×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
scheckenbachb
Explorer
Member since: ‎10-19-2012
‎06-03-2024
Community Statistics
Posts 9
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎10-19-2012
Activity Feed
View All

Splunk OVA for VMware Metrics (5096)

by in All Apps and Add-ons
‎04-08-2024 03:19 AM
‎04-08-2024 03:19 AM
Hello All, we plan to use a Splunk OVA for VMware Metrics (5096) in combination with Splunk on Windows. I can't find any information how this OVA will be supported. E.g  Operating System and Splunk updates. Does anyone know this? Regards, Bernhard ... View more
Labels

Re: forward MAIN index from an indexer

by in Splunk Enterprise
‎07-01-2020 03:06 AM
‎07-01-2020 03:06 AM
I found a solution to forward a sourcetype only. But as we use TCP, the Indexer stopps/pauses indexing as soon as the receiver is not responding. I'm working on this now ... props.conf [security-audit] TRANSFORMS-security-audit = send_to_syslog #  transforms.conf [send_to_syslog] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = syslog_slms #  output.conf [syslog:syslog_slms] server = <IP>:10514 type = tcp # ... View more

Re: forward MAIN index from an indexer

by in Splunk Enterprise
‎06-25-2020 11:51 PM
‎06-25-2020 11:51 PM
I've opend a case at Splunk support. ... View more

Re: forward MAIN index from an indexer

by in Splunk Enterprise
‎06-22-2020 08:00 AM
‎06-22-2020 08:00 AM
It's still the same. Data not from the MAIN index  get's forwarded also. I forgot to say, we have a 2 node indexer cluster and for testing only one is configured as shown may this has any side effect ? ... View more

forward MAIN index from an indexer

by in Splunk Enterprise
‎06-22-2020 03:16 AM
‎06-22-2020 03:16 AM
Hi, we are tring to forward only the MAIN index from an indexer to a third-party systems using TCP. I've seen the documentation (Forward data to third-party systems/Route and filter data) and some community articles. Unfortunatly we still get other indexes (e.g. fortinet) forwarded also. Any idea what we make wrong ? The last try from the ..\system\local\outputs.conf: ## 21.6.2020 [tcpout] defaultGroup = slms indexAndForward = true forwardedindex.0.whitelist = #forwardedindex.1.blacklist = (_.*|fortinet) forwardedindex.1.blacklist = forwardedindex.2.whitelist = forwardedindex.0.whitelist = main forwardedindex.filter.disable = false #[indexAndForward] #index=true [tcpout:slms] server = 192.168.249.140:514 sendCookedData = false blockOnCloning = false #forwardedindex.0.whitelist = #forwardedindex.1.blacklist = #forwardedindex.2.whitelist = #forwardedindex.2.whitelist = main #forwardedindex.filter.disable = false # ... View more
Labels

Re: ERROR DispatchReaper - Failed to reap

by in Deployment Architecture
‎10-12-2018 12:01 AM
‎10-12-2018 12:01 AM
It looks like we have a courrupted and unreadable *_323 directory. May I simple delete this? ... View more

ERROR DispatchReaper - Failed to reap

by in Deployment Architecture
‎10-11-2018 04:26 AM
‎10-11-2018 04:26 AM
We had to restore the Splunk indexer from a backup, loosing the 'colddb'. I now see the folowing ERROR in splunk.log, anything I need to worry about? 10-11-2018 11:22:50.108 +0200 ERROR DispatchReaper - Failed to reap D:\Program Files\Splunk\var\run\splunk\dispatch\remote_pvpsvgs6c01_scheduler_nobody_RUNCLUF1ZGl0RMD524612f09816f458b_at_1536120900_323 because of The directory is not empty. 10-11-2018 11:22:50.117 +0200 ERROR DispatchReaper - Failed to reap D:\Program Files\Splunk\var\run\splunk\dispatch\remote_PVPSVHC2C01_SummaryDirector_1536121209.679 because of The directory is not empty. 10-11-2018 11:23:20.074 +0200 ERROR DispatchReaper - Failed to reap D:\Program Files\Splunk\var\run\splunk\dispatch\remote_pvpsvgs6c01_schedulernobody_RUNCLUF1ZGl0_RMD524612f09816f458b_at_1536120900_323 because of The directory is not empty. 10-11-2018 11:23:20.091 +0200 ERROR DispatchReaper - Failed to reap D:\Program Files\Splunk\var\run\splunk\dispatch\remote_PVPSVHC2C01_SummaryDirector_1536121209.679 because of The directory is not empty. 10-11-2018 11:23:21.473 +0200 WARN DatabaseDirectoryManager - Directory='D:\Program Files\Splunk\var\lib\splunk_internaldb\colddb\911_8E7523CC-5821-453D-AE7E-7E46FB5189E5' does not exist. The directory representing this bucket might have just rolled. ... View more

How to update an indexer cluster?

by in Deployment Architecture
‎10-05-2016 11:33 PM
‎10-05-2016 11:33 PM
Hi everyone, I have to update (6.1.8 -> 6.4.3) a Splunk deployment build of 1 Master, 2 Search Heads (non-pooled), 2 indexer (cluster) and a few forwarder. I've check the manuals, but I'm still unsure what the correct process is. Especially the indexer cluster. Must I take both indexer and master down until all three are updated? Regards, Bernhard ... View more

splunk users expire after x days of inactivity

by in Security
‎01-21-2013 08:33 AM
‎01-21-2013 08:33 AM
Hi, is it possible to set an "expire after x days of inactivity" for Splunk's own built-in system users? The Manager GUI in V 5.0.1 dosen't offer this. Regards, Bernhard ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-03-2024 02:39 AM