About ryanhast

ryanhast · ‎11-22-2017

I ran into the issue with the KVstore not starting after upgrading my indexers form 6.4.7 to 6.6.4. Shout out to @sgarvin55 for his answer. In my server.conf on my indexers I had the following setting. sslVersions = tls1.2, -ssl3, -ssl2, -ssl1 I removed that setting and restarted Splunk. KVstore started normally. It appears the default is now tls1.2 for Splunk 6.6.3 and 6.6.4.

ryanhast · ‎11-01-2017

Make sure that your server is not also running a Splunk forwarder. 1. Uninstall then reinstall Splunk.

ryanhast · ‎08-26-2017

Is the role that your user-prefs.conf not deployed to you SHC? What is the error that SHC is barking about? I my SHC I package the user-prefs.conf in a separate package to deploy to SHC. Any changes I make them there.

ryanhast · ‎12-25-2016

The 'restartifNeeded' set to true in the serverclass.conf may take care of the restart always when an app is deployed to the forwarder. restartIfNeeded = true | false * This is only valid on forwarders that are newer than 6.4. * If true and issueReload is also true, then when an updated app is delpoyed to the client, that client will try to reload that app. If it fails, it will then restart. * defaults to false https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Serverclassconf Here is post on answers that may point you in the direction with working with 'upstart' and splunkd. https://answers.splunk.com/answers/22511/integrating-splunk-with-upstart-ubuntu-debian.html

ryanhast · ‎12-07-2015

I had this issue on a UF running on windows. The UF was missing the $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/. I ran a repair from the windows "Programs and Features". After the repair $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/ was present and error went away. Splunk UF 6.2.6.

ryanhast · ‎02-25-2015

It breaks the log into a .log format with each event per line. Again their is a Splunk UF on the kiwi log collecting server.

ryanhast · ‎02-25-2015

On my kiwi log collector I do have a Splunk UF installed. How can I configure the TA_Windows App to read the collected windows event log? Is there a way?

ryanhast · ‎02-25-2015

I have a Kiwi log collector that Windows event logs are being collected on. The logs are first collected on a remote Kiwi log collector then forwarded to my Kiwi log collector. I know that the best way of getting windows event logs into Splunk is to install the universal forwarder on each windows host, but that is not an option for me. The goal is to use the TA_Windows app to read the remote Windows event logs that are collected on the Kiwi log collector server and forward the data parsed into Splunk to a index. Any ideas?

Posts	8
Solutions	1
Karma Given	12
Karma Received	1
Member Since	‎08-22-2014

Online Status	Offline
Date Last Visited	‎03-09-2023 01:31 PM

How to monitor Windows event logs from shared log ...

Re: After upgrading to 6.5.0, KV Store will not st...

Re: Splunk not starting with 8089

Re: user-prefs.conf in a custom app

Re: Is it possible to stop the forwarder instead o...

Re: UF not sending any data - The pipeline indexer...

Re: How to monitor Windows event logs from shared ...

Re: How to monitor Windows event logs from shared ...

How to monitor Windows event logs from shared log ...