account that I did use does have full admin rights. I know very little about how things work via the API, should there always be something there to retrieve or does that only happen for some period after the search/schedule report runs?

dkozinn · ‎09-29-2020

Hi @jorjiana88 , The splunk management port is accessible on 8089. Using curl, I get this: {"messages":[{"type":"ERROR","text":"Action forbidden."}]} To verify that the credentials were correct, I intentionally used the wrong password and then got this: {"messages":[{"type":"ERROR","text":"Unauthorized"}]}

dkozinn · ‎08-02-2020

I do still have the issue @thambisetty. @peterm30 mentioned that it might be a permissions issue, so I checked the directory where Splunk is installed. After a little digging, it looks there are directories with results under $HOME/var/run/splunk/dispatch that are owned by root with permissions of 700, meaning the splunk user wouldn't be able to see the contents. I noticed files named results.csv.gz and looking at them (as root), these seem to be the output of the searches. If this is the issue, what is causing those to be written by root instead of splunk? Note that $HOME/var/run/splunk/dispatch is owned by splunk (not root). Thanks to both of you for getting back to me.

dkozinn · ‎07-08-2020

I'm running Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance. I am using an Enterprise dev/test license (single user) for this instance. Any attempt to send email results in the following in python.log: 2020-07-07 21:45:15,136 +0000 ERROR sendemail:1435 - [HTTP 404] https://127.0.0.1:8089/servicesNS/admin/search/saved/searches/_new?output_mode=json Traceback (most recent call last): File "/opt/splunk/etc/apps/search/bin/sendemail.py", line 1428, in <module> results = sendEmail(results, settings, keywords, argvals) File "/opt/splunk/etc/apps/search/bin/sendemail.py", line 261, in sendEmail responseHeaders, responseBody = simpleRequest(uri, method='GET', getargs={'output_mode':'json'}, sessionKey=sessionKey) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 577, in simpleRequest raise splunk.ResourceNotFound(uri) ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/servicesNS/admin/search/saved/searches/_new?output_mode=json The mailserver is on the local host, TLS isn't in use. I've verified that the Splunk user can send email both via the mail command as well as calling sendmail directly. The error happens if I use an alert with email as well as using |sendemail from a search. As this instance is limited to a single user the user that this runs under has the admin role. For logging preferences, I set EmailSender to DEBUG but I'm not seeing anything useful.

dkozinn · ‎05-07-2020

Trying to bump for visibility. Still happens after upgrading to 8.0.3. The only thing I noticed that might be unusual (and I don't know if it is) is that the permissions on the CSV file are that it's set to 0600 and owned by root. The directory itself and the only other file there (called .dummy_history) are all owned by splunk:splunk. If I change the ownership of the .csv to be splunk:splunk it changes back to root.

dkozinn · ‎01-14-2020

I have a fresh install of Splunk Enterprise 8.01 on a box running Ubuntu 19.10 as a standalone instance (no clustering, etc.) When I access the Search app, there is never any history showing under Search History. Using |history as a search does not product any output either. If I look in /opt/splunk/etc/users/myuser/search/history there is a CSV file that gets updated with each search I enter. If I look at the _audit index, I do see the searches there. I've looked through a few other posts here but none seems relevant. Any suggestions?

dkozinn · ‎01-09-2020

I've got a similar issue with a clean install of 8.0.1 under Ubuntu, though in my case no history shows up at all on the summary page and I get nothing at all back from |history. In my case, there is a .csv file in $SPLUNK_HOME/etc/users/my_user/search/history and new searches get appended to that. Everything is running on a single machine, no clustering.

Posts	18
Solutions	0
Karma Given	2
Karma Received	6
Member Since	‎11-20-2019

Online Status	Offline
Date Last Visited	‎03-06-2024 11:08 AM

8.0.4.1 on Ubuntu 20.04LTS: Why are emails failing...

No search history for clean install of 8.01 Enterp...

Re: Search History disappeared ( Splunk Enterprise...

Re: Search History disappeared ( Splunk Enterprise...

Re: Search History disappeared ( Splunk Enterprise...

Re: 8.0.4.1 on Ubuntu 20.04LTS: Why are emails fai...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS s...

8.0.4.1 on Ubuntu 20.04LTS: Why are emails failing...

Re: No search history for clean install of 8.01 En...

No search history for clean install of 8.01 Enterp...

Re: Search History disappeared ( Splunk Enterprise...