About gpareesi11

gpareesi11 · ‎07-03-2018

Hi, I have upgraded my environment to 7.1.1 and also renew my licenses. Everything work fine, except the Splunk App for VMware, I always received Licensing error. When I look in my Splunk Licenses, I see all has valid. In the App I see the following message: License problems detected. See details below. Last updated Fri Jun 22 2018 at 00:05:09 GMT-0400 (EDT) I have try to refresh, but the last updated is always Fri Jun 22 ? Anyone already faced this problem ? Thanks

gpareesi11 · ‎08-11-2017

Hi, Looking this documentation, you should be able to create a workflow. http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/CreateworkflowactionsinSplunkWeb Navigate to Settings > Fields > Workflow actions. Click New to create a workflow action. For the Destination App, select search. For Name, type: get_whois_info For Label, type: Get info for IPaddress: $src_ip$ For Apply only to the following fields, type: src_ip For Action type, make sure link is selected. For URI, type: https://www.tcpiputils.com/browse/ip-address/$src_ip$ From the Open link in drop down menu, make sure New window is selected. From the Link Method drop down menu, make sure get is selected. Save your workflow action. Verify your workflow action works as expected. Return to the Search & Reporting app and search for sourcetype="" src_ip="" over the last 4 hours. Expand the first event and click Event Actions. Click Get info for IPaddress: {src_ip}. A secondary browser window should open to the URI and display the IP address information. I'm not exactly sure how this should be add to Dashboard. Maybe this can be helpful. G

gpareesi11 · ‎06-26-2017

Hi, Have you look this post maybe it could help ? https://answers.splunk.com/answers/329368/how-to-change-the-background-color-of-a-table-row.html Thanks

gpareesi11 · ‎06-22-2017

Hi guys, I have deployed the solution using NVM collector on CentOS 7 and Splunk 6.6.1 running on Windows. The only issue I've seen was the firewall on my CentOS blocking the port 2055, after stopping and disabling the firewall, a few minutes later, NVM Dashboard has been populated with data. Your acnvm.conf, look correct, verify Splunk Data Input UDP port 20519, 20520 and 20521, and the firewall not blocking these ports on Splunk Server. Thanks Guillaume

gpareesi11 · ‎06-21-2017

Hi, I having the same issue, after updating the GeoLite2-city.mmdb file, I receive file Integrity Error in Splunk. I solve the issue using HashTool from DigitalVolcano Software, I retrieve the SHA-256 hash from the new GeoLite2-City.mmdb file, then I've modify the manifest by replacing the old Hash with the new Hash. Restart Splunk Now no more file integrity error. I suppose each time we update the MMDB file this procedure will be require. Guillaume

gpareesi11 · ‎09-29-2016

Hi, I've upgraded my splunk environment to 6.5.0, and I have some issue with Splunk App for Exchange, Error in 'map': Did not find value for required attribute 'time'. The application in SplunkBase not support 6.5 https://splunkbase.splunk.com/app/1660/ Splunk Versions 6.4 6.3 6.2 If you use production you should expect it to be listed as supported.

gpareesi11 · ‎08-30-2016

Hi, I'm running version 2.0 installed from scratch, never used 1.0. Yes the password.conf is present and contain encrypted password Only *.conf file in the local folder, there no last_session_call_info.pos in the folder. Thank you

gpareesi11 · ‎08-26-2016

Hi, I'm currently running Splunk Enterprise 6.4.3 on Windows 2012r2, almost everything running smoothly except EMC Isilon App & Add-On. I'm currently trying to solve why I'm unable to get these apps working properly. I have install both Application EMC Isilon Add-on for Splunk Enterprise & EMC Isilon App for Splunk Enterprise. I have configure the Add-on, using IP of one Node of my Isilon Cluster and using Admin account. Configuration look simple and don't give any error message. I did not see any sourcetype from EMC in Splunk, emc:isilon:rest or emc:isilon:syslog I'm troubleshooting the problem using : index=_internal component="ExecProcessor" "EMC Isilon Error:" and here what I see: message from "python "C:\Program Files\Splunk\etc\apps\TA_EMC-Isilon\bin\isilon.py"" EMC Isilon Error: Could not get TA_EMC-Isilon credentials from splunk. Error: 'str' object has no attribute 'os_startIndex' message from "python "C:\Program Files\Splunk\etc\apps\TA_EMC-Isilon\bin\isilon.py"" EMC Isilon Error: Error while getting session validity for authentication. EMC Isilon Error: Could not get TA_EMC-Isilon credentials from splunk. Error: 'str' object has no attribute 'os_startIndex' *message from "python "C:\Program Files\Splunk\etc\apps\TA_EMC-Isilon\bin\isilon.py"" EMC Isilon Error: Looks like an error while getting count for endpoint 401 Client Error: Authorization Required : https://xxx.xxx.xxx.xxx:8080/platform/1/statistics/current?key=node.sensor.fan.rpms.$get_count$&devid=all * These two errors message came back constently and not data from Isilon is in Splunk. Thanks

gpareesi11 · ‎07-12-2016

I'm have not found the ways to correct the issue using the UI, but if you are using the "Configure modular inputs manually in the configuration files" in the following link: http://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/Configureinputs The NetScaler restart to collect the stats. Thanks

gpareesi11 · ‎07-12-2016

Hi, I'm using the Splunk add-on for Citrix NetScaler for statistics and everything was working until I updated to version 6.2 of the add-on. I have removed all configurations and restarted from scratch. When I try to add New Appliance, I populated the required field and I receive the following message. REST ERROR[1021]: Fail to decrypt the encrypted credential information - not well-formed (invalid token): line 85, column 41" Unable to get Data from my NetScaler. Has anyone already faced this issue? Running Splunk Enterprise 6.4.2 and Splunk add-on for Citrix NetScaler v6.2 Thanks

gpareesi11 · ‎06-01-2016

I have exactly the same issue, I working to fix it, but if you have found a solution please post the answer. Thanks

gpareesi11 · ‎05-31-2016

Hi, I don't know the exact use case, but you can try this: | rename "Nom du compte" AS username Thank

gpareesi11 · ‎05-31-2016

Hi, 1 question, this should not be a problem regarding this link: http://docs.splunk.com/Documentation/Splunk/6.1.4/Forwarding/Compatibilitybetweenforwardersandindexers Use Splunkbase to check App-Specific compatibility restriction. 2 question, use this link, this should help you: http://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Installanixuniversalforwarder

gpareesi11 · ‎05-31-2016

Hi, What could be the issue of the following error using "Clustered Single Value Map Visualization": Error rendering Clustered Single Value Map Visualization visualization. Thank you

gpareesi11 · ‎05-19-2016

Hi, I found the issue, I was'nt using the "Clustered Single Value Map Visualization". THank

gpareesi11 · ‎05-19-2016

Hi, I'm currently trying the application, I have import a CSV Data in my splunk enterprise and I'm trying to build a map base on Latitude/Longitude, the map working properly, but I'm unable to change the blue circle for a map-pin. I'm using the following search: index=borne | fillnull | rename nLatitude as latitude nLongitude as longitude nNoBorne as description | eval markerColor=case(like(description, "%"), "red") | eval icon=case(like(description, "%"), "map-pin") | table latitude, longitude, description, markerColor, icon

gpareesi11 · ‎03-09-2016

Great thanks

gpareesi11 · ‎03-09-2016

I understand this part, but when the bucket ages out, I don't need to delete everything but keep a different log interval to reduce the amount of data kept on storage. I still need some dashboard and report but based on 5 minutes log interval instead of 1 second ? Thank you

gpareesi11 · ‎03-09-2016

Hi, I'm currently looking if it possible to reduce the amount of data store in index after 6 months. Example: I'm collecting CPU performance metric at each second for my server, after 6 months is it possible to reduce the size by keeping only CPU performance metric on 5 minutes interval for the next 6 months ? Thank you

gpareesi11 · ‎06-30-2015

Hi, can you try to modify your ldap.conf has follow: [default] server = spdc.nwtraders.msft port = 389 ssl = false basedn = DC=nwtraders,DC=msft binddn = cn=Administrator,cn=Users,DC=nwtraders,DC=msft password = Password1 alternatedomain = NWTRADERS The SA-ldapsearch.log should be in $SPLUNK_HOME/var/log/splunk/SA-ldapsearch.log Thank you

gpareesi11 · ‎06-29-2015

Hi, I finally correct the file collection, so actually I'm getting everything from the VNX 5300. Thanks for the default Dashboard, I've build my own using prebuilt add-on and it working. Thank you

gpareesi11 · ‎06-26-2015

Hi, I'm still searching why the Add-On does'nt work, in my troubleshooting step I've found the add-on trying to access the following files without success: "C:\Program Files\Splunk\ETC\Apps\Splunk_TA_EMC-vnx\static\appIcon.png" with error Path not found. "C:\Program Files\Splunk\ETC\Apps\Splunk_TA_EMC-vnx\appserver\modules\view\dashboards\dashboard-en_US.html" with error Path not found. "C:\Program Files\Splunk\ETC\Apps\Splunk_TA_EMC-vnx\appserver\modules\view\dashboards\dashboard-en.html" with error Path not found. "C:\Program Files\Splunk\ETC\Apps\Splunk_TA_EMC-vnx\appserver\modules\view\dashboards\dashboard.html" with error Path not found. Does some have the older version of this Add-On 1.0.1, I will try to see if I have the same problem. Thanks

gpareesi11 · ‎06-23-2015

Hi, I'm trying to deploy the Splunk Add-On for EMC VNX. I followed the procedure in the documentation and I have the following data index in the Splunk I'm unable to receive vnx_file data. Here is the inputs.conf: [vnx_data_loader://LabPS_vnx_file] network_addr = IP_StorageProcessor_A network_addr2 = IP_StorageProcessor_B username = encrypted password = encrypted platform = VNX File site = Lab PS I also have the following error when I try to open the EMC VNX dashboard: I'm currently running Splunk 6.2.2 on Windows 2012 R2, I have a VNX5300 Unified with 1 Control Station and 2 SP. Thank you

Posts	23
Solutions	5
Karma Given	0
Karma Received	5
Member Since	‎03-26-2015

Online Status	Offline
Date Last Visited	‎07-09-2020 01:52 PM

Splunk App for VMware 3.4.2

Troubleshooting EMC Isilon App for Splunk Entrepri...

Splunk Add-on for Citrix Netscaler 6.2: "REST ERRO...

Error rendering Clustered Single Value Map Visuali...

Use awesome icon not working

Reduce size of index after amount of time

Splunk Add-On for EMC VNX: Why am I getting "Page ...

Splunk App for VMware 3.4.2

Re: How can I connect a field in my dashboard pane...

Re: Color map not working on New Relic Splunk App

Re: Cisco AnyConnect Network Visibility Module (NV...

Re: Can you exclude specific files from the Splunk...

Re: Does Splunk APP for Exchange work under versio...

Re: Troubleshooting EMC Isilon App for Splunk Entr...

Troubleshooting EMC Isilon App for Splunk Entrepri...

Re: Splunk Add-on for Citrix Netscaler 6.2: "REST ...

Splunk Add-on for Citrix Netscaler 6.2: "REST ERRO...

Re: How to remove spaces from CSV column names to ...

Re: space in field value

Re: Forwarder 6.4.1 with Server 6.2.1

Error rendering Clustered Single Value Map Visuali...

Re: Use awesome icon not working

Use awesome icon not working

Re: Reduce size of index after amount of time

Re: Reduce size of index after amount of time

Reduce size of index after amount of time

Re: SA-ldapsearch.log is missing - AD domain not f...

Re: Splunk Add-On for EMC VNX: Why am I getting "P...

Re: Splunk Add-On for EMC VNX: Why am I getting "P...

Splunk Add-On for EMC VNX: Why am I getting "Page ...