Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jmrubio
jmrubio
Explorer
Member since:
07-31-2023
03-26-2024
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 07-31-2023 |
Activity Feed
- Posted STIG requires file permissions, ownership, and group membership of system files and commands match the vendor value on Security. 03-01-2024 10:15 AM
- Karma Re: UDP data input for richgalloway. 02-14-2024 09:48 AM
- Posted Re: UDP data input on Installation. 02-13-2024 05:18 PM
- Posted UDP data input on Installation. 02-13-2024 01:46 PM
- Posted Re: Which indexer should I send data to? on Splunk Search. 02-09-2024 08:16 AM
- Karma Re: Which indexer should I send data to? for gcusello. 02-09-2024 08:14 AM
- Posted Which indexer should I send data to? on Splunk Search. 02-09-2024 08:02 AM
- Posted Re: Network device logs on Getting Data In. 02-07-2024 02:02 PM
- Karma Re: Network device logs for richgalloway. 02-07-2024 02:01 PM
- Posted Re: Network device logs on Getting Data In. 02-07-2024 01:52 PM
- Posted Network device logs on Getting Data In. 02-07-2024 10:32 AM
- Karma Re: Splunk cannot authenticate the request. CSRF validation failed. for maraman_splunk. 02-06-2024 04:04 PM
- Posted Re: kvstore certificate renewal is not working... on Knowledge Management. 10-23-2023 10:07 AM
- Karma Re: kvstore certificate renewal is not working... for vinod94. 10-23-2023 10:06 AM
- Posted Re: Can't connect to heavy forwarder GUI on Deployment Architecture. 09-18-2023 09:36 AM
- Posted Re: Can't connect to heavy forwarder GUI on Deployment Architecture. 09-18-2023 07:58 AM
- Posted Re: Can't connect to heavy forwarder GUI on Deployment Architecture. 09-18-2023 07:38 AM
- Posted Re: Can't connect to heavy forwarder GUI on Deployment Architecture. 09-13-2023 09:13 AM
- Posted Why Can't I connect to heavy forwarder GUI? on Deployment Architecture. 09-13-2023 08:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-01-2024
10:15 AM
I am having trouble clearing a STIG that requires file permissions, ownership, and group membership of system files and commands match the vendor values. It is hitting on pretty much all of the splunk files, but I am not sure what it means when it says it has to match the vendor values. Any help is much appreciated!
... View more
Labels
- Labels:
-
other
02-13-2024
05:18 PM
@richgalloway So I just have to create an index wit the same name on the indexers?
... View more
02-13-2024
01:46 PM
Hello! I am trying to send data to Splunk using UDP, I tried to set it up using the documentation and seen a few videos on how to set it up but can't get it right. I have the data coming into my HF from network devices and then should be sent to my indexers. After going through the set up I get this error message "Search peer splunk_indexer_02 has the following message: Received event for unconfigured/disabled/deleted index=<index> with source="source::udp:514" host="host::xx.xx.xx.xx" sourcetype="sourcetype::<sourcetype>. So far received events from 2 missing index(es)." I created a new index during the set up but there is no data to search.
... View more
Labels
- Labels:
-
heavy forwarder
-
indexer
02-09-2024
08:16 AM
I have to work with what I have so it's going from the hf to the indexers. Thanks for the response @gcusello !!
... View more
02-09-2024
08:02 AM
Hello! I am trying to send syslogs to splunk from network devices using udp. I have one heavy forwarder and two indexers, does it matter which indexer i set up to listen for the data?
... View more
Labels
- Labels:
-
other
02-07-2024
01:52 PM
@richgalloway Is there any way to not have to use a separate syslog server?
... View more
02-07-2024
10:32 AM
Hello! I wanted to ask what is the best way/configuration to get network device logs directly into splunk? Thanks in advance!
... View more
Labels
- Labels:
-
Windows
10-23-2023
10:07 AM
Three years later and this worked! Thanks!!
... View more
09-18-2023
09:36 AM
Is that the only way to get the data in? This is a production server and I don't think I will be able to disable/stop firewalld.
... View more
09-18-2023
07:58 AM
Hello @gcusello, I tried ss -na | grep 8000 and it returned: tcp LISTEN 0 128 *:8000 *:*
... View more
09-18-2023
07:38 AM
Hello @isoutamo , Sorry for the late response. So in the splunkd.logs all of the messages are - WARN TcpOutputProc [16779 indexerPipe] - The TCP output processor has paused the data flow. Forwarding to host_dest=<IP> inside output group default-autolb-group from host_src=Splunk_Heavy_Forwarder has been blocked for blocked_seconds=355350. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. And the last message in the splunkd_access.log is from June : ( I am trying to connect to the HF through the web, and the cURL command returned a 303 error "The resource has moved temporarily"
... View more
09-13-2023
09:13 AM
Hello @gcusello, Firewalld is running, and I do not see anything disabling web interface in server.conf. The "trustedIP" is commented out, but I do not know if that matters.
... View more
09-13-2023
08:55 AM
I am getting a 500 internal server error when I try to connect to the HF GUI. I ran firewall-cmd --list-ports, and it shows 8000/tcp. I also checked web.conf, and it shows enableSplunkWebSSL = 1, as well as httport = 8000. What else can I check? I appreciate the help in advance!
... View more
- Tags:
- splunk search
Labels
- Labels:
-
heavy forwarder
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-26-2024
11:41 AM
|
