About godman

godman · ‎02-18-2019

I have added this in my SH's but I am seeing the same pattern where event's are not returning any values.

godman · ‎02-18-2019

This is a Distributed Environment , and the splunk version is : 7.1.2

godman · ‎02-15-2019

When i see the fields in the left hand side with 'X' no of event's and when i select any value it's not giving me the event's , if i add this in the search I am able to get it. index= fluentbit KUBERNETES_NAMESPACE = "XXXX" --- Doesn't work index= fluentbit KUBERNETES_NAMESPACE = XXXX --- Doesn't work index= fluentbit KUBERNETES_NAMESPACE :: "XXXX" -- work's I have added the fields in the fields.conf but nothing seems to work ?

godman · ‎11-02-2018

I am having trouble in configuring splunk authentication with SAML , it's not redirecting to the right landing page and giving me with error status:1 . No matter how i change the configurations it's landing on *"https://hostname:8000/en-US/account/login" * with same Error . Can anyone share the ideal settings that works with SAML? Any kind of help is appreciated!

godman · ‎09-28-2018

I solved this by adding my admin password in $SPKUNK_HOME/etc/system/local/user-seeds.conf [user_info] PASSWORD = and backed up the current passwd file in $SPLUNK_HOME/etc/ Now restart the splunk and login with the default password with the changeme , you can also copy the old user information if you have any from the file passwd

godman · ‎09-26-2018

This is the Error I am getting and when i try giving my username and password or the admin password it's not working First time signing in? Username: admin Password: Use the password that you created during installation. If you've forgotten your username or password, please contact your Splunk administrator.

godman · ‎09-25-2018

I don't have LDAP set up and — using Splunk authentication — when I try to login, the web UI sometimes returnes an ERROR First time signing in? And when i try with the admin password it's also giving me the same Error. This is the error message I am getting when i try giving my username and password or the admin password it's not working Username: admin Password: Use the password that you created during installation. If you've forgotten your username or password, please contact your Splunk administrator. Anyone encountered this issue? Thanks for any help!

godman · ‎09-07-2018

In this example they only have one value for the field and in my case i have many values for each field and i am not able to add all of them to the inputs.conf .

godman · ‎09-07-2018

I am not able to search for all of the events from the fields. When i try field::value , I can see all of the events. But with field=value , only some of the events are searchable. updated my fields.conf with [field] INDEXED = true , but do i also need to update my inputs.conf with the fields and its values? There are going to be more values for the fields, and it can be hard to update all of them?

godman · ‎08-28-2018

I found the solution, by adding the -index to the command it worked : {noformat} ./splunk remove monitor -source -index {noformat}

godman · ‎08-24-2018

Tried adding with the -source in the CLI and unfortunately same Error.

godman · ‎08-23-2018

I am trying to remove some monitors and when i tried from CLI it's throwing me Error : Parameters must be in the form '-parameter value' command used : ./splunk remove monitor /app/abcded -auth '$USERNAME:$PASSWORD'

godman · ‎07-25-2018

In the events we have Status Field where the values are Success and Failures and I want an alert when the Status field changes from 3 or more consecutive failures to Success.

Posts	13
Solutions	2
Karma Given	2
Karma Received	1
Member Since	‎07-23-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Fluentbit logs sent through HEC and I am not able ...

Splunk Saml authentication is not redirecting to t...

In trying to sign in on Splunk, why am I getting t...

_meta fields: why am I unable to search for all of...

Remove the Splunk monitors from CLI

Generate a alert when the Status field change from...

Re: Fluentbit logs sent through HEC and I am not a...