About tprzelom

tprzelom · ‎06-10-2015

"service iptables stop" Linux firewall was my problem

tprzelom · ‎08-29-2014

I went from 1.0.0 and all my Windows Infra App menu and dashboards are broken. Fresh install of 1.0.2 didn't yield any results

tprzelom · ‎08-29-2014

You have to go into the XML view for the dashboards and look at what searches are run to populate the dashboard. They may rely on the sourcetype or index defined in the inputs.conf or something more abstract like an eventtype.

tprzelom · ‎08-11-2014

I think this occurs because a search head in the pool is down.

tprzelom · ‎08-11-2014

Same issue 6.0.3, utilizing search head pooling [JobManager module] Splunkd daemon is not responding: ('Error connecting to /services/search/jobs: The read operation timed out',)

tprzelom · ‎05-27-2014

used for testing the script included with the salesforce TA app

tprzelom · ‎05-21-2014

Splunk 6.0.3 Chrome Version 34.0.1847.137 ~10,000 clients Same issue Restarting the deployment server has worked for me twice /opt/splunk/bin/splunk restart The restart will drop the list of clients that have checked in so you'll need to wait for a client to tag home before you can look at it through the forwarder management screen.

tprzelom · ‎04-18-2014

Start on linux/unix from standard install location: /opt/splunk/bin/splunk start Verify: ps -ef | grep splunk

tprzelom · ‎04-17-2014

Initially the peer value consisted of all of my indexers, but as the count value wound down I was left with 2 peers showing the errors with a count value of less than 10. Those 2 peers showed the following in their logs repeatedly. 04-17-2014 11:02:03.853 -0700 WARN CMSlave - handleHeartbeatDone: successful heartbeat and re-add not received but proxy is in disconnected state. Forcing re-add. 04-17-2014 11:02:03.853 -0700 INFO CMSlave - event=addPeer resetting masks for all buckets on clearAndReadd Eventually the error subsided which I attribute to the cluster reaching a state of homeostasis with its replication rate because my search and replication factors are not met yet.

tprzelom · ‎04-17-2014

I've got the same log errors appearing on my cluster master 6.0.3

tprzelom · ‎04-14-2014

04-14-2014 13:03:09.199 -0700 ERROR ClusterMasterPeerHandler - Cannot add peer=x.x.x.x mgmtport=8089 (reason: non-zero pending job count=2090) I've got walls of this error on the cluster master. Anyone know what's causing it and how serious of a problem it is?

tprzelom · ‎04-02-2014

For some cases you'll be able to run mysearch | extract reload=t To reprocesses to props.conf file and begin extracting fields w/o needing a restart

tprzelom · ‎12-18-2013

index=summary_security earliest=@d latest=-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d-30m latest=-6d@d-30m orig_sourcetype=dhcp | timechart partial=f span=30m count by orig_sourcetype | eval marker = "last_week" | eval _time = _time+86400*7+1800] | search NOT dhcp=0 | timechart partial=f span=30m avg(dhcp) by marker This is the final search I came up with. Adding in "search NOT dhcp=0" removed the extra portions of the graph.

tprzelom · ‎12-17-2013

index=summary_security earliest=-1d@d latest=now orig_sourcetype=dhcp | timechart count by orig_sourcetype | eval marker = "today" | eval _time = _time+1800 | append [search index=summary_security earliest=-7d@d latest=-6d@d orig_sourcetype=dhcp | timechart count by orig_sourcetype | eval marker = "last week" | eval _time = _time+86400*7+1800] | timechart sum(dhcp) by marker I'm using the above search in order to create a week over week comparison of my sourcetype counts. The problem is that my "last week" data flatlines after the day i'm looking at and continues for a week into the future creating a bunch of white space in my graph. Any ideas how to solve this one?

tprzelom · ‎12-05-2013

How do I change the sourcetype for events from Windows eventlog, it is usually WinEventLog: , where logname may be for example System or Application. In the following inputs.conf configuration [WinEventLog:System] sourcetype=win_clients disabled = 0 the events arrive with a sourcetype of WinEventLog:System instead of win_clients.

tprzelom · ‎11-15-2013

The issue was the light forwarder was being managed by cfengine3 and was transitioned to chef and something was lost in the transition which resulted in partial functionality. My solution was rip all that out and use a universal forwarder that has a deploymentclient.conf sent to it by chef. Then use the deployment server from there.

tprzelom · ‎11-06-2013

I'm using REGEX = ,TRAFFIC, with no success There is no space after the comma. This feels like something more sinister that just a regex. I had a much more complex system in place that all of a sudden stopped working, so I dialed it back to basics to try and uncover the problem. These logs are coming through an rsyslog tier, could there be some kind of metadata affecting the logs?

tprzelom · ‎11-05-2013

Nov 5 15:32:38 hostname.net 1,2013/11/05 15:32:38,0002C100698,TRAFFIC,end,1,2013/11/05 15:32:37,IP_ADDR,IP_ADDR,IP_ADDR,IP_ADDR,firewall_rule,,,incomplete,vsys1,trust,untrust,ethernet1/2,ethernet1/1,anycast_vip_IP_ADDR,2013/11/05 15:32:37,159998,1,47031,3978,47031,3978,0x400000,tcp,allow,74,74,0,1,2013/11/05 15:32:33,0,any,0,12676624,0x0,IP_RANGE,IP_RANGE,0,1,0 hot off the press

tprzelom · ‎11-05-2013

props.conf: [pan_event] TRANSFORMS-traffic = traffic_source transforms.conf: [traffic_source] REGEX = (,TRAFFIC,) FORMAT = sourcetype::pan_traffic DEST_KEY = MetaData:Sourcetype I've got data being indexed as sourcetype=pan_event. I have distributed the above props and transforms to the indexers and restarted them, but I am unable to create a pan_traffic sourcetype. Where am I going wrong?

tprzelom · ‎11-05-2013

If you have index time extractions configured will search time extractions override them?

tprzelom · ‎06-03-2013

If you have an indexer with an outputs.conf file sending to itself it will generate this error and the metrics.log file will show all the queues are full. Check your serverclass.conf if you're using the deployment server, you may need to create a blacklist entry to prevent the indexer from receiving the outputs file.

tprzelom · ‎01-22-2013

Jan 2013, need brtfs support

tprzelom · ‎11-26-2012

Found it. App permission problem http://splunk-base.splunk.com/answers/61063/simple-field-extractions-not-working-in-props

tprzelom · ‎11-26-2012

[doorcontrolcsv] DELIM = "," FIELDS = "timestamp", "whatever", "door_name", "alert_type", "alert_value" There should be an S at the end of DELIMS, for anyone who comes across this

tprzelom · ‎11-21-2012

I removed the pipe to extract reload=T and am receiving the same results

Posts	34
Solutions	3
Karma Given	8
Karma Received	8
Member Since	‎02-19-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk Cluster Master Peer Handler Error

Timechart Graph extends into the future

WinEventLog define sourcetype on forwarder

Index Time Sourcetyping

Extraction Precedence

Extraction failure

Can't access splunk web remotely

Re: Search Head Cluster: Why am I getting "Connect...

Re: App for Windows Infrastructure 1.0.1

Re: Splunk App for Windows infrastructure data not...

Re: Read time out while opening Job manager in Spl...

Re: Read time out while opening Job manager in Spl...

Re: BSM Scripted input help

Re: Blank Forwarder Management page on Splunk 6

Re: Peer status - down

Re: Splunk Cluster Master Peer Handler Error

Re: Failed to create result provider for remote pe...

Splunk Cluster Master Peer Handler Error

Re: apply cluster-bundle

Re: Timechart Graph extends into the future

Timechart Graph extends into the future

WinEventLog define sourcetype on forwarder

Re: Index Time Sourcetyping

Re: Index Time Sourcetyping

Re: Index Time Sourcetyping

Index Time Sourcetyping

Extraction Precedence

Re: skipped indexing of internal audit...

Re: Can I run splunk on btrfs?

Re: Extraction failure

Re: Extraction failure

Re: Extraction failure