Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About trademarq
trademarq
Explorer
Member since:
06-06-2011
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 2 |
| Karma Given | 2 |
| Karma Received | 7 |
| Member Since | 06-06-2011 |
Activity Feed
- Got Karma for Re: Splunk CiscoUCS TA Python Error: SyntaxError: invalid syntax. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk CiscoUCS TA Python Error: SyntaxError: invalid syntax. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"?. 06-05-2020 12:47 AM
- Karma Help with "set diff" (need to keep the time of the events in the results)? for tmeader. 06-05-2020 12:46 AM
- Karma Re: Palo Alto "Could not find macro" Error for yannK. 06-05-2020 12:46 AM
- Got Karma for Re: Does maxVolumeDataSizeMB in indexes.conf do anything?. 06-05-2020 12:46 AM
- Got Karma for Unable to send phonehome message to deployment server. BUT It is connected!??. 06-05-2020 12:46 AM
- Got Karma for Re: Has anyone gotten Splunk for Bluecoat working?. 06-05-2020 12:46 AM
- Posted Re: Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"? on Getting Data In. 06-24-2015 12:44 PM
- Posted Re: Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"? on Getting Data In. 06-23-2015 08:14 AM
- Posted Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"? on Getting Data In. 06-23-2015 08:13 AM
- Tagged Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"? on Getting Data In. 06-23-2015 08:13 AM
- Tagged Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"? on Getting Data In. 06-23-2015 08:13 AM
- Tagged Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"? on Getting Data In. 06-23-2015 08:13 AM
- Tagged Why is the Splunk Universal Forwarder on my domain controllers consuming 100% CPU with error "DsBind failed"? on Getting Data In. 06-23-2015 08:13 AM
- Posted Re: Splunk CiscoUCS TA Python Error: SyntaxError: invalid syntax on All Apps and Add-ons. 06-27-2014 01:01 PM
- Posted Splunk CiscoUCS TA Python Error: SyntaxError: invalid syntax on All Apps and Add-ons. 06-27-2014 12:58 PM
- Tagged Splunk CiscoUCS TA Python Error: SyntaxError: invalid syntax on All Apps and Add-ons. 06-27-2014 12:58 PM
- Posted Re: Only the Overview dashboard has data PAN-App v4.1.1 Splunk v6.1.1 on All Apps and Add-ons. 06-20-2014 12:20 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
06-24-2015
12:44 PM
2 Karma
I was able to confirm that a security control (Symantec Critical Server Protection / DSP) was preventing the Splunk service from doing what it wanted to do. Resolving the security rules fixed the issue.
... View more
06-23-2015
08:14 AM
Running Splunk 6.2.0 Forwarder in most cases, will upgrade to a newer revision if that is a confirmed fix.
... View more
06-23-2015
08:13 AM
On more than a few of my domain controllers, the Splunk Universal Forwarder is consuming 100% CPU and spewing many errors in splunkd.log like this:
06-22-2015 15:26:58.603 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe (/splunk-winevtlog.exe)"" splunk-winevtlog - EvtDC::connectToDC: DsBind failed: (5)
This appears to be an issue with the SID resolution as I am collecting Windows Logs on these domain controllers. I'm aware of the evt_dc_name parameter in inputs.conf, but I don't wish to use it because the objects should all be available locally. How do I resolve this issue?
... View more
06-27-2014
01:01 PM
2 Karma
I figured this one out on my own. A temporary lapse in my instruction following skills caused this error: The Splunk_TA_CiscoUCS app MUST be run on a Splunk Lightweight Forwarder, Heavy Forwarder, or other full Splunk instance. I was attempting to run it on a Universal Forwarder, and from there I got the weird error message. Running the app on a full instance as noted in the documentation solved this issue.
... View more
06-27-2014
12:58 PM
I’m trying to bring up the Cisco UCS app, and Splunk seems to be unhappy with the python scripted input.
06-24-2014 10:21:30.524 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py equipmentFex equipmentIOCard equipmentSwitchCard equipmentChassis equipmentPsu computeBlade computeRackUnit fabricDceSwSrvEp etherPIo fabricEthLanEp fabricEthLanPc fabricEthLanPcEp fabricVlan fabricVsan lsServer vnicEtherIf vnicFcIf storageLocalDisk firmwareRunning statsCollectionPolicy" File "/opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py", line 49
06-24-2014 10:21:30.524 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py equipmentFex equipmentIOCard equipmentSwitchCard equipmentChassis equipmentPsu computeBlade computeRackUnit fabricDceSwSrvEp etherPIo fabricEthLanEp fabricEthLanPc fabricEthLanPcEp fabricVlan fabricVsan lsServer vnicEtherIf vnicFcIf storageLocalDisk firmwareRunning statsCollectionPolicy" with open(os.path.join(APP_PATH, 'local', 'credentials.csv'), 'r') as f:
06-24-2014 10:21:30.524 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py equipmentFex equipmentIOCard equipmentSwitchCard equipmentChassis equipmentPsu computeBlade computeRackUnit fabricDceSwSrvEp etherPIo fabricEthLanEp fabricEthLanPc fabricEthLanPcEp fabricVlan fabricVsan lsServer vnicEtherIf vnicFcIf storageLocalDisk firmwareRunning statsCollectionPolicy" ^
06-24-2014 10:21:30.524 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py equipmentFex equipmentIOCard equipmentSwitchCard equipmentChassis equipmentPsu computeBlade computeRackUnit fabricDceSwSrvEp etherPIo fabricEthLanEp fabricEthLanPc fabricEthLanPcEp fabricVlan fabricVsan lsServer vnicEtherIf vnicFcIf storageLocalDisk firmwareRunning statsCollectionPolicy" SyntaxError: invalid syntax
06-24-2014 10:21:40.529 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py faultInst" File "/opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py", line 49
06-24-2014 10:21:40.529 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py faultInst" with open(os.path.join(APP_PATH, 'local', 'credentials.csv'), 'r') as f:
06-24-2014 10:21:40.529 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py faultInst" ^
06-24-2014 10:21:40.529 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py faultInst" SyntaxError: invalid syntax
06-24-2014 10:21:50.532 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py topSystem equipmentChassisStats computeMbPowerStats computeMbTempStats processorEnvStats equipmentPsuStats adaptorVnicStats etherErrStats etherLossStats etherRxStats etherPauseStats etherTxStats swSystemStats" File "/opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py", line 49
06-24-2014 10:21:50.532 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py topSystem equipmentChassisStats computeMbPowerStats computeMbTempStats processorEnvStats equipmentPsuStats adaptorVnicStats etherErrStats etherLossStats etherRxStats etherPauseStats etherTxStats swSystemStats" with open(os.path.join(APP_PATH, 'local', 'credentials.csv'), 'r') as f:
06-24-2014 10:21:50.532 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py topSystem equipmentChassisStats computeMbPowerStats computeMbTempStats processorEnvStats equipmentPsuStats adaptorVnicStats etherErrStats etherLossStats etherRxStats etherPauseStats etherTxStats swSystemStats" ^
06-24-2014 10:21:50.532 -0400 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/Splunk_TA_CiscoUCS/bin/Collect.py topSystem equipmentChassisStats computeMbPowerStats computeMbTempStats processorEnvStats equipmentPsuStats adaptorVnicStats etherErrStats etherLossStats etherRxStats etherPauseStats etherTxStats swSystemStats" SyntaxError: invalid syntax
The syntax error appears to be with this line, but it looks okay to me:
with open(os.path.join(APP_PATH, 'local', 'credentials.csv'), 'r') as f:
... View more
06-20-2014
12:20 PM
Let us know what support says. I am having this same exact issue.
... View more
04-12-2012
10:22 AM
1 Karma
Hi
maxVolumeDataSizeMB only affects you if you have a volume set up in indexes.conf and an index (also in indexes.conf) configured to use it. Then, all of your configured indexes will adhere to using the volume's mountpoint for their storage, and you could use maxVolumeDataSizeMB to regulate how big you wish to allow the volume to get as a whole. Note you can use maxTotalDataSizeMB in your index stanza to regulate size on a per index basis as well. My guess is you don't have maxTotalDataSizeMB on an index set. A piece of my indexes.conf is below - just note that I never roll things over to cold or frozen, I keep things hot or warm 😉
# Set up shared disk pool for indexers
[volume:hotwarm]
path = $SPLUNK_DB
maxVolumeDataSizeMB = 900000
# Main indexes
[main]
homePath = volume:hotwarm/defaultdb/db
coldPath = volume:hotwarm/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
maxTotalDataSizeMB = 850000
In english - my main indexes are stored in a volume called hotwarm. Volume hotward size limit - 900,000MB, but the main index in that volume can only be 850,000MB (to allow space for some other smaller indexes I have).
... View more
01-06-2012
06:48 AM
First - I want to say I gave up on this and rolled the functionality for my bluecoat tracking into Enterprise Security. But, before I gave up, I found out that the bluecoat app is not designed to work in a distributed environment (at all). I had it working pretty well when I uninstalled it from everything and set it up to run solely on one indexer. A side effect of that is you have to send all your bluecoat traffic to one indexer. Hope this helps.
... View more
10-26-2011
07:43 AM
1 Karma
Not an answer, but I'm having the same exact problem. Not sure what the issue is..
... View more
09-01-2011
01:25 PM
1 Karma
Im having an issue with a remote forwarder I have set up where it is seemingly not getting connected to my deployment server.
08-31-2011 13:57:16.932 WARN DeploymentClient - Unable to send phonehome message to deployment server. Error status is: not_connected
08-31-2011 13:58:16.932 WARN DeploymentClient - Unable to send phonehome message to deployment server. Error status is: not_connected
08-31-2011 23:00:46.968 WARN DeploymentClient - Unable to send phonehome message to deployment server. Error status is: not_connected
That part that is throwing me off is when I go to the deployment-server and run bin/splunk list deploy-clients, The Forwarder in question shows up every time, maintaining its phone home timestamps and everything, so it appears that it is making connections just fine.
Where else can I look to find out what the issue is?
Thanks in advance!
... View more
