About jwelters

jwelters · ‎04-20-2017

This was the best solution, it just wasn't a great one but it worked. I believe it's the best solution given the limitations of the core tool.

jwelters · ‎02-21-2017

It looks like this will work well, as there's already a script that creates the Search macro, and the lookup table... it's fairly easy to also have it create the macro for this.

jwelters · ‎02-21-2017

There are a few hundred.

jwelters · ‎02-17-2017

I have an interesting use case, where I have a list of strings that I search for within our proxy logs to identify problem systems. This works quite well. Currently the list exists in both a CSV format, and a search Macro. The macro just specifies (phrase1 OR phrase2 OR phrase3) it's not complicated. Recently I decided I wanted to add to our analysis and return the results but also figure out how to add a new field that is the particular string that was matched. For example if the phrase was infected, I could display a table with the _time, URL , and matched_string. This would make analysis a bit easier for us. I've seen a couple ways folks have looked at doing something similar but I wasn't able to find a working solution for me, has anyone done something like this before ?

jwelters · ‎11-30-2016

Yup, only having a problem with the index defined in this particular app being able to recieve data.

jwelters · ‎11-30-2016

Volumes are defined and working within the SPLUNK_HOME/etc/system/local/indexes.conf. I don't think it's a volumes issue... I seem to be thinking it's some sort of issue around setting some sort of permission on the index to be permitted to receive data... which doesn't seem to be a thing.

jwelters · ‎11-30-2016

Volumes are defined and working within the SPLUNK_HOME/etc/system/local/indexes.conf.

jwelters · ‎11-29-2016

I have several indexers checking into a deployment server and as such wanted to use a deployed app to manage indexes. In my environment, we have many indexes which results in using the deployment server to manage them a good solution. The problem I'm having is that the indexes are getting created on the indexer, and it seems like it would be working just fine. However it's not, when sending events I get an error that says that the index doesn't exist or is disabled. Here's the indexes.conf that the app pushes (right now it contains nothing else): homePath = volume:hot1/index1/db coldPath = volume:cold1/index1/colddb thawedPath = $SPLUNK_DB/index1/thaweddb The app is called: SplunkIndexer-Linux/ I tried adding an export=system to the top of the apps indexes.conf and that didn't have an impact. I've got to be missing something simple here... anyone have any ideas?

jwelters · ‎10-24-2014

Only because testing has shown that while all of the other data flows properly, splunk stream data doesn't seem to distribute. When you configure the input from wire data you list a destination, we currently have that set to the same heavy forwarder in hopes that would result in the forwarder sending the information through the normal routing in outputs.conf. That doesn't work. I can also point the splunk app for stream location to be one of the indexers and that also works fine. The goal would be to configure it in the way that both you and I expect it to. So the outputs.conf drives where the data goes, and the stream forwarder just captures it to route. These are all systems that have well functioning configurations in place other then the stream functionality. That is it gathers a whole boat load of logs and sends to distributed indexers and everything has worked amazingly well. Add stream app, enable TCP/UDP, and add in the wire data inputs. The wire data input is currently set the default which I would expect to work, then just use the underlying outputs.conf to send the data to the distributed indexer environment.

jwelters · ‎10-24-2014

Perhaps I've asked the question the wrong way. We know how to send data to the distributed indexing environment by placing the appropriate stanza in outputs.conf. The splunk stream configuration does not adhere to this configuration setting. Your'e right in this case heavy / universal probably doesn't matter in our case we are using the heavy forwarders for other reasons on these particular hosts.

jwelters · ‎10-24-2014

We are looking at deploying splunk stream to replace some current monitoring solutions. One question I ran into was: How do you configure splunk stream on a heavy forwarder to forward in a distributed manner to multiple indexers ? We are running the most recent version of splunk and intend to use distributed indexing to 5 indexers. The docs list it as a deployment option however, there isn't any clear documentation I could find concernnig how to do this.

jwelters · ‎06-24-2013

Yes, but how do I do that with SSL enabled ? We already have that working without SSL.

jwelters · ‎06-20-2013

Currently we are using a basic splunk configuration for the outputs.conf on all of our clients. [tcpout:indexerGroup] server=server1:8182,server2:8182,server3:8182 We are working on enabling SSL which can ba accomplisehd by doing : [tcpout] defaultGroup = splunkssl [tcpout:splunkssl] compressed = true server = server3:9998 sslCertPath = $SPLUNK_HOME/etc/auth/server.pem sslPassword = $1$iYxeTtEVRyXQ sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem sslVerifyServerCert = false The above for SSL accomplishes this for one servers, we need to have the same functionality as current. How do I enable SSL forwarding in a round robin manner as we are using today ? In addition is it possible to use a single port in splunk to listen for both SSL and non SSL connections ?

jwelters · ‎05-07-2013

You are correct, except for how do I configure it so when I send it I'm able to send data from multiple indexes to one. I only have one index as the destination however I have multiple on my system. So far syslog seems to be the only approach I can find that might work,however the lack of encryption is concerning.

jwelters · ‎05-07-2013

I thought of sending it as syslog, however the encryption of forwarding it as Splunk data is desired. I don't care about the remote indexers licensing whatsoever. The challenge as you mention is sending data from 30+ indexes to one index. Syslog might be the only option for us.

jwelters · ‎05-07-2013

I'm trying to determine how to send my data as it's being indexed to a a secondary indexer. That in itself is easy, the catch is currently I have many indexes and the indexer I'm required to send the data to has one. So I need to forward indexed data to a single index on a remote indexer. I have no ability to configure the remote indexer. Does anyone have any suggestions that may help in accomplishing this ?

Posts	16
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎01-30-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to create a custom field to match a particular...

How to edit indexes.conf to resolve an error that ...

Splunk Stream Distributed Indexing

Splunk Forwarder SSL Configuration

Forward Data to Independent Indexer

Re: How to create a custom field to match a partic...

Re: How to create a custom field to match a partic...

Re: How to create a custom field to match a partic...

How to create a custom field to match a particular...

Re: How to edit indexes.conf to resolve an error t...

Re: How to edit indexes.conf to resolve an error t...

Re: How to edit indexes.conf to resolve an error t...

How to edit indexes.conf to resolve an error that ...

Re: Splunk Stream Distributed Indexing

Re: Splunk Stream Distributed Indexing

Splunk Stream Distributed Indexing

Re: Splunk Forwarder SSL Configuration

Splunk Forwarder SSL Configuration

Re: Forward Data to Independent Indexer

Re: Forward Data to Independent Indexer

Forward Data to Independent Indexer