About Martin_Doering

Martin_Doering · ‎10-10-2023

These series colors from the documentation are not the real colors used. Instead, the colors are as follows (taken from $SPLUNK_HOME$/share/splunk/search_mrsparkle/exposed/js/splunk/palettes/ColorCodes.js): [0x006d9c, 0x4fa484, 0xec9960, 0xaf575a, 0xb6c75a, 0x62b3b2, 0x294e70, 0x738795, 0xedd051, 0xbd9872, 0x5a4575, 0x7ea77b, 0x708794, 0xd7c6b7, 0x339bb2, 0x55672d, 0xe6e1ae, 0x96907f, 0x87bc65, 0xcf7e60, 0x7b5547, 0x77d6d8, 0x4a7f2c, 0xf589ad, 0x6a2c5d, 0xaaabae, 0x9a7438, 0xa4d563, 0x7672a4, 0x184b81, 0x7fb6ce, 0xa7d2c2, 0xf6ccb0, 0xd7abad, 0xdbe3ad, 0xb1d9d9, 0x94a7b8, 0xb9c3ca, 0xf6e8a8, 0xdeccb9, 0xb7acca, 0xb2cab0, 0xa5b2bf, 0xe9ddd4, 0x66c3d0, 0xaab396, 0xf3f0d7, 0xc1bcb3, 0xb6d7a3, 0xe1b2a1, 0xdec4ba, 0xabe6e8, 0x91b282, 0xf8b7ce, 0xcba3c2, 0xcccdce, 0xc3ab89, 0xc7e6a3, 0xada9c8, 0xa4bbe0]

Martin_Doering · ‎09-25-2023

Hi! We are facing the same issue, both on versions 8.2.9 and version 8.2.12. We did not find a solution yet, but raised a support ticket.

Martin_Doering · ‎03-03-2020

We also have the same issue with 7.3.3, and have found the following workaround: simply add an empty paragraph in the HTML code before the style tag: <html> <p/> <style> ...

Martin_Doering · ‎09-12-2019

I also had the same issue (using Splunk version 7.2.7), and a restart of the cluster master did not help. First, you need to disable indexer clustering on the search head you want to remove. In Splunk Web, go to Settings --> Indexer Clustering. Then remove the cluster master you do not want to collect data from, which is only working if it is not the only cluster master. If it is the only one, click on Edit --> Disable Indexer Clustering instead. Afterwards, the search head will show as "Unavailable" in the monitoring console of the cluster master. After some digging through the configuration files of the cluster master (looking for the search head's IP address and host name), I found some leftovers of the removed search head: In the [settings] stanza of $SPLUNK_HOME$/etc/apps/splunk_monitoring_console/local/splunk_monitoring_console_assets.conf in the configuredPeers key In $SPLUNK_HOME$/etc/apps/splunk_monitoring_console/lookups/assets.csv In $SPLUNK_HOME$/etc/apps/splunk_monitoring_console/lookups/dmc_forwarder_assets.csv After removing those leftovers and restarting splunkd , the search head had also been removed from the cluster master.

Martin_Doering · ‎01-09-2018

I finally got this running on Splunk 6.6.4. The following is required: invalid_cmd=archive needs to be included in the source stanza (not in the sourcetype stanza as stated in the docs). The jar archive must be specified with its full absolute path. However, this file path must not contain spaces nor quotation marks. This makes the standard path of "C:\Program Files\SplunkUniversalForwarder\..." impossible to use. I had to change this to C:\Progra~1\SplunkUniversalForwarder\... to omit both spaces and quotation marks. The only difference of my configuration to the problem stated in the question is that I do not use runnable jar files, so my Java call is java -cp C:\Progra~1\SplunkUniversalForwarder\... CLASS_NAME . I have deployed this to a Windows Universal Forwarder that in turn forwards the parsed data to a Linux Heavy Forwarder. On the HF, I perform some additional field extractions from the file name (which is not available for the unarchive_cmd ). So on the UF, props.conf only contains source stanzas, and on the HF, props.conf only contains sourcetype stanzas.

Martin_Doering · ‎12-04-2017

Made some progress: I now see some warnings of the "ArchiveContext" component: Command cmd="java -cp "C:\Program Files\SplunkUniversalForwarder\etc\apps\bin.jar" " for archive= failed: exited with code 1. Need to find out what this is about. My own code does not exit with status code 1 (but rather with 0 or negative numbers).

Martin_Doering · ‎12-04-2017

Same question from my side. I got this running on a Linux universal forwarder, but by a Windows universal forwarder, the command is never run (knowing that because the Java could would otherwise write to a log file). splunkd.log shows that the archive is processed ("Finishied processing file ..." messages from the ArchiveProcessor), so the "invalid_cause = archive" setting is working.

Posts	8
Solutions	0
Karma Given	4
Karma Received	5
Member Since	‎10-11-2012

Online Status	Offline
Date Last Visited	‎10-10-2023 10:04 AM

Re: Are there Different Dashboard Colors since Upd...

Re: How to complete a KVStore Migration

Re: How to change the width of panels in xml?

Re: How do I remove a search head that is appearin...

Re: unarchive_cmd with Java on a Windows system

Re: unarchive_cmd with Java on a Windows system

Re: unarchive_cmd with Java on a Windows system