Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About scheckenbachb
scheckenbachb
Explorer
Member since:
10-19-2012
01-24-2023
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-19-2012 |
Activity Feed
- Posted Re: forward MAIN index from an indexer on Splunk Enterprise. 07-01-2020 03:06 AM
- Posted Re: forward MAIN index from an indexer on Splunk Enterprise. 06-25-2020 11:51 PM
- Posted Re: forward MAIN index from an indexer on Splunk Enterprise. 06-22-2020 08:00 AM
- Posted forward MAIN index from an indexer on Splunk Enterprise. 06-22-2020 03:16 AM
- Posted Re: ERROR DispatchReaper - Failed to reap on Deployment Architecture. 10-12-2018 12:01 AM
- Posted ERROR DispatchReaper - Failed to reap on Deployment Architecture. 10-11-2018 04:26 AM
- Tagged ERROR DispatchReaper - Failed to reap on Deployment Architecture. 10-11-2018 04:26 AM
- Posted How to update an indexer cluster? on Deployment Architecture. 10-05-2016 11:33 PM
- Tagged How to update an indexer cluster? on Deployment Architecture. 10-05-2016 11:33 PM
- Tagged How to update an indexer cluster? on Deployment Architecture. 10-05-2016 11:33 PM
- Tagged How to update an indexer cluster? on Deployment Architecture. 10-05-2016 11:33 PM
- Tagged How to update an indexer cluster? on Deployment Architecture. 10-05-2016 11:33 PM
- Posted splunk users expire after x days of inactivity on Security. 01-21-2013 08:33 AM
- Tagged splunk users expire after x days of inactivity on Security. 01-21-2013 08:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-01-2020
03:06 AM
I found a solution to forward a sourcetype only. But as we use TCP, the Indexer stopps/pauses indexing as soon as the receiver is not responding. I'm working on this now ... props.conf [security-audit] TRANSFORMS-security-audit = send_to_syslog # transforms.conf [send_to_syslog] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = syslog_slms # output.conf [syslog:syslog_slms] server = <IP>:10514 type = tcp #
... View more
06-22-2020
08:00 AM
It's still the same. Data not from the MAIN index get's forwarded also. I forgot to say, we have a 2 node indexer cluster and for testing only one is configured as shown may this has any side effect ?
... View more
06-22-2020
03:16 AM
Hi, we are tring to forward only the MAIN index from an indexer to a third-party systems using TCP. I've seen the documentation (Forward data to third-party systems/Route and filter data) and some community articles. Unfortunatly we still get other indexes (e.g. fortinet) forwarded also. Any idea what we make wrong ? The last try from the ..\system\local\outputs.conf: ## 21.6.2020 [tcpout] defaultGroup = slms indexAndForward = true forwardedindex.0.whitelist = #forwardedindex.1.blacklist = (_.*|fortinet) forwardedindex.1.blacklist = forwardedindex.2.whitelist = forwardedindex.0.whitelist = main forwardedindex.filter.disable = false #[indexAndForward] #index=true [tcpout:slms] server = 192.168.249.140:514 sendCookedData = false blockOnCloning = false #forwardedindex.0.whitelist = #forwardedindex.1.blacklist = #forwardedindex.2.whitelist = #forwardedindex.2.whitelist = main #forwardedindex.filter.disable = false #
... View more
Labels
- Labels:
-
configuration
10-12-2018
12:01 AM
It looks like we have a courrupted and unreadable *_323 directory. May I simple delete this?
... View more
10-11-2018
04:26 AM
We had to restore the Splunk indexer from a backup, loosing the 'colddb'. I now see the folowing ERROR in splunk.log, anything I need to worry about?
10-11-2018 11:22:50.108 +0200 ERROR DispatchReaper - Failed to reap D:\Program Files\Splunk\var\run\splunk\dispatch\remote_pvpsvgs6c01_scheduler_nobody_RUNCLUF1ZGl0RMD524612f09816f458b_at_1536120900_323 because of The directory is not empty.
10-11-2018 11:22:50.117 +0200 ERROR DispatchReaper - Failed to reap D:\Program Files\Splunk\var\run\splunk\dispatch\remote_PVPSVHC2C01_SummaryDirector_1536121209.679 because of The directory is not empty.
10-11-2018 11:23:20.074 +0200 ERROR DispatchReaper - Failed to reap D:\Program Files\Splunk\var\run\splunk\dispatch\remote_pvpsvgs6c01_schedulernobody_RUNCLUF1ZGl0_RMD524612f09816f458b_at_1536120900_323 because of The directory is not empty.
10-11-2018 11:23:20.091 +0200 ERROR DispatchReaper - Failed to reap D:\Program Files\Splunk\var\run\splunk\dispatch\remote_PVPSVHC2C01_SummaryDirector_1536121209.679 because of The directory is not empty.
10-11-2018 11:23:21.473 +0200 WARN DatabaseDirectoryManager - Directory='D:\Program Files\Splunk\var\lib\splunk_internaldb\colddb\911_8E7523CC-5821-453D-AE7E-7E46FB5189E5' does not exist. The directory representing this bucket might have just rolled.
... View more
- Tags:
- splunk-enterprise
10-05-2016
11:33 PM
Hi everyone,
I have to update (6.1.8 -> 6.4.3) a Splunk deployment build of 1 Master, 2 Search Heads (non-pooled), 2 indexer (cluster) and a few forwarder. I've check the manuals, but I'm still unsure what the correct process is. Especially the indexer cluster.
Must I take both indexer and master down until all three are updated?
Regards,
Bernhard
... View more
01-21-2013
08:33 AM
Hi,
is it possible to set an "expire after x days of inactivity" for Splunk's own built-in system users? The Manager GUI in V 5.0.1 dosen't offer this.
Regards, Bernhard
... View more
- Tags:
- users
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-24-2023
10:14 AM
|
