About L_Petch

L_Petch

Hello, Yes case sensitivity was an issue. I could only get the command to run in CLI if SC4S was in upper case but if it is Upper or Lower case in the script it always exits 1regardless of running state.

L_Petch

Hi @livehybrid Apologies I got side tracked by another project and just coming back to this. I am stuck and cannot get this check script to work. I have even tried a simpler "if else " statement but don't seem to get the desired affect. If I change your script to echo rather than exit I get the echo reply I am expecting if the sc4s container state is started or stopped but as soon as it is using exit statements it always exits 1. Below is what I have done, hoping you can spot my mistake. ----------sc4s_health_check_script.sh---------- Only change is making sc4s upper case # Example keepalived health check script #!/bin/bash # Check if SC4S container is running podman ps --filter "name=SC4S" --filter "status=running" | grep SC4S > /dev/null 2>&1 || exit 1 # Check if syslog port (e.g., 514) is listening ss -ltn | grep ':514 ' > /dev/null 2>&1 || exit 1 exit 0 ----------Keepalived.conf---------- vrrp_script sc4s_health_check { script "/etc/keepalived/sc4s_health_check_script.sh" interval 2 weight -20 } track_script { sc4s_health_check } This is what I get from keepalived and no matter what I change it always returns 1 Keepalived_vrrp[11414]: VRRP_Script(sc4s_health_check) succeeded Keepalived_vrrp[11414]: Script `sc4s_health_check` now returning 1 Keepalived_vrrp[11414]: VRRP_Script(sc4s_health_check) failed (exited with status 1) keepalived_vrrp[11414]: (VI_1) Changing effective priority from 254 to 234

L_Petch

@gcusello thanks that is exactly what I needed

L_Petch

Hi @gcusello How does this stop the filter from stopping access to all the other indexers the user has access to? As soon as I add the filter " host::spl001 OR host::spl002 " for example it will apply this restriction to all indexes not jus the _internal I want it to wont it?

L_Petch

Hello, I need to give certain users access to _internal but only allow them to see certain hosts. I planned to do this by adding a new role, giving them access to the index and then limiting them to the hosts in the search filter section. This works however it restricts access in all other indexes they have access to, to the same search filter even though this isn't inherited and access granted by a separate role. Is there an easier/better way of doing this?

L_Petch

Hello, 2 questions but the second is more of a keepalived question than it is an SC4S question. First question is what is the advantages of SC4S vs Nginx? From what I can see it doesn't really matter which you use its more preference, is that correct? My current setup is 2 HF's load balancing data between them and will have SC4S implemented on them for syslog. Second question: I am planning on using keepalived to LB via a VIP, I planned to just track the Podman process in keepalived how you would for apache etc and increment the priority if the process stopped, this would then make keepalived failover the VIP however, the Podman process doesn't get removed if it stops. What is the best way to achieve this, guessing Podman has its own solution but I rarely use Podman so no idea.

L_Petch

Hi all, Thanks for the quick replies. They help with troubleshooting but the issue ended up being a firewall that isn't documented and i wasnt informed was part of the route whilst trying to originally diagnose the issue.

L_Petch

Hello, I am getting the below error on two of my indexers. The indexers in question are on a different site (Site2) to the other two indexers & license manager in the cluster (site1). Site 1is working correctly with the same configuration as the indexers for site 2. My guess is networking but both indexers can connect to the LM on this port and there are no issues showing on the firewall between the two. All troubleshooting I have tried shows doesn't show any connectivity issues. Anyone come across this problem and have a solution? ####################################################################### HttpClientRequest [2156984 LMTrackerExecutorWorker-0] - Returning error HTTP/1.1 502 Error connecting: Connection reset by peer ERROR LMTracker [2156984 LMTrackerExecutorWorker-0] - failed to send rows, reason='Unable to connect to license manager=https://****:8089 Error connecting: Connection reset by peer' #######################################################################

L_Petch · ‎03-04-2025

Hello, I have a dashboard that checks all indexes and displays the event count for today and the last write time. This allows users of the dashboard to alert if an index has not been written to in a certain amount of time. My issue is that the dashboard runs when the user clicks into it and runs the searches using their permissions as expected. However they do not have access to all indexes so cannot see the stats for all indexes. What is the easiest way to change this so that they can see an event count for all indexes without having to give them access to the index?

L_Petch · ‎02-12-2025

Hello, Apologies as this has probably been asked before. With the Splunk vCPU licensing is the license per cluster or VM. For example if you have a 24 vCPU license is this the CPU usage allowance for the whole cluster or 24 vCPU per VM?

L_Petch · ‎02-10-2025

@kiran_panchavat Thanks, this helps

L_Petch · ‎02-10-2025

Hello, I want to deploy 3rd party SSL certs via an app using the deployment server as there are too many Splunk Forwarders to do this individually. This works however, as there is an SSL line with the default password in server.conf it reads this first and therefor won’t read the correct SSL password in the apps server.conf file stopping it from working. Is there a better way of doing this so that I don’t need to write a script to hash out the SSL section in server.conf?

L_Petch · ‎09-11-2024

Hello, A client went mad on how many saved searches they require and wont get rid of them. Due to this it is hammering rw on the indexers to the point the indexers can cope and remove themselves from the cluster and then re adds which and more resource strain. adding more indexers isnt an option The current setup is 3vm multisite search head cluster and a 4vm multisite indexer cluster. As they only require 3rf and 3sf i am wondering if there is a way to use only 1SH and 1 Indexer for all saved searches to run so that the load doesnt affect the other 3 indexers?

L_Petch · ‎03-21-2024

This was indeed the issue. Thank you so much for the help.

L_Petch · ‎03-20-2024

Just to add to this I doubled the RAM in my dev environment for the VM to 24GB and still get the same error

L_Petch · ‎03-20-2024

This is the full error output, Migrating to: VERSION=9.2.0.1 BUILD=d8ae995bf219 PRODUCT=splunk PLATFORM=Linux-x86_64 ********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION ********** Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 39, in <module> from splunk.rcUtils import makeRestCall, CliArgError, NoEndpointError, InvalidStatusCodeError File "/opt/splunk/lib/python3.7/site-packages/splunk/rcUtils.py", line 17, in <module> from splunk.search import dispatch, getJob, listJobs File "/opt/splunk/lib/python3.7/site-packages/splunk/search/__init__.py", line 17, in <module> from splunk.rest.splunk_web_requests import is_v2_search_enabled File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/splunk_web_requests/__init__.py", line 1, in <module> import cherrypy File "/opt/splunk/lib/python3.7/site-packages/cherrypy/__init__.py", line 76, in <module> from . import _cprequest, _cpserver, _cptree, _cplogging, _cpconfig File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpserver.py", line 6, in <module> from cherrypy.process.servers import ServerAdapter File "/opt/splunk/lib/python3.7/site-packages/cherrypy/process/__init__.py", line 13, in <module> from .wspbus import bus File "/opt/splunk/lib/python3.7/site-packages/cherrypy/process/wspbus.py", line 66, in <module> import ctypes File "/opt/splunk/lib/python3.7/ctypes/__init__.py", line 551, in <module> _reset_cache() File "/opt/splunk/lib/python3.7/ctypes/__init__.py", line 273, in _reset_cache CFUNCTYPE(c_int)(lambda: None) MemoryError Error running pre-start tasks

L_Petch · ‎03-18-2024

I have tried both the preview and upgrading without doing the preview. It is after running the start command that it errors. In preview mode I get the same error it just takes a lot longer to get to the error. - rpm -U splunk_package_name.rpm - $SPLUNK_HOME/bin/splunk start

L_Petch · ‎03-14-2024

Hi Marnell, Yes this error is happening on my 2 HF's and deployment servers. All have 12GB of RAM with 10GB available.

L_Petch · ‎03-13-2024

Hello All, I am currently testing upgrading from Splunk Enterprise version 9.0.4 to 9.2.0.1 but get the below error. Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 39, in <module> from splunk.rcUtils import makeRestCall, CliArgError, NoEndPointError, InvalidStatusCodeError MemoryError Error running pre-start tasks. I will add that there are a few more lines to the error but this is an air-gapped environment and hoping there is no need to manually type it all out 🙂 TIA Leon

L_Petch · ‎09-22-2023

Hi, So this error was due to the Admin user being deleted and the owner being set to admin still. I managed to fix this by changing the owner but after talking to PS deleting Admin is a mistake as so many services rely on it that it has been changed back.

L_Petch · ‎09-18-2023

Hello all, The Splunk default admin name has been changed and now I get the below error on Splunk DB connect. Please can someone let me know which conf file holds this info so I can change it to the new username? Splunkd error: HTTP 400 -- User with name=admin does not exist

Posts	22
Solutions	2
Karma Given	4
Karma Received	2
Member Since	‎09-18-2023

Online Status	Offline
Date Last Visited	Thursday

User access to _internal

SC4S with Keepalived

Splunk licensing error

Dashboard permissions

Splunk Vcpu licensing

SSL certs via Deployment server

Run saved searches on a single indexer

Update error from 9.0.4 to 9.2.0.1

HTTP 400 error in DBConnect due to changing admin ...

Re: SC4S with Keepalived

Re: SC4S with Keepalived

Re: User access to _internal

Re: User access to _internal

User access to _internal

SC4S with Keepalived

Re: Splunk licensing error

Splunk licensing error

Dashboard permissions

Splunk Vcpu licensing

Re: SSL certs via Deployment server

SSL certs via Deployment server

Run saved searches on a single indexer

Re: Update error from 9.0.4 to 9.2.0.1

Re: Update error from 9.0.4 to 9.2.0.1

Re: Update error from 9.0.4 to 9.2.0.1

Re: Update error from 9.0.4 to 9.2.0.1

Re: Update error from 9.0.4 to 9.2.0.1

Update error from 9.0.4 to 9.2.0.1

Re: HTTP 400 error in DBConnect due to changing ad...

HTTP 400 error in DBConnect due to changing admin ...

Are you a member of the Splunk Community?