About joe06031990

joe06031990 · ‎12-12-2024

Thanks I will give it a try

joe06031990 · ‎12-12-2024

Hi, I can see the below error in the internal logs for a host that is not bringing any logs in Splunk error SSLOptions [17960 TcListener] - inputs. conf/[SSL]: could not read properties; we don’t have ssl options in inputs.conf just wondered if there was any other locations to check on the universal forwarder as it works fine for other servers.

joe06031990 · ‎10-29-2024

Hi, just wondered if oracle cloud had tagging to onboard data like AWS does for Splunk like this: splunk add monitor /var/log/secure thanks

joe06031990 · ‎10-23-2024

Hi, in getting a 201 token error on Splunk cloud maintenance dashboard. just wondered if anyone has seen this before.

joe06031990 · ‎09-18-2024

Hi, Is the Dnslookup available in Splunk cloud like enterprise?

joe06031990 · ‎05-17-2024

Hi, Is there a way of bulk enabling alerts in Splunk enterprise? Thanks, Joe

joe06031990 · ‎11-12-2023

Thanks, if I enable maintenance mode won’t that stop data coming in or will the indexers that are up still be receiving data?

joe06031990 · ‎11-11-2023

Hi, we have a two site 6 indexer cluster 3 per site and we are upgrading the CPU and each site will be offline for 3 hours per site, do I need to do anything on Splunk or do I need to run ./Splunk offline on 3 indexers at a time before they are shut down? Thanks

joe06031990 · ‎08-21-2023

Hi, On certain events the indexed time is 24h after the event _time across all indexes on Splunk cloud, just wondered if anyone has seen this before it doesn’t look to matter on the source type that is used. thanks,

joe06031990 · ‎05-12-2023

Hi, I have two servers with identical server classes and apps one has onboard /var/log/secure and one has not, the one that has not has that message about the offset but the one which has doesn't have the offset message.

joe06031990 · ‎05-12-2023

Hi, I am onboarding the /var/log/secure path and i am getting the bellow about offset INFO WatchedFile /path/to/file.log Will begin reading at offset=253 for file Just wondered what I could do to resolve this? Thanks, Joe

joe06031990 · ‎05-12-2023

Hi, I am trying to use btool to find an index that is used in an inputs.conf: ./splunk btool inputs list --debug | grep "indexname" However I get nothing back, am I doing something wrong? Thanks, Joe

joe06031990 · ‎04-25-2023

Hi, We have integration with ServiceNow however we have an alert in a custom App to create a ticket to service now however the Problem_URL is wrong and is pointing to the search app instead of the custom app. I have checked the saved search in _internal logs and it is correct. Any help would be greatly appreciated. Thanks

joe06031990 · ‎02-27-2023

hi, Spunk universal forwarder version 9..0.3 running at 100% cpu on Linux even after a restart is their a known issue/workaround for this? thanks, joe

joe06031990 · ‎02-21-2023

Hi, For field extractions in a clustered environment do you have to use the props.conf method or can you use the field extractor GUI on the search head? Thanks, Joe

joe06031990 · ‎02-17-2023

Yeah I want to completely remove 2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359.

joe06031990 · ‎02-16-2023

Hi, I have the bellow event: {"log":"2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359 1 connection.go:153] connecting to UNIX:///csi/csi.sock" I need to remove 2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359 and have tried rex but unable to do so, just wondered if someone could help me? Thanks, Joe

joe06031990 · ‎02-10-2023

Thanks

joe06031990 · ‎01-30-2023

Hi, What would the btool command be to find a certain part Of an input.conf file? Thanks

joe06031990 · ‎01-30-2023

Hi, on Splunk cloud can you create a blank Splunk app for storing dashboards,alerts and reports or does it need reviewing by Splunk? thanks

joe06031990 · ‎11-13-2022

Looks like there was a fault with two of the search head nodes.

joe06031990 · ‎11-09-2022

Hi , the timeframe is set to today and the span in the time chart is 1 hour. sometime the volume is lower or higher from the same hour.

joe06031990 · ‎11-09-2022

Hi, on our Splunk instance I have set a report using a time chart with a span of 1h and time frame of a day and the report is scheduled to run every hour however each time the report runs it shows different results. Just wondered if anyone has seen this before? thanks, joe

joe06031990 · ‎07-30-2022

Hi, just wondering for the Microsoft Cloud Services from the documentation it says it is only required on the search head cluster however it does say optional on the heavy forwarder. My question is usually I setup the inputs on the deployment server however as this is cloud data should the inputs.conf be on the heavy forwarder or the search head? Thanks, Joe

joe06031990 · ‎07-24-2022

Thanks

Posts	125
Solutions	4
Karma Given	37
Karma Received	0
Member Since	‎03-08-2020

Online Status	Offline
Date Last Visited	‎06-03-2025 04:01 AM

Error in internal logs for ssl for inputs.conf

Oracle cloud tagging

201 token error on Splunk cloud maintenance dashbo...

Dnslookup command splunk cloud

Bulk enabling alerts

Splunk indexer cluster CPU upgrade

On certain events the indexed time is 24h after th...

How can I resolve Splunk input offset?

Using btool to find an index in a monitor stanza

Why is Splunk to Servicenow Problem_url incorrect?

Re: Error in internal logs for ssl for inputs.conf

Error in internal logs for ssl for inputs.conf

Oracle cloud tagging

201 token error on Splunk cloud maintenance dashbo...

Dnslookup command splunk cloud

Bulk enabling alerts

Re: Splunk indexer cluster CPU upgrade

Splunk indexer cluster CPU upgrade

On certain events the indexed time is 24h after th...

Re: Splunk input offset

How can I resolve Splunk input offset?

Using btool to find an index in a monitor stanza

Why is Splunk to Servicenow Problem_url incorrect?

Spunk universal forwarder version 9.0.3 running at...

Do you have to use the props.conf method or GUI fo...

Re: Rex issue

How to write rex to remove?

Re: What would the btool command be to find a cert...

What would the btool command be to find a certain ...

Can you create a blank Splunk app for storing dash...

Re: Inconsistent results in Splunk

Re: Inconsistent results in Splunk

Has anyone else got inconsistent results in Splunk...

Microsoft Cloud Services Add on installation

Re: How to create an Alert for an increase in IIs ...

Are you a member of the Splunk Community?