About rjteh_splunk

rjteh_splunk · ‎07-31-2019

Do you have any lookup files in the "UI > Settings > Lookups > Lookup table files" section?

rjteh_splunk · ‎07-26-2019

@gl0balt3kkie, the automatic lookup file is most likely missing from your splunk server i.e. it may not be on disk anymore. Either an app search/splunk collections were not enabled again. At times the lookup file maybe removed from a splunk version/app upgrade, usually the latter, but it's best to check if it's on disk manually. You can find where the lookup file is located by checking the lookup definition, followed by the file itself, on the UI. Simply navigate to... UI > Settings > Lookups > Lookup definitions > Select "All" for App Context > Select Owner as "Any" > Enter "event_id_to_action_lookup" in the search filter and hit find. Once you see the lookup filename, then you can navigate to... UI > Settings > Lookups > Lookup table files > Select "All" for App Context > Select Owner as "Any" > Enter "event_id_to_action_lookup.csv" (if it is the same filename) in the search filter and hit find. You will see the folder path for the lookup file. The actual "event_id_to_action_lookup.csv" lookup file is part of the "TA-Exchange-Mailbox" app (TA-Exchange-Mailbox/lookups folder) which can be found here if you download "Splunk Add-on for Microsoft Exchange" app. https://splunkbase.splunk.com/app/3225/ If this file is missing from your search head, you will need to import it back.

rjteh_splunk · ‎07-22-2019

@efaundez blacklisting the lookups in distsearch.conf only prevents the SH from replicating them to the search peers/indexers via the knowledge bundle. In essence, any modifications via search commands (e.g. outputlookup)/UI modifications should still be replicated/synced across the SH in a SHC setup. Another way to sync lookup files between SHs in a cluster environment is through the Deployer (documented in the URL below), but any modifications to the lookups via a search command/UI will be overridden. Hence this method is not usually not preferred to sync lookups. https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/PropagateSHCconfigurationchanges#Preserve_lookup_files_across_app_upgrades In regards to the process, on how lookups are synced across the SH(s). Each SH maintains a configuration baseline and if changes are made to a file, they are pushed to the other SHs and the baseline is then changed to the new/incremented one.

rjteh_splunk · ‎04-28-2019

Hi @analiaeg , There could be several reasons to that log message... Depending on the other messages before/after it, there could be a network connection issue between your Deployment client (DC) and Deployment server (DS). Please make sure there is no firewalls in between blocking the 8089 port that is needed for communication. One way to test the connection between the DS and DC is the telnet command to port 8089 on the DC to DS. Usually it is the case where there is a network connectivity issue somewhere with most customers. Or there have been cases where the sslPassword in server.conf under the "[sslConfig]" stanza maybe have been changed from the default (if you are using the default Splunk server.pem cert). Otherwise, it may not be the correct sslPassword for your own imported SSL server certificate. More information about this stanza can be found here for your reference. > server.conf sslPassword = <password> * Server certificate password. * Default is "password". http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Serverconf

rjteh_splunk · ‎04-28-2019

If you have a LB in front of the SH(s), you can try to configure the splunk web fqdn in SAML configuration > Advanced Settings > "Fully qualified domain name or IP of the load balancer". This will configure the fqdn of the LB in authorize.conf.

rjteh_splunk · ‎04-28-2019

Hi @GenRockeR , You can try to clean the local kvstore on the SH that you attempted to add to the SHC by following the steps below. Stop the search head that has the stale KV store member. (stop splunkd on esh5.prod) Run the command splunk clean kvstore --local. Restart the search head. This triggers the initial synchronization from other KV store members. Run the command splunk show kvstore-status to verify synchronization. The reference these steps can be found here: https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/ResyncKVstore#Resync_stale_KV_store_members

rjteh_splunk · ‎04-07-2019

Hi @yangban, I can see that your issue is somewhat similar to the following Splunk Answer. https://answers.splunk.com/answers/718467/cannot-view-users-with-can-delete-role.html We have realized that the roles implementation/feature mechanism needs to be improved/fixed to prevent this issue and have raised SPL-164129 and SPL-155548 bugs. In the bugs, we have identified that when a setting is modified/updated in the admin role it will add "grantableRoles = admin" in authorize.conf. This can cause the UI to not display some users vs others. This is because of a conflicting capability/capabilities between roles. In your scenario, perhaps one of your users might have a capability enabled which the "admin" role did not. Hence, due to the conflicting capability, users with admin or other roles which do not have this capability, they will not be bale to see the user in the UI. More information about how grantableRoles work is explained below for your reference. http://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/Authorizeconf#.5Brole_.3CroleName.3E.5D NOTE: A role that has been assigned 'grantableRoles' can list only the users whose capabilities are a subset of all capabilities of the roles assigned to 'grantableRoles'. Example: Consider a Splunk instance where role1-4 are assigned the following capabilities: role1: c1, c2, c3 role2: c4, c5, c6 role3: c1, c6 role4: c4, c8 Users user1-4 are assigned the following roles: user1: role1 user2: role2 user3: role3 user4: role4 You can also use the following search on any SH to view the capabilities of each role: | rest /services/authorization/roles splunk_server=local | search title=admin OR title=<role_name> OR title=<role_name> | table title capabilities imported_srchFilter srchTimeWin imported_roles imported_capabilities srchIndexesAllowed srchIndexesDefault To restore your admin capability to view those users again with certain roles, you can implement one of the following workarounds. Remove grantableRoles = admin option from admin role from authorize.conf. Though this will need to be done every time capabilities are modified in the admin role. Alternatively, you can add the other user role as a 'grantableRoles' to "admin". However, any future roles that has conflicting capabilities, you will have to add it to grantableRoles as well. Lastly, add any capabilities that the other user roles have to the "admin" role. This is probably the most simplest workaround, where you would want the admin role to have all capabilities ideally.

rjteh_splunk · ‎04-03-2019

If you have access to search, you can potentially find the actual forwarder with this search. | metasearch index=main sourcetype=<your_sourcetype_here_or_put_*> host=* | stats list(sourcetype) by host or index=main NOT (host=sh* OR host=idx*) sourcetype=<your_sourcetype_here_or_put_*> | stats list(sourcetype) by host

rjteh_splunk · ‎03-26-2019

Are you having bundle validation issues at the moment? If you have installed your own self-signed certificate it would need to be trusted by a well known CA. Please see here for self-signed certificate installation. https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/HowtoprepareyoursignedcertificatesforSplunk More information about the issue would be helpful i.e. is the bundle validation failing, if so, what is the error message?

rjteh_splunk · ‎10-18-2018

The "edit_roles_grantable" capability will only allow the user to create/edit the role if they have listed the roles in "Inheritance" section on the custom role. For example, if you want to create/edit a power role, the user must at least be assigned a custom role which inherits another custom role which has power capabilities or the power role itself (as shown below). Once the user logs in and attempts to create a new role, they will be able to only select from the following list. However, if you would like the user to be able to inherit from all available roles, you can add the "edit_roles" capability to achieve this. Documented here: About defining roles with capabilities

rjteh_splunk · ‎10-18-2018

We're trying to set up Role Based Access Controls for our security team who provisions roles and access. Can you please suggest the right capabilities and inheritance that we should use? We had setup a test role with the following inheritance and capabilities. Role Name: test Inheritance role: user Capabilities: edit_roles_grantable, edit_user The complete list of capabilities for this test role is... accelerate_search change_own_password edit_search_schedule_window export_results_is_visible get_metadata get_typeahead input_file list_inputs list_metrics_catalog output_file pattern_detect request_remote_tok rest_apps_view rest_properties_get rest_properties_set schedule_rtsearch search This role works fine when trying to create roles that inherit user level access, but when we try to create a new role that inherits power or sc_admin, it throws an error as given below: > ERROR AdminHandler:AuthenticationHandler - current user doesn't have permissions to create new role with imported role

rjteh_splunk · ‎11-09-2017

Splunk has identified this issue in SPL-145546, it is only a problem with the UI, so you should still be able to use authorize.conf to assign the index(es) to role(s). To temporarily workaround the issue, please follow the steps below. Workaround: Step 1) Create a local directory in the search app on the SH with the correct permissions for splunkd to access i.e. $SPLUNK_HOME/etc/apps/search/local/data/ui/manager Step 2) Copy an old "authentication_roles.xml" file from "$SPLUNK_HOME/etc/apps/search/default/data/ui/manager" in any 6.x version or simply download a new 6.x version of Splunk and extract the file there, then place it into the folder created in step 1. Step 3) Refresh the SH configuration with debug refresh via the web browser: http://:8000/en-US/debug/refresh Step 4) Create a new role on the SH and you should see all your indexes configured on the index cluster. Note: In the workaround provided above, there is a known issue (SPL-146171) where only 1000 indexes is displayed in the UI. If you have more than 1000 indexes, you should modify authorize.conf to add the index(es) to role(s) instead

Posts	12
Solutions	1
Karma Given	4
Karma Received	21
Member Since	‎12-20-2016

Online Status	Offline
Date Last Visited	‎12-04-2023 11:42 PM

Can you please suggest the right capabilities and ...

Re: lookup table does not exist

Re: lookup table does not exist

Re: How are the lookups updated after entering the...

Re: HttpPubSubConnection - Unable to parse message...

Re: Location value in SPMetadata.xml

Re: Some troubles when add host to SHC

Re: Admin can't see users with a certain role and ...

Re: Determine actual forwarder host

Re: SSLv3 certificate error

Re: Can you please suggest the right capabilities ...

Can you please suggest the right capabilities and ...

Re: Indexes are not available to select from "Avai...