Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About computermathguy
computermathguy
Path Finder
Member since:
08-27-2014
4 weeks ago
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 13 |
| Karma Received | 7 |
| Member Since | 08-27-2014 |
Activity Feed
- Posted Re: After upgrading from 9.0.3 version to 9.1.0 Version facing the below Error (in Cluster Master, Search head) on Splunk Enterprise. 4 weeks ago
- Posted Re: Why am I getting Invalid key in stanza [clustermaster:one] on Installation. 4 weeks ago
- Posted Re: Search head keeps failing in search head cluster on Deployment Architecture. 08-11-2025 07:50 AM
- Posted Re: How to integrate SA-Investigator with ES on Splunk Enterprise Security. 08-08-2025 09:47 AM
- Posted Re: Some Windows UF not sending Security logs on Getting Data In. 07-25-2025 05:37 AM
- Got Karma for Re: Forgot Pass4symmKey. 06-17-2025 12:25 PM
- Posted Re: Splunk CAC Authentication not working on Security. 04-24-2025 01:29 PM
- Posted Re: How to add dark theme compatibility to custom app? on Splunk Search. 04-24-2025 06:47 AM
- Posted Re: Disabling Splunk Secure Gateway in a Cluster Deployment on Installation. 04-16-2025 05:44 AM
- Posted Re: Why Am I Seeing Events In The Future And How Do I Stop It on Splunk Search. 03-11-2025 08:33 AM
- Posted Re: Why am I getting "ERROR: The http port [8000] is already bound." trying to start Splunk after installation on Installation. 01-21-2025 06:46 AM
- Karma Re: Why am I getting "ERROR: The http port [8000] is already bound." trying to start Splunk after installation on Linux? for vnguyen46. 01-21-2025 06:43 AM
- Got Karma for Re: Forgot Pass4symmKey. 01-06-2025 08:51 PM
- Got Karma for Re: Flagged Risky Commands- Why is Splunk no longer recognizing command?. 01-03-2025 01:59 AM
- Got Karma for Re: Python 2.7 present and shouldn't be. 12-22-2024 10:53 PM
- Karma Re: File Integrity Check for dural_yyz. 11-07-2024 01:42 PM
- Karma Re: Python 2.7 present and shouldn't be for cmuesing. 11-07-2024 01:03 PM
- Posted Re: Python 2.7 present and shouldn't be on Splunk Search. 11-07-2024 01:02 PM
- Posted Re: Anonymizing (Masking) Data Using SEDCMD on Splunk Enterprise. 09-19-2024 10:58 AM
- Karma Re: Why am I unable to apply search head cluster bundle? for skrivis. 09-19-2024 10:44 AM
Topics I've Started
4 weeks ago
The change from [clustermaster:one] to [clustermanager:one] also worked for me. No more "invalid key" warning.
... View more
4 weeks ago
Did you change [clustermaster:one] to [clustermanager:one] ? The change worked for me. https://community.splunk.com/t5/Splunk-Enterprise/After-upgrading-from-9-0-3-version-to-9-1-0-Version-facing-the/m-p/698051
... View more
08-11-2025
07:50 AM
I added the following to server.conf on the SHC members. [httpServer] maxThreads = 8000 maxSockets = 8000
... View more
08-08-2025
09:47 AM
I needed to preface the view name with /app/SplunkEnterpriseSecuritySuite/ Sample: Investigate Identity Artifacts - "/app/SplunkEnterpriseSecuritySuite/ident_by_name" Investigate Asset Artifacts - "/app/SplunkEnterpriseSecuritySuite/asset_artifacts" Investigate File/Process Artifacts - "/app/SplunkEnterpriseSecuritySuite/file_artifacts"
... View more
07-25-2025
05:37 AM
On some our Windows UF hosts, we were getting System events but no Security events. Our Windows admin noticed that the Splunk service account was running as an NT service. After changing the service account to LocalSystem, the Windows UF hosts started sending their security events.
... View more
04-24-2025
01:29 PM
Sorry for the late response. We opted to stay with using Apache as an SSL proxy to pass the user's credentials to Splunk.
... View more
04-24-2025
06:47 AM
Thanks for the info. I had a user wondering why the theme was not changing to dark on the custom app.
... View more
04-16-2025
05:44 AM
I assume app should be [install] state = disable or disabled ?
... View more
03-11-2025
08:33 AM
One of our timecharts showed "future" time (by one hour) on the x-axis. Turns out the server time was off by one hour.
... View more
01-21-2025
06:46 AM
My SHC captain displayed the message: Checking http port [8000]: not available ERROR: http port [8000] - port is already bound. Splunk needs to use this port. Would you like to change ports? [y/n]: Killing the pid correlated to port 8000 worked.
... View more
11-07-2024
01:02 PM
1 Karma
We just upgraded from 9.2.2 to 9.2.3 and started getting the python integrity warnings. File path Check result File path Check result /opt/splunk/bin/jp.py present_but_shouldnt_be /opt/splunk/bin/python2.7 present_but_shouldnt_be
... View more
09-19-2024
10:58 AM
Yes..... Is there a way to implement masking globally? If not, I assume we to add each sourcetype in props.
... View more
09-18-2024
10:35 AM
As a test, I first created some credit card numbers using a python script.
I placed the script, along with inputs and props, on the search head. I only placed props on the indexers.
The following SEDCMD will mask the 1st and 3rd set of 4-digits. The two groups (2nd and 4th set of 4-digits) will not be masked.
props:
[cc_generator]
SEDCMD-maskcc = s/\d{4}-(\d{4})-\d{4}-(\d{4})/xxxx-\1-xxxx-\2/g
inputs:
[script://./bin/my_cc_generator.py]
interval = */30 * * * *
sourcetype = cc_generator
disabled = 0
index = mypython
output:
xxxx-9874-xxxx-9484
... View more
Labels
- Labels:
-
development
09-12-2024
01:48 PM
Adding this attribute enableCertBasedUserAuth = true \ to web.conf, generates the below proxy error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request Reason: Error reading from remote server
... View more
09-12-2024
07:12 AM
Since Splunk 6.x we have been using a proxy server (Apache) with Splunk to pass the user's CAC credentials to Splunk. Is it true that with 9.2.2, a proxy is no longer needed? I'm also trying to implement CAC authentication following Configure Splunk Enterprise to use a common access card for authentication - Splunk Documentation and Configuring Splunk for Common Access Card (CAC) authentication - Splunk Lantern, but now getting the following error message: "This site can't be reached"
... View more
07-26-2024
03:34 PM
Created a local directory within the SplunkDeploymentServerConfig app. Added the outputs.conf
/opt/splunk/etc/apps/SplunkDeploymentServerConfig/local/outputs.conf
[indexAndForward]
index = true
selectiveIndexing = true
Clients started reporting to the DS after restarting Splunk. Thankful I found this thread.
... View more
04-05-2024
10:04 AM
Thanks..... Worked like a charm.
... View more
01-09-2024
09:32 AM
Does anyone know if version 7.x of Threat Defense Manager (f.k.a. Firepower Management Center) is compatible with the latest version of Cisco's eStreamer add-on? https://splunkbase.splunk.com/app/3662
... View more
Labels
- Labels:
-
troubleshooting
01-09-2024
09:00 AM
Recently we upgraded FMC from 6.x to 7.x and noticed no data was being streamed into the /opt/splunk/etc/apps/TA-eStreamer/bin/encore/data/splunk directory. We then started getting a firewall error when testing the connection.. Does anyone know if FMC 7.x is compatible with the TA-eStreamer add-on? ./splencore.sh test Diagnostics ERROR [no message or attrs]: Could not connect to eStreamer Server at all. Are you sure the host and port are correct? If so then perhaps it is a firewall issue.
... View more
11-15-2023
10:38 AM
3 Karma
Just make sure you use single quotes around the encrypted password. /opt/splunk/bin/splunk show-decrypted --value '<your encrypted password>'
... View more
10-02-2023
01:35 PM
After creating the /opt/splunk/etc/apps/search/README directory, I ran "cat > alert_actions.conf.spec" within the README directory.
... View more
10-02-2023
11:24 AM
Getting the same warning. I'll submit a support ticket.
... View more
08-28-2023
09:38 AM
We managed to resolve the the "type 28 / 500 internal server" Enterprise Security installation error by cleaning out /tmp.
... View more
08-28-2023
09:27 AM
We got the same error for all the members of the cluster. When it occurred, we had to restart Splunk on each member.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
4 weeks ago
|
Karma from
