All Topics

Finn · ‎02-25-2022

When using the DLTK, I get a lot of different error messages rather frequently, the most often occurring being:"Could not parse xml reply (no reply from script). See splunkd.log for more info.." with...

When using the DLTK, I get a lot of different error messages rather frequently, the most often occurring being:"Could not parse xml reply (no reply from script). See splunkd.log for more info.." with "02-25-2022 11:21:05.426 +0100 WARN HttpListener [16744 HttpDedicatedIoThread-7] - Socket error from 127.0.0.1:60124 while accessing /services/mltk-container/sync: Winsock error 10053" as the corresponding entry in the log file. The state of the DLTK on my machine is, that a connection with Docker has been successfully established, but no containers are found in the containers context menu except for the __dev__ container, which cant be started. I have pulled some of the images from dockerhub as described in the setup guide for air gapped environments, even though mine is not. These are not found by Splunk. Has anyone got any idea of what I might be doing wrong, I have tried to follow the setup guide as closely as possible without success. Thanks in advance

Mohsin123 · ‎02-25-2022

I've this | eval status=if(CODE=200,"success","failure") i need to have 3 fields like success, failure , total I'm trying this | stats eval(if(c(CODE=200))) as success but its not working Cou...

I've this | eval status=if(CODE=200,"success","failure") i need to have 3 fields like success, failure , total I'm trying this | stats eval(if(c(CODE=200))) as success but its not working Could you please help ?

badien · ‎02-25-2022

Hi Dears I want to know which training course is about how to write a use case in Splunk. I am a beginner and want to get the idea, of which use case is good and beneficial for my organization. ...

Hi Dears I want to know which training course is about how to write a use case in Splunk. I am a beginner and want to get the idea, of which use case is good and beneficial for my organization. Br

EspenLysvik · ‎02-25-2022

How do I make a search that includes to events. The first event is a 'CALL' with parameters and the second event is the response.

ggharat · ‎02-25-2022

Hello Team, I create an Add-on where I configured REST API for data collection input. It executed successfully upon testing and I saved it. But while creating an input in the particular Add-on ap...

Hello Team, I create an Add-on where I configured REST API for data collection input. It executed successfully upon testing and I saved it. But while creating an input in the particular Add-on app, I am getting below error even after selecting field option in Global account. The following required arguments are missing: count. Kindly assist. Regards Gargi Gharat

jackbigt · ‎02-24-2022

An older splunk instance (6.5.0) was found within my environment running on a windows server 2008r2 host. The instance was experiencing license breaches which were resolved by pointing the host to ...

An older splunk instance (6.5.0) was found within my environment running on a windows server 2008r2 host. The instance was experiencing license breaches which were resolved by pointing the host to our primary license master. Currently when searching index=* no results are found. The main index has over 500 million events with data currently flowing into the index. There are no errors when searching _* indexes

vbatra · ‎02-24-2022

I am using the REST API knowledge in - https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-DB-Connect-V3-Automated-Programmatic-cre... But I am not able to update a DB connection. Is there...

I am using the REST API knowledge in - https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-DB-Connect-V3-Automated-Programmatic-cre... But I am not able to update a DB connection. Is there a way to update it without having to delete it? My end goal is to update an identity, but for that, I am thinking if updating the db connection to point to another identity, then deleting the original identity, then creating a new one, and pointing my db connection to it via REST API.

vbatra · ‎02-24-2022

I am trying to edit DB connections using the REST API, but I am not able to find ways to edit a DB connection. Is the only way via deleting and creating it again?

MeMilo09 · ‎02-24-2022

Hello Splunk Community, I am trying to replicate a heat map using the table formats app available through Splunk. I see the coloring of the cells when I use the stats command as below, but I nee...

Hello Splunk Community, I am trying to replicate a heat map using the table formats app available through Splunk. I see the coloring of the cells when I use the stats command as below, but I need to have the data show as a chart. The issue is when I use chart all the color goes away from the table. Is there a work around for this problem? <dashboard> <label>Table Formats</label> <description>Format columns using built-in table formats (coloring, number formatting).</description> <row> <panel> <table> <search> <query> index="Dept_data_idx" eventType="Created" status="success" host=* | bucket _time span=1h | stats count by _time host </query> <earliest>-7d</earliest> <latest>now</latest> </search> <format type="color" field="count"> <colorPalette type="minMidMax" maxColor="#31A35F" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax"></scale> </format> </table> <html> </html> </panel> </row> </dashboard>

iMarko · ‎02-24-2022

Hi, I'm writing a splunk query to find emails with specific file types attached I have the regex working which pulls the files and also extracts the file extensions which I'll be using for data coll...

Hi, I'm writing a splunk query to find emails with specific file types attached I have the regex working which pulls the files and also extracts the file extensions which I'll be using for data collection purposes later. I will then use this extracted file extension to search and return specific emails containing files with said extension (hope that makes sense) The problem is that when I use |where FileExtension=".doc" I get events returned where it contains a .doc file which is fine. But it also shows all the other files attached which I do not want. For example I want my output to be sender recipient file.doc But what I am getting is sender recipient file.doc file.a file.b file.c file.d Is there any way to do some kind of exclusive search that will ignore the extra data in the file field that are not .doc's as they are of no interest to me at the moment?

SimonM · ‎02-24-2022

Its a basic request however has been causing me grief: Easiest / most efficient way to find Destination IP (dstip) for multiple IP list: I regularly am supplied with a list of IP (10-20) for con...

Its a basic request however has been causing me grief: Easiest / most efficient way to find Destination IP (dstip) for multiple IP list: I regularly am supplied with a list of IP (10-20) for confirmation Need to stop using ; OR "" OR "" OR "" Like to use simple lookup for multiple dstIP if possible - copy and paste IP scenario index=? if dstip = 1.2.3.4 2.3.4.5 3.4.5.6 4.5.6.7 | table hostname, hostip Yes I'm learning but I super appreciate any help with this easy one > will save me hours

tlmayes · ‎02-24-2022

Trying to run a query that has a token field. The output injects a space before and after the token provided keyword, which breaks the query.. Simple, but baffling. Original query |inp...

Trying to run a query that has a token field. The output injects a space before and after the token provided keyword, which breaks the query.. Simple, but baffling. Original query |inputlookup somelookup.csv | eval raw="" | foreach * [eval raw=raw.",".coalesce('<<FIELD>>',"") ] | search raw="*$token$*" | table field1, field2, field3 Output of query |inputlookup somelookup.csv | eval raw="" | foreach * [eval raw=raw.",".coalesce('<<FIELD>>',"") ] | search raw="* <keyword> *" | table field1, field2, field3 How do I get rid of the spaces before and after the keyword?

JMondares · ‎02-24-2022

[Contents deleted per request]

roscolaw · ‎02-24-2022

Have a log that is confusing me on how to extract the time. From hour 01:00:00 to 23:59:59, it's fine, but the vendor uses hour 24 instead of 0 for midnight to 1AM. So, at 00:30:00 (12:30AM) the ...

Have a log that is confusing me on how to extract the time. From hour 01:00:00 to 23:59:59, it's fine, but the vendor uses hour 24 instead of 0 for midnight to 1AM. So, at 00:30:00 (12:30AM) the timestamp reads 24:30:00. Anyone run into this or know how to recognize the 24... hour stuff as the 00... hour it should be? Here's an actual cut and paste from the log timestamp: "24:57:05:996" Thanks in advance,

mnj1809 · ‎02-24-2022

I supposed to get the some data in Splunk twice in a day. I want to create 2 email alerts as follows: 9 AM email alert: should alert if no data received at 5 AM and/or if no data received previou...

I supposed to get the some data in Splunk twice in a day. I want to create 2 email alerts as follows: 9 AM email alert: should alert if no data received at 5 AM and/or if no data received previous day at noon. 3 PM email alert: should alert if no data received at noon and/or if no data received earlier the same morning at 5. Thanks for your help in advance. @bowesmana

pacifikn · ‎02-24-2022

Greetings!!! How can i install splunk indexers in centos 7? What I will need and what are steps to follow ? I need to setup splunk TEst Environment, So far I have only installed Splunk...

Greetings!!! How can i install splunk indexers in centos 7? What I will need and what are steps to follow ? I need to setup splunk TEst Environment, So far I have only installed Splunk enterprise as Search Head and I am able to browse it through web GUI and create users, I need also to INSTALL SPLUNK INDEXERS? AND splunk forwarder, and also install splunk management node that will be able to receive syslog from network security devices source and manages search head , KINDLY HELP me and guide me with the steps??? Thank you in advance!!!

bsrikanthreddy5 · ‎02-24-2022

Hi, We are migrating our cluster from on-prem to a smart-store enabled cluster in AWS, a few indexes at a time, during which process event counts is not matching in some cases. Case1: Eventcount...

Hi, We are migrating our cluster from on-prem to a smart-store enabled cluster in AWS, a few indexes at a time, during which process event counts is not matching in some cases. Case1: Eventcount in aws cluster is less than event count in on-prem Case2: Eventcount in aws cluster is more than event count in on-prem Any idea what might cause the event count, not to match?

rajureddi121195 · ‎02-24-2022

can i get the data of indexers which is having more than 45 days old data.

Stefanie · ‎02-24-2022

I am in the process of creating a search to detect significant hard drive decreases. Using the results from my search, I would like to then create a timechart to show how the usage has changed over...

I am in the process of creating a search to detect significant hard drive decreases. Using the results from my search, I would like to then create a timechart to show how the usage has changed over time. This is my search: index=perfmon collection=LogicalDisk sourcetype="Perfmon:LogicalDisk" counter="% Free Space" (instance!="HarddiskVolume*") (instance!=_Total) | eval usedSpace=round(100-Value,0) |stats min(usedSpace) as min, avg(usedSpace) as avg by host, instance |eval delta = avg - min |where delta>10 |rename instance as drive My results return the hostname, the drive letter, the minimum, the average, and the delta for the disk space usage in a tabular format. Let's say it returns one host, I would then like to use that same host to return a timechart for the host and drive. Is this possible?

doesntmatter · ‎02-24-2022

I'm trying something like this: my base search | where data.value1 == data.value2 my base search | where data.value1 != data.value2 I've tried variations of match = case as well. A s...

I'm trying something like this: my base search | where data.value1 == data.value2 my base search | where data.value1 != data.value2 I've tried variations of match = case as well. A single event has the two fields I want to compare.

All Topics

All Topics

Why am I receiving a lot of different error messages with the usage of the DLTK?

how to make a new field based on status code

Which training course is about how to write a use case in Splunk?

Search that includes two following events, a call and then the response in the log

Splunk Add-on to configure REST API calls

Why were no results found when searching across non internal indexes?

DBConnect: How to Edit DB Connections via REST API?

Help with DBConnect Edit a DB Connection or Identity

How to create a Table Formats Coloring

How can I ignore additional data from a field

How to search multiple dstIP traffic most efficiently

How to get rid of the the spaces in token output?

Why are my Splunk UF events being sent to main index, even with a customized inputs.conf file?

How to extract time field that goes from 24:59:59 to 01:00:00?

How to create email alert?

How can install splunk indexers in centos?

On-prem to Smartstore migration issues- Why are the event counts not matching?

How to get the data of indexers which is having more than 45 days old data?

How to use results from one search to create a timechart?

How to check whether or not two different fields match?

All Topics

Are you a member of the Splunk Community?

All Topics