About conwaw

conwaw · ‎10-14-2021

Hi, we have a cluster environment with 6 indexers. Each host has 128GB Ram, but as I see Splunk using only ~4GB. Is there any chance to optimize (speedup) memory usage and let splunk to use for example 100GB of RAM ? I have tons of different indexers with different dashboards .... If yes, how to do it ? Cheers Konrad

conwaw · ‎05-27-2020

Hi, I have installed Splunk Enterprise system with multiple users. Each our user has access only to specified indexes. In our Searchhead I have installed Splunk DB Connect App. This app include two user roles: db_connect_admin (with admin permissions) db_connect_user (with user permission) To allowed my users (~400 users) use Splunk DB Connect App I have assigned for each user new role - db_connect_user. After few weeks one of my users discovered that he has full access to all indexes. I was really surprised because till now everything was restricted. I have reviewed all roles and I realised that each user with assigned role db_connect_user has full access to all indexes. This is enterprise system with a lot of indexes with sensitive informations. Problem is generated by this field (Role -> Indexes -> All non-internal indexes) which cannot be deactivated in GUI (or I do not know how to do it - maybe some one will help here) : I have got information from support that this capability cannot be deactivated, which is wrong. I have deinstalled Splunk DB Connect App - and everything get back to normal. I just would like to warn all users, that installation of that addon generating high risk of data leak. I have opened ticket to support but as I see our discussion going to nowhere... Maybe some one will be able to help me and tell me how to deactivate in role field "indexes > All non-internal indexes " ??? I`m using latest release of that App and Splunk 8.0. I appreciate any hints. Cheers Konrad

conwaw · ‎04-30-2020

Hi, thank You for Your time and support. :))))) In did, ../ui folder was almost empty. [splunk@deda1000 ui]$ pwd /opt/splunk/etc/apps/Splunk_TA_cisco-esa/default/data/ui [splunk@deda1000 ui]$ ll total 4 drwxr-xr-x 2 splunk splunk 4096 Jul 4 2018 panels [splunk@deda1000 ui]$ I have created ..\nav and ..\views folder with default.xml inside ..\nav. ..\views folder is empty. Log showing this: 2020-04-30 14:33:22,055 INFO [5eaac592097febdc08ae50] startup:139 - Splunk appserver version=8.0.0 build=1357bef0a7f6 isFree=False isTrial=False 2020-04-30 14:33:22,104 INFO [5eaac592097febdc08ae50] cached:163 - /opt/splunk/etc/apps/Splunk_TA_cisco-esa/appserver/static/setup.json 2020-04-30 14:33:22,148 WARNING [5eaac592097febdc08ae50] appnav:404 - An unknown view name "Servers" is referenced in the navigation definition for "Splunk_TA_cisco-esa". 2020-04-30 14:33:22,148 WARNING [5eaac592097febdc08ae50] appnav:404 - An unknown view name "Templates" is referenced in the navigation definition for "Splunk_TA_cisco-esa". 2020-04-30 14:33:22,148 WARNING [5eaac592097febdc08ae50] appnav:404 - An unknown view name "Tasks" is referenced in the navigation definition for "Splunk_TA_cisco-esa". 2020-04-30 14:33:22,149 INFO [5eaac592097febdc08ae50] error:321 - Masking the original 404 message: 'Splunk cannot find the "None" view.' with 'Page not found!' for security reasons still not working... I suspect that my script removed (rm -rf ./Splunk_TA_cisco-esa) app folder instead of deinstall ./bin/splunk remove app Splunk_TA_cisco-esa . I have just installed splunk local and will try to deploy that app, after deployment I will copy app folder to prod system and then try to uninstall. Maybe this will help. Let me try it.

conwaw · ‎04-29-2020

HI Pavel, thanks for Your feedback. I have reviewed mentioned folder. Except all users it include two folders and file: ./splunk-system-user ./uname ./users.ini There are no mods. Few weeks ago I have renamed that app and I suspect that, this name change modified something. Maybe its cached somewhere ? I have clean up browser cache but it didnt helped. Do You have any other ideas ?

conwaw · ‎04-29-2020

Just would like to add logs from web_service.log for that incident. Maybe some one knows how to solve it ? 2020-04-29 11:25:05,547 INFO [5ea947f1877f198ba62e10] startup:139 - Splunk appserver version=8.0.0 build=1357bef0a7f6 isFree=False isTrial=False 2020-04-29 11:25:05,632 WARNING [5ea947f1877f198ba62e10] appnav:404 - An unknown view name "Servers" is referenced in the navigation definition for "Splunk_TA_cisco-esa". 2020-04-29 11:25:05,632 WARNING [5ea947f1877f198ba62e10] appnav:404 - An unknown view name "Templates" is referenced in the navigation definition for "Splunk_TA_cisco-esa". 2020-04-29 11:25:05,632 WARNING [5ea947f1877f198ba62e10] appnav:404 - An unknown view name "Tasks" is referenced in the navigation definition for "Splunk_TA_cisco-esa". 2020-04-29 11:25:05,633 INFO [5ea947f1877f198ba62e10] error:321 - Masking the original 404 message: 'Splunk cannot find the "None" view.' with 'Page not found!' for security reasons

conwaw · ‎04-29-2020

HI, how to properly (completly) remove Splunk addon and install it again ? My deployment script redeploying all Splunk addons/apps using this command: $HOME_SPLUNK/bin/splunk remove app app_name $HOME_SPLUNK/bin/splunk install app app_name What is strange, You will be able to redeploy applications this way, till You will create some dashboard in app or You will modify something in Your app/addon. Afterwards, when You will reinstall Your app with this two commands - You will not have an access to it anymore. I have tested it with Cisco ESA addon. Everything is working fine till I will start using that app. Afterwards, when app is configured and my script will remove and install app again - I see error 404. I suspect that application generating some searches which are not properly removed by "./splunk remove app" command. This problem appear for example in addon: Splunk-App-CISCO-ESA. Maybe some one will be able to help me and show me the way how to properly deploy/redeploy apps in searchhead using command line. How to avoid 404 errors afterwards ? Thanks in advance for Your support. Dlugi

conwaw · ‎04-14-2020

I cannot use Your command because nothing listen on port 8191. This is my problem, its not starting.

conwaw · ‎04-11-2020

Hi, Does anyone know where may I find official documentation which will help me to resolve this problem? I have renewed a certificate using this tutorial, but for some reason, MongoDB is still not starting. https://splunkonbigdata.com/2019/07/03/failed-to-start-kv-store-process-see-mongod-log-and-splunkd-log-for-details/ mongodb.log is showing this error... 2020-04-11T10:27:08.899Z W CONTROL [main] net.ssl.sslCipherConfig is deprecated. It will be removed in a future release. 2020-04-11T10:27:08.902Z F NETWORK [main] The provided SSL certificate is expired or not yet valid. 2020-04-11T10:27:08.902Z F - [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager.cpp 1145 2020-04-11T10:27:08.902Z F - [main] ***aborting after fassert() failure Can anyone here help? Cheers Konrad

conwaw · ‎03-06-2020

Hi, in my organization we have full automated Splunk Enterprise environment. Automated except one thing - apps in search head. I would like to kindly ask You for some advice's, how to organize Search Head environment for multiple users. In our environment we have 50% Splunk advanced users (apps developers) and 50% dashboard readers. At the moment everyone using Search App as default one - each user storing there all searches. How to backup each user environment ? On many YouTube Splunk movies I saw that many people creating Splunk App and storing there all informations. Then app is located in HOME_SPLUNK/etc/apps/user-appname and could be easily managed by system administrator (tar,backup,restore). The problem is that only admin can create apps. Is there any way to store users search environments in some containers/folders which administrator can easily manipulate. I would like to store Splunk Apps in git repo and user search enviornments somewhere in backup. So if i will do search head deployment, my script will install list of current apps and restore last backup of user searches. How to manage it in the best way ? I will appreciate it any support. Thanks in advance

Posts	9
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎03-06-2020

Online Status	Offline
Date Last Visited	‎07-07-2023 12:04 AM

Splunk - memory usage, how to optimize ?

DB Connect App generating data leak issue - each u...

Problem with reinstallation of apps/addons - error...

Why is KV Store certificate renewal not working?

Splunk apps best practices - how to organize user ...

Splunk - memory usage, how to optimize ?

DB Connect App generating data leak issue - each u...

Re: Problem with reinstallation of apps/addons - e...

Re: Problem with reinstallation of apps/addons - e...

Re: Problem with reinstallation of apps/addons - e...

Problem with reinstallation of apps/addons - error...

Re: kvstore certificate renewal is not working...

Why is KV Store certificate renewal not working?

Splunk apps best practices - how to organize user ...