Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About narenpalepu
narenpalepu
New Member
Member since:
09-20-2017
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-20-2017 |
Activity Feed
- Posted Re: Why are ssl 3.0 and AWS ELB throwing errors after the upgrade in Spunk 7.0? on Installation. 02-12-2018 05:50 PM
- Posted Re: Why are ssl 3.0 and AWS ELB throwing errors after the upgrade in Spunk 7.0? on Installation. 02-12-2018 12:39 PM
- Posted Why are SSL 3.0 and AWS ELB throwing errors after the upgrade from Splunk 6.5.1 to 7.0.2? on Installation. 02-11-2018 02:37 AM
- Tagged Why are SSL 3.0 and AWS ELB throwing errors after the upgrade from Splunk 6.5.1 to 7.0.2? on Installation. 02-11-2018 02:37 AM
- Tagged Why are SSL 3.0 and AWS ELB throwing errors after the upgrade from Splunk 6.5.1 to 7.0.2? on Installation. 02-11-2018 02:37 AM
- Tagged Why are SSL 3.0 and AWS ELB throwing errors after the upgrade from Splunk 6.5.1 to 7.0.2? on Installation. 02-11-2018 02:37 AM
- Tagged Why are SSL 3.0 and AWS ELB throwing errors after the upgrade from Splunk 6.5.1 to 7.0.2? on Installation. 02-11-2018 02:37 AM
- Tagged Why are SSL 3.0 and AWS ELB throwing errors after the upgrade from Splunk 6.5.1 to 7.0.2? on Installation. 02-11-2018 02:37 AM
- Posted Re: Anonymize -p password on Getting Data In. 01-31-2018 07:02 PM
- Posted Anonymize -p password on Getting Data In. 01-31-2018 04:35 PM
- Tagged Anonymize -p password on Getting Data In. 01-31-2018 04:35 PM
- Tagged Anonymize -p password on Getting Data In. 01-31-2018 04:35 PM
- Tagged Anonymize -p password on Getting Data In. 01-31-2018 04:35 PM
- Tagged Anonymize -p password on Getting Data In. 01-31-2018 04:35 PM
- Posted Re: Why am I near critical disk alert on Indexer nodes? on Alerting. 09-21-2017 01:43 PM
- Posted Re: Why am I near critical disk alert on Indexer nodes? on Alerting. 09-20-2017 01:25 PM
- Posted Re: Out of 3 clusters why are 2 showing similar results and the third is missing results? on Deployment Architecture. 09-20-2017 01:08 PM
- Posted Re: Out of 3 clusters why are 2 showing similar results and the third is missing results? on Deployment Architecture. 09-20-2017 11:16 AM
- Posted Re: Out of 3 clusters why are 2 showing similar results and the third is missing results? on Deployment Architecture. 09-20-2017 11:15 AM
- Posted Out of 3 clusters why are 2 showing similar results and the third is missing results? on Deployment Architecture. 09-20-2017 10:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-12-2018
05:50 PM
I am using splunk certs. Any pointer in this direction is appreciated. Not seeing the same issue on indexers.
... View more
02-12-2018
12:39 PM
Thanks for the response.
CONNECTED(00000003)
depth=0 CN = eoe-pdx-splunk-search-0fa4b3c077a58b38b, O = SplunkUser
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = eoe-pdx-splunk-search-0fa4b3c077a58b38b, O = SplunkUser
verify error:num=21:unable to verify the first certificate
verify return:1
Certificate chain
0 s:/CN=eoe--0fa4b3c077a58b38b/O=SplunkUser
i:/C=US/ST=CA/L=San Francisco/O=Splunk/CN=SplunkCommonCA/emailAddress=support@splunk.com
Server certificate
-----BEGIN CERTIFICATE-----
MIICPTCCAaYCCQD54aziriM0MjANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJV
UzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoM
BlNwbHVuazEXMBUGA1UEAwwOU3BsdW5rQ29tbW9uQ0ExITAfBgkqhkiG9w0BCQEW
EnN1cHBvcnRAc3BsdW5rLmNvbTAeFw0xNzA2MjExODAzMzVaFw0yMDA2MjAxODAz
MzVaMEcxMDAuBgNVBAMMJ2VvZS1wZHgtc3BsdW5rLXNlYXJjaC0wZmE0YjNjMDc3
YTU4YjM4YjETMBEGA1UECgwKU3BsdW5rVXNlcjCBnzANBgkqhkiG9w0BAQEFAAOB
jQAwgYkCgYEApBBvXGG/r72pHNN6q4Mh7Ax5XfYIuOs35uJpzXs6lJ2v0o05Lfqp
J0QfKsSIQAfh3onCwfpsNFWbaKtQuzs4qaQPOX4lQmPKYV0qfAlGJWgjT7FAqKLH
BrtS0RovQ+sp396VPujYyO9hrqZ3d+Qtt+87TXOeteqyyGXu7l+zXMMCAwEAATAN
BgkqhkiG9w0BAQUFAAOBgQCK2vo/ct+EtGF4GpFlB0kp/leoiyNjnpGMrvNxv2z+
DEtavXevgxH0aOIoRgcBI+rPrEYbD9XtqEzFHEBXbLdhRQHsfAf2OQq5Vz4uOu0I
JHfSkgvQDDOifftTUcs3+vphdzexR+anmM5y8ArioEmMRa2UYKhsyGHEVjl7MMHg
RQ==
-----END CERTIFICATE-----
subject=/CN=eoe-pdx-splunk-search-0fa4b3c077a58b38b/O=SplunkUser
issuer=/C=US/ST=CA/L=San Francisco/O=Splunk/CN=SplunkCommonCA/emailAddress=support@splunk.com
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
SSL handshake has read 1108 bytes and written 431 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 112ADC00DEF5813EA46F7A0CB8F59E88E7B6E119A90417F7C72BA4AAF9FF59A7
Session-ID-ctx:
Master-Key: 1C5B35A20A1247A63A95491FBF6E1FE0C03139433C4262B1CF448C69E56E3E73FB931A8E58620D216DC8E0EB1AB62D29
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 46 c5 6b 10 a3 e0 78 ea-5d f5 c7 17 24 9d 11 cb F.k...x.]...$...
0010 - ea 37 67 49 11 c7 01 9e-93 f7 2c 4e eb 55 52 3a .7gI......,N.UR:
0020 - 72 80 be 81 da 69 26 d2-7d 18 b5 e0 30 b2 b4 c2 r....i&.}...0...
0030 - e9 81 1f 87 9e 5c c3 c2-2f 14 81 6f 47 f7 5a 24 ......./..oG.Z$
0040 - f2 b8 0a dd d7 9f 96 0b-da 8a 0a 6f 06 48 0e cb ...........o.H..
0050 - 2e 01 62 0f 5b c8 1b 5a-0e 7a 96 94 01 c5 b6 da ..b.[..Z.z......
0060 - 6b 26 75 d2 ca 2b fc 0c-55 ad 7f 76 fb e6 c2 d0 k&u..+..U..v....
0070 - 94 9c 6f aa c5 5a dc 8a-6c 43 2d e4 28 e3 14 d1 ..o..Z..lC-.(...
0080 - 79 2c 66 37 0d 6c 64 f0-d6 f2 3a 37 21 0c b5 9f y,f7.ld...:7!...
0090 - b6 e8 1a cf 68 7a 78 78-cc 22 9d 86 0b dc 3d c2 ....hzxx."....=.
Start Time: 1518467892
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
... View more
02-11-2018
02:37 AM
Hi All,
I upgraded search and index clusters to 7.02 from 6.5.1
Seeing the following in splunkd.log
02-11-2018 10:31:34.913 +0000 WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client hello C', alert_description='handshake failure'.
and ELB AWS health checks are failing. Tried enabling all the ciphers in AWS did not help.
I am on Ubuntu 12.
Any other changes to be done for SSL or ciphers.
Thanks,
NP
... View more
01-31-2018
07:02 PM
Thanks a lot to both .
props.conf
[source::/var/log/syslog]
TRANSFORMS = auth-password-anonymizer
transforms.conf
[auth-password-anonymizer]
REGEX = ^(.)-p [0-9A-Za-z]\w{9,255}(.?)$
FORMAT = $1-p ########$2
DEST_KEY = _raw
... View more
01-31-2018
04:35 PM
I need to anonymize -p passwords that are appearing in syslog.
Used
props.conf
[syslog_log_control]
source::/var/log/syslog
TRANSFORMS = auth-password-anonymizer
transforms.conf
auth-password-anonymize]
REGEX = -p [0-9A-Za-z]\w{9,255}
FORMAT = $1-p =########$2
DEST_KEY = _raw
I am seeing syslog Cannot parse into key-value pair errors
02-01-2018 00:17:29.320 +0000 WARN ProcessTracker - (child_183__Fsck) IniFile - /opt/splunk/etc/slave-apps/_cluster/local/props.conf, line 95: Cannot parse into key-value pair: source::/var/log/syslog
Please advise
Thanks,
NP
... View more
09-21-2017
01:43 PM
Is there any other query we can run?. I am trying to access the license info from my dmc . Can you point me to a doc to establish support account. So that I can convert this to support ticket.
... View more
09-20-2017
01:25 PM
Thanks . Results are same as before.
... View more
09-20-2017
01:08 PM
Good Question. That helps. I started managing spunk couple of weeks ago. The user roles are same. But one cluster has new index which is missing in search default. other 2 has data in main index. That clarifies. Please mark the issue, resolved.
... View more
09-20-2017
11:16 AM
Three clusters do not share same data but they have similar data with similar no of results.
... View more
09-20-2017
11:15 AM
Yes . Thanks for asking. From GUI we get complete results on all three clusters. From API 2 clusters shows similar to GUI results. One Cluster shows only 10.
... View more
09-20-2017
10:29 AM
Hi ,
Rest API Splunk query results difference
We have a query running with JDK REST API. We have 3 spunk clusters. The result on 2 clusters is showing full results. where as one cluster is showing only 10 results. The configuration files look same. Is there any parameter I need to adjust to give complete results.
Thanks,
NP
... View more
09-20-2017
10:08 AM
Hi ,
I am using following( default) query for near critical disk alert on Indexer nodes. The daily results are showing 99% where as actual disk usage is much lower. Can you help clarify. I will submit the actual support contract later.
Thanks,
Naren
| rest splunk_server_group=dmc_group_* /services/server/status/partitions-space
| eval free = if(isnotnull(available), available, free)
| eval usage = capacity - free
| eval pct_usage = floor(usage / capacity * 100)
| where pct_usage > 92
| stats first(fs_type) as fs_type first(capacity) AS capacity first(usage) AS usage first(pct_usage) AS pct_usage by splunk_server, mount_point
| eval usage = round(usage / 1024, 2)
| eval capacity = round(capacity / 1024, 2)
| rename splunk_server AS Instance mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"
Alert search Results:
Instance Mount Point File System Type Capacity (GB) Usage (GB) Usage (%)
prd-sjc-splunk-indexer-1 /opt/colddb ext4 14881.80 14239.33 95
prd-sjc-splunk-indexer-2 /opt/colddb ext4 14881.80 14523.47 97
prd-sjc-splunk-indexer-3 /opt/colddb ext4 14881.80 14664.28 98
prd-sjc-splunk-indexer-4 /opt/colddb ext4 14881.80 14845.24 99
prd-sjc-splunk-indexer-5 /opt/colddb ext4 14881.80 14612.96 98
prd-sjc-splunk-indexer-6 /opt/colddb ext4 14881.80 14744.09 99
Actual Disk space:
Processing on prd-sjc-splunk-indexer-2
/dev/mapper/hot-hot 10403135808 7814205760 2064642256 80% /opt/splunk
/dev/mapper/cold-cold 15604702004 10252296568 4565973644 70% /opt/colddb
Processing on prd-sjc-splunk-indexer-1:
/dev/mapper/hot-hot 10403135808 7956960136 1921887880 81% /opt/splunk
/dev/mapper/cold-cold 15604702004 9749420004 5068850208 66% /opt/colddb
Processing on prd-sjc-splunk-indexer-5
/dev/xvdg 10403139904 7912240516 1966611388 81% /opt/splunk
/dev/mapper/colddb-colddb 15604697908 9752163196 5066103124 66% /opt/colddb
Processing on prd-sjc-splunk-indexer-3:
/dev/mapper/hot-hot 10403135808 7865249624 2013598392 80% /opt/splunk
/dev/mapper/cold-cold 15604702004 9997688028 4820582184 68% /opt/colddb
Processing on prd-sjc-splunk-indexer-4
/dev/mapper/cold-colddb 15604697908 10681093532 4137236996 73% /opt/colddb
/dev/mapper/hot-hotdb 10403135808 7779513904 2099334112 79% /opt/splunk
Processing on prd-sjc-splunk-indexer-6
/dev/xvdg 10321219904 7766226312 2030705592 80% /opt/splunk
/dev/mapper/colddb-colddb 15604697908 10138947556 4679318764 69% /opt/colddb
Processing on prd-sjc-splunk-indexer-7
/dev/xvdg 10403139904 7783278992 2095572912 79% /opt/splunk
/dev/xvdh 17111506844 1754748380 14497765008 11% /opt/colddb
updated to mark code and data as code
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
