All Posts

karthi2809 · ‎04-08-2024

Its showing in the events

marketplace · ‎04-08-2024

Here is the response: CONNECTED(00000005) depth=1 C = US, ST = CA, L = San Francisco, O = Splunk, CN = SplunkCommonCA, emailAddress = support@splunk.com verify error:num=19:self signed certifica...

Here is the response: CONNECTED(00000005) depth=1 C = US, ST = CA, L = San Francisco, O = Splunk, CN = SplunkCommonCA, emailAddress = support@splunk.com verify error:num=19:self signed certificate in certificate chain verify return:0 write W BLOCK Certificate chain 0 s:/CN=SplunkServerDefaultCert/O=SplunkUser i:/C=US/ST=CA/L=San Francisco/O=Splunk/CN=SplunkCommonCA/emailAddress=support@splunk.com 1 s:/C=US/ST=CA/L=San Francisco/O=Splunk/CN=SplunkCommonCA/emailAddress=support@splunk.com i:/C=US/ST=CA/L=San Francisco/O=Splunk/CN=SplunkCommonCA/emailAddress=support@splunk.com Yes, the certs are from Splunk. Thank you

scheckenbachb · ‎04-08-2024

Hello All, we plan to use a Splunk OVA for VMware Metrics (5096) in combination with Splunk on Windows. I can't find any information how this OVA will be supported. E.g Operating System and Splunk ...

Hello All, we plan to use a Splunk OVA for VMware Metrics (5096) in combination with Splunk on Windows. I can't find any information how this OVA will be supported. E.g Operating System and Splunk updates. Does anyone know this? Regards, Bernhard

ITWhisperer · ‎04-08-2024

Try without the search <input type="dropdown" token="color" depends="$color_dropdown_token$" searchWhenChanged="false"> <label>Color</label> <choice value="*">All</choice> <choice ...

Try without the search <input type="dropdown" token="color" depends="$color_dropdown_token$" searchWhenChanged="false"> <label>Color</label> <choice value="*">All</choice> <choice value="Green">Green</choice> <choice value="Orange">Orange</choice> <choice value="Red">Red</choice> <initialValue>*</initialValue> </input>

alvesri · ‎04-08-2024

Hi, thanks for the reply, But meanwhile I found another solution, I will try this solution next to see if it works.

Jasmine · ‎04-08-2024

i am using below to load colur in drop downlist . Data loading propertly. but it always shows - Could not create search - No Search query provided <input type="dropdown" token="color" depends="$c...

i am using below to load colur in drop downlist . Data loading propertly. but it always shows - Could not create search - No Search query provided <input type="dropdown" token="color" depends="$color_dropdown_token$" searchWhenChanged="false"> <label>Color</label> <choice value="*">All</choice> <choice value="Green">Green</choice> <choice value="Orange">Orange</choice> <choice value="Red">Red</choice> <initialValue>*</initialValue> <search> <query/> <earliest>$Time.earliest$</earliest> <latest>$Time.latest$</latest> </search> </input>

ITWhisperer · ‎04-08-2024

As I explained earlier, you don't need to just look back further and further. The "issue" is to do with indexing lag. Whenever that lag spans a report time period boundary, you have the potential for...

As I explained earlier, you don't need to just look back further and further. The "issue" is to do with indexing lag. Whenever that lag spans a report time period boundary, you have the potential for missed events. To mitigate this, you could use overlapping time periods, and use some sort of deduplication scheme, such as a summary index, if you want to avoid multiple alerts for the same event.

Nimi1 · ‎04-08-2024

Thanks for your answer KothariSurbhi After some debugging Ive discovered that Splunk pulled logs again from many buckets from all kinds of different dates on February 23rd. It seems that logs who h...

Thanks for your answer KothariSurbhi After some debugging Ive discovered that Splunk pulled logs again from many buckets from all kinds of different dates on February 23rd. It seems that logs who had already entered Splunk in 2023 entered again on February 23, 2024 for a reason that is still unclear. Nothing happened on the AWS side and the s3 buckets looks perfectly fine.

adrifesa95 · ‎04-08-2024

I will try to search in the last 60 min by doing a throttle of the incidentId

meetmshah · ‎04-08-2024

Hello @matoulas Can you please elaborate the question? One liner isn't seems to define the actual problem

meetmshah · ‎04-08-2024

Hello @alexspunkshell, below search should give you list of all CIM Indexes Macro Definition - | rest /servicesNS/-/-/admin/macros count=0 splunk_server=local | search title=cim*indexes | table tit...

Hello @alexspunkshell, below search should give you list of all CIM Indexes Macro Definition - | rest /servicesNS/-/-/admin/macros count=0 splunk_server=local | search title=cim*indexes | table title definition Please accept the solution and hit Karma, if this helps!

ITWhisperer · ‎04-08-2024

If your report runs every 15 minutes looking back 15 minutes, there will be boundary conditions where the event has a timestamp in the 15 minutes prior to the reported one, which didn't get indexed u...

If your report runs every 15 minutes looking back 15 minutes, there will be boundary conditions where the event has a timestamp in the 15 minutes prior to the reported one, which didn't get indexed until this time period and therefore is missed

ITWhisperer · ‎04-08-2024

Timechart will be filling in the empty time slots with zeroes. Given that you have an error, I suspect that this part of the process hasn't been reached before the error, which is why these are missi...

Timechart will be filling in the empty time slots with zeroes. Given that you have an error, I suspect that this part of the process hasn't been reached before the error, which is why these are missing from your final result.

ITWhisperer · ‎04-08-2024

You need to investigate your settings for your report and determine why you are missing alerts.

DineshElumalai · ‎04-08-2024

Initially I was facing error. I passed token inside the quotes "$token$". That worked for me. Thanks a lot.

NoSpaces · ‎04-08-2024

Have a nice day! I have several Splunk instances and often see the message below: WorkloadsHandler [111560 TcpChannelThread] - Workload mgmt is not supported on this system. I know that the ...

Have a nice day! I have several Splunk instances and often see the message below: WorkloadsHandler [111560 TcpChannelThread] - Workload mgmt is not supported on this system. I know that the workload feature is not supported on the windows system, and it is obviously disabled How can I get rid of this annoying message in the splunkd.log?

alexspunkshell · ‎04-08-2024

Below are the CIM Macros where i am using and there are different indexes mapped in individual macros. I want to get the list of all indexes mapped in all the CIM Macros. Hence i did a scheduled se...

Below are the CIM Macros where i am using and there are different indexes mapped in individual macros. I want to get the list of all indexes mapped in all the CIM Macros. Hence i did a scheduled search which runs and check all the macros. But it is utilizing lot of memory and even searches are failing. Please help me with a better way to get the list of all indexes mapped in CIM Macros. cim_Authentication_indexes cim_Alerts_indexes cim_Change_indexes cim_Endpoint_indexes cim_Intrusion_Detection_indexes cim_Malware_indexes cim_Network_Resolution_indexes cim_Network_Sessions_indexes cim_Network_Traffic_indexes cim_Vulnerabilities_indexes cim_Web_indexes

adrifesa95 · ‎04-08-2024

and what can be the problem when the difference is 4-5 min between the indexing time and the _time, and the alert runs every 15 min and looks at the last 15 min.

avi7326 · ‎04-08-2024

@ITWhisperer Can I please get you guidance.

avi7326 · ‎04-08-2024

Yes you understand correctly, I have two different log types ABC and EFG in the same index, but the sourcetype is different in both logs so the condition is when there will be error it will be calcu...

Yes you understand correctly, I have two different log types ABC and EFG in the same index, but the sourcetype is different in both logs so the condition is when there will be error it will be calculated from the ABC log but the details which it is containing it is in EFG log that is in other sourcetype and I will also fetch the details of that log but what I want is when I got total error is ABC is 5 then when I should search the ABC and EFG together it should show me 5 errors only related to the correlationid. I hope you understand my query from this .

All Posts

All Posts

Re: How to extract a value from fields when using stats()?

Re: Http Event Collector (HEC): SSL Self Signed Certificate Error

Splunk OVA for VMware Metrics (5096)

Re: could not create search - No Search query provided

Re: Datepicker with Submit button

could not create search - No Search query provided

Re: Alerts not triggering

Re: Duplicate Log Entries from S3 Bucket

Re: Alerts not triggering

Re: Data Summary is not showing host at all

Re: Splunk Search to find the list of CIM Mapped indexes

Re: Alerts not triggering

Re: Timechart removes 0 values when searching for over 2 days

Re: RSA_Probe_Alert_RSA_SECUREID_null_Splunk will check every min for the events with key word "svc_radius_probe_ct

Re: Passing a token value with different spaces

Splunk on Windows - Disable message about workload mgmt unsupported

Splunk Search to find the list of CIM Mapped indexes

Re: Alerts not triggering

Re: How to fetch the count with details.

Re: How to fetch the count with details.

All Posts

Are you a member of the Splunk Community?

All Posts