Having a weird issue with Splunk.  I have a bunch of devices & servers on my network sending log data to UDP:514 on my Splunk container... events are showing up great in the dashboard and I can drill down to show hosts/sources/sourcetypes going into the thousands, so definitely getting data.  But when I click on any to search for the actual events, no matter the filter choice, I always get "No Results Found".  The data is there but source doesn't work.

Tried from the default admin user and a new user just in case it was a roles or permissions issue, but no dice.  

 

Any ideas?

 

UPDATE:

After multiple re-installs and restarts, variations on licensing (free vs trial), changing of file permissions to splunk:splunk, etc, I'm still having the same issue with Relative Search presets.  The Real-time search presets work, but only show events going forward with no events prior to when the option is selected no matter which size time window.  So collection is definitely working, categorizing is working, and the totals still do show up in the Dashboard Summary.  But no historical data can be shown.

 

I do see the following error messages on startup:

Failed to start KV Store process. See mongod.log and splunkd.log for details.
6/4/2017, 12:43:54 PM
KV Store changed status to failed. KVStore process terminated.
6/4/2017, 12:43:53 PM
KV Store process terminated abnormally (exit code 1, status exited with code 1). See mongod.log and splunkd.log for details.
6/4/2017, 12:43:53 PM

 

splunkd.log has these errors:

06-04-2017 12:43:53.407 -0400 ERROR MongodRunner - mongod exited abnormally (exit code 1, status: exited with code 1) - look at mongod.log to investigate.
06-04-2017 12:43:53.407 -0400 ERROR KVStoreBulletinBoardManager - KV Store process terminated abnormally (exit code 1, status exited with code 1). See mongod.lo
g and splunkd.log for details.
06-04-2017 12:43:53.407 -0400 ERROR KVStoreBulletinBoardManager - KV Store changed status to failed. KVStore process terminated.

 

mongo.log has these lines:

 2017-06-04T15:31:39.576Z I JOURNAL  [initandlisten] journal dir=/opt/splunk/var/lib/splunk/kvstore/mongo/journal
 2017-06-04T15:31:39.577Z I JOURNAL  [initandlisten] recover : no journal files present, no recovery needed
 2017-06-04T15:31:39.788Z I JOURNAL  [durability] Durability thread started
 2017-06-04T15:31:39.788Z I JOURNAL  [journal writer] Journal writer thread started
 2017-06-04T15:31:39.790Z I CONTROL  [initandlisten] ** WARNING: You are running this process as the root user, which is not recommended.
 2017-06-04T15:31:39.790Z I CONTROL  [initandlisten] 
 2017-06-04T15:31:39.790Z I CONTROL  [initandlisten] 
 2017-06-04T15:31:39.790Z I CONTROL  [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'.
 2017-06-04T15:31:39.790Z I CONTROL  [initandlisten] **        We suggest setting it to 'never'
 2017-06-04T15:31:39.791Z I CONTROL  [initandlisten] 
 2017-06-04T15:31:39.791Z I INDEX    [initandlisten] allocating new ns file /opt/splunk/var/lib/splunk/kvstore/mongo/local.ns, filling with zeroes...
 2017-06-04T15:31:39.886Z E CONTROL  [initandlisten]   mmap() failed for /opt/splunk/var/lib/splunk/kvstore/mongo/local.ns len:16777216 errno:19 No such device
 2017-06-04T15:31:39.886Z F INDEX    [initandlisten] error couldn't open file /opt/splunk/var/lib/splunk/kvstore/mongo/local.ns terminating
 2017-06-04T15:31:39.886Z I -        [initandlisten] Invariant failure false src/mongo/db/storage/mmap_v1/catalog/namespace_index.cpp 239
 2017-06-04T15:31:39.901Z I CONTROL  [initandlisten] 

Edited June 4, 20179 yr by jedimstr

Hello,

 

Is it possible to run AirvideoHD on Unraid and give it access to another NAS sitting on the same network?

The other NAS is a Netgear Readynas.

A UNC access to the right folder maybe?

 

7 minutes ago, xtrips said:

Hello,

 

Is it possible to run AirvideoHD on Unraid and give it access to another NAS sitting on the same network?

The other NAS is a Netgear Readynas.

A UNC access to the right folder maybe?

 

 

1 hour ago, Squid said:

My guess is you accidentally clicked reply on my question, because I don't see any relation. 

 

Nope.  You want to give a docker application access to a share from another computer on your network.  The FAQ entry is how you do it.

4 minutes ago, Squid said:

Nope.  You want to give a docker application access to a share from another computer on your network.  The FAQ entry is how you do it.

Ok, then thank you. Could you elaborate just a bit? My guess is I should look for the Unraid Dockers FAQ, right?

What should I look into there?

I suppose that you refer to the "Add another Path, Port or Variable" parameter in the docker's setting.

Which one is suitable for my need? Path? Port? Variable? Device?

None actually allows me to browse my network, or write the IP of my other NAS. 

Is that what I should look for in the FAQ?

You need to mount the remote share using the Unassigned Devices plugin.  Then you add another path mapping to the template (/media2 mapped to /mnt/disks/xxxxxxx with an access mode of Read/Write:Slave)

 

Then within AirVideo, you tell it to find your media at /media2

2 hours ago, Squid said:

You need to mount the remote share using the Unassigned Devices plugin.  Then you add another path mapping to the template (/media2 mapped to /mnt/disks/xxxxxxx with an access mode of Read/Write:Slave)

 

Then within AirVideo, you tell it to find your media at /media2

Thank you for your help.

This is as far as I got:

- I got the Unassigned Disks mapped to an NFS share on my other NAS

- I mapped it in AirVideo and could access the Videos folder I mapped.

- There is no content in the Videos folder.

- But there is also no content to be seen under this same mapping in the Unassigned Disks NFS section.

- This even though I could mount the mapping and I could see under Unassigned Disks the Used and Free space of the actual NFS share.

 

BTW I cannot Unmount that NFS share from Unraid. Somehow the log says it is being in use. Couldn't find what was possibly using the share already, and without any content visible....

 

What could be the reason that I successfully mapped an NFS share, could see the utilization of that share, but no content?

I guess that when I resolve that issue, that content will also appear under Air Video, right?

Edited July 16, 20178 yr by xtrips

Forget about my previous post.

Eventually the content of the NFS share appeared. My guess is the size of it was so big it took a long time to show up.

So I can see the content through the Unassigned Disks and I mapped it into AirVideo to /videos.

But when I open my IOS app it says 

Could not load folder content, sorry

Access to file denied: /videos

 

What now?

2 minutes ago, xtrips said:

Forget about my previous post.

Eventually the content of the NFS share appeared. My guess is the size of it was so big it took a long time to show up.

So I can see the content through the Unassigned Disks and I mapped it into AirVideo to /videos.

But when I open my IOS app it says 

Could not load folder content, sorry

Access to file denied: /videos

 

What now?

Outside of permission issues on the NFS share (which I can't help you with) the only thing I can suggest is to make sure that the access mode to the path you added on the template is set to RW:Slave

 

 

3 minutes ago, Squid said:

Outside of permission issues on the NFS share (which I can't help you with) the only thing I can suggest is to make sure that the access mode to the path you added on the template is set to RW:Slave

 

 

Mmmmm, if I can access, read and write to that NFS share through Unraid on my Windows 10 PC then my guess is that the share and the permissions are fine on the other NAS, right?

And the path on the template is set to RW:Slave.

 

What else can it be?

 

I tried installing this into my unRAID server, but it doesn't work.  Dockers are completely new to me, so that might be it.  I did have a look at This Youtube vid but it didn't really solve it for me. 

When I need to fill in the template, I fill in the repo address mentioned in the first post of this thread (https://github.com/dmaxwell351/docker-containers/tree/templates)

but it doesn't seem to work.  (It says "the command failed")The network setup is set to "bridge", but that's about all I can set? 

Could somebody please be so kind to give a newbie a step-by-step setup please?

Edited September 4, 20178 yr by BartDG

10 minutes ago, BartDG said:

Could somebody please be so kind to give a newbie a step-by-step setup please?

Can't help you with that, but

10 minutes ago, BartDG said:

When I need to fill in the template, I fill in the repo address mentioned in the first post of this thread (https://github.com/dmaxwell351/docker-containers/tree/templates)

but it doesn't seem to work.  (It says "the command failed")The network setup is set to "bridge", but that's about all I can set? 

If you followed the video, you've got an Apps tab.  Go to it, search (or browse) for whatever app you want and install it.

 

When the template comes up, pretty much the only thing you ever need to do is adjust the paths if necessary.  No need to ever use the template dropdown menu or change the repo address, etc.

Thanks Squid.  I just noticed something strange though.  I tried some other Dockers and while those did install, things didn't quite turn out the way it was meant to be.  First I tried "Acestream".  It did install, but I didn't end up with Acestream, but with "Koma-Helix"??

I then tried "Activ Transmission VPN", and it also installed, but in t his case, I ended up with "Tonido" ?? 

 

This is very strange, to say the least!  Am I doing something wrong here?  The only thing I need to do is click on the installation icon, right?

8 minutes ago, BartDG said:

Thanks Squid.  I just noticed something strange though.  I tried some other Dockers and while those did install, things didn't quite turn out the way it was meant to be.  First I tried "Acestream".  It did install, but I didn't end up with Acestream, but with "Koma-Helix"??

No idea what version of CA you're using, but there was a bug a couple months ago that did that intermittently.

 

That, and if you have multiple browser tabs open to CA concurrently, but the appfeed gets updated by Window B (as it was opened last), but you install from Window A, there's a chance depending upon what happened with the feed that the references are out of sync.  Edge case that's a real PITA to fix and basically requires a top-down rewrite of the whole thing.

As far as I can tell, I'm using the most recent version of CA ( 2017.09.03a).  Would rebooting the server help?  Or maybe reinstalling CA?

7 minutes ago, BartDG said:

Would rebooting the server help? 

Yup.

OK, I'll try that in an hour.  Currently the Mover is busy.

 

Cheers!

It worked!  Rebooting the server did the trick, thx!

Is the Splunk Docker still being maintained/updated?

17 hours ago, unevent said:

Is the Splunk Docker still being maintained/updated?

dmaxwell was last online in June.  Last posted in April.  Last update to to the container was 6 months ago.

1 hour ago, Squid said:

dmaxwell was last online in June.  Last posted in April.  Last update to to the container was 6 months ago.

 

Thanks.

Air Video HD

 

Anyone know how to firm up a Server Pin for remote access?

 

I'd like to stop the docker from generating new PIN's that stop me accessing the server remotely.

 

Thanks.

Edited November 6, 20178 yr by Monkeyair

Hi,

 

I'm new to unRAID and Docker in general but have managed to setup Air Video HD docker without too much issue, however I want to add a second share, the problem is that this share is Private so Docker doesn't have permissions to it, it shows up in the app but obviously doesn't load, is there anyway around this (other than setting the share to Public!)?

 

Thanks

 

Edited December 16, 20178 yr by PR.

With Airvideo, has anyone observed a memory leak when its generating thumbnails?
I'm using AirvideoHD for iOS and tvOS, and whenever I go into a folder that has videos that hasn't been thumbnailed/cached before I see the memory usage of the docker jump up and never go down again. 

Workaround is to keep track of memory usage and browse through all your share folders, and then restart the docker when you see memory getting a bit uncomfortable, and repeat. Once all thumbnails are made you can leave the docker running... until you add a bunch of videos again