Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dkozinn
dkozinn
Path Finder
Member since:
11-20-2019
03-06-2024
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 6 |
| Member Since | 11-20-2019 |
Activity Feed
- Posted Re: Search History disappeared ( Splunk Enterprise 8.0.1) on Splunk Enterprise. 07-22-2022 09:01 AM
- Posted Re: Search History disappeared ( Splunk Enterprise 8.0.1) on Splunk Enterprise. 07-22-2022 08:29 AM
- Posted Re: Search History disappeared ( Splunk Enterprise 8.0.1) on Splunk Enterprise. 07-22-2022 08:12 AM
- Posted Re: 8.0.4.1 on Ubuntu 20.04LTS: Why are emails failing with 'ResourceNotFound' error on alerts? on Alerting. 03-10-2022 10:49 AM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 03-09-2022 04:43 PM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 03-09-2022 03:36 PM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 03-08-2022 05:37 PM
- Got Karma for Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler. 03-08-2022 02:49 PM
- Karma Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler for trashyroadz. 03-08-2022 02:43 PM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 03-08-2022 02:42 PM
- Karma Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler for benhooper. 10-21-2020 08:19 AM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 10-21-2020 07:58 AM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 10-21-2020 07:52 AM
- Got Karma for Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler. 10-20-2020 12:47 PM
- Got Karma for Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler. 10-20-2020 12:47 PM
- Got Karma for 8.0.4.1 on Ubuntu 20.04LTS: Why are emails failing with 'ResourceNotFound' error on alerts?. 10-20-2020 12:46 PM
- Got Karma for Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler. 10-20-2020 12:46 PM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 10-20-2020 08:24 AM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 09-30-2020 06:28 AM
- Posted Re: Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance: Emails fail with 'ResourceNotFound' error on aler on Alerting. 09-29-2020 02:01 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 |
07-22-2022
09:01 AM
Interesting that you did that. My instance of Splunk runs on a small Ubuntu server (no GUI) and I access from any number of different systems, but always using "admin" as a user ID when I have to log in.
... View more
07-22-2022
08:29 AM
For the license I have (Dev/Test), I can only have one user, which by default is "admin". I'd changed that, and from the information that I got, the user name not being "admin" on a Dev/Test instance is what causes the problems. Note that this has nothing to do with the account on the machine that it's running on; This is the user that you provision within Splunk itself (Settings->Users).
... View more
07-22-2022
08:12 AM
I'd forgotten about this post, I did get an resolution: For devtest instances, it turns out that a number of functions don't work properly if you've changed the name of the user to anything other than "admin". Once I changed it back to admin not only did history start working, but an issue I'd had with mail not being delivered got fixed as well. Let me know if that fixes the issue for you.
... View more
03-10-2022
10:49 AM
@trashyroadz wrote In Advance Settings for the alert, the server is changed from 'localhost' to your organization's email server (for me, mail.splunk.com). I think this depends on your local email setup. In my case, my local machine is running it's own mail server (Postfix) and has an upstream server that it talks to for delivery off the local machine. It works fine with either localhost or mymachine.example.com:25 in that field.
... View more
03-09-2022
04:43 PM
Following-up on my follow-up, I noticed a few errors when restarting splunk, and to make a long story short, found that I'd copied some things from the original user directory to the admin user directory as root but never changed the file ownership. As a result, it seems that Splunk wasn't able to read those files. Running chown -R splunk:splunk from $SPLUNK_ETC/users/admin fixed that, and now I'm seeing the old saved searches, etc.
... View more
03-09-2022
03:36 PM
I wish this was a VM as I'd just take a snapshot before trying this. Obviously it's easy enough to save and restore the files, but I don't know what happens internally in Splunk and as mentioned before, I'd rather not have to build the per-user stuff again from scratch if I can help it.
... View more
03-08-2022
05:37 PM
To be honest @trashyroadz I was surprised that anyone found this and followed up after all this time, so it's much appreciated. You might have missed the other half of my last message: Rather than try to recreate saved searches, alerts, etc., can I copy everything under ./etc/users/olduser to ./etc/users/admin? I tried copying a few things but I suspect there are things I'm missing (stuff under various metadata directories?). I haven't done anything I care about after I modified the username so I don't care if anything there gets blown away.
... View more
Thank you so much for following up on this. I modified the username in passwd and finally alerts are working. As a bonus, I believe that may have fixed an issue with search history always being blank despite the etc/users/myuser/search/myhost.csv file being populated. I hadn't checked that in a while so I can't be 100% sure this was the fix, but it is working now. Rather than try to recreate saved searches, alerts, etc., can I copy everything under ./etc/users/olduser to ./etc/users/admin? I tried copying a few things but I suspect there are things I'm missing (stuff under various metadata directories?). I haven't done anything I care about after I modified the username so I don't care if anything there gets blown away.
... View more
10-21-2020
07:58 AM
Regarding your earlier comments about the hard-coded username in the code, on my system I've changed the default name of the administrative user. To be honest, I don't recall if I was prompted to do that or if I did it for some other reason. Could that be somehow involved?
... View more
10-21-2020
07:52 AM
There are a large number of files under $SPLUNK_HOME owned by root, though not all. On my machine, splunkd is running through systemd as root. Would I still need to change the ownership of those files?
... View more
10-20-2020
08:24 AM
Thanks for digging into this @benhooper . I'd started digging into this and got stuck due to the same lack of documentation that you mentioned.
... View more
I was not able to get the 404 error. I used the exact curl command you suggested, going to 127.0.0.1 using the same userid/password that I use to log in. Splunk itself runs as root on my machine, so I can't use that for credentials, but the account that I did use does have full admin rights. I know very little about how things work via the API, should there always be something there to retrieve or does that only happen for some period after the search/schedule report runs?
... View more
Hi @jorjiana88 , The splunk management port is accessible on 8089. Using curl, I get this: {"messages":[{"type":"ERROR","text":"Action forbidden."}]} To verify that the credentials were correct, I intentionally used the wrong password and then got this: {"messages":[{"type":"ERROR","text":"Unauthorized"}]}
... View more
I do still have the issue @thambisetty. @peterm30 mentioned that it might be a permissions issue, so I checked the directory where Splunk is installed. After a little digging, it looks there are directories with results under $HOME/var/run/splunk/dispatch that are owned by root with permissions of 700, meaning the splunk user wouldn't be able to see the contents. I noticed files named results.csv.gz and looking at them (as root), these seem to be the output of the searches. If this is the issue, what is causing those to be written by root instead of splunk? Note that $HOME/var/run/splunk/dispatch is owned by splunk (not root). Thanks to both of you for getting back to me.
... View more
I'm running Splunk Enterprise 8.0.4.1 on Ubuntu 20.04LTS single user instance. I am using an Enterprise dev/test license (single user) for this instance. Any attempt to send email results in the following in python.log:
2020-07-07 21:45:15,136 +0000 ERROR sendemail:1435 - [HTTP 404] https://127.0.0.1:8089/servicesNS/admin/search/saved/searches/_new?output_mode=json Traceback (most recent call last): File "/opt/splunk/etc/apps/search/bin/sendemail.py", line 1428, in <module> results = sendEmail(results, settings, keywords, argvals) File "/opt/splunk/etc/apps/search/bin/sendemail.py", line 261, in sendEmail responseHeaders, responseBody = simpleRequest(uri, method='GET', getargs={'output_mode':'json'}, sessionKey=sessionKey) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 577, in simpleRequest raise splunk.ResourceNotFound(uri) ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/servicesNS/admin/search/saved/searches/_new?output_mode=json
The mailserver is on the local host, TLS isn't in use. I've verified that the Splunk user can send email both via the mail command as well as calling sendmail directly. The error happens if I use an alert with email as well as using |sendemail from a search.
As this instance is limited to a single user the user that this runs under has the admin role. For logging preferences, I set EmailSender to DEBUG but I'm not seeing anything useful.
... View more
05-07-2020
10:12 AM
Trying to bump for visibility. Still happens after upgrading to 8.0.3.
The only thing I noticed that might be unusual (and I don't know if it is) is that the permissions on the CSV file are that it's set to 0600 and owned by root. The directory itself and the only other file there (called .dummy_history) are all owned by splunk:splunk. If I change the ownership of the .csv to be splunk:splunk it changes back to root.
... View more
01-14-2020
05:20 PM
I have a fresh install of Splunk Enterprise 8.01 on a box running Ubuntu 19.10 as a standalone instance (no clustering, etc.) When I access the Search app, there is never any history showing under Search History. Using |history as a search does not product any output either. If I look in /opt/splunk/etc/users/myuser/search/history there is a CSV file that gets updated with each search I enter. If I look at the _audit index, I do see the searches there.
I've looked through a few other posts here but none seems relevant. Any suggestions?
... View more
01-09-2020
09:18 AM
1 Karma
I've got a similar issue with a clean install of 8.0.1 under Ubuntu, though in my case no history shows up at all on the summary page and I get nothing at all back from |history.
In my case, there is a .csv file in $SPLUNK_HOME/etc/users/my_user/search/history and new searches get appended to that.
Everything is running on a single machine, no clustering.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-06-2024
11:08 AM
|
