Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About computermathguy
computermathguy
Communicator
Member since:
08-27-2014
Wednesday
Community Statistics
| Posts | 41 |
| Solutions | 0 |
| Karma Given | 23 |
| Karma Received | 7 |
| Member Since | 08-27-2014 |
Activity Feed
- Karma Spike in 503 errors in the Splunk WebUI after upgrading to 10.0.3 (also affects 9.2.10/9.3.9/9.4.8/10.2.0) for livehybrid. 03-06-2026 12:25 PM
- Posted Re: Spike in 503 errors in the Splunk WebUI after upgrading to 10.0.3 (also affects 9.2.10/9.3.9/9.4.8/10.2.0) on Splunk Enterprise. 03-06-2026 11:57 AM
- Karma Re: Spike in 503 errors in the Splunk WebUI after upgrading to 10.0.3 (also affects 9.2.10/9.3.9/9.4.8/10.2.0) for verbal_666. 03-06-2026 11:57 AM
- Karma Re: 9.3.6 to 9.3.9 ... freuently WebUI timeout! for verbal_666. 03-06-2026 11:20 AM
- Karma Re: 9.3.6 to 9.3.9 ... freuently WebUI timeout! for verbal_666. 03-06-2026 11:20 AM
- Karma Re: 9.3.6 to 9.3.9 ... freuently WebUI timeout! for livehybrid. 03-06-2026 11:19 AM
- Posted Re: 9.3.6 to 9.3.9 ... frequently WebUI timeout! on Splunk Enterprise. 03-06-2026 06:22 AM
- Karma 9.3.6 to 9.3.9 ... frequently WebUI timeout! for verbal_666. 03-06-2026 06:20 AM
- Posted Re: Spike in 503 errors in the Splunk WebUI after upgrading to 10.0.3 (also affects 9.2.10/9.3.9/9.4.8/10.2.0) on Splunk Enterprise. 03-05-2026 07:16 AM
- Posted Re: What capabilities are needed to run sendemail command? on Reporting. 12-10-2025 01:15 PM
- Posted Re: Database connection is invalid setup for MSSQL 2016 - Splunk DBconnect on All Apps and Add-ons. 12-03-2025 01:41 PM
- Posted Re: Database connection is invalid setup for MSSQL 2016 - Splunk DBconnect on All Apps and Add-ons. 12-03-2025 01:26 PM
- Karma Re: Database connection is invalid setup for MSSQL 2016 - Splunk DBconnect for gabo. 12-03-2025 01:26 PM
- Posted Re: After upgrading from 9.0.3 version to 9.1.0 Version facing the below Error (in Cluster Master, Search head) on Splunk Enterprise. 09-22-2025 06:47 AM
- Posted Re: Why am I getting Invalid key in stanza [clustermaster:one] on Installation. 09-22-2025 06:45 AM
- Posted Re: Search head keeps failing in search head cluster on Deployment Architecture. 08-11-2025 07:50 AM
- Posted Re: How to integrate SA-Investigator with ES on Splunk Enterprise Security. 08-08-2025 09:47 AM
- Posted Re: Some Windows UF not sending Security logs on Getting Data In. 07-25-2025 05:37 AM
- Got Karma for Re: Forgot Pass4symmKey. 06-17-2025 12:25 PM
- Posted Re: Splunk CAC Authentication not working on Security. 04-24-2025 01:29 PM
Topics I've Started
03-06-2026
11:57 AM
Then our users start asking questions about the 502 proxy errors.
... View more
03-06-2026
06:22 AM
We also started getting 502 Proxy errors on all our Web UIs after upgrading from 9.3.8 to 9.3.9.
... View more
03-05-2026
07:16 AM
I just started getting a 502 Proxy error (not a 503) after upgrading from 9.3.8 to 9.3.9. The addition of the below stanza to server.conf did not help. [applicationsManagement] splunkbaseAppsDumpUrl= archivedSplunkbaseAppsDumpUrl= We are using Apache as an SSL proxy to pass your user's CAC credentials through Splunk. Proxy Error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request Reason: Error reading from remote server
... View more
12-10-2025
01:15 PM
We were getting a "command=sendmail, rootCAPath while sending mail to ..." message for users other than admins. Adding the 'list_settings' capability fixed it. Thanks
... View more
12-03-2025
01:41 PM
We are getting the same error on all our MSSQL connections except one. I've used DBConnect for many years (since 2016) and never came across this issue. Started happening after upgrading DBConnect to 4.1.1 and Red Hat to version 8. P.S. I thought trustServerCertificate=true was the correct property setting to resolve this certificate error?
... View more
12-03-2025
01:26 PM
A few weeks ago we upgraded to DBConnect 4.1.1. We can connect to one MSSQL host but not the others Same error: "encrypt" property is set to "true" and "trustServerCertificate" property is set to "true" but the driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption: Error: Certificates do not conform to algorithm constraints. ClientConnectionId:a3859b49-32ea-4200-b83a-2d083b41ba59
... View more
09-22-2025
06:47 AM
The change from [clustermaster:one] to [clustermanager:one] also worked for me. No more "invalid key" warning.
... View more
09-22-2025
06:45 AM
Did you change [clustermaster:one] to [clustermanager:one] ? The change worked for me. https://community.splunk.com/t5/Splunk-Enterprise/After-upgrading-from-9-0-3-version-to-9-1-0-Version-facing-the/m-p/698051
... View more
08-11-2025
07:50 AM
I added the following to server.conf on the SHC members. [httpServer] maxThreads = 8000 maxSockets = 8000
... View more
08-08-2025
09:47 AM
I needed to preface the view name with /app/SplunkEnterpriseSecuritySuite/ Sample: Investigate Identity Artifacts - "/app/SplunkEnterpriseSecuritySuite/ident_by_name" Investigate Asset Artifacts - "/app/SplunkEnterpriseSecuritySuite/asset_artifacts" Investigate File/Process Artifacts - "/app/SplunkEnterpriseSecuritySuite/file_artifacts"
... View more
07-25-2025
05:37 AM
On some our Windows UF hosts, we were getting System events but no Security events. Our Windows admin noticed that the Splunk service account was running as an NT service. After changing the service account to LocalSystem, the Windows UF hosts started sending their security events.
... View more
04-24-2025
01:29 PM
Sorry for the late response. We opted to stay with using Apache as an SSL proxy to pass the user's credentials to Splunk.
... View more
04-24-2025
06:47 AM
Thanks for the info. I had a user wondering why the theme was not changing to dark on the custom app.
... View more
04-16-2025
05:44 AM
I assume app should be [install] state = disable or disabled ?
... View more
03-11-2025
08:33 AM
One of our timecharts showed "future" time (by one hour) on the x-axis. Turns out the server time was off by one hour.
... View more
01-21-2025
06:46 AM
My SHC captain displayed the message: Checking http port [8000]: not available ERROR: http port [8000] - port is already bound. Splunk needs to use this port. Would you like to change ports? [y/n]: Killing the pid correlated to port 8000 worked.
... View more
11-07-2024
01:02 PM
1 Karma
We just upgraded from 9.2.2 to 9.2.3 and started getting the python integrity warnings. File path Check result File path Check result /opt/splunk/bin/jp.py present_but_shouldnt_be /opt/splunk/bin/python2.7 present_but_shouldnt_be
... View more
09-19-2024
10:58 AM
Yes..... Is there a way to implement masking globally? If not, I assume we to add each sourcetype in props.
... View more
09-18-2024
10:35 AM
As a test, I first created some credit card numbers using a python script.
I placed the script, along with inputs and props, on the search head. I only placed props on the indexers.
The following SEDCMD will mask the 1st and 3rd set of 4-digits. The two groups (2nd and 4th set of 4-digits) will not be masked.
props:
[cc_generator]
SEDCMD-maskcc = s/\d{4}-(\d{4})-\d{4}-(\d{4})/xxxx-\1-xxxx-\2/g
inputs:
[script://./bin/my_cc_generator.py]
interval = */30 * * * *
sourcetype = cc_generator
disabled = 0
index = mypython
output:
xxxx-9874-xxxx-9484
... View more
Labels
- Labels:
-
development
09-12-2024
01:48 PM
Adding this attribute enableCertBasedUserAuth = true \ to web.conf, generates the below proxy error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request Reason: Error reading from remote server
... View more
09-12-2024
07:12 AM
Since Splunk 6.x we have been using a proxy server (Apache) with Splunk to pass the user's CAC credentials to Splunk. Is it true that with 9.2.2, a proxy is no longer needed? I'm also trying to implement CAC authentication following Configure Splunk Enterprise to use a common access card for authentication - Splunk Documentation and Configuring Splunk for Common Access Card (CAC) authentication - Splunk Lantern, but now getting the following error message: "This site can't be reached"
... View more
07-26-2024
03:34 PM
Created a local directory within the SplunkDeploymentServerConfig app. Added the outputs.conf
/opt/splunk/etc/apps/SplunkDeploymentServerConfig/local/outputs.conf
[indexAndForward]
index = true
selectiveIndexing = true
Clients started reporting to the DS after restarting Splunk. Thankful I found this thread.
... View more
04-05-2024
10:04 AM
Thanks..... Worked like a charm.
... View more
01-09-2024
09:32 AM
Does anyone know if version 7.x of Threat Defense Manager (f.k.a. Firepower Management Center) is compatible with the latest version of Cisco's eStreamer add-on? https://splunkbase.splunk.com/app/3662
... View more
Labels
- Labels:
-
troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Wednesday
|
Karma from
