About jamesy281

jamesy281 · ‎03-12-2015

Thanks, The problem is now where to start looking for the cause, all our nodes are on the same VLAN.

jamesy281 · ‎03-12-2015

Harsmarvania57, Thanks for your feedback, looking at the log as you suggested I can see two distinct types of heartbeat message: the first is: -0400 WARN DistributedPeerManagerHeartbeat - Failed to get list of indexes from peer https://n.n.n.n:8089 (there are a lot of these all for the same indexer The second is: -0400 INFO CMPeer - peer=GUID peer_name=primary_indexer transitioning from=Up to=Down reason="heartbeat or restart timeout=60" (this one appears once for each indexer at least once a day at different times.) Which of these were you seeing when troubleshooting your issue?

jamesy281 · ‎03-09-2015

Hi There, Recently one of our saved searches have been failing intermittently with the error below, the search is set to trigger an alert when the return count is 0. As it is failing this is the return count and so we are getting false alarms. We have a simple cluster setup with 1 X search head, 1X master, and 2 X indexers. I have checked the time on all three servers and they are synced with the NTP server fine. The below is returned in the search: ERROR: [indexer2] Search results may be incomplete, peer searchhead1 search ended prematurely. Error = Peer indexer2 will not return any results for this search, because the search head is using an outdated generation (search head gen_id=35; peer gen_id=36). This can be caused by the peer re-registering and the search head not yet updating to the latest generation. This should resolve itself shortly. ERROR: [indexer1] Search results may be incomplete, peer searchhead1 search ended prematurely. Error = Peer [indexer1] will not return any results for this search, because the search head is using an outdated generation (search head gen_id=35; peer gen_id=37). This can be caused by the peer re-registering and the search head not yet updating to the latest generation. This should resolve itself shortly.

jamesy281 · ‎12-22-2014

acharlieh, Thanks for the quick response and the info, it pointed me in the right direction, the actual search I used that worked was: | rest /services/saved/searches| search "action.email"=1 "disabled"=1

jamesy281 · ‎12-22-2014

Hi There, I want to create a scheduled search to find if any alerts have been set to disabled. I have looked at the _internal index but can't see any way of detecting the status of the alert. can this be done from within a search? Thanks, James.

jamesy281 · ‎10-31-2014

I will indeed, thanks again.

jamesy281 · ‎10-30-2014

Thanks, I will install fresh with the most recent version on the search head. I have downloaded the Cisco Security Suite and the splunk add on for ASA, when I extract it it is listed as Splunk_TA_cisco_asa. is there an additional component (SA)? I can't see that on the site.

jamesy281 · ‎10-30-2014

Is the sourcetype located in the props.conf file within the main app or under the TA/ SA?

jamesy281 · ‎10-30-2014

Hi frmassdam, Thanks for the reply. This is the original configuration that I had but the dashboard didn't show any data.

jamesy281 · ‎10-30-2014

Hey there, I need some help with the Cisco Security suite. we are running a distributed environment which consists of 1 X master, 1x serach head and two indexers. The app was installed using the WEB ui by my predecessor along with the SA and TA. Our ASA is directed to one of the indexres via syslog UDP 514 and I can search this fine. The dashboard was showing no data so I followed a ton of KB articles and made changes as suggested I even installed the TA on both indexers however after rebooting I just got a bunch of errors. I ended up just uninstalling all the components completely. my question is what is the correct installation procedure in a distributed environment such as mine? all the documents say install it in $Splunkhome..., etc but not on what servers it is required. Do I simply need to install on the search head and copy the apps to the apps directory and that is it or is it required on the indexers also? Any help is appreciated.

jamesy281 · ‎10-11-2014

Oops sorry just spotted this comment option.

jamesy281 · ‎10-11-2014

Hi Jrodman, Sorry I didn't mean to add it as an answer, I thought if I could resolve my issue it may help the original poster to anonymise before indexing so he wouldn't need to worry about doing it at search time. I have already created a separate post but haven't had any responses which is why I posted here. https://answers.splunk.com/answers/171932/how-to-anonymize-data-at-search-time.html Sorry for posting this as an answer again but I don't see how to add as a comment.

jamesy281 · ‎10-11-2014

Jrodman, Great response, I am new to splunk sd I,m not sure how to go about creating a new index for the purposes of anonymizing. I am using the props.conf method at the moment with source type and a sed command to replace the data but I can't seem to get it to work. I followed the KB article below and have done a rolling restart on all the indexers but still the data is not masked. http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Anonymizedatausingconfigurationfiles

Posts	13
Solutions	1
Karma Given	0
Karma Received	5
Member Since	‎09-26-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Saved search failing with gen_id mistmatch

How to create a scheduled search to find if any al...

Splunk security suite installation

Re: Saved search failing with gen_id mistmatch

Re: Saved search failing with gen_id mistmatch

Saved search failing with gen_id mistmatch

Re: How to create a scheduled search to find if an...

How to create a scheduled search to find if any al...

Re: Splunk security suite installation

Re: Splunk security suite installation

Re: Splunk security suite installation

Re: Splunk security suite installation

Splunk security suite installation

Re: How can we anonymize user date at search time?

Re: How can we anonymize user date at search time?

Re: How can we anonymize user date at search time?