Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Posts
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Posts
All Posts
10-23-2023
05:24 PM
1 Karma
I used the wrong case in the field name. Try my edited answer.
10-23-2023
05:11 PM
Hello, I tried the command you suggested and it did not show any effects Please suggest. Thanks
10-23-2023
04:03 PM
so after opening a case with Splunk tech support because we were unable to upgrade in place our Windows 2019 Servers from Splunk version 9.0.0 to 9.1.1 we were instructed to backup the ETC directory ...
See more...
so after opening a case with Splunk tech support because we were unable to upgrade in place our Windows 2019 Servers from Splunk version 9.0.0 to 9.1.1 we were instructed to backup the ETC directory than uninstall Splunk and do a new install of 9.1.1 then copy the old ETC directory back over well we did just that except we also put it on new/different hardware and now we can't log in to Splunk Web, we get the login screen it takes our credentials and then we get the three dots of death ... any help / advice is tremendously appreciated
Labels
- Labels:
-
Windows
10-23-2023
03:40 PM
@gcusello Hi! Thank you for your advice! (1) It will be kind of difficult to list all 280 indexes. We can probably decrease it to 68 by using something like index=p* I was wondering if t...
See more...
@gcusello Hi! Thank you for your advice! (1) It will be kind of difficult to list all 280 indexes. We can probably decrease it to 68 by using something like index=p* I was wondering if there might be another alternative way to do it without listing all the indexes in search of in macro (2) The rule is actually useful to us, since we had few issues with performance due to users using index=* , selecting big time period and searching for some "text" through all of our 280+ indexes But just curious on why are you saying it isn't useful? Regards, @mlevsh
10-23-2023
03:39 PM
@phanTom thank you for all your help! I am familiar with the daemons names, I am trying to identify the relevant log from each <daemon>.log to fit my cases, let me be more specific: for example,...
See more...
@phanTom thank you for all your help! I am familiar with the daemons names, I am trying to identify the relevant log from each <daemon>.log to fit my cases, let me be more specific: for example, I think that thelog message for playbook running is "decided_command_handler_process_containers.cpp : 597 : DECIDED_CMD_PROCESS_CONTAINERS: rule <playbook id> on container <containet number> SUCCESS" or the log message for succussing ingestion is: "connector_executor.cpp : 934 : INGESTDCommandProcessor::ExecuteConnector DONE. Outcome: success" could you help me identify the relevant cpp and number (597 and 934 are the examples I have pasted here) for each case I wrote above? I hope that I did not complicate the things too much..
10-23-2023
03:18 PM
@meshorer that's fine! Download the app, look in the inputs.conf file and you will have the path to all log files it monitors. I gave you the name of the Daemon so just add ".log" to the end and ...
See more...
@meshorer that's fine! Download the app, look in the inputs.conf file and you will have the path to all log files it monitors. I gave you the name of the Daemon so just add ".log" to the end and that's the log you need to monitor. I would assume the other SIEM has an app/parser/collector/something already for Linux as the only thing the Splunk App for SOAR won't monitor is the OS performance metrics.
10-23-2023
03:05 PM
Hi @phanTom the thing is that I am looking to forward the logs to an external siem which is not splunk (so this app won’t be helpful for my situation) This is done with rsyslog that is why I want...
See more...
Hi @phanTom the thing is that I am looking to forward the logs to an external siem which is not splunk (so this app won’t be helpful for my situation) This is done with rsyslog that is why I want to identify the relevant logs for me
10-23-2023
02:30 PM
1 Karma
There are a number of event codes that have static descriptions of the event in each iteration of the event. This page shows how to trim off the event descriptions on ingest. This can save a lot of d...
See more...
There are a number of event codes that have static descriptions of the event in each iteration of the event. This page shows how to trim off the event descriptions on ingest. This can save a lot of data. https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/Configuration
10-23-2023
02:27 PM
We are on splunk platform . We have server reporting to on prem Deployment servers and outputs configured to send cloud indexers .
10-23-2023
01:58 PM
I would like to allow list a url from my dashboards so that no more redirection warnings pop up. Per the documentation, I can do this by editing web-features.conf on my SHs. What would be the prope...
See more...
I would like to allow list a url from my dashboards so that no more redirection warnings pop up. Per the documentation, I can do this by editing web-features.conf on my SHs. What would be the proper way to push this as a bundle? I tried creating and modifying web-features.conf in an app context on the SHC Deployer (../shcluster/apps/myapp/default/web-features.conf) directory but I still got the pop up (yes, I restarted the SHs). After using "apply shcluster-bundle", I used btool AND show config to verify the config changes appeared on the SHs. No dice. If I modify web-features.conf directly on the SHs (../etc/system/local/web-features.conf), it works perfectly. Thank you! my edited web-features.conf below: [feature:dashboards_csp] dashboards_trusted_domain.domain1 = *myurl.com
Labels
- Labels:
-
deployer
-
search head clustering
10-23-2023
01:21 PM
I fixed the issue by decreasing the "chunk_limit_size".
10-23-2023
12:41 PM
how to convert below json array to table { "Group10": { "owner": "Abishek Kasetty", "fail": 2, "total": 12, "agile_team": "Punchout_ReRun", "test": "", "pass": 6, ...
See more...
how to convert below json array to table { "Group10": { "owner": "Abishek Kasetty", "fail": 2, "total": 12, "agile_team": "Punchout_ReRun", "test": "", "pass": 6, "report": "", "executed_on": "Mon Oct 23 03:10:48 EDT 2023", "skip": 0, "si_no": "10" }, "Group09": { "owner": "Lavanya Kavuru", "fail": 45, "total": 190, "agile_team": "Hawks_ReRun", "test": "", "pass": 42, "report": "", "executed_on": "Sun Oct 22 02:57:43 EDT 2023", "skip": 0, "si_no": "09" } } Expected Output ________________________ ________________________ ________________________ agile_team pass fail ________________________ ________________________ ________________________ Hawks_ReRun 42 45
Labels
- Labels:
-
JSON
10-23-2023
12:41 PM
1 Karma
I think you can do that with the appendpipe command, which processes the current results and adds new results to bottom. | stats values(company), avg(Score) as AvgScore by ip
| appendpipe [ stats...
See more...
I think you can do that with the appendpipe command, which processes the current results and adds new results to bottom. | stats values(company), avg(Score) as AvgScore by ip
| appendpipe [ stats avg(AvgScore) as Average, median(AvgScore) as Median, max(AvgScore) as Max by company ]
10-23-2023
12:17 PM
I know this is quite a late response, but you should be able to accomplish this with using the "Filter using Regex". Select "host" for Source Field In "Drop Events Matching Regular Expression", ent...
See more...
I know this is quite a late response, but you should be able to accomplish this with using the "Filter using Regex". Select "host" for Source Field In "Drop Events Matching Regular Expression", enter ^foo- That will set it so any events with the host field value, that starts with foo- will be dropped.
10-23-2023
11:45 AM
Just ran into this issue myself. In my case we found a handful of UF's that had corrupted PATH statements. Verify you have a correct system path by executing the following Powershell cmd-let $env:...
See more...
Just ran into this issue myself. In my case we found a handful of UF's that had corrupted PATH statements. Verify you have a correct system path by executing the following Powershell cmd-let $env:path If your path statement does not contain the following entries, chances are this is why you are receiving the . C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\
10-23-2023
11:32 AM
1 Karma
".84" is correctly interpreted as ".840". Zero padding is always on the side away from the decimal. The difference between the two timestamps is 892ms. If the application reporting the event inten...
See more...
".84" is correctly interpreted as ".840". Zero padding is always on the side away from the decimal. The difference between the two timestamps is 892ms. If the application reporting the event intended the timestamp to be "14.084" then it should be corrected.
10-23-2023
11:26 AM
Hello, I tried your suggestion and it worked fine. I am accepting this as a solution Can you also suggest how to put the average, median and max on the bottom of the table? Thank you again Below ...
See more...
Hello, I tried your suggestion and it worked fine. I am accepting this as a solution Can you also suggest how to put the average, median and max on the bottom of the table? Thank you again Below is the example: company ip AvgScore CompanyA ip1 1 CompanyA ip2 3 CompanyA ip3 4 Average 2.7 Median 3 Max 4
10-23-2023
10:40 AM
Hi Team, We are observing discrepancy in calculation when the timestamp is less the 100ms. Example: Response time: “2023-10-23 14:46:14.84” Request time: “2023-10-23 14:46:13.948” When “Respo...
See more...
Hi Team, We are observing discrepancy in calculation when the timestamp is less the 100ms. Example: Response time: “2023-10-23 14:46:14.84” Request time: “2023-10-23 14:46:13.948” When “Response time – Request time” value should be “136ms” but in Splunk it showing as “890ms”. While calculating Splunk is considering inbound value as ““2023-10-23 14:46:14.840ms” instead of “.84ms” as its in 2 digits. So, is there any possibility to resolve this discrepancy from the Splunk query level or .conf level. Regards, Siva.
Labels
10-23-2023
10:31 AM
Are you interested in leaving out dest_domain values that don't have high counts? A real simple way to approach it is to "pre-count" the dest_domain using eventstats, and limit just those that had m...
See more...
Are you interested in leaving out dest_domain values that don't have high counts? A real simple way to approach it is to "pre-count" the dest_domain using eventstats, and limit just those that had more than a particular threshold (in this case 100) with the where command: index= <Splunk query>
| eventstats count by sourcetype
| where count>100
| timechart span=15m count by dest_domain usenull=f useother=f | head 15 Also, when you think about how Splunk is running these commands, you might visualize it running these commands over and over your data...like several for-loops one right after another. That's what it does. That's what it is optimized for...it's a bit counterintuitive compared to databases where you are trying to limit full-scans of things. The distributed architecture of Splunk is built for this.
10-23-2023
10:13 AM
The old way of just running a python script as an alert action was deprecated a while back. It was a really simple, "run script and here's the search data." That way is old and busted...so it is no...
See more...
The old way of just running a python script as an alert action was deprecated a while back. It was a really simple, "run script and here's the search data." That way is old and busted...so it is not around anymore. The new hotness is Custom Alert Actions. You can create one that runs your python. There's some more setup/configuration so it is registered with the system and more effort goes into packaging it up as an official configuration in Splunk (official as in you made it for your environment...). Here is a previous discussion on this topic, too.
