or is there a way we can delete any conf file using api call which Splunk recognizes? as I am creting it using API call and during deletion, we can manually delete the file and do a splunk restart as a work around, but would be helpful to understand if there is any better way? Thanks. ... View more

for syslog service syslog restart Redirecting to /bin/systemctl restart syslog.service Failed to restart syslog.service: Unit not found. in this scenario, splunk will accept from rsyslog or syslog-ng (client) or server side too we should have the respective rsyslog/ syslog-ng conf ... View more

Thanks @PavelP ... View more

by the way this result format is specified in any file or its text format by default? ... View more

Hi @PavelP , thanks for the above. I've done similar works fine. However I wanted to understand from Splunk filters. Looks like there are nothing. Thanks again for your inputs. ... View more

Thanks for you help @harsmarvania57 ... View more

This is working now 🙂 After changing max_peers_to_download_bundle value which was 5 in our settings. ... View more

However I will check the Link provided and come back ... View more

in this environment we have 4 indexers. I verified the size, before upgrade it was 187MB (4 days before) now it is showing 697 MB (how can I verify what is being added additionally - may be the issue with TAs which needs verifying?). I verified logs and see below: 04-01-2020 16:04:49.972 +0100 INFO CMBundleMgr - setting latest bundle= to active bundle=Bundle-ID 04-01-2020 16:04:49.972 +0100 INFO CMBundleMgr - apply bundle status transitioning from='Bundle validation is in progress.', to='None' 04-01-2020 16:04:49.972 +0100 INFO CMRepJob - running job=CMBundleRemoveJob bundle=[id=, path=/$SPLUNK_HOME/var/run/splunk/cluster/remote-bundle/.bundle] 04-01-2020 16:04:51.938 +0100 INFO CMBundleMgr - Removed the untarred bundle folder=/$SPLUNK_HOME/var/run/splunk/cluster/remote-bundle/ One of the older logs I see: 04-01-2020 16:03:02.222 +0100 WARN DistributedBundleReplicationManager - Asynchronous bundle replication to 9 peer(s) succeeded; however it took too long (longer than 10 seconds): elapsed_ms=13911, tar_elapsed_ms= 2019 , for 9 peer(s), bundle_replication_mode="baseline", bundle_file_name=utility-server-1.bundle, bundle_size=155030KB, replication_id=111111111, replication_reason="async replication allowed" Should I back-out the upgrade and test? ... View more

It was not like this earlier, We never used to perform this activity, as said this is happening in only one environment where we upgraded Splunk to 7.3.4 Hence thinking whether upgrade is causing issue (current version expires in next 20 days so need to decide a way forward). Code is updating in master-apps but not pushed to slave-apps, is it only from .bundle or something else I need to check (I am not a Splunk expert though 🙂 ... View more

yes - for this case but never it was like this. this should be done automatically (though I am not a splunk expert but this is what I have seen). Same is not happening with other environment where my splunk is running with 7.1 Also I just tried pushing code into indexer and see the same, .bundle getting created and removed automatically. Code is updated under master-apps but not been pushed to slave-apps (is id due to .bundle or something else I am missing)? when I see the cluster status: master cluster_status=None active_bundle checksum= value1 timestamp=1585595012 (in localtime=Mon Mar 30 20:03:32 2020) latest_bundle checksum= value1 timestamp=1585595012 (in localtime=Mon Mar 30 20:03:32 2020) last_validated_bundle checksum= value2 last_validation_succeeded=1 timestamp=1585742519 (in localtime=Wed Apr 1 13:01:59 2020) [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_ML_Toolkit/default/experiments.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_imperva-waf/default/eventgen.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_microsoft-sqlserver/default/sqlserver_dbx2.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_oracle/default/db_input_templates.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_sourcefire/default/eventgen.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_squid/default/eventgen.conf ... View more

Also I just modified the code and pushed it for indexer. I see the .bundle created and then removed automatically cluster status command shows below: master cluster_status=None active_bundle checksum= value1 timestamp=1585595012 (in localtime=Mon Mar 30 20:03:32 2020) latest_bundle checksum= value1 timestamp=1585595012 (in localtime=Mon Mar 30 20:03:32 2020) last_validated_bundle checksum= value2 last_validation_succeeded=1 timestamp=1585742519 (in localtime=Wed Apr 1 13:01:59 2020) [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_ML_Toolkit/default/experiments.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_imperva-waf/default/eventgen.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_microsoft-sqlserver/default/sqlserver_dbx2.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_oracle/default/db_input_templates.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_sourcefire/default/eventgen.conf [Not Critical]No spec file for: $Splunk_Home/etc/master-apps/Splunk_TA_squid/default/eventgen.conf ... View more

yes, I have tried manually still it is not working unless I need to move existing .bundle file to bak file and generate new bundle by restarting Splunk service, post this when I am running my puppet code, it is then replicated (with updated bundle). ... View more