All Topics

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

All Topics

Several question about index

by in Getting Data In
‎05-30-2022 09:38 PM
‎05-30-2022 09:38 PM
Hi, I have index that call "myindex" and have several question about it: 1-how can i remove specific date range of specific index and force to reindex it?  (cli or web?) 2-how to view percentage ... See more...
Hi, I have index that call "myindex" and have several question about it: 1-how can i remove specific date range of specific index and force to reindex it?  (cli or web?) 2-how to view percentage of status of current indexing job?  (cli or web?) 3-how to force reindex specific directory? (cli or web?) 4-i have 2 seprate index (1-daily, 2-ondemand) first one index this path /opt/daily, second index this path /opt/ondemand every night a script sync daily path, and indexed correctly. the issue is when I put log of today on ondemand path it will index correctly but next day when daily script run, daily index not update correctly and just show log that belong after that on splunk!   e.g. 1-I've update ondemand path and it contain log og today from 00:00 to 11:00 2-next day after script run and daily path update on splunk only show from 11:00 to 23:59    any idea? Thanks,
Labels

Deploy Splunk with a different context

by in Installation
‎05-30-2022 07:50 PM
‎05-30-2022 07:50 PM
Hi All, I am trying to deploy Splunk in a different context. By default when I run this command /opt/splunk/bin/splunk start --accept-license It starts the web with "/" as a deployment web contex... See more...
Hi All, I am trying to deploy Splunk in a different context. By default when I run this command /opt/splunk/bin/splunk start --accept-license It starts the web with "/" as a deployment web context and I can access it by http://localhost:8000/ Now, if I would like to access Splunk like this http://localhost:8000/splunk-local, so that all the redirect URLs would look like this http://localhost:8000/splunk-local/en-US/app/launcher/home, http://localhost:8000/splunk-local/en-US/account/login?return_to=%2Fen-US%2Fapp%2Flauncher%2Fhome Reason for asking this question: In the Kubernetes environment, it's a bit challenging to configure Networks for applications using the default "/" as a context Thanks Vikas @jho-splunk @daniel333 @48tfhd86gv @gcusello @dstromberg 
Labels

Why do different ip addresses have different search speeds?

by in Splunk Search
‎05-30-2022 07:02 PM
‎05-30-2022 07:02 PM
version : splunk  enterprise 8.1.3 I have a datasource with a field that is either an ip address. The following ip addresses are examples. If i do a search for a ip the response time is quite go... See more...
version : splunk  enterprise 8.1.3 I have a datasource with a field that is either an ip address. The following ip addresses are examples. If i do a search for a ip the response time is quite good. earliest=05/30/2022:00:00:00 earliest=05/30/2022:04:00:00 index=firewall src_ip=1.1.1.1 But, If i do a search for a ip the response time is slow. earliest=05/30/2022:00:00:00 earliest=05/30/2022:04:00:00 index=firewall src_ip=2.2.2.2 Is there a reason for the difference in search speed depending on the IP? 
Labels

Highlighting data in one table that is contained in a separate table?

by in Dashboards & Visualizations
‎05-30-2022 05:20 PM
‎05-30-2022 05:20 PM
Hi, rather new to this community, but trying to figure this out.  I have table 1 with two fields, (src_ip and dest_ip) and another table 2 with (IP) field.  I would like to highlight any IPs in table... See more...
Hi, rather new to this community, but trying to figure this out.  I have table 1 with two fields, (src_ip and dest_ip) and another table 2 with (IP) field.  I would like to highlight any IPs in table 2 that are a match to any in table 1 in either field.  Is there an easy way to accomplish this?  Thanks in advance.
Labels

How to Display the time when logs are not ingested?

by in Splunk Search
‎05-30-2022 01:08 PM
‎05-30-2022 01:08 PM
Hi Experts, I'm new to splunk. I have created a dashboard to which logs are ingested every min and shows how many logs were ingested, as percentage i.e, on hourly basis it calculates the value as t... See more...
Hi Experts, I'm new to splunk. I have created a dashboard to which logs are ingested every min and shows how many logs were ingested, as percentage i.e, on hourly basis it calculates the value as total. ingested logs/60.  However, in the drill-down part, I would like to show the actual timing when the logs were not ingested. Let me know if there is a mechanism to achieve this. Regards, Karthikeyan
Labels

Help with JSON Regex extraction

by in Splunk Search
‎05-30-2022 01:05 PM
‎05-30-2022 01:05 PM
Similar to https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-all-fields-from-userdata/m-p/596078#M207501 Could you please help me with this I use       source=http:splunk_ec... See more...
Similar to https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-all-fields-from-userdata/m-p/596078#M207501 Could you please help me with this I use       source=http:splunk_ecp_IPC2_kafka_logs sourcetype=yo_kafka_logs properties YoRouterLoggingInterceptor | rex "properties=(?\{.*\})" |table chatOriginUrl,firstName,lastName, conversationId,clientSourceId,engagedHandler       The string is       30 May 2022 08:38:20,741 log_level='DEBUG' thread_name='yoRouterExecutor-9' hostName=yo-router-b-deployment-39-gb2hf class_name='com.al.wsgcat.ngsp.yo.logging.YoRouterLoggingInterceptor' app=NGSPYO event_name=YOROUTER correlationId=BLiLDEyd-24052022-070434975 URI=https://yo.al.com/yo/gateway/v1/handleRouting,Method=POST,Headers=[Accept:"application/json", Content-Type:"application/json", Content-Length:"2388"],Request body={"yoMessage":{"messageText":"Representative has disconnected","from":null,"to":"mglueck@ngspchattims.al.com","properties":{"lineOfBusiness":"MYCA","messageCategory":"returningasync","messageCount":"","yoId":"svc.yo7@ngspchattims.al.com/Smack","transferIntentCode":"","experience":"platinum","checkoutStatus":"","customerMemberConnectionId":"44f4d6263627d8267385ea64d8bfc057","requestHandler":"","messageType":"ccpdisconnected","browserVersion":"Chrome 101.0.4951.61","action":"","workGroupName":"Social_Media_Team","chatType":null,"aao_locale":"en-US","microBotIntent":null,"deviceType":"mobile","applicationVersion":"1.0","interactionId":"159MS6U2J6NFHGP4","clientSourceId":"smrt","deviceOS":"Android 12","chatOriginUrl":"https://online.al.com/myca/mycaassist/us/startChat.do?request_type=authreg_home","messageId":"f3b5c925-2ac9-41a5-9917-41b0edb9e065","chatSessionId":"s_675f1a75-94b7-4e02-a240-94ef07b25c6e","masterBotIntent":null,"messageOrigin":"ccp","firstName":"J","userGroups":"","intentCode":"offers_generic","alSession":"","bbv":"6cf84eea-a1270454-e62fd5be-273cb071","smallCustomerArt":"","escalationIndicator":"","customerNumber":"CRPXMSYRO9UK7P3","riskflag":"","queuedTimeStamp":"","toId":"svc.yo24@ngspchattims.al.com/Smack","lastName":"","conversationHeader":"","customerProduct":"137","correlation-id":"f3b5c925-2ac9-41a5-9917-41b0edb9e065","channel-user-id":"44f4d6263627d8267385ea64d8bfc057","locale":"en-US","gatekeeper":"DF25AD3025E28FFB6B6C8701A1DA0DEEF8DA561973401A20FDC35FBFDB68118DEF63E653045C3B52BCDADCE57398C054AEA7B99DCD0FA2B1628E31E96AFE7BC0EC16F04DF6BA0CF2406C14EF3BFC6ECD73F4F8CC155AAD568EB6F44816A8C576667749FA70F9B9F48A99EC3723D2AEABEF11BBC65DB47E317B99BB95CC71D8D03B394999B87CC149618E59061DD0AD06A","historicalChat":"","confidenceScore":"","creditFlag":"N","engagedHandler":"mglueck","botId":"","channelId":"web","productCreatedDate":"","conversationId":"","conversationTopic":null,"languageId":"US","customerMemberId":"","ccpId":"mglueck","sessionId":"itc_9d9907d7-e64d-475f-b9ea-21b26e6b2797","globalCustomerMemberId":"","pegaMessageId":null,"createdDate":"2022-05-30T15:38:18.481Z","customerMemberIPAddress":"192.16.1","waitTime":"1358"}},"routeCode":"CCP","xmppId":"mglueck"}      

Why is Transaction command not working as expected?

by in Splunk Search
‎05-30-2022 10:39 AM
‎05-30-2022 10:39 AM
I encounter with strange issue when i use transaction and at the end sort by duration it show highest duration is 15000 but when i remove transaction it show 17000 as highest duration!!! FYI1:corre... See more...
I encounter with strange issue when i use transaction and at the end sort by duration it show highest duration is 15000 but when i remove transaction it show 17000 as highest duration!!! FYI1:correct value is 17000 and there is no special filter exist here! FYI2:duration directly print in log i just use transaction to aggregate two lines.   Here is with transaction command: | rex "actionName.*\.(?\w+\.\w+)\]" | rex "duration\[(?\d+)" | rex "transactionId\[(?\w+-\w+-\w+-\w+-\w+)" |transaction transactionId | sort - duration | table duration actionName username   Here is without transaction: | rex "actionName.*\.(?\w+\.\w+)\]" | rex "duration\[(?\d+)" | rex "transactionId\[(?\w+-\w+-\w+-\w+-\w+)" | sort - duration | table duration actionName username   Here is the log: 2022-05-30 12:39:34,262 INFO  [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] parameters[] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] username[ABC] startTime[1653898174262] 2022-05-30 12:42:26,109 INFO  [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] duration[171847] status[done]   any idea? Thanks
Labels

How to handle huge data in Splunk custom command

by in All Apps and Add-ons
‎05-30-2022 10:02 AM
‎05-30-2022 10:02 AM
Hi, We have implemented a custom command which queries the external rest api and pulls the data to splunk search page. The challenge we are facing is when the response data is huge Splunk search pa... See more...
Hi, We have implemented a custom command which queries the external rest api and pulls the data to splunk search page. The challenge we are facing is when the response data is huge Splunk search page is waiting for couple of minutes(more than 5 minutes) with out showing any data. The result of the api's comes in the form of partitions. Lets say, if we have 100k records in the api rsult, All those 100k rows would be splitting up into 100 partitions and we need to iterate over 100 times to get all the 100k records. Similarly if we could send the partition data to splunk and get the results appended to the splunk page as and when we get data for all partitions, we can have end user see the data as soon as possible instead of waiting for couple of minutes. My custom command is generating custom command. I would like to know if there is any way to send the data in chunks to Splunk page instead waiting to pull all the 100k records. We tried couple of ways like yield (our code is in Python and using Splunk python SDK), enabling streaming attribute etc. Please help me here to figure out a way to send the data in chunks for the generating custom command. Thanking you.
Labels

Why when I use transaction command, search is not extracting some fields

by in Splunk Search
‎05-30-2022 09:23 AM
‎05-30-2022 09:23 AM
Hi try to use transaction command, but actionName is empty!   Here is my SPL | rex "actionName.*\.(?<actionName>\w+\.\w+)\]" | rex "duration\[(?<duration>\d+)" | rex "transactionId\[(?<tra... See more...
Hi try to use transaction command, but actionName is empty!   Here is my SPL | rex "actionName.*\.(?<actionName>\w+\.\w+)\]" | rex "duration\[(?<duration>\d+)" | rex "transactionId\[(?<transactionId>\w+-\w+-\w+-\w+-\w+)" |transaction transactionId | table duration actionName username Here is the current result: duration    actionName    username   171847                                           ABC      Here is the expected result: duration            actionName           username   171847    QueryOnData.Allow     ABC       Here is the log: 2022-05-30 12:39:34,262 INFO  [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] parameters[] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] username[ABC] startTime[1653898174262] 2022-05-30 12:42:26,109 INFO  [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] duration[171847] status[done]
Labels

How to Graph CPU usage of indexers over time?

by in Splunk Enterprise
‎05-30-2022 09:16 AM
‎05-30-2022 09:16 AM
I received this image from support and I would like to create a panel in my dashboard to mimic this information.  How would I go about doing that?  I was trying with the current query, but am not hav... See more...
I received this image from support and I would like to create a panel in my dashboard to mimic this information.  How would I go about doing that?  I was trying with the current query, but am not having luck.       index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx* | stats avg(data.normalized_pct_cpu) AS cpu_usage BY host | table host cpu_usage         I am using data.normalized_pct_cpu as the docs state that it is Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine, which seems to be what I want but not sure if that is the best way to go about this.

How to display last update time for a specific timezone irrespective of the local timezone?

by in Dashboards & Visualizations
‎05-30-2022 08:52 AM
‎05-30-2022 08:52 AM
Hi All, I referred the following https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-page-last-updated-time-in-the-dashboard/m-p/599698#M49203 to display the last refreshed/... See more...
Hi All, I referred the following https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-page-last-updated-time-in-the-dashboard/m-p/599698#M49203 to display the last refreshed/updated date-time on the dashboard. In my case, it uses my local system's timezone to display the result. I changed the timezone in Splunk from default to EST, but it still takes and displays time as per local timezone. Can anybody please share a way to display the date time for a specific timezone irrespective of the local timezone on which the dashboard is being accessed?  Thank you
Labels

How can I Troubleshoot why apply shcluster-bundle does not work / takes very long time?

by in Deployment Architecture
‎05-30-2022 08:05 AM
‎05-30-2022 08:05 AM
Hello, When I run the splunk apply cluster-bundle command it seems to create a bundle for all apps in /$SPLUNK_HOME/etc/shcluster/apps to /$SPLUNK_HOME/var/run/splunk/deploy/apps. The last modified... See more...
Hello, When I run the splunk apply cluster-bundle command it seems to create a bundle for all apps in /$SPLUNK_HOME/etc/shcluster/apps to /$SPLUNK_HOME/var/run/splunk/deploy/apps. The last modified date on all app catalogs in /$SPLUNK_HOME/var/run/splunk/deploy/apps is always the date of when I last ran the apply shcluster bundle command. We have merge_to_default set, could that have something to do with all apps being pushed to the search head cluster regardless if there has been any change in the apps? How can I troubleshoot what the problem could be? If the apply command finishes it can take up to hours but usually it's something that times out.

How to access OUTPUT variables from Stored Procedure called by dbxquery?

by in All Apps and Add-ons
‎05-30-2022 07:28 AM
‎05-30-2022 07:28 AM
I am calling a Stored Procedure in MS SQL using dbxquery:     The Stored Procedure is configured with:   EXECUTE @RC = [dbo].[getSomeData] @time ,@interval ,@retVal OUTPUT ,@retE... See more...
I am calling a Stored Procedure in MS SQL using dbxquery:     The Stored Procedure is configured with:   EXECUTE @RC = [dbo].[getSomeData] @time ,@interval ,@retVal OUTPUT ,@retErrorMessage OUTPUT GO   Am I able to access the values returned in the OUTPUT variables, i.e. retVal and retErrorMessage, from the stored procedure? All help and insight is appreciated. Thanks
Labels

Is Cyberark PAM/PSM user integration with Splunk possible?

by in Security
‎05-30-2022 06:44 AM
‎05-30-2022 06:44 AM
Hello,  I am requested to make a study on the possibility to integrate Splunk authentication/authorization  with Cyberark PAM/PSM.  To get connected into Splunk, the users should go through PAM/P... See more...
Hello,  I am requested to make a study on the possibility to integrate Splunk authentication/authorization  with Cyberark PAM/PSM.  To get connected into Splunk, the users should go through PAM/PSM.   I could not find anything in the documentation nor in internet. Can you please tell me if this is or will be feasible?  
Labels

How to configure Heavy forwarder syslog output with TLS?

by in Security
‎05-30-2022 06:37 AM
1 Karma
‎05-30-2022 06:37 AM
1 Karma
Hi, We can configure a heavy forwarder to send syslog data from Splunk to a third party. How do we this flow to use TLS with mutual authentication (client and server certificates)? Thanks, Gabriel
Labels

MicroSoft SCCM app Integration with Splunk

by in All Apps and Add-ons
‎05-30-2022 05:32 AM
‎05-30-2022 05:32 AM
We are trying to integrate Microsoft SCCM v2.1.3  app with Splunk to get the patching information.  I need an SOP to follow the steps to integrate Microsoft SCCM with Splunk . please help me with thi... See more...
We are trying to integrate Microsoft SCCM v2.1.3  app with Splunk to get the patching information.  I need an SOP to follow the steps to integrate Microsoft SCCM with Splunk . please help me with this .
Labels

Is there a supported or working CIM Mapping add on for "Cisco Cloud Security Umbrella Add on"?

by in Getting Data In
‎05-30-2022 05:27 AM
‎05-30-2022 05:27 AM
Hi all, I am using "Cisco Cloud Security Umbrella Addon for Splunk" to ingest the Data via API. https://splunkbase.splunk.com/app/5557/ Unfortunately the add-on does not include any CIM knowled... See more...
Hi all, I am using "Cisco Cloud Security Umbrella Addon for Splunk" to ingest the Data via API. https://splunkbase.splunk.com/app/5557/ Unfortunately the add-on does not include any CIM knowledge.  Can anyone tell me if there is a supported or working add-on for the CIM Mapping?   Thank you O.
Labels

Is there a way to make transaction wait or end before starting new transaction?

by in Splunk Search
‎05-30-2022 04:23 AM
‎05-30-2022 04:23 AM
Hi, is there a way to make a Splunk transaction wait until it has ended, before starting another transaction.   e.g. if I have (with latest results at the top) a end b start ... See more...
Hi, is there a way to make a Splunk transaction wait until it has ended, before starting another transaction.   e.g. if I have (with latest results at the top) a end b start c start d end e end f start g start h start   What I get from Splunk here would be transactions: f->e, g->d and b->a. But what I want is h->e and c->a, so once it's found "start" it then looks for "end", and then looks for the next "start" after that... etc.
Labels

How can I extract all key value between brackets (keys vary)?

by in Splunk Search
‎05-30-2022 03:38 AM
‎05-30-2022 03:38 AM
Hi I have a string like below, how can I extract all key value between brackets (keys vary)? Arg[2]: NetworkPacket{trace='0'errCode=''dateTimeLocalTransaction='Mon May 30 00:00:00 IRDT 2022'dateT... See more...
Hi I have a string like below, how can I extract all key value between brackets (keys vary)? Arg[2]: NetworkPacket{trace='0'errCode=''dateTimeLocalTransaction='Mon May 30 00:00:00 IRDT 2022'dateTimeLocalTransactionTo='Mon May 30 23:59:59 USDT 2022'selectedTerminalTypes='[]'UDPApproveTermID='', dateEnd=null', referenceID='', selectedFlowTypeMaps=[]}   for above string out put like this: trace=0 errCode= dateTimeLocalTransaction=Mon May 30 00:00:00 USDT 2022 dateTimeLocalTransactionTo=Mon May 30 23:59:59 USDT 2022 selectedTerminalTypes= UDPApproveTermID= dateEnd=null referenceID= selectedFlowTypeMaps=   Thanks,
Labels

Do I need to go through V7.x -> V8.0 -> V8.2, or  is it possible to go through V7.x -> V8.1 -> V8.2 instead of V8.0?

by in Splunk Enterprise
‎05-30-2022 02:59 AM
‎05-30-2022 02:59 AM
i am planning to upgrade splunk enterprise from V7.x to V8.2, do i need to go through V7.x -> V8.0 -> V8.2 ?  or  is it possible to go through V7.x -> V8.1 -> V8.2 instead of V8.0?     if anyth... See more...
i am planning to upgrade splunk enterprise from V7.x to V8.2, do i need to go through V7.x -> V8.0 -> V8.2 ?  or  is it possible to go through V7.x -> V8.1 -> V8.2 instead of V8.0?     if anything goes wrong i need to revert back,  is it necessary to go through V8.2 -> V8.0 -> V7.x? Or is it possible to switch back directly to V8.2 -> V7.x without going through V8.0?   Splunk documentation will be highly appreciated.  
Labels