About zliu

zliu · ‎11-06-2012

There are two ways you can find out the status of your new purchased license: Ask your Account Manager to contact his/her internal departments to see why it is not delivered yet. You can contact license@splunk.com to find out the status. If you don't hear back from Support, please call Support Line. Keep in mind that, it makes time to process the order internally. If your current license is about to expire and you need the new one urgently, please let your account manager be aware of it.

zliu · ‎11-06-2012

I ordered my new license, but I haven't received it yet. Who should I contact? My account manager told me that the order has already processed.

zliu · ‎09-05-2012

Below is the document: http://docs.splunk.com/Documentation/Splunk/latest/Admin/LicenserCLIcommands

zliu · ‎09-05-2012

I got license violation and I received a reset key from Splunk Support. The reset key comes with the instruction in the email, but it is via UI. How to use command line to apply reset key?

zliu · ‎06-21-2012

If your portal admin no longer works there, you can pick one of below methods to update: Ask your account manager to contact Splunk Support to assign the new portal admin If you don't know who your account manager is, you can contact Splunk Support directly to request an update via email support@splunk.com or call support hotline. Support will verify with your account manager. Once it is confirmed, Support will assign the new portal admin.

zliu · ‎06-21-2012

How to update portal admin if he/she no longer works in my company?

zliu · ‎06-21-2012

If you would like to re-consolidate your current enterprise licenses, please provide below when email Splunk Support: your current valid enterprise licenses attached to your email instruction on how you would like new licenses sizes to be what version you want new licenses to be Above will be the most efficient and easy way for Splunk Support to send you back new licenses.

zliu · ‎06-21-2012

How to request to re-consolidate licenses from Splunk Support?

zliu · ‎06-20-2012

If you are Portal admin, you are authorized to request adding/removing authorized contacts for your company. You can do so by below methods: A. opening a case to Support email Support at support@splunk.com call support hotline open a case at the portal B. manage(add/remove) authorized contacts at the portal by yourself Above assumes that your authorized contacts <= allowed authorized contact seats purchased by your company. If you would like to add more seats (even if you are not the portal admin), you can contact your account manager to purchase more seats.

zliu · ‎06-20-2012

As an enterprise customer, how can I add more authorized contacts for my company?

zliu · ‎09-28-2011

This is a bug. Bug#SPL-43691

zliu · ‎09-28-2011

In 4.2.x, instead of June, July, August, September, the data listed as August, July, June, September. Data is displayed by alphabetic order of the month name. Data is displayed by alphabetic order of the month name when it should be logical. * |stats count as "Total Incident/month" by date_month

zliu · ‎09-13-2011

We have configured Splunk 4.2.2 running on Windows Server 2008 R2 with a coldPath pointing to a volume ("cold") hosted on a CIFS network drive. Contents of indexes.conf : #Volume Definition [volume:cold] path = \\sjc-vault\SplunkArchive\splunk01 maxVolumeDataSizeMB = 1000000 ################################################################################ # index definitions ################################################################################ [main] coldPath = volume:cold\defaultdb\colddb [history] coldPath = volume:cold\historydb\colddb [summary] coldPath = volume:cold\summarydb\colddb [_internal] coldPath = volume:cold\_internaldb\colddb [_audit] coldPath = volume:cold\audit\colddb [_thefishbucket] coldPath = volume:cold\fishbucket\colddb [_blocksignature] coldPath = volume:cold\blockSignature\colddb However, we get errors on startup for every index with a cold path set to the remote network drive: In handler 'indexes': Unable to load index configuration: In index '_internal': Failed to create directory '\\sjc-vault\SplunkArchive\splunk02\_internaldb\colddb' (Cannot create a file when that file already exists. We are using a domain account to run splunkd. This account has full rights to the shares and folders, therefore this should not be a permission issue. Any advice is appreciated!

zliu · ‎09-02-2011

how do i know if it is Splunk SSL Certificates or the IIS SSL certificates expired Error in splunkd.log, I saw: 08-29-2011 07:57:52.571 ERROR TcpInputProc - Error encountered for connection from host=xxx.xxx.xxxxx.xxxx, ip=xxx.xx.xx.xx. error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired

zliu · ‎08-31-2011

Got these error messages with all users under one particular role "Search operation 'rangemap' is unknown. You might not have permission to run this operation" or "Search operation 'gauge' is unknown. You might not have permission to run this operation." [role_production_support] change_own_password = enabled get_metadata = enabled get_typeahead = enabled list_inputs = enabled request_remote_tok = enabled rest_apps_view = enabled rest_properties_get = enabled rest_properties_set = enabled search = enabled schedule_search = enabled srchIndexesAllowed = * srchDiskQuota = 500 srchJobsQuota = 50

zliu · ‎08-30-2011

This [ ] means all objects.

zliu · ‎08-30-2011

In $SPLUNK_HOME/etc/apps/search/metadata/meta.local [] access = read : [ admin, can_delete, developer, power, user ], write : [ admin, power ] export = none version = 4.2.1 What does this [] mean?

zliu · ‎08-26-2011

The tailing processor is going to list ALL files in ALL directories located in /cust. This is how Splunk understand the stanza, for example, /cust/http*/web/file.log is equal to find /cust | grep "/cust/http*/web/file.log". If there are not that many files, you can have these stanza instead, in this example, /cust/http1/web/ and /cust/http2/web/ It should explain why Splunk is stating so many files that you don't need it to.

zliu · ‎08-26-2011

In my inputs.conf, I have: [monitor://cust/http*/web-*/var/log/modsec-audit.log*] [monitor://cust/http*/web-*/var/log/*access.log*] [monitor://cust/jboss-as*/server/app-*/log/server.log] Why did I get these errors: 08-19-2011 01:02:15.148 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/view.1. 08-19-2011 01:02:15.149 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/vim.1. 08-19-2011 01:02:15.151 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/vimdiff.1. 08-19-2011 01:02:15.153 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/vimtutor.1. 08-19-2011 01:02:15.155 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/xxd.1. I didn't ask Splunk to monitor /cust/soe/ directories.

zliu · ‎08-26-2011

This doesn't appear to be a problem with PCI, instead the UNIX app being used by the customer. Note that PCI is not compatible with the Splunk for Unix app and SKB-unix should be used instead. In general, the SKB's that we offer contain the proper eventtypes and tags to drive the PCI reports. The report in question PCI 1.1.1 uses the following base search syntax to look for network changes: The errors that are being seen is a result of the unix app specifying one of these tags w/ missing eventtypes. If the customer believes they have data that qualifies as network change data but it's not showing up in the report, then the data is likely not being tagged appropriately. tag=pci tag=eventtype::network tag=eventtype::modify (tag=eventtype::configuration OR tag=eventtype::policy)

Posts	70
Solutions	15
Karma Given	41
Karma Received	88
Member Since	‎09-18-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Where is my new purchased license?

How to use command line to apply reset key?

How to update portal admin if he/she no longer wor...

How to request to re-consolidate licenses from Spl...

Can I ask Support to add more authorized contacts?

data is displayed by alphabetic order of the month...

Not able to start Splunk on Windows when coldpath ...

how do i know if it is Splunk SSL Certificates or ...

Err: "Search operation 'rangemap' is unknown. You ...

What does this mean in local.meta?

Re: Where is my new purchased license?

Where is my new purchased license?

Re: How to use command line to apply reset key?

How to use command line to apply reset key?

Re: How to update portal admin if he/she no longer...

How to update portal admin if he/she no longer wor...

Re: How to request to re-consolidate licenses from...

How to request to re-consolidate licenses from Spl...

Re: Can I ask Support to add more authorized conta...

Can I ask Support to add more authorized contacts?

Re: data is displayed by alphabetic order of the m...

data is displayed by alphabetic order of the month...

Not able to start Splunk on Windows when coldpath ...

how do i know if it is Splunk SSL Certificates or ...

Err: "Search operation 'rangemap' is unknown. You ...

Re: What does this mean in local.meta?

What does this mean in local.meta?

Re: How Splunk understands inputs stanza

How Splunk understands inputs stanza

Re: Defining and locating eventtypes in PCI app