About gregbo

gregbo · ‎12-22-2022

Every week the Upgrade Readiness Scan says that Splunk Essentials for Cloud and Enterprise 9.0 is incompatible with jQuery 3.5. When I go on Splunkbase to see if it has an update, I see no mention of Splunk Essentials for Cloud and Enterprise 9.0 at all. Should I just delete the app?

gregbo · ‎12-05-2022

I checked for max_history_length in all directories on both search heads, and on both it's only defined in system/default/limits.conf with the default value of 1000 I then checked the history file for myself on both search heads, and one has 1614 entries and the other has 2609 entries. When I check the Search History in Splunk Web, i see 36 searches (going back 3 days) on the Search Head that has 2609 entries, and 261 searches (going back 8 months) on the Search Head that shows 1614 entries in the file. So, I don't understand the relationship between the max_history_length stanza and how many searches show up

gregbo · ‎12-02-2022

I have two Splunk Enterprise environments, both at 9.0.2. For users in one environment, search history goes back only two days. For users in the other environment, search history goes back more than 8 months. Any clue about what could cause that? Both environments are using a single search head. Users are set up the same in each environment. The limits.conf on both search heads is identical. I verified that the user's search history .csv file goes back two days on one and 8 months on the other.

gregbo · ‎11-11-2021

I forgot to mention, I'm seeing this issue with tables that have a unique id as the rising column as well.

gregbo · ‎11-11-2021

I've set up some tables in DB Connect, using a timestamp (date_modified) as a rising column (there were no other suitable fields, and it's COTS, so the vendor isn't going to add a unique value). The where column is "where date_modified > ?". The issue is that each time the input is run, it creates a new event for the most recent row. I would expect that to happen is the where clause said "where date_modified >= ?", but with it set as "where date_modified > ?", I would think it would just add no rows. Has anyone else seen this?

gregbo · ‎09-20-2021

Thanks for the info, I tried the solution in that article and it made to difference. My error message is different than the one in that article.

gregbo · ‎09-17-2021

I'm trying to get a large text file ingested using the HEC. In my searches for the data, I see events that say "Message body length 3169085 greater than maximum allowed (2097152). Where can I change that maximum? I can't find any setting that says "Message body length", and I can't find any setting set to 2097152

gregbo · ‎02-01-2021

We have Splunk DB Connect 3.4.1 working with out SQL Server databases. We also have an Oracle database that works over 1521 (non-ssl), but are trying to get it to work over SSL. We've set up everything according to instructions bet we're getting this error message: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate) So it looks like there's a mismatch in cipher suites between DB Connect and the oracle database. How can I find out which cipher suites DB Connect is trying to use? we're using ojdbc8 for Oracle 19

gregbo · ‎01-28-2021

I'm trying to set up DB Connect to use Oracle Wallet. I'm at step 5 under "Connect Splunk DB Connect to Oracle Wallet environments using ojdbc8" (https://docs.splunk.com/Documentation/DBX/3.4.1/DeployDBX/Troubleshooting), where it asks me to prepend some text in JVM Options. However, I have two JVM Options, task server JVM Options and Query Server JVM Options. Which one should I use? BTW, I tried adding the text to both and it didn't work.

gregbo · ‎01-14-2021

When i do that, the search on the new tab doesn't include the values that were clicked on, like in Auto.

gregbo · ‎07-16-2020

I heard that RHEL 7 can have mount points that point to S3...has anyone tried setting that up and placing index buckets on that partition? Wondering if it's possible or not.

gregbo · ‎04-22-2020

I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this?

gregbo · ‎03-05-2020

I checked, and both outputs.conf are identical (except for the sslPassword hash). Could it be something else? Is there a way to increase the "Maximum message size" that's mentioned in the error?

gregbo · ‎03-04-2020

One of my forwarders is not connecting with the indexers. Another system that is identical is connecting just fine. I keep getting errors about the message being rejected because it's too big, but I can't figure out where to adjust the allowed message size. This error is from the indexer: 03-04-2020 15:45:26.122 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=x.x.x.x:57186 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

gregbo · ‎03-03-2020

The disk usage is at 17% and inode usage is at 1%. The error message from Splunk Web says minFreeSpace is 5000 and free space is 85711: 03-03-2020 16:16:48.266 +0000 WARN DiskMon - MinFreeSpace=5000. The diskspace remaining=85711 is less than 2 x minFreeSpace

gregbo · ‎08-02-2019

Whelp, I learned I need to pay closer attention to my inputs.conf...I had it as renderXML, but it's supposed to be renderXml. It's working now.

gregbo · ‎08-02-2019

I have a Windows 2016 Server and I've got a UF sending windows event logs. They only come in as xml, even if I put renderXML = false in inputs.conf. Anyone know what I'm missing?

gregbo · ‎06-26-2019

Someone is telling me that Splunk doesn't grab Perfmon data properly...they are getting %Processor Time from both the Process and Processor counters. They say that if they grab the data from Process for each process and add them up, they don't get the same value as the value from the Processor counter (even taking the number of CPUs/Cores/Hyperthreading into account). They say they asked Splunk for updates and got some updates and they still don't work.

gregbo · ‎06-24-2019

There's a Process object and a Processor object in Perfmon. The Processor object works fine. The user has all the necessary rights.

gregbo · ‎06-24-2019

All the ones I ever see is Python. I need one that uses a bash script.

gregbo · ‎06-21-2019

I have splunk getting data for the other objects, including Processor, but nothing happens for Process. The process stanza: [perfmon://Process] interval = 60 object = Process counters = _Total instances = * index = windows showZeroValue = 1 disabled = 0 The processor stanza: [perfmon://Proccesor] interval = 60 object = Processor counters = * instances = * index = windows showZeroValue = 1

gregbo · ‎05-30-2019

I have a splunk cluster (RHEL) with 2 indexers, and they seem to have a memory leak. Memory usage grows steadily until it runs out of memory and the OOM Killer kills the splunkd process. The only way to get the memory back is to restart the server (restarting splunk doesn't help). I've got two clusters that do this, and a few single instance splunk servers that never do this. Oddly enough, it's usually one of the indexers in the cluster that eats up memory first. ulimit and THP is set properly on all the servers. Has this happened to anyone?

gregbo · ‎04-17-2019

I just installed a new UF on a Windows VM, and I'm getting an error that connection to the host failed, with "sock_error = 10054. SSL Error = No error" The indexers I'm trying to connect to can talk to a bunch of other Windows VMs. The ports to the indexers are open from the Windows VM that's having the problem. This configuration worked when I installed it on other VMs What does "SSL Error = No error" mean?

gregbo · ‎11-16-2018

How about a non-clustered bucket? Can I just delete it from the OS?

gregbo · ‎09-13-2018

Did you ever figure this out?

Posts	73
Solutions	4
Karma Given	3
Karma Received	17
Member Since	‎01-28-2016

Online Status	Offline
Date Last Visited	‎02-01-2023 01:30 AM

When will Splunk Essentials for Cloud and Enterpri...

Why is search history retention inconsistent betwe...

DB Connect Rising Column Keeps inserting the lates...

Where do I change the maximum Message body length?

What cipher suites does DB Connect use?

Where do I put the JVM options in the GUI

Has anyone ever mounted a RHEL partition that poin...

How do I migrate a Splunk indexer cluster to new h...

One UF isn't connecting to the indexer

Why am I getting a warning about disk space when m...

When will Splunk Essentials for Cloud and Enterpri...

Re: Search History retention inconsistent between ...

Why is search history retention inconsistent betwe...

Re: DB Connect Rising Column Keeps inserting the l...

DB Connect Rising Column Keeps inserting the lates...

Re: Where do I change the maximum Message body len...

Where do I change the maximum Message body length?

What cipher suites does DB Connect use?

Where do I put the JVM options in the GUI

Re: Creating drilldown to new tab for auto search ...

Has anyone ever mounted a RHEL partition that poin...

How do I migrate a Splunk indexer cluster to new h...

Re: One UF isn't connecting to the indexer

One UF isn't connecting to the indexer

Why am I getting a warning about disk space when m...

Re: Does Windows Server 2016 only produce xml logs...

Does Windows Server 2016 only produce xml logs?

Is there a problem with splunk getting data from t...

Re: Splunk won't index Perfmon Process object

Does anyone have an example of a custom alert acti...

Splunk won't index Perfmon Process object

Memory leak on indexers in a cluster

New install of UF windows, splunkd.log says "sock_...

Re: How do I remove a corrupted bucket in an Index...

Re: How to extract XML attribute names and corresp...