About agrachevBLK

agrachevBLK · ‎08-12-2015

In our case (6.2 Enterprise) tail -f splunkd.log suggested there was a lock on mongo.db rm /opt/splunk/var/mongo/mongod.lock did the job allowed the httpd process to start.

agrachevBLK · ‎05-20-2013

For firewalls (Checkpoints): number of accepts/denies for a particular service (port) (i.e. profiling.) Also for baselining: log voulumes for every type of events.

agrachevBLK · ‎04-09-2013

Had a similar situation: estream stopped flowing after a network outage that took the SDC-splunk link down... Ended up manually removing pid files in apps/Sourcefire/tmp ; archiving logs in ../log However, most likely, it's the bookmark reset (./ssl_test.pl -start=now ) that helped...

Posts	3
Solutions	1
Karma Given	3
Karma Received	1
Member Since	‎08-24-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Re: Splunk will not start and is waiting for confi...

Re: IT Security Guys - What are YOU using splunk t...

Re: Sourcefire estreamer.log stopped getting data ...