Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Joffer
Joffer
Path Finder
Member since:
07-20-2010
06-05-2020
Community Statistics
| Posts | 31 |
| Solutions | 2 |
| Karma Given | 17 |
| Karma Received | 15 |
| Member Since | 07-20-2010 |
Activity Feed
- Karma Re: Windows Vs Linux - host and serverName variable in system/local/ (host in searches) for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: How do I configure default apps with deployment server? for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: How do I configure default apps with deployment server? for bbingham. 06-05-2020 12:45 AM
- Karma Re: Question about filters for deployment server (4.1.4) for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: Regex crash course? for dwaddle. 06-05-2020 12:45 AM
- Karma Re: Regex crash course? for Michael_Wilde. 06-05-2020 12:45 AM
- Karma Re: Regex crash course? for wollinet. 06-05-2020 12:45 AM
- Karma Re: Whats the difference between _whitelist and whitelist? for rroberts. 06-05-2020 12:45 AM
- Karma Re: IIS WebSIte seperated logging - my config somehow grabs all website files as well. why? for ziegfried. 06-05-2020 12:45 AM
- Karma Re: How do I get LDAP values from Active Directory? for matt. 06-05-2020 12:45 AM
- Karma Re: Does Splunk not support LDAP group inheritance? for the_wolverine. 06-05-2020 12:45 AM
- Karma Re: Deployment Server not sending config file to client for Lowell. 06-05-2020 12:45 AM
- Karma Re: Disable lightweight forwarding in 4.1 from command line for CerielTjuh. 06-05-2020 12:45 AM
- Karma Re: Nested Active Directory Groups for the_wolverine. 06-05-2020 12:45 AM
- Karma Re: Help with LDAP configuration? for the_wolverine. 06-05-2020 12:45 AM
- Karma Re: How do I get LDAP values from Active Directory? for the_wolverine. 06-05-2020 12:45 AM
- Karma Re: How do I get LDAP values from Active Directory? for benstraw. 06-05-2020 12:45 AM
- Got Karma for Re: How can I configure Splunk Forwarder to NOT index historical WinEvents?. 06-05-2020 12:45 AM
- Got Karma for Re: How can I configure Splunk Forwarder to NOT index historical WinEvents?. 06-05-2020 12:45 AM
- Got Karma for Why does Splunk start SplunkWeb on Windows during boot when configured as LightForward?. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 2 |
08-23-2010
09:21 AM
Will the sourcetype change when the index has more than 100 events?
If you start indexing with followTail = 1 in the config(s), there will never be 100 events the first time...
... View more
08-23-2010
09:13 AM
There is a 'typo' in my config. Is should be 'stateOnClient = enabled'. Missing a 'd'. After fixing this it worked fine 🙂
... View more
08-21-2010
10:13 AM
Isn't this the defaults? I copied it from /apps/ and did not touch any files after that. If I create a local/app.conf with state = enabled it works, but I didn't think I had to do that when I use deployment server - I enable the app in serverclass.conf
... View more
08-20-2010
11:21 AM
I've got a followup question...
I've now copied the SplunkLightForwarder into my deployment folder. I did not add any new files/config to that app. My serverclass.conf for that app is as follows:
[serverClass:LightForwarder:app:SplunkLightForwarder]
stateOnClient = enable
restartSplunkd = true
The app is distributed to the clients and enabled, but the webserver is still running. Why?
Do I need to add a local/app.conf (or should I enable default/app.conf?) file to the folder and 'enable' it there? I thought the stateOnClient should take care of that and enable the app and hence disable the webserver?
... View more
08-17-2010
08:52 AM
I ended up skipping all lists in [global] and just do my config in the serverClass stanzas (and :app:xxx). It finally worked.
Still, I would like to have my previous question confirmed or not:
"So, in my config above, if I don't put the global whitelist, the whitelist in some-app would "overrun" the inherited machineTypes from the Windows class, and linux servers would be a match for the app?"
Put another way, will a whitelist.0 = * in a :app:xxx stanza overrun a parent serverclass machineTypes filter, or will '*' only apply to the supplied machineTypes servers?
... View more
08-17-2010
08:49 AM
Yepp, thats where I found it 🙂
... View more
08-17-2010
08:49 AM
Thanks for the info and the effort, and not to be rude, but I don't think you read my post very thorough... I have the deployment up and running and working just fine 🙂
I did have a question/discussion (with my self?!!?) about SplunkLightForwarder.
What are your contents of the /Applications/splunk/etc/deployable-apps/SplunkLightForwarder? Did u copy or link the $SPLUNK_HOME/etc/apps/SplunkLightForwarder to /Applications/splunk/etc/deployable-apps/SplunkLightForwarder?
Please read on my post again 🙂
... View more
08-16-2010
03:28 PM
I've got my custom apps (mostly custom inputs.conf files) working, and now I'm looking into configure some of the default apps, at this point SplunkLightForwarder (enable it) and sample_app (disable it).
I've got the forwarding functioning with my own "fwd-to-splunk01" app (outputs.conf file), but this doesn't kill the webserver on the server, neither does it run in forward only mode, all which the SplunkLightForwarder does.
I did try this simple config, hoping it would work, but it didn't:
[serverClass:LightForwarder:app:SplunkLightForwarder]
stateOnClient = enable
restartSplunkd = true
I know the reason. Reading the splunkd.log I see this:
08-16-2010 16:57:46.452 WARN Application - Application: SplunkLightForwarder cannot be loaded as path: /opt/splunk/etc/deployment-apps/SplunkLightForwarder does not exist.
08-16-2010 16:57:46.452 WARN ServerClass - Unable to load application: SplunkLightForwarder
Creating a /opt/splunk/etc/deployment-apps/SplunkLightForwarder/local/app.conf which could enable the app replaces the entire /opt/splunk/etc/apps/SplunkLightForwarder on my client. I've read other places here on Splunk Answers that I should link or copy the whole app from /opt/splunk/etc/apps/SplunkLightForwarder to /opt/splunk/etc/deployment-apps/SplunkLightForwarder on my server, but I was hoping there were other means to get this configured (and the only config I want at this point is to activate LightForward and disable sample_app).
Why I'm asking, is that if I link from apps to deployment-apps on my server and then upgrade my splunk indexer/deployment server (they are on the same server), my clients that happen to not be upgraded at that time could potentially get a config that is not working with the version installed on the client. Or the other way around.. (newer client doesn't like old defaults for LightForwarder). Is this a valid problem?
Comments?
... View more
08-16-2010
01:14 PM
One important thing I noticed is that my Windows x64 servers sends an utsname=windows-x64 to splunk, and not windows-intel as I thought.
... View more
08-16-2010
01:00 PM
So, in my config above, if I don't put the global whitelist, the whitelist in some-app would "overrun" the inherited machineTypes from the Windows class, and linux servers would be a match for the app?
... View more
08-13-2010
04:34 PM
2 Karma
Lets say I have this simple serverClasses:
[global]
whitelist.0 = *
[serverClass:Windows]
machineTypes = windows-intel
[serverClass:Windows:app:some-app]
whitelist.0 = *
stateOnClient = enabled
restartSplunkd = true
Will the whitelist in "some-app" enable the app for linux servers (and all other servers)? Even though I set machineTypes to windows-intel in the serverClass? Or will only windows servers be "handed down" to the app stanza and the filtered through the white/blacklists?
Can I use whitelist, blacklist and machineTypes in one and the same stanza?
... View more
08-12-2010
10:27 AM
6 Karma
You can use splunk list deploy-clients to list the clients that have contacted the server.
The phone home interval is 30 seconds by default. It can be changed in $SPLUNK_HOME/etc/system/local/deploymentclient.conf by setting/changing the phoneHomeIntervalInSecs variable. My example below changes this to 1 minute (60 seconds)
#***************************************************************************
# Configure a Splunk deployment client.
#
# Note: At a minimum the [deployment-client] stanza is required in
# deploymentclient.conf for deployment client to be enabled.
#***************************************************************************
[deployment-client]
disabled = false
serverEndpointPolicy = acceptAlways
phoneHomeIntervalInSecs = 60
#***************************************************************************
# The following stanza specifies deployment server connection information
#***************************************************************************
[target-broker:deploymentServer]
targetUri = splunk01.mydomain.loc:8089
... View more
08-10-2010
02:12 PM
Do you use the LightForwarder or the normal Forwarder. The normal Forwarder can/will index your data and use diskspace etc. It will then take a bigger hit on your system. How much I don't know.
... View more
08-04-2010
09:21 AM
Finally. This worked:
[monitor://C:\inetpub\sites\]
sourcetype = iis
followTail = 1
whitelist = \\logs\\*
disabled = 0
Note the last star in the whitelist (*)
... View more
07-30-2010
12:18 PM
the whitelist doesn't work for my splunk lightforwarder. Even though the simple whitelist should be correct it is not forwarded.
... View more
