Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About nnmiller
nnmiller
Contributor
Member since:
11-08-2013
11-01-2024
Community Statistics
| Posts | 85 |
| Solutions | 10 |
| Karma Given | 142 |
| Karma Received | 120 |
| Member Since | 11-08-2013 |
Activity Feed
- Got Karma for Re: KV Store lookup failing with error about KV store initialization failure. 01-26-2022 08:58 AM
- Got Karma for Re: KV Store lookup failing with error about KV store initialization failure. 12-22-2020 05:54 PM
- Got Karma for Re: KV Store lookup failing with error about KV store initialization failure. 11-24-2020 02:12 PM
- Posted Re: Can the Bloodhound app be used in a cluster enviroment? on All Apps and Add-ons. 09-15-2020 07:19 AM
- Got Karma for Re: KV Store lookup failing with error about KV store initialization failure. 06-22-2020 08:40 AM
- Got Karma for Re: How to change the permissions of a saved search from the CLI. 06-19-2020 10:56 AM
- Karma Re: How to join two tables where the key is named differently and must be cleaned up first? for DalJeanis. 06-15-2020 08:01 AM
- Karma Re: Poor ldapsearch performance - SA-ldapsearch app for Richfez. 06-15-2020 07:59 AM
- Karma Re: How do I test connectivity over a specific port in Windows? for jhornsby_splunk. 06-15-2020 07:50 AM
- Karma How do I get a count of unique and total buckets in my environment? for davidpaper. 06-05-2020 12:50 AM
- Karma Re: How do I get a count of unique and total buckets in my environment? for davidpaper. 06-05-2020 12:50 AM
- Karma How do I test connectivity over a specific port in Windows? for jpondrom_splunk. 06-05-2020 12:50 AM
- Karma Re: How do I test connectivity over a specific port in Windows? for jpondrom_splunk. 06-05-2020 12:50 AM
- Karma Re: SmartStore Sizing for adonio. 06-05-2020 12:50 AM
- Karma Why am I still running into License Master Timeouts and Slowness after upgrading to 6.5.6 to resolve SPL-134638? for alee_splunk. 06-05-2020 12:50 AM
- Karma Re: Why am I still running into License Master Timeouts and Slowness after upgrading to 6.5.6 to resolve SPL-134638? for alee_splunk. 06-05-2020 12:50 AM
- Karma Re: termsOfServiceDirectory which web.conf should this stanza be placed in, in a distributed environment. Using btool for Yorokobi. 06-05-2020 12:50 AM
- Got Karma for Re: What's ops.json in etc/system/replication?. 06-05-2020 12:50 AM
- Got Karma for Re: What's ops.json in etc/system/replication?. 06-05-2020 12:50 AM
- Karma Re: How do I change the REST API execution timeout? for valiquet. 06-05-2020 12:49 AM
Topics I've Started
09-15-2020
07:19 AM
@ridwanahmed Yes, you would need to deploy the app from the SHC deployer.
... View more
06-25-2019
12:02 PM
2 Karma
splunk/etc/system/replication/ops.json
ops.json resides on each of the SHC members. It is a commit history for the changes made to KOs and other configurations on the SH for the time period it covers.
It will contain references to the roles you removed until the ops.json window shifts past the date where the changes were made or applied on the SHC members.
... View more
05-08-2019
10:00 AM
You need to review your job inspector and possibly search.log and determine where the latency is occurring.
Also, if you are on 6.6 or later, you need to revert max_searches_per_process back to the default of 500. Many orgs ran into the bug prior to 6.6 which causes slow search start up and still have max_searches_per_process = 1 .
... View more
02-01-2019
07:28 AM
There's are HUGE caveats to the key routing method to re-parse data:
a) unsupported (don't bother opening a case about it)
b) untested (e.g. it has worked in the past but is not QA'd so could break at any point)
c) applies to ALL inputs on the system you set it up on -- regardless of the stanza it's applied in, so you are essentially relegating an IF to a single input.
... View more
06-20-2018
04:43 PM
This is normal behavior. An index cluster master is also a search head -- that's how it populates all the cluster master's "indexer clustering" information. A standalone License Master, if added to the monitoring console would also have the role of "Search Head", since that's where the license dashboards are generated.
... View more
01-28-2018
05:17 AM
Splunk cannot "mitigate" or "remediate" the impact of a kernel patches that, essentially, turn off all CPU optimizations. These flaws are inherent to the architecture of the CPU.
Your organization must determine, for your organization , if the potential risk is sufficient to warrant applying the patches. To perform risk analysis, you need to understand the nature of the risk, and then examine how likely those potential risks could occur in your environment.
Most organizations do not seem to bother with risk analysis of system vulnerabilities. Meltdown/Spectre is definitely a case where it should be performed.
... View more
01-08-2018
09:31 AM
1 Karma
I've asked the community on Slack/IRC to weigh in with concrete data pre-/post-mitigation.
... View more
12-18-2017
11:07 AM
3 Karma
You can't sum these as you have in your query, since they are IOPS per disk. From the /services/server/status/resource-usage/iostats docs page:
Access the most recent disk I/O statistics for each disk. This endpoint is currently supported for Linux, Windows, and Solaris. By default this endpoint is updated every 60s seconds.
Running:
splunk cmd splunkd instrument-resource-usage --debug > some_log_file.log 2>&1
shows that these stats come from /proc/diskstats
(HT: blachance_splunk)
... View more
11-16-2017
11:26 AM
Another method for the init script, ignoring the systemd aspect, requiring your version of su on Linux to have libpam.so linked, is to replace:
"/opt/splunk/bin/splunk" start --no-prompt --answer-yes
with the following, replacing <splunk_user> with the correct user for your environment:
su <splunk_user> -c '/opt/splunk/bin/splunk start --no-prompt --answer-yes'
So far I've check RHEL 6 and CentOS 6 and both include the PAM library in the su binary.
... View more
08-23-2017
01:33 PM
1 Karma
mmodestino, I think you typo'd there...
I think we have sufficiently realized why CLI will always be there...heck, even on windows and mac, admin via the gui is the way to go.
Don't you mean 'admin via the CLI is the way to go'? 😉
... View more
08-22-2017
12:43 PM
Reviewing the REST API Reference, it appears that the tutorial docs are incorrect.
Per auth/login REST API docs section, the correct command here is (yes, enter username/pass 2x):
curl -k -u admin:changeme https://localhost:8089/services/auth/login -d username=admin -d password=changeme
Which returns an XML response with a session key:
<response>
<sessionKey>192fd3e46a31246da7ea7f109e7f95fd</sessionKey>
</response>
... View more
08-16-2017
08:40 AM
Please try using one of the following to work around this issue:
Unicode or ASCII version of special characters such as backslash, "<", or, ">". For example:
Unicode "\" = \u005c
Hex ASCII "\" = \x5c
Unicode "<" = u003c
Hex ASCII "<" = \x3c
Use {X} where "X" is the character count to indicate the number of occurrences of the character. E.g.:
#blacklist = EventCode="1" Message="(?i)\\(pIng|caLc).exe\<{1}"
#blacklist = EventCode="1" Message="\.{1}"
In SEDCMD these two methods are used as a workaround for oddities with the regex parser, so I am wondering if they work here as well.
... View more
08-14-2017
07:41 AM
1 Karma
The NIX UI will never be common on *servers for many reasons, most important of which is security. In addition it adds a ridiculous level of dependencies which have the potential to make the system unstable when patching (you do, patch right? see "most important" point), increase resource consumption, add configuration management work, etc.
Source: 15+ years as a systems admin.
... View more
08-11-2017
01:23 PM
Just to clarify: the single ERROR line contains the cause "SPL-90606". This references a bug number in our database.
... View more
08-02-2017
12:43 PM
1 Karma
Just a note--I tried hexx's method in 6.6.0 and it failed with <msg type="ERROR">You do not have permission to share objects at the system level</msg> even though I was attempting it as admin.
Instead, I had to use the methods covered in the documentation on REST ACLs, involving curl .
... View more
07-28-2017
05:46 AM
Splunk automatically calculates the concurrency. If you change the CPU configuration of VMs, you should verify that Splunk recalculates properly.
Calculation:
max_searches_per_cpu x number_of_cpus + base_max_searches = max_hist_searches
(max_searches_perc / 100) x max_hist_searches = max_hist_scheduled_searches
max_rt_search_multiplier x max_hist_searches = max_realtime_searches
The default settings are base_max_searches = 6 , max_searches_per_cpu = 1 , max_searches_per = 50 , and max_rt_search_multiplier = 1 . So in your case:
((1 * 8) +6) = 14 = max_hist_searches per SH
4 * 14 = 56 = max search head cluster concurrency
((50 /100) * 14 ) = 7 = max_historical_scheduled_searches per SH
4 * 7 = 28 max search head cluster scheduled search concurrency
1 * 14 = 14 = max_realtime_searches per SH
4 * 14 = 56 = max rt search head cluster concurrency
How you have quota enforcement set on the SHC will also affect perceived concurrency at the SHC captain (please see How the cluster enforces quotas.
Additionally, if there are communication problems in your SHC that prevent the SHs from reporting back that scheduled jobs have been completed, the captain will not remove their search jobs from the queue, resulting in delays or failure to delegate jobs by the captain.
... View more
07-07-2017
07:03 AM
1 Karma
You should not be editing back end configuration files manually on your SHC. You should be performing back end edits on the deployer, then pushing the changes to the SHC.
Please review the following documentation:
Use the deployer to distribute apps and configuration updates
How configuration changes propagate across the search head cluster
There are isolated cases where you may want to change settings in $SPLUNK_HOME/etc/system/local/ config files, but these are rare, and generally only necessary if there is a problem in the SHC.
... View more
06-16-2017
03:04 PM
You're welcome. Hat tip goes to jkat54 for pinging me about this question.
... View more
06-16-2017
06:53 AM
4 Karma
The bug is poorly worded.
Basically, Splunk capabilities work exactly as intended. If a user does not have the capability to run schedule searches, even if an admin goes in and sets the restricted user's saved search to a scheduled search, the search won't run.
A bug that allowed admin to successfully set a search as scheduled for a user without that capability was fixed. Another customer that was using that "loophole" filed this bug when the loophole stopped working.
The work around to get the "loophole" back is by creating a the special "service account", giving ownership of the searches to that "service account", then giving each user that needs to modify those searches read/write permission.
... View more
06-09-2017
03:07 PM
SSH has pretty bad performance, and therefore, so does scp. Once the network buffer is full, it's slow slow slow. There are a couple of ways around this: a) use the high performance network patches for SSH available here PSC HPN Patches (I use these myself on servers which do large file transfers), or switch to an ftp over SSL implementation, netcat, or similar.
For example, I had a customer using straight ftp to constantly transfer high volume firewall logs like this without issue.
I'm not even sure the HPN patches would do what is needed in this case, because of connection pauses. If logs are not coming continuously through that pipe, then you're going to have the connection restart overhead throwing off your time_before_close . So maybe add something like the following to /etc/ssh/sshd_config :
ClientAliveInterval 120
ClientAliveCountMax 720
I presume there's some sort of security policy to prevent you from just using syslog here?
... View more
05-19-2017
11:44 AM
Based on the Windows Security Operations Center app page on Splunkbase, the last supported version is Splunk 5.0. There is an email address listed there to which you can report bugs.
If you restarted after installing and configuring the app, you shouldn't have to restart after editing macros. Try performing a debug refresh.
Chances are, give the age of the app, that some things may not be compatible with more recent versions of Splunk. Be sure to review your _internal index for WARN/ERROR log messages from the app.
... View more
03-21-2017
07:11 AM
Please open a support case with Secunia encouraging them to adhere to the strict JSON standard. The standard not complicated, and what Splunk parses without issue.
If more customers complained to their vendors, there'd be less need for workarounds like this.
... View more
01-19-2017
07:07 AM
Sounds like you are not forwarding your search head's internal logs to the indexers. This can cause performance issues on the search head in addition to consuming space.
Please have a look at the following docs page: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata
... View more
01-09-2017
04:00 PM
If KV Store stays in "Starting" status, then you have a different problem, assuming mongod is actually running. ERROR: child process failed, exited with error number 100 is a generic error.
I would suggest opening a support ticket if you haven't resolved the problem already.
... View more
12-27-2016
07:27 AM
I downvoted this post because this answer is incorrect. Splunk is capable of monitoring compressed files. There must be some other issue here.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-01-2024
11:18 AM
|
Karma from
Karma given to
