Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About joshuapetitt
joshuapetitt
Path Finder
Member since:
10-05-2017
02-26-2026
Community Statistics
| Posts | 33 |
| Solutions | 0 |
| Karma Given | 34 |
| Karma Received | 3 |
| Member Since | 10-05-2017 |
Activity Feed
- Posted Re: Need help with TCP routing of events from Universal Forwarder on Getting Data In. 02-26-2026 08:54 AM
- Karma Re: Need help with TCP routing of events from Universal Forwarder for livehybrid. 02-26-2026 08:37 AM
- Posted Need help with TCP routing of events from Universal Forwarder on Getting Data In. 02-26-2026 08:15 AM
- Posted Re: Using a sparkline with tstats on Dashboards & Visualizations. 03-23-2022 07:18 PM
- Karma Re: Using a sparkline with tstats for haraksin. 03-23-2022 07:17 PM
- Karma Re: Timechart trend for gcusello. 09-23-2021 02:17 PM
- Karma Re: How to forward data when forwarder cannot contact indexer through firewall for isoutamo. 07-16-2020 01:02 PM
- Posted How to forward data when forwarder cannot contact indexer through firewall? on Getting Data In. 07-16-2020 12:00 PM
- Karma Re: Can I manually rename an index homePath with existing data? for gcusello. 07-16-2020 07:15 AM
- Posted Can I manually rename an index homePath with existing data? on Getting Data In. 07-16-2020 06:36 AM
- Karma Re: Splunk REST API: How to get deployment app version, author and description? for MuS. 06-05-2020 12:49 AM
- Karma Re: Are there any recommended settings for file permissions of .conf files in deployment apps? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: Are there any recommended settings for file permissions of .conf files in deployment apps? for iandrews_splunk. 06-05-2020 12:49 AM
- Karma Re: Will monitored files that are renamed be reindexed? for micahkemp. 06-05-2020 12:49 AM
- Karma Re: How can I force a scheduled script to run when installing (or uninstalling) new software? for nickhills. 06-05-2020 12:49 AM
- Karma Re: Where does rest/services/apps/local get data? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: Splunk REST API: How to get deployment app version, author and description? for MuS. 06-05-2020 12:49 AM
- Karma Will Splunk run a modular input using system Python on a Universal Forwarder for LukeMurphey. 06-05-2020 12:49 AM
- Karma Re: Will Splunk run a modular input using system Python on a Universal Forwarder for LukeMurphey. 06-05-2020 12:49 AM
- Karma How to clone Splunk_TA_Windows and use this both apps with different setings for one server for atyshke1. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-26-2026
08:54 AM
This works! Thanks for your quick response 🙂
... View more
02-26-2026
08:15 AM
Hi all, I'm using Splunk Enterprise 9.4.x with Windows Universal Forwarders. I'm trying to route specific sources and sourcetypes to a special Splunk Indexer, while all other events are routed to the default Indexer. I have the following outputs.conf on the UF [tcpout] defaultGroup = splunkssl # this is defined in another outputs.conf and this works [tcpout:special] server = 1.2.3.4:9998 [tcpout-server://1.2.3.4:9998] sslRootCAPath = # custom cert sslVerifyServerCert = true sslCommonNameToCheck = # custom common name altCommonNameToCheck = 1.2.3.4 I have the following props.conf on the UF [source::WinEventLog:Microsoft-Windows-PowerShell/Operational] TRANSFORMS-route = route_to_special I have the following transforms.conf on the UF [route_to_special] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = special What I am seeing is that the _internal logs are being sent to the special Indexer, but no other events. The WinEventLog:Microsoft-Windows-PowerShell/Operational are still being sent to the default Indexer. What am I doing wrong? Should I expect this to work? Should this work for WinEventLog inputs?
... View more
Labels
- Labels:
-
universal forwarder
03-23-2022
07:18 PM
This is what I needed for making a sparkline on a Single Value visualization. Worked very well!
... View more
07-16-2020
12:00 PM
Hi all,
I have a situation where there are servers from which we wish to get logs into Splunk.
However, we cannot use the traditional Universal Forwarder because these servers are not allowed to connect through the firewall to the indexer.
We can go from "inside" the firewalled network to these servers "outside" the network.
So we could perform some sort of API calls if necessary.
Is there a way to set up a Heavy Forwarder to poll the servers "outside" the network and pull in the logs?
Does the UF support being a "server" instead of a "client", meaning UF would expose an API that could be queried by an HF?
Any and all suggestions (aside from reconfiguring firewall) are welcome, thanks!
... View more
Labels
- Labels:
-
indexer
-
universal forwarder
07-16-2020
06:36 AM
Hi all, I'm dealing with a legacy Splunk installation where I'd like to clean up an index for consistency. Lets say I have an index called 'mydata'. This index is active and has events indexed there fairly regularly (i.e. many times a minute) Previously, this index was defined manually in /opt/splunk/etc/system/local/indexes.conf. The home path was specified as /opt/splunk/var/lib/splunk/mydatadb/db'. (NOTE: the folder 'mydatadb' in the path) Most of our other indexes use the notation of having the home path folder the same name as the index. I would like to migrate this existing index to use this pattern. Can I simply update indexes.conf to use '/opt/splunk/var/lib/splunk/mydata/db' then manually rename the folder in the filesystem, and restart the indexer? Is there any metadata or anything else in the db that would cause this path change to break the indexed data?
... View more
Labels
- Labels:
-
indexer
07-17-2018
12:40 PM
I've edited the system PATH and Splunk does just call the first python that is found in the path. I'm trying now to set the path in splunk-launch.conf but am not having any success at this. I've started a new question about that here:
https://answers.splunk.com/answers/672234/splunk-universal-forwarder-how-to-set-path-environ.html
... View more
07-17-2018
12:35 PM
1 Karma
because I need to have splunk call a specific python interpreter. The system has python 3 installed. I need to install python 2, and set the PATH so that SUF calls python 2.
... View more
07-17-2018
12:30 PM
1 Karma
I need to add to the PATH environment variable used by Splunk Universal Forwarder.
I have tried editing splunk-launch.conf and I have checked the envvars using splunk envvars but this doesn't seem to set the path.
Is it possible to set the PATH variable that Splunk uses?
(Note, I only want to setup this specialized PATH for the splunkd instance. I do not want it to be systemwide)
... View more
- Tags:
- splunk-enterprise
07-17-2018
12:11 PM
Thanks for the reply, I'm trying to do that very thing. Although other parts of the system rely on python 3 being first in the PATH. Is there a way I can set the PATH variable for just the Universal Forwarder? Perhaps via a .conf file?
... View more
07-17-2018
12:01 PM
precisely "how" will splunk invoke the system's Python interpreter? I have python 3 and python 2 installed on the system, and the python calls python 3 because how how the PATH is setup. Can I somehow override to tell splunk which python to use?
... View more
07-16-2018
03:45 PM
The add-on in question is https://splunkbase.splunk.com/app/1928
... View more
07-16-2018
03:44 PM
I don't think the Custom Inputs applies, I am wanting to collect tables from a different url, not add new tables. Also on the AddonBuilder, I don't think this applies to the Splunk Add-on For ServiceNow?
... View more
07-16-2018
11:47 AM
Is it possible to ingest information from multiple ServiceNow instances using a single "Splunk Add-on for ServiceNow"?
We have multiple ServiceNow instances, and a single Splunk infrastructure we would like to ingest into.
My current strategy is multiple "apps" in Splunk, one for each ServiceNow instance.
Can I configure a single apps/Splunk_TA_snow to ingest from multiple ServiceNow urls?
... View more
- Tags:
- splunk-enterprise
07-02-2018
03:12 PM
I'm using Splunk_TA_windows addon as a deployment app.
In the local/inputs.conf, I've added a stanza to monitor Windows Event Log where the channel does not exist on all the Windows computers where the Splunk_TA_windows app is deployed.
This is causing errors in the splunkd.log.
It is possible to configure the inputs.conf for specific computers, or suppress error logging on inputs which are known not to exist on all computers?
Is the only answer to make another deployment app for the specific servers?
... View more
- Tags:
- splunk-enterprise
03-15-2018
11:03 AM
Thanks, at the end of the day this may be the easiest thing to do. I'd like to pull the data from each app.conf (so I can see the version and author information). But a custom forwarder to do this might be the easiest for me to accomplish.
... View more
03-13-2018
12:35 PM
@MuS, do you know if I can ask the UFs about the apps they have? Is this info in any of the _internal indexes or anything like that? I know about the /services/deployment/server/clients endpoint, but this doesn't seem to have the info either.
... View more
03-13-2018
12:34 PM
@damiensurat, I am looking for the information about the deployment-apps on a deployment server.
Basically, I need to report the app information about the apps that can be deployed (not that necessarily are deployed, or where they are deployed)
... View more
03-13-2018
12:03 PM
Thank you for your reply. I also looked at a specific application using a similar request as your example and saw the same thing. What I really need is to see the label, version, author and description from the app.conf file in each deployment app. Is there another way to do what I am needing?
... View more
03-13-2018
11:40 AM
Note, I'm not necessarily interested in what clients they are deployed to. I just need to get the label, version, author and description of the applications that can be deployed.
... View more
03-13-2018
11:38 AM
I am trying to make some reports for apps and deployment apps.
I was able to use:
| rest /services/apps/local
to get the label, version, author and description of local apps.
How do I do I get this same information for the deployment-apps?
I've tried
| rest /services/deployment/server/applications
but it does not show the label, version, author or description?
... View more
03-13-2018
11:22 AM
@somesoni2, thank you! That fixed the issue, and makes sense now. If you make this an answer, I'll accept.
... View more
03-13-2018
11:01 AM
I'm trying to get a list of installed addons for both local server instances and for deployed addons.
I've tried using the search:
| rest /services/apps/local
however, I am wondering where this data is coming from? For instance, I had an app in opt/splunk/etc/apps , but I have since deleted that specific app folder. However it still shows in the list?
Also, I have apps which I installed via the interface, but have then moved to deployment-apps (they are meant to be deployment apps). They show in the search results, but I'm wondering why? Should they?
... View more
- Tags:
- splunk-enterprise
01-09-2018
08:43 AM
I am trying to make a custom Addon with a setup.xml
In the Splunk deployment that I am targeting, the management port has been changed from 8089 to 18089 (to avoid port conflicts with existing services).
After I install my app, I do see a 'Set up' action in the Apps list for my app.
But when I try to go to the Set up page by clicking on the link, I get a 404.
I've read about other addons with setup that indicated the problem may be that the management port is not 8089.
How to I configure my app to use the correct management port?
... View more
01-02-2018
10:07 AM
maybe? I am still researching how to properly setup setup.xml 😉 The one portion I'm still not 100% sure on is after I do have a working setup.xml, how I would reference the .conf value in the dashboard panel as a token?
... View more
01-02-2018
09:04 AM
I am making an add-on that will be installed in a couple of different splunk environments.
The different splunk environments use different index names for the "same" data.
I would like to make my search string somehow configurable, so the index that it searches can be configurable by the end user.
I know there are the $token$ values that can be used in panel search queries. Is it possible to populate the $token$ value from a local .conf file perhaps?
I found a related questions here:
https://answers.splunk.com/answers/221617/retrieving-values-from-config-file.html
UPDATES:
It looks like the setup.xml is what I need to include in my app:
https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Setup.xmlconf
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-26-2026
08:03 AM
|
