About dkrichards16

dkrichards16 · ‎07-16-2020

We had one search head have to be rebuilt because of JAVA issues. We had another search head, due to a network switch outage, loose connection to the search head cluster. When we re-adding those servers to the search head cluster we not have a strange issue with where custom apps can't search. They either provided a "error fetching saved searches" in the panel then get stuck in a infinite loop of refreshing the browser tab or they load an error 255 where they can't search indexes even though they can search indexes fine in the default search and reporting app. We use custom authorization.conf and authorize.conf configs in /opt/splunk/etc/system/local and affected servers have the latest configs copied from a healthy server. I'm working with splunk support but they are requesting har browser files and the issues seem to be permissions related. Has anyone else seen this issue and able to resolve it?

dkrichards16 · ‎08-01-2019

I had the same issue and a restart of Splunk on the index master cleared it up.

dkrichards16 · ‎07-10-2019

When I run | tunefs I'm getting "Unknown search command 'tunefs'." Is there something I need to install or enable for that command to run?

dkrichards16 · ‎04-04-2019

Is the Cisco Spark Add-On compatible with the rebranding to Cisco Teams? Also, is it compatible with Splunk 7.2.5?

dkrichards16 · ‎02-18-2019

This great. Very simple to use. A lot eaiser than all the js versions out there!

dkrichards16 · ‎09-05-2018

Thanks. I guess my question is could I put the regex in the line_break and not even need anything in the transforms. But, I'm going to use TRANSFORM-### to link to the transforms to ensure our data gets parsed at index time instead of search time. Thanks for letting me ponder.

dkrichards16 · ‎09-05-2018

NOTE: You get a significant boost to processing speed when you use LINE_BREAKER to delimit multi-line events (as opposed to using SHOULD_LINEMERGE to reassemble individual lines into multi-line events). * When using LINE_BREAKER to delimit events, SHOULD_LINEMERGE should be set to false, to ensure no further combination of delimited events occurs. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

dkrichards16 · ‎09-05-2018

Hi, I'm doing some research for our new architecture and am currently doing some house keeping on our props and transforms. If we have a regex for a sourcetype, is it faster to put the regex in the transforms or in the props and use line_breaker? Traditionally, we just set should_linemerge to false in the props and then put the regex in the transforms and link it via report in the props. However, I just read something that said doing regular expressions in line_breaker causes a performance increase. Could someone provide a clear explanation on this for me?

dkrichards16 · ‎05-10-2018

Okay thanks. The MC doesn't have an option for heavy forwarder as a server role. Should I leave it blank? Also, we are using the heavy forwarder to bridge between two splunk instances on different networks and the heavy forwarder is on a dmz. Is it better to send the internal logs to the receiving Splunk location's MC or the MC on the forwarding side's Splunk?

dkrichards16 · ‎05-09-2018

Also, to turn on internal logs. Is it better to add the heavy forwarder to the monitoring console on the receiving side or the sending side. I'm currently working in the sending side and not sure if I can force the internal logs to go to an internal source and not be forwarded with everything else?

dkrichards16 · ‎05-09-2018

In the monitoring console what is the best practice of server role for heavy forwarders? I used Indexer but not sure if there is a better suit for those? Our heavy forwarder will be the only indexer in the overview page because according to the docs for index clusters only add the search head master as a search peer? Could someone please confirm these are both accurate?

dkrichards16 · ‎02-06-2018

Hi, I installed the latest version of the custom cluster map visualization app in our testing environment and even after a reboot the app icon isn't coming up. Is there something I need to do to change this from an add-on, that's just available in the background, & a visible app in the side panel?

dkrichards16 · ‎01-23-2018

Thanks Clearing the Web Cache fixed the login screen logo for the two servers I had with broken links.

dkrichards16 · ‎01-22-2018

I'm running into an issue where I accidentally didn't drop the png file into the /opt/splunk/etc/app/search/appserver/static/logincustomlogo/ folder and got a broken image link. I dropped the file and restarted splunk but still getting the broken link. Has anyone else ran into this issue? Thanks,

dkrichards16 · ‎01-22-2018

Hi, has anyone ran into an issue. I accidentally didn't have the .png or .jpg in the /opt/splunk/etc/apps/search/appserver/static/logincustomlogo/ folder after modifying /opt/splunk/etc/system/local/web.conf file when I restarted and got a broken image link. I then dropped the file in the correct folder and restart splunk again but still getting the broken link. I tried setting the custombackground to default so I could remove the web.conf then started the process over but still no luck. Is there something in the static folder that changes and needs to be manually edited?

dkrichards16 · ‎01-09-2018

We are starting to have additional issues with other apps like DB_Connect and may downgrade to 6.6.5 which has support for Mobile. I'd hate to loose Metric and other cool features of 7.X that was shown in the conf but if I gain speed for features we use daily it might be worth it. I'll keep you posted what we decide on.

dkrichards16 · ‎12-11-2017

Hi, has anyone tested and be able to use Splunk Add-on for Mobile Access with Splunk Enterprise 7.X? It is saying its only supported up to Splunk Enterprise 6.6. Also, we will be using it thru a DMZ for the public IP to be visible in the app. Thanks,

dkrichards16 · ‎08-31-2017

We found the issue. When I escaped less than in the searchbase I accidentally used greater than so the search brought back no results.

dkrichards16 · ‎08-30-2017

I have two Splunk DB Connect SQL queries that I appended into a search and it worked. However, when I append it in the search for a dashboard, which is then used for an inline panel search to provide a total it doesn't add the appended information to the total. Are we allowed to use append in search bases?

dkrichards16 · ‎06-09-2017

I'm not super familiar with macros in Splunk yet but I'll keep this in mind. Thanks

Posts	22
Solutions	1
Karma Given	1
Karma Received	4
Member Since	‎06-09-2017

Online Status	Offline
Date Last Visited	‎07-16-2020 02:23 PM

Splunk Search Heads in infinite loop of refreshing

| tunefs not working when searching in the Alerts ...

Cisco Teams

Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER

What is the server role of heavy forwarder and ind...

Why is the custom cluster map visualization app ic...

loginCustomLogo broken link

Splunk Add-on for Mobile Access with Splunk Enterp...

Help using append in a search

Is there an efficient way to convert booleans in m...

Splunk Search Heads in infinite loop of refreshing

Re: How do I remove a search head that is appearin...

| tunefs not working when searching in the Alerts ...

Cisco Teams

Re: Add a help panel to a dashboard?

Re: Which is faster: SHOULD_LINEMERGE vs LINE_BREA...

Re: Which is faster: SHOULD_LINEMERGE vs LINE_BREA...

Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER

Re: What is the server role of heavy forwarder and...

Re: What is the server role of heavy forwarder and...

What is the server role of heavy forwarder and ind...

Why is the custom cluster map visualization app ic...

Re: loginCustomLogo broken link

Re: Putting a custom logo on the login screen

loginCustomLogo broken link

Re: Splunk Add-on for Mobile Access with Splunk En...

Splunk Add-on for Mobile Access with Splunk Enterp...

Re: Help using append in a search

Help using append in a search

Re: Is there an efficient way to convert booleans ...