About akira_splunk

akira_splunk · ‎10-15-2019

Can you please share the lambda function?

akira_splunk · ‎05-20-2019

Here's a possible solution to match on multiple fields: 1. Import entities from a search and create a new field in the search (e.g. index=blah | eval server_process=host+"."+process | dedup server_process | table server_process, host, process) 2. Create different KPI base search for the process metrics and leverage the field you defined in the entity import (e.g. index=blah | eval server_process=host+"."+process | table server_process, host, process, metric). 3. When defining the KPI in the service, reference the title matching field as server_process

akira_splunk · ‎04-01-2019

I downvoted this post because no longer accurate with 7.2 enhancement

akira_splunk · ‎10-18-2018

David, I just tested this on a Windows universal forwarder sending to a Macbook indexer+search head in one. The extractions are working for me. My suggestions is to remove the props/transforms you have above from the UF and indexers. Place only on the search head. Since you're using a deployment server and having this configuration pushed out to your search head, indexers, and forwarder, you can fix this by creating another serverclass for just the search head. Then place the assign the app where these configs are located to just the search head serverclass, put out the configs, restart all the servers, and you should be good to go.

akira_splunk · ‎07-20-2018

Hey Kris, NO Deployment server for your Clustered indexers or Search Head Clusters. In your case, you need to use the Cluster Master for the indexers, and a Deployer for your search heads. A deployment server would only be an option if the indexers were 'distributed' (i.e. when clustering is NOT enabled, but data is spread and load balanced across multiple indexers). And similarly for Search Heads. Only if the SHs are independent. It's not recommended to have the search heads disparate, as user changes done one SH would NOT be replicated to the other search heads.

akira_splunk · ‎06-12-2018

My customer can validate this has also worked for them. Great find @joeydenbroeder

akira_splunk · ‎12-07-2017

You likely have inputs within the app still enabled. Do not disable the app. Disable the inputs instead. If you want to limit access to the splunk_TA_aws app, limit the access to certain roles instead. And FYI, after disabling the splunk_TA_aws on my system, I was prompted that a restart is required. I re-enabled the splunk_TA_aws app first, then restart my system. Since then the disable app link/button is gone. So perhaps it's not meant to be disabled. And one last note, make sure your splunk_TA_aws inputs are setup on a heavy forwarder, NOT on your search head.

akira_splunk · ‎11-03-2017

We have a Splunk deployment in AWS and have our Search Head Cluster front-ended with an ALB (not ELB). Users frequently have the screen say "502 bad gateway", which usually goes away after a refresh or two. Has anyone else seen this, and figured out how to fix it?

akira_splunk · ‎06-09-2017

I can say from recent experience in 2017 on Splunk 6.5 that the buckets will roll from warm to cold, even if the cold volume and warm volume are the same. One of my customer had their warm maxVolumeDataSizeMB set to 1.5TB, and their cold maxVolumeDataSizeMB also set to 1.5TB. However, they only had 1.5TB of disk space available, TOTAL! We reduced the maxVolumeDataSizeMB for both hot and cold to 725GB each. Upon deploying the bundle from the cluster master, through the monitoring console, we can instantly see the warm bucket size and usage decrease to 725GB, and the size of the cold bucket increase to 725GB. We also validated by looking at the filesystem on one of the indexers. The old data was NOT frozen!

akira_splunk · ‎06-09-2017

I can say from recent experience in 2017 on Splunk 6.5 that the buckets will roll from warm to cold, even if the cold volume and warm volume are the same. A customer maximized their disk space, and the indexer stopped writing to disk. They reduced the maxVolumeDataSizeMB setting on the cluster master, and redeployed the bundle to the indexers. Through the monitoring console, we can instantly see the warm bucket size and usage decrease, and the size of the cold bucket increase usage increase. We also validated by looking at the filesystem. The old data was NOT frozen!

akira_splunk · ‎04-13-2016

Error 1625: This installation is forbidden by system policy occurs when installing Possible Causes: You're not logged in as an administrator. Your Windows Installer system policy prevents you from installing digitally-signed software updates. Possible Solutions: Log on to your computer with administrative rights, and try reinstalling. Log on as an administrator and retry installation, and retry. If that doesn't work, you will need to enable installation of digitally-signed software updates: Open a command prompt as administrator From the command prompt, type gpedit.msc, and then click OK. On the Local Group Policy window, navigate to Local Computer Policy, then Computer Configuration, then Administrative Templates, then Windows Components, and then Windows Installer. Double-click Prohibit non-administrators from applying vendor-signed updates. Click Disabled, and then click OK.

akira_splunk · ‎04-13-2016

=== Verbose logging started: 4/4/2016 8:59:13 Build type: SHIP UNICODE 5.00.9600.00 Calling process: C:\Windows\system32\msiexec.exe === MSI (c) (A8:64) [08:59:13:892]: Resetting cached policy values MSI (c) (A8:64) [08:59:13:892]: Machine policy value 'Debug' is 0 MSI (c) (A8:64) [08:59:13:892]: ******* RunEngine: ******* Product: c:\windows\temp\splunkforwarder-6.3.3-f44afce176d0-x64-release.msi ******* Action: ******* CommandLine: ********** MSI (c) (A8:64) [08:59:13:892]: Client-side and UI is none or basic: Running entire install on the server. MSI (c) (A8:64) [08:59:13:892]: Grabbed execution mutex. MSI (c) (A8:64) [08:59:13:908]: Cloaking enabled. MSI (c) (A8:64) [08:59:13:908]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (A8:64) [08:59:13:908]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (38:24) [08:59:13:908]: Running installation inside multi-package transaction c:\windows\temp\splunkforwarder-6.3.3-f44afce176d0-x64-release.msi MSI (s) (38:24) [08:59:13:908]: Grabbed execution mutex. MSI (s) (38:B8) [08:59:13:908]: Resetting cached policy values MSI (s) (38:B8) [08:59:13:908]: Machine policy value 'Debug' is 0 MSI (s) (38:B8) [08:59:13:908]: ******* RunEngine: ******* Product: c:\windows\temp\splunkforwarder-6.3.3-f44afce176d0-x64-release.msi ******* Action: ******* CommandLine: ********** MSI (s) (38:B8) [08:59:13:908]: Machine policy value 'DisableUserInstalls' is 0 MSI (s) (38:B8) [08:59:13:908]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038 MSI (s) (38:B8) [08:59:13:924]: SRSetRestorePoint skipped for this transaction. MSI (s) (38:B8) [08:59:13:924]: File will have security applied from OpCode. MSI (s) (38:B8) [08:59:14:330]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'c:\windows\temp\splunkforwarder-6.3.3-f44afce176d0-x64-release.msi' against software restriction policy MSI (s) (38:B8) [08:59:14:330]: SOFTWARE RESTRICTION POLICY: c:\windows\temp\splunkforwarder-6.3.3-f44afce176d0-x64-release.msi has a digital signature MSI (s) (38:B8) [08:59:14:705]: SOFTWARE RESTRICTION POLICY: c:\windows\temp\splunkforwarder-6.3.3-f44afce176d0-x64-release.msi is permitted to run at the 'unrestricted' authorization level. MSI (s) (38:B8) [08:59:14:705]: End dialog not enabled MSI (s) (38:B8) [08:59:14:705]: Original package ==> c:\windows\temp\splunkforwarder-6.3.3-f44afce176d0-x64-release.msi MSI (s) (38:B8) [08:59:14:705]: Package we're running from ==> c:\Windows\Installer\405ce823.msi MSI (s) (38:B8) [08:59:14:721]: APPCOMPAT: Compatibility mode property overrides found. MSI (s) (38:B8) [08:59:14:721]: APPCOMPAT: looking for appcompat database entry with ProductCode '{6909E33C-54C7-4380-9790-93E834B78BAF}'. MSI (s) (38:B8) [08:59:14:721]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (38:B8) [08:59:14:721]: Machine policy value 'TransformsSecure' is 1 MSI (s) (38:B8) [08:59:14:721]: Machine policy value 'DisablePatch' is 0 MSI (s) (38:B8) [08:59:14:721]: Machine policy value 'AllowLockdownPatch' is 0 MSI (s) (38:B8) [08:59:14:736]: Machine policy value 'DisableMsi' is 1 MSI (s) (38:B8) [08:59:14:736]: Machine policy value 'AlwaysInstallElevated' is 0 MSI (s) (38:B8) [08:59:14:736]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (38:B8) [08:59:14:736]: Rejecting product '{6909E33C-54C7-4380-9790-93E834B78BAF}': Non-assigned apps are disabled for non-admin users. MSI (s) (38:B8) [08:59:14:736]: Machine policy value 'DisableLUAPatching' is 0 MSI (s) (38:B8) [08:59:14:736]: Machine policy value 'DisableFlyWeightPatching' is 0 MSI (s) (38:B8) [08:59:14:736]: APPCOMPAT: looking for appcompat database entry with ProductCode '{6909E33C-54C7-4380-9790-93E834B78BAF}'. MSI (s) (38:B8) [08:59:14:736]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (38:B8) [08:59:14:736]: Transforms are not secure. MSI (s) (38:B8) [08:59:14:736]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'c:\windows\temp\splunk.txt'. MSI (s) (38:B8) [08:59:14:736]: Command Line: CURRENTDIRECTORY=C:\ CLIENTUILEVEL=3 CLIENTPROCESSID=3752 MSI (s) (38:B8) [08:59:14:736]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{9B5DC04D-40BF-4F0C-BC1D-F9A710A81949}'. MSI (s) (38:B8) [08:59:14:736]: Product Code passed to Engine.Initialize: '' MSI (s) (38:B8) [08:59:14:736]: Product Code from property table before transforms: '{6909E33C-54C7-4380-9790-93E834B78BAF}' MSI (s) (38:B8) [08:59:14:736]: Product Code from property table after transforms: '{6909E33C-54C7-4380-9790-93E834B78BAF}' MSI (s) (38:B8) [08:59:14:736]: Product not registered: beginning first-time install MSI (s) (38:B8) [08:59:14:736]: Product {6909E33C-54C7-4380-9790-93E834B78BAF} is not managed. MSI (s) (38:B8) [08:59:14:736]: Machine policy value 'AlwaysInstallElevated' is 0 MSI (s) (38:B8) [08:59:14:736]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (38:B8) [08:59:14:736]: MSI_LUA: Installation UI level is silent, no credential elevation is possible MSI (s) (38:B8) [08:59:14:736]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'. MSI (s) (38:B8) [08:59:14:736]: Entering CMsiConfigurationManager::SetLastUsedSource. MSI (s) (38:B8) [08:59:14:736]: User policy value 'SearchOrder' is 'nmu' MSI (s) (38:B8) [08:59:14:736]: Adding new sources is allowed. MSI (s) (38:B8) [08:59:14:736]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'. MSI (s) (38:B8) [08:59:14:736]: Package name extracted from package path: 'splunkforwarder-6.3.3-f44afce176d0-x64-release.msi' MSI (s) (38:B8) [08:59:14:736]: Package to be registered: 'splunkforwarder-6.3.3-f44afce176d0-x64-release.msi' MSI (s) (38:B8) [08:59:14:736]: Note: 1: 2205 2: 3: Error MSI (s) (38:B8) [08:59:14:736]: Note: 1: 2262 2: AdminProperties 3: -2147287038 MSI (s) (38:B8) [08:59:14:736]: Machine policy value 'AlwaysInstallElevated' is 0 MSI (s) (38:B8) [08:59:14:736]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (38:B8) [08:59:14:736]: Rejecting product '{6909E33C-54C7-4380-9790-93E834B78BAF}': Non-assigned apps are disabled for non-admin users. MSI (s) (38:B8) [08:59:14:736]: Note: 1: 1708 MSI (s) (38:B8) [08:59:14:736]: Product: UniversalForwarder -- Installation failed. MSI (s) (38:B8) [08:59:14:736]: Windows Installer installed the product. Product Name: UniversalForwarder. Product Version: 6.3.3.0. Product Language: 1033. Manufacturer: Splunk, Inc.. Installation success or error status: 1625. MSI (s) (38:B8) [08:59:14:736]: MainEngineThread is returning 1625 MSI (s) (38:24) [08:59:14:736]: No System Restore sequence number for this installation. Info 1625.This installation is forbidden by system policy. Contact your system administrator. c:\windows\temp\splunkforwarder-6.3.3-f44afce176d0-x64-release.msi MSI (s) (38:24) [08:59:14:752]: User policy value 'DisableRollback' is 0 MSI (s) (38:24) [08:59:14:752]: Machine policy value 'DisableRollback' is 0 MSI (s) (38:24) [08:59:14:752]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (38:24) [08:59:14:752]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (38:24) [08:59:14:752]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (38:24) [08:59:14:752]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (c) (A8:64) [08:59:14:752]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (c) (A8:64) [08:59:14:752]: MainEngineThread is returning 1625 === Verbose logging stopped: 4/4/2016 8:59:14 ===

Posts	12
Solutions	2
Karma Given	12
Karma Received	10
Member Since	‎11-06-2015

Online Status	Offline
Date Last Visited	‎06-22-2020 09:36 PM

Fixing 502 errors when front-ending Search Heads w...

Splunk Forwarder Windows Installation Fails with E...

Re: Amazon Kinesis Firehose to Splunk with cloudwa...

Re: Splunk ITSI - using different types of entitie...

Re: How to extract the timestamp from a filename a...

Re: Can you help me with a problem I'm having extr...

Re: Can other server types (clustered indexers, he...

Re: Fixing 502 errors when front-ending Search Hea...

Re: Splunk Health Check Overview: How can we remov...

Fixing 502 errors when front-ending Search Heads w...

Re: What happens when maxVolumeDataSizeMB paramet...

Re: What happens when maxVolumeDataSizeMB paramet...

Re: Splunk Forwarder Windows Installation Fails wi...

Splunk Forwarder Windows Installation Fails with E...