About rjk123

rjk123 · ‎08-01-2023

Thanks for this, now I get it - the SHC site has nothing to do with SH's, but is a reference to the IDX cluster sites. I found this page, Deploy a search head cluster in a multisite environment - Splunk Documentation, with the following text: "It is recommended that you set each search head's site attribute to "site0", to disable search affinity. When search affinity is disabled, the search head runs its searches across indexers spanning all sites."

rjk123 · ‎07-30-2023

I am creating a 2nd SH cluster (with its own Deployer), and both SH clusters (old and new) will be accessing a single (multi-site) IDX cluster. The existing SH cluster is using Site 0, and the indexers are using site 1 and 2. Do I need to configure the new SH cluster with a unique site id, eg. Site 4, or does not not matter? There seems to be about zero docs for multiple SH clustering. Thanks.

rjk123 · ‎07-21-2023

Thanks for the replies. So then, a Deployer can manage multiple SH clusters, but the SH's still all need to be the same. Sounds like a single cluster to me. Anyway, that answers my question. I will need a second deployer for a truly separate SH cluster. Thanks.

rjk123 · ‎07-19-2023

I already have a clustered enterprise environment and I want to create an additional SH cluster for a dedicated purpose, but using the same IDX cluster. Do I need an additional Deployer server for this, or can I have the existing Deployer manage multiple SH clusters? How to do this? Thanks for any suggestions. R.

rjk123 · ‎07-06-2023

It's been a while, but I've found the problem. The syslog traffic is coming through a load balancer, so hitting different HFs - needless to say, the HFs are not configured the same. The problematic HF is newer and does not have the custom settings on the older one. The new one is using the default props.conf file, and the [syslog] sourcetype stanza points to a [syslog-host] transforms stanza. The transform as a regex extraction to pick out the hostname - and that is overriding any host setting in the inputs.conf file. The older HF has a custom [syslog] stanza which is using a different transform. Hence no host extraction, keeping the correct value intact. The default transform causing the problem.. ../etc/system/default/transforms.conf [syslog-host] DEST_KEY = MetaData:Host REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(\w[\w\.\-]{2,})\]?\s FORMAT = host::$1 The end.

rjk123 · ‎06-08-2023

The event detail I included is as it appears in the splunk search, only the host/path/index/user details are changed. Yes, there are many other inputs on the HF, but only these for the new index. What I mostly don't understand is why the 'host' field setting doesn't override whatever Splunk is doing to pickup the host value. Is it a not-so-powerful setting?

rjk123 · ‎06-08-2023

I have configured a Splunk HF with the following inputs.conf stanzas (details changed) for two new device logs. Note the explicit host setting for each: [monitor:///path/splunklogs/10.10.1.1/*.log] disabled = false host = myhost10 sourcetype = syslog index = my_index [monitor:///path/splunklogs/10.20.1.1/*.log] disabled = false host = myhost20 sourcetype = syslog index = my_index I created the index at the same time, so to validate its working I simply ran a search "index=my_index" (knowing there will be nothing else there). But surprisingly, the search returns events from three hosts instead of two! The first device looks okay, but for the second one (ie. the second inputs stanza), some of the events are showing the wrong host value. It seems to be picking up a host value embedded in the event, but I don't see how. And I thought the inputs 'host' setting would override that anyway. So, from the below example, the host SHOULD be set to 'myhost20' from the inputs stanza, but instead is showing as host 'xyz000000001234'. Can anyone explain how that could be happening, and so, how to prevent it? Sample event, with the standard fields below it: 2023-06-08T14:38:51+10:00 Sev=notice Facility=user Hostname=<loadbalancer> Header="Client " Message="Client IP: 10.20.1.1 | <109>Jun 8 14:40:11 xyz000000001234 some_field -: AUDIT [dvc="10.20.1.1" dvchost="10.20.1.1" version="7.7" user="<user>" role="" source="10.1.2.3" type="user_action" outcome="success" message="2023-06-08T14:40:11+10:00 abc120000001111 sshd\[2876138\]: Accepted keyboard-interactive/pam for device from 10.1.2.3 port 12345 ssh2"]" host = xyz000000001234 index = my_index source = /path/splunklogs/10.20.1.1/10.20.1.1-08-06-2023:14.log sourcetype = syslog Thanks for any response. R.

rjk123 · ‎01-23-2023

I have a UF set to send logs to both Splunk IDX and SIEM, using the TCPOUT settings in outputs.conf, but this is sending via TCP and we want it to use UDP (due to high log rate). Can it be done? There is no option for the tpcout stanza to set a protocol. So it is TCP only. I found there is a syslog-out stanza for the outputs.conf file, which can use UDP or TCP, but that one also says it can't be used on UFs. Am I stuck with TCP, or is there another way? Thanks for any responses, Rod.

rjk123 · ‎04-08-2021

I am preparing to upgrade a distributed and clustered Splunk Enterprise install from 7.3.3 to 8.1.2, but the install guides are not clear for the correct method. My current plan is to upgrade in the following order: Deployment Servers (primary and standby) Cluster Masters / License Masters (primary and standby) Search Head cluster 2-site Indexer cluster and afterward, all the HFs and UFs (many of each). Where I'm not clear is the SH/IDX process. SH: rolling or all at once? IDX: one site at a time, or all at once? I have found documentation that says we can do rolling upgrade of SH's, and can do IDX's one site at a time, but other documentation that implies I have to do all SH and IDX in one big hit (because 7.3.3 > 8.1.2 is more than a single version jump). My colleagues are in conflict which is correct. Any clues to the real answer here? Thanks for any help.

rjk123 · ‎08-27-2020

Don't worry, I think I found it. I can see other logs configured in inputs.conf with the same case, and these show up okay in splunk. Answer = NOT case sensitive.

rjk123 · ‎08-27-2020

I have an example where logs are not shown in splunk search, and I can see the index name in the inputs file has mixed case, but the actual index name is all lower case. Will this the cause the logs to not get ingested? I also note the sourcetype case is wrong too, so are any/all these fields case sensitive? actual index name: "target_index" [monitor:///file/path/logfile.log] index = Target_Index sourcetype = mBAS_log disabled = false Thanks for the help.

Posts	11
Solutions	2
Karma Given	4
Karma Received	0
Member Since	‎11-23-2019

Online Status	Offline
Date Last Visited	‎11-20-2023 09:26 AM

Do I need a different SH site id for a 2nd SH clus...

Can a single Deployer server manager two SH cluste...

Why are events using the wrong 'host' value?

How to use Universal Forwarder to send logs to SIE...

upgrade steps for clustered environment 7.3.3 to 8...

is the index field in inputs.conf case sensitive?

Re: Do I need a different SH site id for a 2nd SH ...