3 votes
Accepted

HAProxy 503 Service Unavailable No servers avalible to handle this request

Check that the respective SSL certs on the backends cover 192.168.23.x. If not, then HAProxy considers their cert to be invalid. Solution should be either (a) update HAProxy config so that the ...
tater's user avatar
  • 1,475
2 votes
Accepted

Will Splunk update the index if an already indexed file is edited?

My understanding is that if someone were to edit a log file, then whether Splunk would reindex the file would depend upon the nature of the edit. (Further information about how Splunk decides whether ...
hmallett's user avatar
  • 2,465
2 votes

Thoughts on Free Splunk

We are a team of 12 people in a large media company in London. We have an enterprise license in excess of 100GB for the company as a whole but our team still runs a separate server with the free ...
nick fox's user avatar
  • 661
2 votes

Thoughts on Free Splunk

You can't even change the default admin password with the free license. This means anyone on the network can send data to the indexer/forwarder with the default admin:changeme credentials. Think ...
mr.zog's user avatar
  • 931
2 votes

Parsing or Reformatting Logs before feeding them to Splunk or Elastic Search

This is common when dealing with Windows event logs. Many address the problem by using SEDCMD in transforms.conf to edit the events. Another solution is to pre-process the events with Cribl (https:...
RichG's user avatar
  • 186
2 votes

Splunk splitting multi-line log events by date

Tell Splunk to break events before a date that comes at the beginning of a line. And it would help to tell Splunk the expected format of timestamps: LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d-\d\d ...
RichG's user avatar
  • 186
2 votes
Accepted

How to configure SSL certificates for Splunk on port 8089?

Take a look at this documentation page. The file you need to modify is /opt/splunk/etc/system/local/server.conf. That file is responsible for managing the SSL for port 8089. Specifically, you need to ...
user3207874's user avatar
2 votes
Accepted

How to non-interactively add a Splunk forwarder?

You can use the splunk login command to pass your credentials to the Splunk server: ./splunk login -auth 'admin:mypassword' ./splunk add forward-server SPLUNK-IP-ADDRESS:SPLUNK-PORT
user3207874's user avatar
1 vote

Splunk Enterprise - Configure to drop specific events

I wound up combining RichG's response with some advice from another forum and came up w/ my answer. Here it is props.conf [source::auditd] TRANSFORMS-set=setnull transforms.conf [setnull] REGEX = ...
Egyas's user avatar
  • 165
1 vote
Accepted

Splunk Enterprise - Configure to drop specific events

It would help to know what you've tried so far and how those efforts failed you. What you want to do is possible. It's easier with a separate transform for each message to keep the regular ...
RichG's user avatar
  • 186
1 vote

splunk syslogs Forwarder set up not working and paused data flow

However when I do a search : source="/var/log/udp514.log" nothing shows up. This query does not specify an index so will use your default index list. If your role has no default indexes ...
RichG's user avatar
  • 186
1 vote

Does Splunk have a "heartbeat" feature?

Every forwarder "phones home" at regular intervals. You can search index=_internal for these messages and alert if you don't find them. Look for "phoneHome" (sorry, the exact text escapes me ATM and ...
RichG's user avatar
  • 186
1 vote

How to get Linux commands history in Splunk without Splunk Forwarder?

One solution would be to system syslog to a central syslog server, and running single Splunk Forwarder there. You could then bulk ingest logs, or only ingest logs for the systems you want. It also ...
Ackack's user avatar
  • 1,024
1 vote

How to process core-dumps with Splunk?

Splunk can do this. What you're looking for is a scripted input. Splunk has documentation on this at http://docs.splunk.com/Documentation/Splunk/7.0.2/AdvancedDev/ScriptedInputsIntro Rather than ...
hmallett's user avatar
  • 2,465
1 vote

Sending sssd.log to syslog

On RHEL-7, edit /etc/systemd/system/sssd.service.d/journal.conf, uncomment the two lines there and then restart sssd in order to send the logs to journald.
jhrozek's user avatar
  • 1,380
1 vote

How do I exclude messages from indexing on Splunk Cloud?

I've not used the cloud version sorry but if you install the 'full splunk' on your clients rather than the light-forwarder you can strip them out via props there so they don't get sent to the indexer ...
Chopper3's user avatar
  • 102k
1 vote

JSON vs Key-Value for Splunk

Splunk speaks JSON natively - so long as your JSON is not malformed, Splunk'll take it just fine There's no appreciable difference in indexing JSON vs straight text data with Splunk Some docs....
warren's user avatar
  • 18.7k
1 vote

Splunk How do I get syslog to send data into splunk from remote machines

I know this is an old thread, but just commenting for anyone else who stumbles on it. The recommended approach is to funnel your syslog data through a syslog server like syslog-ng or Rsyslog. Then use ...
Grandson Yates's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible