Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kishor_pinjarka
kishor_pinjarka
Path Finder
Member since:
12-16-2019
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 12-16-2019 |
Activity Feed
- Karma Getting duplicate data for mike_randall. 06-05-2020 12:50 AM
- Karma Re: Not able to filter nagios:core logs after ingestion for gcusello. 06-05-2020 12:50 AM
- Karma Re: How do I disable Transparent Huge Pages (THP) and confirm that it is disabled? for jwelch_splunk. 06-05-2020 12:47 AM
- Posted Re: Splunk Enpterprise - Indexer Cluster issue on Deployment Architecture. 01-08-2020 06:09 PM
- Posted Re: Splunk Enpterprise - Indexer Cluster issue on Deployment Architecture. 01-08-2020 01:49 AM
- Posted Re: Splunk Enpterprise - Indexer Cluster issue on Deployment Architecture. 01-08-2020 01:48 AM
- Posted Re: Splunk Enpterprise - Indexer Cluster issue on Deployment Architecture. 01-08-2020 01:45 AM
- Posted Splunk Enpterprise - Indexer Cluster issue on Deployment Architecture. 01-08-2020 01:01 AM
- Tagged Splunk Enpterprise - Indexer Cluster issue on Deployment Architecture. 01-08-2020 01:01 AM
- Tagged Splunk Enpterprise - Indexer Cluster issue on Deployment Architecture. 01-08-2020 01:01 AM
- Tagged Splunk Enpterprise - Indexer Cluster issue on Deployment Architecture. 01-08-2020 01:01 AM
- Posted Re: Splunk Enterprise - HTTPSConnectionPool - 'socket.error' - Connection timed out on Monitoring Splunk. 01-06-2020 09:25 PM
- Posted Splunk Enterprise - HTTPSConnectionPool - 'socket.error' - Connection timed out on Monitoring Splunk. 01-02-2020 07:46 PM
- Tagged Splunk Enterprise - HTTPSConnectionPool - 'socket.error' - Connection timed out on Monitoring Splunk. 01-02-2020 07:46 PM
- Posted Json event breaking not working as expected on Getting Data In. 12-19-2019 07:36 PM
- Tagged Json event breaking not working as expected on Getting Data In. 12-19-2019 07:36 PM
- Tagged Json event breaking not working as expected on Getting Data In. 12-19-2019 07:36 PM
- Posted Re: Not able to filter nagios:core logs after ingestion on All Apps and Add-ons. 12-18-2019 12:40 AM
- Posted Re: Not able to filter nagios:core logs after ingestion on All Apps and Add-ons. 12-18-2019 12:13 AM
- Posted Re: Not able to filter nagios:core logs after ingestion on All Apps and Add-ons. 12-17-2019 11:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-08-2020
06:09 PM
I missed this step - https://docs.splunk.com/Documentation/Splunk/8.0.1/DMC/Addinstancesassearchpeers
Now it's working fine.
... View more
01-08-2020
01:49 AM
Is it because of different secret key for each - Indexer Cluster and Search Head Cluster?
... View more
01-08-2020
01:48 AM
Also checked, Cluster Master Monitoring Console - Instances dashboard.
They are not showing up there.
... View more
01-08-2020
01:45 AM
Yes, forwarded logs from both Search Heads and Deployer.
Yes, I did role configuration earlier.
Still no luck now. Let me read the docs -https://docs.splunk.com/Documentation/Splunk/7.2.0/DMC/DMCoverview
... View more
01-08-2020
01:01 AM
Why I am not able to see Search Heads connection in Cluster Master Monitoring Console - Overview Dashboard (See 1st image)
However, I did successful connection to Cluster Master from both Search Heads. (See 2nd image)
I referred below documentation (Integrate the search head cluster with an indexer cluster):
https://docs.splunk.com/Documentation/Splunk/7.2.0/DistSearch/SHCandindexercluster
Background of Architecture:
1 CM,
2 Indexers (Indexer Clustered),
2 Search Heads (Search Head Clustered),
1 Deployer
1 Deployment Server
1 Heavy Forwarder
Splunk Enterprise: 7.2
OS: Centos 7
Splunk License - When you first install a copy of Splunk Enterprise, the installed instance uses a 60 day trial license.
... View more
01-06-2020
09:25 PM
Found solution...
Run below two commands on newly created VM after Splunk installtion.
sudo firewall-cmd --zone=public --add-port=8000/tcp --permanent
sudo firewall-cmd --reload
After this I am able to open Splunk Web URL.
... View more
01-02-2020
07:46 PM
1) Installed Splunk Enterprise on server 1:
VERSION=7.2.0
BUILD=8c86330ac18
PRODUCT=splunk
PLATFORM=Linux-x86_64
2) Restarting splunkd:
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
.. [ OK ]
Stopping splunk helpers...
[ OK ]
Done.
Splunk> Be an IT superhero. Go home early.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _internal _introspection _telemetry _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunk/splunk-7.2.0-8c86330ac18-linux-2.6-x86_64-manifest'
All installed files intact.
Done
All preliminary checks passed.
Starting splunk server daemon (splunkd)...
Done
[ OK ]
Waiting for web server at https://127.0.0.1:8000 to be available.. Done
If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com
The Splunk web interface is at ***:8000
3) Port 8000 is already opened from server1 to server2.
4) Trying to access Web URL from server 2: ***:8000
Not able to open Web URL.
5) Checked splunkd logs:
01-02-2020 03:01:30.767 -0800 ERROR ApplicationUpdater - Error checking for update, URL=https://apps.splunk.com/api/apps:resolve/checkforupgrade: Connect Timeout
01-02-2020 03:03:48.066 -0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk_instrumentation/bin/instrumentation.py" HTTPSConnectionPool(host='e1345286.api.splkmobile.com', port=443): Max retries exceeded with url: /1.0/e1345286/6b0c90ec-af87-5382-ae54-e94d7b316c04/1/0?hash=none (Caused by : [Errno 110] Connection timed out)
What I have to do?
... View more
- Tags:
- splunk-enterprise
12-19-2019
07:36 PM
Original log:
[{"username": "xxx", "event": "session_start", "event_category": "session", "timestamp": "2019-12-11 08:26:23.547000+00:00", "context_ip": "xxx", "context_page_referrer": "xxx", "context_page_url": "xxx", "context_page_search": null, "context_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36", "context_data": null, "response": null}, {"username": "xxx", "event": "session_start", "event_category": "session", "timestamp": "2019-12-11 12:53:32.350000+00:00", "context_ip": "xxx", "context_page_referrer": null, "context_page_url": "xxx", "context_page_search": null, "context_user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36", "context_data": null, "response": null}]
Expected logs:
{"username": "xxx", "event": "session_start", "event_category": "session", "timestamp": "2019-12-11 08:26:23.547000+00:00", "context_ip": "xxx", "context_page_referrer": "xxx", "context_page_url": "xxx", "context_page_search": null, "context_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36", "context_data": null, "response": null}
{"username": "xxx", "event": "session_start", "event_category": "session", "timestamp": "2019-12-11 12:53:32.350000+00:00", "context_ip": "xxx", "context_page_referrer": null, "context_page_url": "xxx", "context_page_search": null, "context_user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36", "context_data": null, "response": null}
Currently my used props.conf is:
[xxx]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
SEDCMD-remove_prefix=s/\[//g
SEDCMD-remove_suffix=s/\]//g
SEDCMD-removeeventcommas=s/}, {"username":/}{"username":/g
BREAK_ONLY_BEFORE=\{\"username\" <-- This one is not working
Output I am getting using above props.conf"
{"username": "xxx", "event": "session_start", "event_category": "session", "timestamp": "2019-12-11 08:26:23.547000+00:00", "context_ip": "xxx", "context_page_referrer": "xxx", "context_page_url": "xxx", "context_page_search": null, "context_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36", "context_data": null, "response": null}{"username": "xxx", "event": "session_start", "event_category": "session", "timestamp": "2019-12-11 12:53:32.350000+00:00", "context_ip": "xxx", "context_page_referrer": null, "context_page_url": "xxx", "context_page_search": null, "context_user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36", "context_data": null, "response": null}
I am doing these validation while uploading sample log file from WebUI and during 2nd configuration page of Add Data I am doing this testing.
What I am missing?
... View more
12-18-2019
12:40 AM
Thank you 🙂
... View more
12-18-2019
12:13 AM
Yes, like that it's working 🙂
However, why I am not able to see _raw event when I am expanding the event from right hand side? Any idea?
... View more
12-17-2019
11:42 PM
Yes, I tried that earlier. However, same results.
... View more
12-17-2019
07:19 PM
Sorry to mention you that, filtering is not working in Search.
Means when I write index=### sourcetype=### "keyword for filter"
then I am not able to see anything even though those keywords are present in logs.
Let me know if you need more details. And thank you for your response.
... View more
12-16-2019
06:53 PM
Hi,
I am able to see logs ingested into Splunk, however, not able to to filter nagios:core logs. Also not able to see _raw field. Please see attached image.
Input stanza used on UF:
@### local]# cat inputs.conf
[monitor:///usr/local/nagios/var/nagios.log]
index=nagios
sourcetype = nagios:core
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
