Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dlpco
dlpco
Path Finder
Member since:
09-11-2012
10-19-2020
Community Statistics
| Posts | 35 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 16 |
| Member Since | 09-11-2012 |
Activity Feed
- Karma Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security" for napomokoetle. 06-05-2020 12:50 AM
- Got Karma for How to resolve splunk-perfmon.exe errors of Counter is not found?. 06-05-2020 12:50 AM
- Got Karma for How to resolve splunk-perfmon.exe errors of Counter is not found?. 06-05-2020 12:50 AM
- Got Karma for How to resolve splunk-perfmon.exe errors of Counter is not found?. 06-05-2020 12:50 AM
- Got Karma for Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?. 06-05-2020 12:49 AM
- Got Karma for Re: How to enable the Search Assistant in 6.5.0?. 06-05-2020 12:48 AM
- Got Karma for Re: Does KV Store run in the Free License. 06-05-2020 12:47 AM
- Got Karma for Re: Does KV Store run in the Free License. 06-05-2020 12:47 AM
- Got Karma for Re: Does KV Store run in the Free License. 06-05-2020 12:47 AM
- Got Karma for SOS 3.2 on Splunk 6.2 loggs HttpListener Exception. 06-05-2020 12:47 AM
- Got Karma for SOS 3.2 on Splunk 6.2 loggs HttpListener Exception. 06-05-2020 12:47 AM
- Got Karma for Re: SOS 3.2 on Splunk 6.2 loggs HttpListener Exception. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "Service 'splknetdrv' could not be stopped! Error = 1062" in splunkd.log after restarting Windows universal forwarder?. 06-05-2020 12:47 AM
- Got Karma for ps_sos.ps1 Microsoft.PowerShell.Commands.WriteErrorException. 06-05-2020 12:46 AM
- Got Karma for ps_sos.ps1 Microsoft.PowerShell.Commands.WriteErrorException. 06-05-2020 12:46 AM
- Posted Universal Forwarder - Repeating message TcpOutputProc - Found currently active indexer... on Getting Data In. 04-06-2020 06:20 PM
- Tagged Universal Forwarder - Repeating message TcpOutputProc - Found currently active indexer... on Getting Data In. 04-06-2020 06:20 PM
- Tagged Universal Forwarder - Repeating message TcpOutputProc - Found currently active indexer... on Getting Data In. 04-06-2020 06:20 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 3 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 |
04-06-2020
06:20 PM
I am getting the following messages on my forwarder running on Windows 10:
04-06-2020 18:05:52.171 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
04-06-2020 18:06:22.093 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
04-06-2020 18:06:51.934 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
04-06-2020 18:07:21.808 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
04-06-2020 18:07:51.660 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
I just updated the forwarder to 8.0.3 and these messages just keep coming. There are no disconnect messages, just these found messages.
HELP...
... View more
04-03-2020
07:14 PM
It looks like that this has to do with the mode = multikv default that perfmon data now uses. It looks like the Splunk App Windows Infrastructure or whatever is used to display this screen does not understand or know how to use data in the multikv format. If I change these in inputs.conf to mode = single then they start working again. Is this the only way to get this back or someone know if they are correcting this? I don't know if changing the required inputs.conf stanzas to mode = single will kill off something else.
... View more
03-25-2020
07:22 PM
When I go to the Performance Monitoring screen of the Splunk App Windows Infrastructure I only get data for CPU and Network Metrics.
I am on 8.0.2.1 of Splunk, Splunk Add-on for Microsoft Windows 7.0.0, Splunk App for Windows Infrastructure 2.0.1 and using the current forwarder on the windows 10 machine sending data to the indexer.
It looks like data is coming in but is in a different format than it use to be. It seems that the source no longer has the counter field. Am I missing something in the update?
... View more
08-19-2019
07:10 PM
The names seem to be correct and these errors only happen once per day! They are all set with an interval of 600 so I would think that if the names were wrong it would complain more often. As an example, the log only shows this for the past few days:
08-16-2019 20:56:03 (Many entries but all in the same second.)
08-17-2019 02:22:33 (Only one entry)
08-18-2019 17:43:02 (Only one entry)
08-19-2019 18:16:01 (Many entries again!)
Its almost like windows is not giving up the information - I just don't know how that is obtained.
If I look at the date and time of these errors in Search (Looking at an hour of time selecting a "not found" counter ) I see a dip in the number of events for that minute ONLY.
Any ideas where to go from there?
... View more
08-16-2019
09:41 PM
3 Karma
I have noticed that after updating the Universal Forwarder to 7.3.1 (not sure if it is that update or a Windows update) running on Windows 10 Pro (64bit) Version 1809. I get about 2735 of the same type of the following lines around the same time each day in the Forwarders splunkd.log file. Anyone got an idea of how to fix?
08-16-2019 20:56:04.314 -0700 ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-perfmon.exe" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: IO Data Bytes/sec 08-16-2019 20:56:04.314 -0700 ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-perfmon.exe" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: IO Other Bytes/sec 08-16-2019 20:56:04.314 -0700 ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-perfmon.exe" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: % Processor Time 08-16-2019 20:56:04.314 -0700 ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-perfmon.exe" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: % User Time 08-16-2019 20:56:04.314 -0700 ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-perfmon.exe" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: % Privileged Time 08-16-2019 20:56:04.314 -0700 ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-perfmon.exe" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: Page Faults/sec ... and more lines ...
... View more
Labels
- Labels:
-
universal forwarder
07-17-2018
06:56 PM
Yes it did. It actually had the warning on the application setup screen if you read it. Feel a little stupid that I didn't read/see the error before I posted.
... View more
06-23-2018
05:51 PM
I just saw that in the docs as well as during the application setup. Highest version can only be 4.8.4 right now.
OOPS!!! Thanks guys
... View more
06-23-2018
04:40 PM
1 Karma
Also - why is it complaining when I am not displaying Windows items or using the lookup. If I simply do a search with index=main or even index=_audit, I get the same 3 errors! Why?
... View more
06-23-2018
04:35 PM
1 Karma
How do I rerun the app setup? Are you talking about the setup within the Windows Infrastructure application or do you mean to delete and re-add the application?
Just doing a rebuild on the lookups did not help.
... View more
06-22-2018
04:17 PM
1 Karma
After upgrading to Splunk Add-on for Microsoft Windows 5.0.0 and Splunk App for Windows Infrastructure 1.4.4 it seems I get the following errors ever query I put in:
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'WMI:WinEventLog:Security' and lookup table 'windows_app_lookup'.
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'source::WinEventLog:Security' and lookup table 'windows_app_lookup'.
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'source::XmlWinEventLog:Security' and lookup table 'windows_app_lookup'.
I am unsure what the "for conf" stands for, but when I do a "|inputlookup windows_app_lookup" it does shows the file but no header is conf. It does show the 3 keys above.
... View more
10-29-2016
03:27 PM
1 Karma
In the free license, there is no such entry in the Splunk bar to be able to do that. Is there some way to turn it on again with the free license?
... View more
10-27-2016
09:09 PM
I am using 6.5.0 of Splunk with the Free license install. When in the Search and Reporting screen, I get no Search Assistant. I would like to have that available but can't figure out how to get it turned on.
Suggestions???
... View more
09-29-2016
01:50 PM
Oops forgot some info...
Using the free license (no issue before) and the version of the app is 1.2.1. I know there is 1.3.1 but the system says there is no update to what I have. (Because it is not yet supported???)
... View more
09-29-2016
01:46 PM
I have been running the Splunk App for Windows Infrastructure for a while and then updated to Splunk 6.5 and no longer get anything displayed. I re-ran the setup from the application and it says I got the data and checked the stuff I wanted. However it does not display anything. If I click on one of the reports noted in the application, I get the data I would expect.
Ideas??? Is the App supported in Splunk 6.5.0?
... View more
05-27-2016
01:26 PM
I just upgraded to 6.4.1 and have the same thing going on. I can get to the report by either changing the URL (as you did) or using the link in S.O.S. (which is just a link to the same URL). My Linux system is up to date and I have just updated Splunk in the last few hours. Also using the Splunk Free license.
... View more
02-16-2016
07:32 PM
Did you get an answer offline about this. I have the same issue.
... View more
01-21-2015
10:31 PM
I never did get an answer, I updated to 6.2.1 and installed the indexer on LINUX and issue was not encountered again.
... View more
12-20-2014
11:16 AM
Is that something new in Version 1.1.1??? Previous versions worked and I bet that this one would as well if there was a way to assign the new role created by the install to the admin user.
... View more
12-19-2014
05:49 PM
BTW... I am running Splunk on a LINUX machine using the Splunk_TA_Windows version 4.7.3 on the Windows machine I am monitoring. It is a standalone machine running stuff that I need to keep an eye on and is not a member AD.
... View more
12-19-2014
05:06 PM
The winfra-admin user role REQUIRED for Splunk App for Windows Infrastructure setup. I am running the FREE version so how do I get the ne role associated with the admin user?
... View more
11-28-2014
03:38 PM
sideview....
You found anything of interest yet?
... View more
11-06-2014
11:35 AM
It is strange though that the errors go away if I use Firefox rather than IE 11. Splunk is running in a Linux virtual machine (like the previous versions) so you are correct that it is not Windows. I am connecting to Splunk from a Windows machine. I still am trying to get my head around Firefox working fine and IE 11 not. Going to mess around some more with IE settings to see if I can find something.
... View more
11-06-2014
03:19 AM
3 Karma
Well - I tried it and got the following errors:
Error in 'inputlookup' command: The lookup table 'Requires license feature=KVStore' is invalid.
Looking at the splunkd.log I find the following lines:
INFO LMTracker - Setting feature=KVStore state=ENABLED (featureStatus=1)
a few lines later.....
INFO LMTracker - Setting feature=KVStore state=DISABLED_DUE_TO_LICENSE (featureStatus=2)
I guess that this is saying that KV Store is not valid in the Free License?
... View more
11-06-2014
01:52 AM
1 Karma
This seems to be an IE 11 issue. It fails with IE 11 rather in compatibility mode or not. If I use Firefox (33.0.2) from the same machine, the failures are not seen. I am unsure rather it is an issue with SoS (3.2) or SideView Utils (3.3). Any thoughts???
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-19-2020
10:23 PM
|
