Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About computermathguy
computermathguy
Path Finder
Member since:
08-27-2014
2 weeks ago
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 13 |
| Karma Received | 5 |
| Member Since | 08-27-2014 |
Activity Feed
- Posted Re: Why Am I Seeing Events In The Future And How Do I Stop It on Splunk Search. 2 weeks ago
- Posted Re: Why am I getting "ERROR: The http port [8000] is already bound." trying to start Splunk after installation on Installation. 01-21-2025 06:46 AM
- Karma Re: Why am I getting "ERROR: The http port [8000] is already bound." trying to start Splunk after installation on Linux? for vnguyen46. 01-21-2025 06:43 AM
- Got Karma for Re: Forgot Pass4symmKey. 01-06-2025 08:51 PM
- Got Karma for Re: Flagged Risky Commands- Why is Splunk no longer recognizing command?. 01-03-2025 01:59 AM
- Got Karma for Re: Python 2.7 present and shouldn't be. 12-22-2024 10:53 PM
- Karma Re: File Integrity Check for dural_yyz. 11-07-2024 01:42 PM
- Karma Re: Python 2.7 present and shouldn't be for cmuesing. 11-07-2024 01:03 PM
- Posted Re: Python 2.7 present and shouldn't be on Splunk Search. 11-07-2024 01:02 PM
- Posted Re: Anonymizing (Masking) Data Using SEDCMD on Splunk Enterprise. 09-19-2024 10:58 AM
- Karma Re: Why am I unable to apply search head cluster bundle? for skrivis. 09-19-2024 10:44 AM
- Posted Anonymizing (Masking) Data Using SEDCMD on Splunk Enterprise. 09-18-2024 10:35 AM
- Posted Re: Splunk CAC Authentication not working on Security. 09-12-2024 01:48 PM
- Karma Re: Splunk CAC Authentication not working for cmcgee_splunk. 09-12-2024 07:15 AM
- Posted Re: Splunk CAC Authentication not working on Security. 09-12-2024 07:12 AM
- Got Karma for Re: Forgot Pass4symmKey. 08-30-2024 07:09 AM
- Posted Re: The Client forwarder management not showing the clients on Deployment Architecture. 07-26-2024 03:34 PM
- Posted Re: KV Store status failed on Splunk Enterprise. 07-23-2024 06:20 AM
- Karma Re: KV Store status failed for syazwani. 07-23-2024 06:19 AM
- Got Karma for Re: Invalid message type: 28 during Splunk ES 7.1 Upgrade. 05-28-2024 09:16 AM
Topics I've Started
2 weeks ago
One of our timecharts showed "future" time (by one hour) on the x-axis. Turns out the server time was off by one hour.
... View more
01-21-2025
06:46 AM
My SHC captain displayed the message: Checking http port [8000]: not available ERROR: http port [8000] - port is already bound. Splunk needs to use this port. Would you like to change ports? [y/n]: Killing the pid correlated to port 8000 worked.
... View more
11-07-2024
01:02 PM
1 Karma
We just upgraded from 9.2.2 to 9.2.3 and started getting the python integrity warnings. File path Check result File path Check result /opt/splunk/bin/jp.py present_but_shouldnt_be /opt/splunk/bin/python2.7 present_but_shouldnt_be
... View more
09-19-2024
10:58 AM
Yes..... Is there a way to implement masking globally? If not, I assume we to add each sourcetype in props.
... View more
09-18-2024
10:35 AM
As a test, I first created some credit card numbers using a python script.
I placed the script, along with inputs and props, on the search head. I only placed props on the indexers.
The following SEDCMD will mask the 1st and 3rd set of 4-digits. The two groups (2nd and 4th set of 4-digits) will not be masked.
props:
[cc_generator]
SEDCMD-maskcc = s/\d{4}-(\d{4})-\d{4}-(\d{4})/xxxx-\1-xxxx-\2/g
inputs:
[script://./bin/my_cc_generator.py]
interval = */30 * * * *
sourcetype = cc_generator
disabled = 0
index = mypython
output:
xxxx-9874-xxxx-9484
... View more
Labels
- Labels:
-
development
09-12-2024
01:48 PM
Adding this attribute enableCertBasedUserAuth = true \ to web.conf, generates the below proxy error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request Reason: Error reading from remote server
... View more
09-12-2024
07:12 AM
Since Splunk 6.x we have been using a proxy server (Apache) with Splunk to pass the user's CAC credentials to Splunk. Is it true that with 9.2.2, a proxy is no longer needed? I'm also trying to implement CAC authentication following Configure Splunk Enterprise to use a common access card for authentication - Splunk Documentation and Configuring Splunk for Common Access Card (CAC) authentication - Splunk Lantern, but now getting the following error message: "This site can't be reached"
... View more
07-26-2024
03:34 PM
Created a local directory within the SplunkDeploymentServerConfig app. Added the outputs.conf
/opt/splunk/etc/apps/SplunkDeploymentServerConfig/local/outputs.conf
[indexAndForward]
index = true
selectiveIndexing = true
Clients started reporting to the DS after restarting Splunk. Thankful I found this thread.
... View more
04-05-2024
10:04 AM
Thanks..... Worked like a charm.
... View more
01-09-2024
09:32 AM
Does anyone know if version 7.x of Threat Defense Manager (f.k.a. Firepower Management Center) is compatible with the latest version of Cisco's eStreamer add-on? https://splunkbase.splunk.com/app/3662
... View more
Labels
- Labels:
-
troubleshooting
01-09-2024
09:00 AM
Recently we upgraded FMC from 6.x to 7.x and noticed no data was being streamed into the /opt/splunk/etc/apps/TA-eStreamer/bin/encore/data/splunk directory. We then started getting a firewall error when testing the connection.. Does anyone know if FMC 7.x is compatible with the TA-eStreamer add-on? ./splencore.sh test Diagnostics ERROR [no message or attrs]: Could not connect to eStreamer Server at all. Are you sure the host and port are correct? If so then perhaps it is a firewall issue.
... View more
11-15-2023
10:38 AM
2 Karma
Just make sure you use single quotes around the encrypted password. /opt/splunk/bin/splunk show-decrypted --value '<your encrypted password>'
... View more
10-02-2023
01:35 PM
After creating the /opt/splunk/etc/apps/search/README directory, I ran "cat > alert_actions.conf.spec" within the README directory.
... View more
10-02-2023
11:24 AM
Getting the same warning. I'll submit a support ticket.
... View more
08-28-2023
09:38 AM
We managed to resolve the the "type 28 / 500 internal server" Enterprise Security installation error by cleaning out /tmp.
... View more
08-28-2023
09:27 AM
We got the same error for all the members of the cluster. When it occurred, we had to restart Splunk on each member.
... View more
08-25-2023
12:32 PM
1 Karma
I just noticed the same type-28 error. Before this occurred, were getting a "500 Internal Server" error. We are on Splunk 9.0.5 Waiting to hear back from Splunk support if they can resolve the UI install issue with ES 7.1.1
... View more
08-14-2023
10:46 AM
1 Karma
If you add the stanza [fit] is_risky=false to /opt/splunk/etc/shcluster/apps/Splunk_ML_Toolkit/local/commands.conf on the SHC deployer, then apply the bundle to the SHC members, it seems to have resolved the problem of Splunk not finding fit.py.
... View more
08-14-2023
10:14 AM
Had a similar issue. After adding "[fit] is_risky = false" to commands.conf, Splunk complained that it could not find fit.py when executing the fit command from within my app. However, it could find fit.py if I ran the fit command within the MLTK app.
... View more
07-13-2023
07:55 AM
Did Splunk have any recommendations? I'm having the same issue.
... View more
04-11-2023
11:29 AM
I believe match="relative_time(now(), "-5m") >= $start_time$" should be match="relative_time(now(), "-5s") >= $start_time$"
... View more
02-21-2023
08:49 AM
This just happened to me on 8.2.6. Installed the new Upgrade Readiness app (ver 4.0.2) which overwrote the older 1.0 version.
... View more
02-15-2023
07:15 AM
Has anyone seen the following message after upgrading the storage engine to WireTiger? Executing: splunk migrate migrate-kvstore Output: [App Key Value Store migration] Collection data is not available.
... View more
01-18-2023
07:14 AM
We just upgraded to 8.2.6 and the bucket alerts still persist.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Karma from
