All Posts

gcusello · ‎03-01-2024

Hi @PickleRick and @isoutamo , Thank you for your yints, this is the new transforms.conf [relay_hostname] REGEX = (/var/log/remote/)([^/]+)(/.*) FORMAT = relay_hostname::$2 WRITE_META = true #DES...

Hi @PickleRick and @isoutamo , Thank you for your yints, this is the new transforms.conf [relay_hostname] REGEX = (/var/log/remote/)([^/]+)(/.*) FORMAT = relay_hostname::$2 WRITE_META = true #DEST_KEY = relay_hostname SOURCE_KEY = MetaData:Source REPEAT_MATCH = false I tried with your hints but they don't run, what could I try again? Ciao. Giuseppe

PickleRick · ‎03-01-2024

Only the file authentication.conf is used. The other one - with different extension - is not used. (which should be shown in the output of the commanf @isoutamo provided. Splunk only uses files with...

Only the file authentication.conf is used. The other one - with different extension - is not used. (which should be shown in the output of the commanf @isoutamo provided. Splunk only uses files with the exact name needed, not with some additional prefixes or suffixes (but they can be in various directories from which they are "layered" onto each other according to the precedence rules. https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Wheretofindtheconfigurationfiles Why your authentication doesn't work though - we don't know. Not enough information. Look in your logs, look in your authentication server (LDAP?) logs. That might shed some light on the reasons.

Orange_girl · ‎03-01-2024

I’m sorry, I should’ve been more specific. The files don’t have the same name, one is called authentication.conf and the other one authentication.conf_2. I have updated the binddnpassword in the auth...

I’m sorry, I should’ve been more specific. The files don’t have the same name, one is called authentication.conf and the other one authentication.conf_2. I have updated the binddnpassword in the authentication.conf file, rebooted server, the password got hashed but I’m still not able to log into splunk.

rudal_0205 · ‎02-29-2024

Actually i am looking a query on a scenario where there are few istances on my hosts and it went down.Eventually the there were no logs within 2 hrs ..but we find after 2 hrs the logs are captured.So...

Actually i am looking a query on a scenario where there are few istances on my hosts and it went down.Eventually the there were no logs within 2 hrs ..but we find after 2 hrs the logs are captured.So if we find no logs coming from server past 30 min, it should trigger an alert.

isoutamo · ‎02-29-2024

Hi My old answer for this https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platform-Linux-but/m-p/538062 r. Ismo

isoutamo · ‎02-29-2024

One old post about this https://community.splunk.com/t5/Alerting/How-to-detect-when-a-host-stop-sending-data-to-Splunk/m-p/563571

rudal_0205 · ‎02-29-2024

Hi All, i want a query to check and fire an alert when , there are no logs from a server past 30 min. For example we have different isnatnce running on a host and i want an alert when there are no ...

Hi All, i want a query to check and fire an alert when , there are no logs from a server past 30 min. For example we have different isnatnce running on a host and i want an alert when there are no logs coming from serevr in past 30 min(because server instances are not running) .So we we dont see any logs from server past 30 min and alert shoul notfiy that server instances are stopped.Please help. Logs below event. 3/1/24 12:26:07.000 PM www 89589 0 0.0 00:00:02 0.1 51784 2151496 ? S 35:31 httpd -d_/sys_apps_01/apache/server20Cent/versions/server2.4.56_-f_/sys_apps_01/apache/server20Cent/conf/MTF.AEM.conf host = www2stl52 source = ps sourcetype = ps

Shashwat__Pande · ‎02-29-2024

Hi Rajesh, Thank you for the reply to the above doubt. I would also like to know on what is the max number of volume a machine agent can observe? i.e. if a server has for example 300 Volumes/Storage...

Hi Rajesh, Thank you for the reply to the above doubt. I would also like to know on what is the max number of volume a machine agent can observe? i.e. if a server has for example 300 Volumes/Storage disk. Will the machine agent be able to monitor them all or Does the limit end at around 50-60 volumes? Regards, Shashwat

vk2 · ‎02-29-2024

Is splunk forwarder agent 9.2.0.1 supported on Amazon Linux 2023 x86/arm OS using RPM file. Got error while starting splunk service. tcp_conn_open_afux ossocket_connect failed with No such file o...

Is splunk forwarder agent 9.2.0.1 supported on Amazon Linux 2023 x86/arm OS using RPM file. Got error while starting splunk service. tcp_conn_open_afux ossocket_connect failed with No such file or directory tcp_conn_open_afux ossocket_connect failed with No such file or directory tcp_conn_open_afux ossocket_connect failed with No such file or directory

syazwani · ‎02-29-2024

Hi, Why my CIDR matching in not following the lookup content? Query i used is as below: | makeresults | eval ip="10.10.10.10" | lookup testip ip OUTPUTNEW description Result should look...

Hi, Why my CIDR matching in not following the lookup content? Query i used is as below: | makeresults | eval ip="10.10.10.10" | lookup testip ip OUTPUTNEW description Result should look like this: ip Description 10.10.10.10 New But the real output look like this: ip Description 10.10.10.10 New In Progress Closed I have check my lookup and its clearly state the Description for IP Range 10.10.10.10/27 is "New". Please help and thanks!

ps23 · ‎02-29-2024

This helped, there were few more errors in the python which I fixed too. Thanks

scelikok · ‎02-29-2024

Hi @asabatini, I think the problem is name-capturing groups in REGEX. Using name-capturing groups will already create a field without a FORMAT parameter. You can try one of the below options; Usi...

Hi @asabatini, I think the problem is name-capturing groups in REGEX. Using name-capturing groups will already create a field without a FORMAT parameter. You can try one of the below options; Using name-capturing groups in REGEX; [group1] REGEX = (?<group1>.+\s\-\s\-\s\-\s).*.auditID.:.(?<group2>[\w-]+)..*requestURI.:.(?<group4>[^,]+).+username.:.(?<group5>[^,]+).+sourceIPs....(?<group3>\d+.\d+.\d+.\d+) Without name-capturing groups in REGEX; [group1] REGEX = (.+\s\-\s\-\s\-\s).*.auditID.:.([\w-]+)..*requestURI.:.([^,]+).+username.:.([^,]+).+sourceIPs....(\d+.\d+.\d+.\d+) FORMAT = group1::$1, group2::$2, group5::$3, group3::$4, group4::$5

Symon · ‎02-29-2024

Thanks. Noted sir.

yuanliu · ‎02-29-2024

Glad you can work around this issue! Anyway, I run a spare instance on my laptop always for simple matters that can be emulated. You may consider the same. (You can also observe how versions may af...

Glad you can work around this issue! Anyway, I run a spare instance on my laptop always for simple matters that can be emulated. You may consider the same. (You can also observe how versions may affect these.) I wish I learned how to set up KV store on my laptop so I could help more. But KV Store vs. CSV files has no indication that time-based lookup should function differently. So you would have a support case except 7 might be out of support.

sjringo · ‎02-29-2024

That makes sense and I was wanting to create some additional fields for the output and was getting hung up on the usage of | stats and had to switch it to | eventstats to retain _raw data for the res...

That makes sense and I was wanting to create some additional fields for the output and was getting hung up on the usage of | stats and had to switch it to | eventstats to retain _raw data for the rest of the code after the stats/eventstats. You have helped me before PickleRick and always provide good info !!! Works like a charm, thanks again ! | rex field=_raw "Batch::(?<aJobName>[^\s]*)" | eval aStatus=case( searchmatch("START of script"), "Start", searchmatch("COMPLETED OK"), "End", searchmatch("ABORTED, exiting with status"), "End", true(),null() ) | eventstats values(aStatus) as aStateList by aJobName | where aStateList != "End" |........

richgalloway · ‎02-29-2024

It would help to have a sample (sanitized) event to work with. Avoid lookbehind and lookahead in Splunk. They're costly and rarely necessary. Try on\s(?<HostName>\S*)\sby Firewall Settings

richgalloway · ‎02-29-2024

It depends on what's wrong with it. Tell us more or contact Splunk Support.

secphilomath1 · ‎02-29-2024

I am getting an error when using the following regex (?<=on\s)(.*)(?=\sby Firewall Settings) The error is "Error in 'rex' command: regex="(?<=on\s)(.*)(?<HostName>.*)(?=\sby Firewall Settings)"...

I am getting an error when using the following regex (?<=on\s)(.*)(?=\sby Firewall Settings) The error is "Error in 'rex' command: regex="(?<=on\s)(.*)(?<HostName>.*)(?=\sby Firewall Settings)" has exceeded configured match_limit, consider raising the value in limits.conf." Is there a better way to do this, I am trying to find all text between "on " and " by Firewall Settings. It works in regex101.com, but I get that error in Splunk. TIA!

richgalloway · ‎02-29-2024

One way is using SEDCMD. Add this to the appropriate props.conf file: [mysourcetype] SEDCMD-rmJSONprefix = s/^[^\{]+?//

shrogers · ‎02-29-2024

Hello all, I'm bringing data into Splunk as json but it coming bold text in front that throw off the json. Any suggestion on regx to remove the bold text? <165>Feb 29 19:06:30 server01 darktra...

Hello all, I'm bringing data into Splunk as json but it coming bold text in front that throw off the json. Any suggestion on regx to remove the bold text? <165>Feb 29 19:06:30 server01 darktrace {"hostname":"ss-26138-03","label":"","ip_address":"10.21.32.88","child_id":null,"name":"age_alert-inaccessible_ui","priority":61,"priority_level":"high","alert_name":"Datatrace / Email: Inaccessible UI","status":"Resolved","message":"The UI is inaccessible, this could be the result of a misconfiguration or network error.","last_updated":1709233590.814423,"last_updated_status":1709233590.814423,"acknowledge_time":null,"acknowledge_timeout":null,"uuid":"1111114d-6e72-4029-8ac2-5d051be02ad5","url":"https://server01/sysstatus?alert=1481514d-6e72-4029-8ac2-5d051be02ad5","creationTime":1709233590814}

All Posts

All Posts

Re: Create custom fields at indextime on Heavy Forwarders

Re: Authentication.conf files

Re: Authentication.conf files

Re: Unable to run my query and get correct results.

Re: How to migrate a distributed, clustered Splunk (9.0.4.1) deployment from OS RHEL 7 to new servers RHEL 9?

Re: Unable to run my query and get correct results.

Unable to run my query and get correct results.

Re: Disk attached to VM not showing up in AppD.

Splunk Universal Forwarder agent support for Amazon Linux 2023 x86/arm

cidr match is not properly working

Re: Azure DevOps Daily Commits Info in Splunk

Re: rebuild a syslog event

Re: Splunk App for Linux Auditd Log

Re: Do time-based lookups work only after event-generating commands?

Re: How to get events that have only a starting 'string' with no ending 'string' ?

Re: Optimize Regex

Re: Replication Bundle

Optimize Regex

Re: Regx to remove bolded text

Regx to remove bolded text

All Posts

Are you a member of the Splunk Community?

All Posts