Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About robsenk
robsenk
Engager
Member since:
02-02-2012
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 02-02-2012 |
Activity Feed
- Karma Re: Using sourcetype in input.conf in Batch mode doesn't appear to work for lguinn2. 06-05-2020 12:46 AM
- Posted Re: Using sourcetype in input.conf in Batch mode doesn't appear to work on Getting Data In. 09-26-2013 11:48 AM
- Posted Re: inputs..conf and sourcetypes - Can't override the sourcetype on Getting Data In. 09-26-2013 08:38 AM
- Posted Re: Using sourcetype in input.conf in Batch mode doesn't appear to work on Getting Data In. 09-25-2013 10:33 AM
- Posted Re: Using sourcetype in input.conf in Batch mode doesn't appear to work on Getting Data In. 09-25-2013 10:20 AM
- Posted Using sourcetype in input.conf in Batch mode doesn't appear to work on Getting Data In. 09-25-2013 09:08 AM
- Tagged Using sourcetype in input.conf in Batch mode doesn't appear to work on Getting Data In. 09-25-2013 09:08 AM
- Tagged Using sourcetype in input.conf in Batch mode doesn't appear to work on Getting Data In. 09-25-2013 09:08 AM
- Tagged Using sourcetype in input.conf in Batch mode doesn't appear to work on Getting Data In. 09-25-2013 09:08 AM
- Posted inputs..conf and sourcetypes - Can't override the sourcetype on Getting Data In. 09-25-2013 09:03 AM
- Tagged inputs..conf and sourcetypes - Can't override the sourcetype on Getting Data In. 09-25-2013 09:03 AM
- Tagged inputs..conf and sourcetypes - Can't override the sourcetype on Getting Data In. 09-25-2013 09:03 AM
- Tagged inputs..conf and sourcetypes - Can't override the sourcetype on Getting Data In. 09-25-2013 09:03 AM
- Posted Re: Trying to find instructions to correct this problem with using the SDK examples for PHP on Splunk Dev. 03-18-2013 12:40 PM
- Posted Re: Trying to find instructions to correct this problem with using the SDK examples for PHP on Splunk Dev. 03-13-2013 04:47 PM
- Posted Re: Trying to find instructions to correct this problem with using the SDK examples for PHP on Splunk Dev. 03-12-2013 11:19 AM
- Posted Re: Trying to find instructions to correct this problem with using the SDK examples for PHP on Splunk Dev. 03-12-2013 09:57 AM
- Posted Re: Trying to find instructions to correct this problem with using the SDK examples for PHP on Splunk Dev. 03-11-2013 04:23 PM
- Posted Trying to find instructions to correct this problem with using the SDK examples for PHP on Splunk Dev. 03-11-2013 11:52 AM
- Tagged Trying to find instructions to correct this problem with using the SDK examples for PHP on Splunk Dev. 03-11-2013 11:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
09-26-2013
11:48 AM
We upgraded but I believe the fix was from simplifying the transforms.conf. I found I didn't have the exact same environment on my test box. Thanks for you help.
... View more
09-26-2013
08:38 AM
Thanks for the comment. I'm actually trying to change from a common sourcetype assigned in inputs to a sourcetype defined in the props.conf. It will not override the sourcetype defined in inputs.conf.
The reason we are assigning a common type in inputs.conf is because the auto assignment for sourcetype feature goes wild on our dataset.
... View more
09-25-2013
10:33 AM
I have confirmed this to work in Splunk 5.0.4 build 172409. I will upgrade.
... View more
09-25-2013
10:20 AM
Ok... that's what I have as well. I will go dig further. I should have listed the build we use. version 5.0.3, build 163460. Thanks for comment.
... View more
09-25-2013
09:08 AM
I noticed that source is not available in the Batch mode unlike the monitor mode. I wonder if the same applies to sourcetypes? It wasn't explicitly mentioned in the docs.
... View more
09-25-2013
09:03 AM
We have the need to set a high level sourcetype in the inputs.conf to one sourcetype and override some of those sources using the prop.conf and provide a more meaningful sourcetype. This didn't work however, when I removed the sourcetype from the inputs.conf the props.conf went ahead and overrode the the automatic designation splunk assigned as expected.
The goal is to set all data to one sourcetype with inputs.conf and override sourcetypes for selected files with a specific info in the props.conf.
Note that we are indexing archive files directly that have several levels.
Should this be possible?
Splunk 5.0.4 build 172409.
... View more
03-18-2013
12:40 PM
The first time i mentioned it looked like a curl problem was not correct as I had a problem in the URL. My Bad. So it looks like curl works fine from command line.
... View more
03-13-2013
04:47 PM
curl -k does work outside of the php. I can get data via the curl string but can't get the splunk_service to work in php. It maybe that the way the php is using curl on this server is not correct.... I will try to tail some more logs when i get back to this.... very strange.
... View more
03-12-2013
11:19 AM
Ok... I found that curl from the command line is working. it's disabling the cert. verification fine. The part on the sdk examples that is failing is the login. I can login with curl but the examples/index.php is not getting through the login. this is after editing the settings.local.php file with the proper credentials. Printing $SplunkExamples_connectArguments looks to be correct.
$service = new Splunk_Service($SplunkExamples_connectArguments);
// (NOTE: Can throw HTTP 401 if bad credentials)
$service->login();
Php 5.3.3. and Splunk 5.0.1
... View more
03-12-2013
09:57 AM
Yes it does seem to be a curl issue. I curl the page index page and disable ssl using the curl --insecure --url and it still produces the error....
Thanks for that help David
... View more
03-11-2013
04:23 PM
5.3.3 I saw a recommendation to upgrade but thought the issue pertained to localhost. I have a web server accessing the Splunk api which is on another server. I don't think we want to upgrade just yet on the php side if we don't have to.
... View more
03-11-2013
11:52 AM
Login Failed.
Reason: SSL: certificate subject name 'SplunkServerDefaultCert' does not match target host name 'my-other-server'
If anybody can please advise on how to rid this error. Prob. simple think i missed....
Thanks
... View more
02-14-2012
03:41 PM
Is this an issue with 4.3 as well? Been beating my heat on this one as well.
... View more
