All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

HI @gcusello  Request is to display the status of the jobs in the format as attached below in the excel.  1. These jobs ( Job A , Job B , Job C , Job D, Job E, Job F) are executed once a day and th... See more...
HI @gcusello  Request is to display the status of the jobs in the format as attached below in the excel.  1. These jobs ( Job A , Job B , Job C , Job D, Job E, Job F) are executed once a day and the start time/end time/status of these jobs are captured in splunk. We need to monitor these jobs and highlight the status  Sample of output we would like in our dashboard:   
Hi @Real_captain , your request is just a little vague. what do you want to monitor: that all the steps are correctly completed? that they are completed in the prefixed time, what else? is ther... See more...
Hi @Real_captain , your request is just a little vague. what do you want to monitor: that all the steps are correctly completed? that they are completed in the prefixed time, what else? is there a transaction_Id or something else to correlate events? the five steps have a daily frequency or which one? Then, what do you want to display, could you share a sample of the output that you would have? Ciao. Giuseppe
What you seek to do is not possible.  The contents of commands.conf apply to all roles. Management of the commands.conf file is not controlled by role.  It is governed by whatever process your organ... See more...
What you seek to do is not possible.  The contents of commands.conf apply to all roles. Management of the commands.conf file is not controlled by role.  It is governed by whatever process your organization has for controlling CLI access to the Splunk server(s).
Search peer <hostname> has the following message: Unable to initialize modular input ssg_subscription_modular_input defined in the app splunk secure gateway introspecting scheme-ssg_subscription_modu... See more...
Search peer <hostname> has the following message: Unable to initialize modular input ssg_subscription_modular_input defined in the app splunk secure gateway introspecting scheme-ssg_subscription_modular_input script running failed.    These are new 9.3 builds added to the cluster. I would appreciate any insight.   thanks,
This is your data - you should understand what you are working with or find someone in your organisation who does!
ok what else fields I can visualize can you please let me know based on the event I have given.
| chart count by JSESSIONID severity
I have an IIS server that is sending logs to splunk, and the logs are saved in w3c format. but I found that logs are save in UTC time format. and only IIS format can save logs in local time but there... See more...
I have an IIS server that is sending logs to splunk, and the logs are saved in w3c format. but I found that logs are save in UTC time format. and only IIS format can save logs in local time but there is no parser for IIs.   if someone have integrated IIS do let me know
Hi  Is it possible to create a workflow like below in Splunk.  We have 5 jobs running everyday and the start/end time with status is captured in the Splunk logs.  We want to create a workflow ... See more...
Hi  Is it possible to create a workflow like below in Splunk.  We have 5 jobs running everyday and the start/end time with status is captured in the Splunk logs.  We want to create a workflow as below using the start/end time and status of the jobs:     
That endpoint seems to be specific by the TA itself which we cannot edit, we have both servers using the IAM to point to the s3 bucket which doesn't have s3 private endpoints enabled.
Hi, Please can you confirm if you followed the Splunk 9.4 upgrade pre-steps that are documented here? https://docs.splunk.com/Documentation/Splunk/9.4.0/Installation/AboutupgradingREADTHISFIRST Th... See more...
Hi, Please can you confirm if you followed the Splunk 9.4 upgrade pre-steps that are documented here? https://docs.splunk.com/Documentation/Splunk/9.4.0/Installation/AboutupgradingREADTHISFIRST There is a section on upgrading the kv-store before running the Splunk 9.4 upgrade. HTH
From 9.3 you can also perform automated indexer cluster upgrade. Als in this doc there is a reference to upgrade LM & CM with the app, but they don't mention any other stand-alone servers. https://d... See more...
From 9.3 you can also perform automated indexer cluster upgrade. Als in this doc there is a reference to upgrade LM & CM with the app, but they don't mention any other stand-alone servers. https://docs.splunk.com/Documentation/Splunk/9.3.0/Indexer/AutomatedIDXCrollingupgrade#Run_the_automated_rolling_upgrade_for_non-clustered_deployments Documentation is confusing  
I updated it to a 4 digit year to match my logs.  %d %b %Y %H:%M:%S, %Z  
This isn't so much a question as a comment. I found that time config to be incorrect.  My logs start like this: {"Time": "29 Jan 2025 03:16:30, PST", The default timestring is expecting a 2 digi... See more...
This isn't so much a question as a comment. I found that time config to be incorrect.  My logs start like this: {"Time": "29 Jan 2025 03:16:30, PST", The default timestring is expecting a 2 digit year.   %d %b %y %H:%M:%S, %Z   Prior to the update, Splunk was stil able to figure out the time but issed the timezone parameter. In other words, if your heavy forwarder has the same timezone as your zScaler logs you would probably be fine.    
I am expecting for a JSESSIONID(s) how many critical and error logs are there and to represent them in visualized manner.. Not in this way. I ran the query you given. _time Critical Error 2024-... See more...
I am expecting for a JSESSIONID(s) how many critical and error logs are there and to represent them in visualized manner.. Not in this way. I ran the query you given. _time Critical Error 2024-12-30 0 0 2024-12-31 0 0 2025-01-01 0 0  
Try something like this (assuming JSESSIONID and severity are already extracted) | timechart dc(JSESSIONID) by severity
And you have updated the IAM role to include that new endpoint?
JSESSIONID  10002lBNXPR_Jbi4oCjxehcclRZ:1dmii9ro4 100034eQfpxxxHlMxC9DQnU3jJh:1dfvt9oj5 ...... 700 count Severity = Error or Critical Below is the sample event: unit_hostname="GBWDC142AD011NHA.... See more...
JSESSIONID  10002lBNXPR_Jbi4oCjxehcclRZ:1dmii9ro4 100034eQfpxxxHlMxC9DQnU3jJh:1dfvt9oj5 ...... 700 count Severity = Error or Critical Below is the sample event: unit_hostname="GBWDC142AD011NHA.systems.uk.fed" support_id="5949818439961942897" vs_name="/f5-tenant-01/DARWIN-GBM-UK-UAT/v-darwin-uat.systems.uk.fed-44" policy_name="/Common/waf-fed-transparent" dest_ip="10.146.97.3" dest_port="443" violations="HTTP protocol compliance failed" sub_violations="HTTP protocol compliance failed:Body in GET or HEAD requests" violation_rating="3" attack_type="HTTP Parser Attack" severity="Error" ####### HTTP REQUEST BEGIN ####### "GET /ICMClient/icm/action/actions.json HTTP/1.1 Host: rwin-uat.systems.uk.fed Connection: keep-alive sec-ch-ua-platform: ""Windows"" X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 sec-ch-ua: ""Microsoft Edge"";v=""131"", ""Chromium"";v=""131"", ""Not_A Brand"";v=""24"" DNT: 1 Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://darwin-uat.systems.uk.fed/navigator/?desktop=icmUat&feature=Cases&tos=UKUAT_CMTOS2&solution=DWN Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: adUsername=DNc5oBu9KkG0Z9WbdY0YMA; AMToken=W8s9fXK-BZFJwOfUKvHnc1QOiwE.*AAJTSQACMDIAAlNLABxzTGUweUUvUzRRRjZFdDl3Nk8rTlBxbkM4K2s9AAR0eXBlAANDVFMAAlMxAAIwMQ..*; amlbcookie=01; LtpaToken2=tv+zAqV7lpFPFUr8gCWRTnBa+2n6YAaVE4EmZFMyoUQ3KRFFXKYEweRr0q4QwD5aZEb/x9SlmFrQghiQ7ouuQbCJ3wUJ7MTBQvc8O85Q9NQ5IzaJdXNfbSiVsTTJqsww0qprVDSERq+mlE28ZRDuxECH7oD/QpIZoAH5Blk0gNRIfPFOa0e11Ld9CHxwJDtNt3OyqcH0qrKW3b+ieB4mWh+u65GCOyy7EdWhRW6Cryybq/8R7Z6axHE5Gk/8q3PDBxrw/iTvZdB5UXY32wGB8DfYGR4/wc2MsbW5J4MGK8MnYJya/cLzvUJE5clEEmf3P2ef3n0m1lPXC4HartFMo7f/HA2fN0YM78kNLHx78z6EkBnOWI6kUq+EeC+Uz0RsfwoCipLRqdCrhgEofL1wQve9tIHuOrF9sRG62lfmLl67vrYBJDAaDvRE1yC+xLUQfcTfc0bHDxYE2Q9op/DWY6IBOpeZRi4Hmw2nd9R7HzpDB1Jy3HAJPdhEp2bATfPsD2lKYTOCpCcJKGZ3/XEMreEwm970Tz04UZSZ/8MQ86Au+7yVB0WXF+ypFYhXWCWznQfjbdWfKL5u1gxake41N0GdM95XLqydb2JxGQr/V00yqAgu6yh5BNMhhf33rx/I9RxO4jwj/2M3tGjrD0+v5tgVkHVhBA3w7grur118FnAJ7s57A3lDtPjLFjs2w4gZ; JSESSIONID=0000k4OMOHFe-x8tp-F0TmQxoBN:1dmii9ro4; TS01492bb9=0111266d7745aebde115d8e1c57860aa8fb4d2d0645896fc5a6ed9865e53e7eed30bd3d6f3092e028ebe7f89753f63d3e54b8d8646 " ####### HTTP REQUEST END ####### ####### HTTP RESPONSE BEGIN ####### "Response logging disabled" ####### HTTP RESPONSE END ####### response_is_truncated="" ip_client="10.227.31.83" x_forwarded_for_header_value="N/A" method="GET" uri="/ICMClient/icm/action/actions.json" microservice="N/A" query_string="N/A" response_code="200" sig_cves="N/A" sig_ids="N/A" sig_names={N/A} sig_set_names="N/A" staged_sig_cves="N/A" staged_sig_ids="N/A" staged_sig_names="N/A" staged_sig_set_names="N/A" violation_details="<?xml version='1.0' encoding='UTF-8'?> <BAD_MSG> <violation_masks> <block>0-0-0-0</block> <alarm>2400500004500-106200000003e-0-0</alarm> <learn>0-0-0-0</learn> <staging>0-0-0-0</staging> </violation_masks> <request-violations> <violation> <viol_index>14</viol_index> <viol_name>VIOL_HTTP_PROTOCOL</viol_name> <http_sanity_checks_status>64</http_sanity_checks_status> <http_sub_violation_status>64</http_sub_violation_status> <http_sub_violation>Q29udGVudC1UeXBlIGhlYWRlciBpbiBHRVQgcmVxdWVzdA==</http_sub_violation> </violation> </request-violations> </BAD_MSG>"
This documentation is confusing. First it says about automating the rolling upgrade of SHC, then it lists upgrading standalone SH as a use case. To be honest, I'd avoid using this app. If not for an... See more...
This documentation is confusing. First it says about automating the rolling upgrade of SHC, then it lists upgrading standalone SH as a use case. To be honest, I'd avoid using this app. If not for any other reason, it supports only using tgz archive to replace the running splunk instance whereas I tend to use system packages (rpm or deb) whenever possible.
Actually, this is not entirely true. 1. With HEC the "basic" form of... well, it's not even authentication as such since the token is not very secret and is often used by many different sources, is ... See more...
Actually, this is not entirely true. 1. With HEC the "basic" form of... well, it's not even authentication as such since the token is not very secret and is often used by many different sources, is a HEC token. 2. Additionally, you can limit source IPs from which the HTTP input accepts connections (the acceptFrom setting) 3. If you have TLS enabled you can use requireClientCert option to require the client to present a valid cert. By default this option is disabled so HEC can accept TLS connection from anyone (possibly with exception for clients not meeting the defined sslVersions or cipher suites). 4. Additionally to 3. you can limit accepted clients to only those presenting clients containing either sslCommonNameToCheck values or sslAltNameToCheck. It's a relatively rarely used option since as @isoutamo said - typically HEC is a rather "open" input but the options are there. I don't remember for certain but I think the 3. and 4. parameters can only be defined on a HEC input as a whole, not on a per-token basis.