Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Topics
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Topics
All Topics
09-29-2021
06:29 PM
Hi all, I'm new to this forum and found quite a few ideas and solutions to issues admins hit. The organisation I work for are standing up a new site and requested new pair of heavy forwarders to be...
See more...
Hi all, I'm new to this forum and found quite a few ideas and solutions to issues admins hit. The organisation I work for are standing up a new site and requested new pair of heavy forwarders to be installed. The issue we have been mulling over is how to provide a highly available forwarder cluster at this site. The forwarders will be based on Linux, will process data from the network (Syslog, netflows etc) and also process files located on a NFS share (service provider managed CIFS/NFS share). We are using Splunk Cloud but have a deployment server on-prem to manage forwarders on the internal networks. My question - is there a solution to provide a clustered pair of forwarders that act in an active/passive cluster that allows support for processing files and also accepting network traffic? cheers aiders
Labels
- Labels:
-
heavy forwarder
09-29-2021
06:08 PM
Is it possible to specify how far back data is retrieved for Azure AD logs? Seems to be it grabbed a bit over 3 months worth.
Labels
- Labels:
-
administration
-
troubleshooting
09-29-2021
05:15 PM
I configured Splunk's latest Box TA and I am receiving "Connection reset by peer" any suggestions on what the issue could be? Following is a snippet from splunkd.log 09-29-2021 18:56:48.754 -0400...
See more...
I configured Splunk's latest Box TA and I am receiving "Connection reset by peer" any suggestions on what the issue could be? Following is a snippet from splunkd.log 09-29-2021 18:56:48.754 -0400 ERROR ExecProcessor - message from "/opt/splunk/splunk/bin/python3.7 /opt/splunk/splunk/etc/apps/Splunk_TA_box/bin/box_service.py" WARNING:boxsdk.network.default_network:Request "GET https://api.box.com/2.0/events?stream_type=admin_logs&limit=500&stream_position=0&created_after=2021-09-26T17:00:00-00:00&created_before=2021-09-27T17:00:00-00:00" failed with ConnectionError exception: ConnectionError(ProtocolError('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))) My box.conf for the TA is as follows ## ## SPDX-FileCopyrightText: 2021 Splunk, Inc. <sales@splunk.com> ## SPDX-License-Identifier: LicenseRef-Splunk-1-2020 ## ## [box_default] folder_fields = type,id,name,size,sequence_id,etag,item_status,permissions,created_at,modified_at,has_collaborations,can_non_owners_invite,tags,created_by,modified_by,parent,path_collection,shared_link collaboration_fields = type,id,created_by,created_at,modified_at,expires_at,status,accessible_by,role,acknowledged_at,item file_fields = type,id,name,owned_by,comment_count,version_number,created_at,modified_at,purged_at,trashed_at,size,content_created_at,content_modified_at,file_version,description,path_collection,shared_link task_fields = type,id,item,due_at,action,message,is_completed,created_by,created_at comment_fields = type,id,is_reply_comment,message,tagged_message,item,modified_at,created_by,created_at user_fields = type,id,name,login,created_at,modified_at,role,timezone,space_amount,space_used,max_upload_size,can_see_managed_users,is_external_collab_restricted,status,job_title,phone,address,avatar_url,is_exempt_from_device_limits,is_exempt_from_login_verification,enterprise,my_tags created_after = collection_interval = 120 priority = 10 record_count = 500 use_thread_pool = 1 url = https://api.box.com restapi_base = https://api.box.com/2.0 disable_ssl_certificate_validation = True
Labels
- Labels:
-
troubleshooting
09-29-2021
05:14 PM
Hi Team I am trying to extract few report from user agent. like below OS details OS version Browser Browser Version Operating System Operating System Version Mobile device Curre...
See more...
Hi Team I am trying to extract few report from user agent. like below OS details OS version Browser Browser Version Operating System Operating System Version Mobile device Currently i am using eval ( IF & Case ) to generate report however its very manual process and more time consuming. Please find below command for example If - val Device =if(match(cs_user_agent, "iPhone"),"iPhone",if(match(cs_user_agent, "Macintosh"),"iPhone",if(match(cs_user_agent, "iPad"),"iPhone",if(match(cs_user_agent, "Android"),"Android",if(match(cs_user_agent, "Win64"),"Windows",if(match(cs_user_agent, "14092"),"Windows",if(match(cs_user_agent, "Windows"),"Windows",if(match(cs_user_agent,"SM-"),"Android",if(match(cs_user_agent,"CPH"),"Android",if(match(cs_user_agent,"Nokia"),"Android",if(match(cs_user_agent,"Pixel"),"Android",if(match(cs_user_agent,"TB-"),"Android",if(match(cs_user_agent,"VFD"),"Android",if(match(cs_user_agent,"HP%20Pro%20Slate"),"Android",if(match(cs_user_agent,"VOG-L09"),"Android",if(match(cs_user_agent,"YAL-L21"),"Android",if(match(cs_user_agent,"ATU-L22"),"Android",if(match(cs_user_agent,"MAR-LX1A"),"Android",if(match(cs_user_agent,"RNE-L22"),"Android",if(match(cs_user_agent,"INE-LX2"),"Android",if(match(cs_user_agent,"AMN-LX2"),"Android",if(match(cs_user_agent,"LYO-LO2"),"Android",if(match(cs_user_agent,"DRA-LX9"),"Android",if(match(cs_user_agent,"LYA-L29"),"Android",if(match(cs_user_agent,"ANE-LX2J"),"Android",if(match(cs_user_agent,"STK-L22"),"Android",if(match(cs_user_agent,"EML-AL00"),"Android",if(match(cs_user_agent,"BLA-L29"),"Android",if(match(cs_user_agent,"X11"),"Linux",if(match(cs_user_agent,"LDN-LX2"),"Android",if(match(cs_user_agent,"TB3-"),"Android",if(match(cs_user_agent,"5033T"),"Android",if(match(cs_user_agent,"5028D"),"Android",if(match(cs_user_agent,"5002X"),"Android",if(match(cs_user_agent,"COR-"),"Android",if(match(cs_user_agent,"MI%20MAX"),"Android",if(match(cs_user_agent,"WAS-LX2"),"Android",if(match(cs_user_agent,"vivo"),"Android",if(match(cs_user_agent,"EML-L29"),"Android",if(match(cs_user_agent,"Moto"),"Android",if(match(cs_user_agent,"MMB"),"Android",if(match(cs_user_agent,"Redmi%20Note%208"),"Android",if(match(cs_user_agent,"M2003J15SC"),"Android",if(match(cs_user_agent,"MI%20MAX"),"Android",if(match(cs_user_agent,"Nexus"),"Android",if(match(cs_user_agent,"ELE-L29"),"Android",if(match(cs_user_agent,"Redmi%20Note%204"),"Android",if(match(cs_user_agent,"rv:89.0"),"Android",if(match(cs_user_agent,"VKY-L09"),"Android",if(match(cs_user_agent,"SmartN11"),"Android",if(match(cs_user_agent,"A330"),"Android",if(match(cs_user_agent,"LM-"),"Android",if(match(cs_user_agent,"G8341"),"Android",if(match(cs_user_agent,"INE-AL00"),"Android",if(match(cs_user_agent,"Mi"),"Android",if(match(cs_user_agent,"CLT"),"Android",if(match(cs_user_agent,"Android"),"Android",if(match(cs_user_agent,"BV9700Pro"),"Android",if(match(cs_user_agent,"5024I"),"Android",if(match(cs_user_agent,"MEIZU"),"Android",if(match(cs_user_agent,"Linux%20X86_64"),"Linux","OTHER"))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) Case - val Brand= case(match(cs_user_agent, "CPH"),"Oppo",match(cs_user_agent, "SM-"),"Samsung",match(cs_user_agent, "VFD"),"Vodafone",match(cs_user_agent, "VFD"),"Vodafone",match(cs_user_agent, "VOG"),"Huawei",match(cs_user_agent, "ELE"),"Huawei",match(cs_user_agent, "CLT"),"Huawei",match(cs_user_agent, "EML"),"Huawei",match(cs_user_agent, "LYA"),"Huawei",match(cs_user_agent, "EVR"),"Huawei",match(cs_user_agent, "BLA"),"Huawei",match(cs_user_agent, "DRA"),"Huawei",match(cs_user_agent, "LDN"),"Huawei",match(cs_user_agent, "YAL-L21"),"Huawei",match(cs_user_agent, "ATU-L22"),"Huawei",match(cs_user_agent, "MAR-LX1A"),"Huawei",match(cs_user_agent, "X11"),"Linux",match(cs_user_agent, "INE-LX2"),"Huawei",match(cs_user_agent, "AMN-"),"Huawei",match(cs_user_agent, "RNE-L22"),"Honor",match(cs_user_agent, "LYO"),"Huawei",match(cs_user_agent, "ANE"),"Huawei",match(cs_user_agent, "STK"),"Huawei",match(cs_user_agent, "BLA"),"Huawei",match(cs_user_agent, "TB3-"),"Lenovo",match(cs_user_agent, "5033T"),"Alcatel",match(cs_user_agent, "5028D"),"Alcatel",match(cs_user_agent, "5002X"),"Alcatel",match(cs_user_agent, "iPhone"),"iPhone",match(cs_user_agent, "20Win64"),"Desktop",1=1,"other") Can any one help me on how do i use lookup? or automatic lookup so it fills a "human-readable" type into a separate field. Thanks
09-29-2021
04:31 PM
Hi, I tried to search for this online and I am probably not typing my search correctly :-), and am hoping one of you Splunk experts could possibly help me or point me in the right direction. I have...
See more...
Hi, I tried to search for this online and I am probably not typing my search correctly :-), and am hoping one of you Splunk experts could possibly help me or point me in the right direction. I have a full Splunk heavy forwarder that is monitoring some network folders (and sending them to some indexes using the outputs.conf configuration). This server is going to be retired, and I am moving this to a new Splunk server installation. My question is, where does Splunk store the information about the last file it has read ? I am looking to recreate the Directory Monitor input ont he new server, however, I am assuming that on the new server, it would start reading the folder from scratch again. I am hoping to stop the old serve's input and start the new server but have the new server read from where the old server left off. Any help would be appreciated. Thanks so much! Oh also this is on Microsoft Windows.
Labels
- Labels:
-
configuration
-
installation
09-29-2021
04:22 PM
Our problem and question are that the machine agent is installed and IIS there is a consumption of them.
It is supposedly a license for all the monitoring, we have a premium license because it re...
See more...
Our problem and question are that the machine agent is installed and IIS there is a consumption of them.
It is supposedly a license for all the monitoring, we have a premium license because it reports consumption of them and they are almost finished.
Labels
- Labels:
-
Accounts and Admin
09-29-2021
03:34 PM
Hi Splunkers, We have installed Nimbus add-on for sending splunk alert to CAUIM portal. Before upgrade to 8.1 it was working fine but after upgrade of splunk version the splunk is not able to se...
See more...
Hi Splunkers, We have installed Nimbus add-on for sending splunk alert to CAUIM portal. Before upgrade to 8.1 it was working fine but after upgrade of splunk version the splunk is not able to send alert to CAUIM. We are seeing below errors when checked into logs. As per below error I suspect this error is relating with python version and we have python 3.7 which is needed for splunk version 8.1. Kindly assist to understand what is actually going on. Error : 09-30-2021 00:22:14.930 +0200 ERROR sendmodalert [56934 AlertNotifierWorker-0] - action=nibus_alerting STDERR - File "/opt/splunk/etc/apps/nimbus-alerting/bin/nimbus_alerting/alert_actions_base.py", line 188, in prepare_meta_for_cam 09-30-2021 00:22:14.930 +0200 ERROR sendmodalert [56934 AlertNotifierWorker-0] - action=nibus_alerting STDERR - File "/opt/splunk/etc/apps/nimbus-alerting/bin/nibus_alerting.py", line 56, in <module>
Labels
- Labels:
-
upgrade
09-29-2021
01:47 PM
Hi All, I am looking to create an alert based on the following base search. index=wineventlog w19tax.exe app_name=W19TAX . I am specifically looking for the alert to only trigger when the same SID c...
See more...
Hi All, I am looking to create an alert based on the following base search. index=wineventlog w19tax.exe app_name=W19TAX . I am specifically looking for the alert to only trigger when the same SID comes up multiple time for the same application. example event: 09/29/2021 04:21:08 PM LogName=Microsoft-Windows-AppLocker/EXE and DLL SourceName=Microsoft-Windows-AppLocker EventCode=8002 EventType=4 Type=Information ComputerName=BPOLCP01S12.rightnetworks.com User=NOT_TRANSLATED Sid=S-1-5-21-2605281412-2030159296-1019850961-762275 SidType=0 TaskCategory=None OpCode=Info RecordNumber=39961045 Keywords=None Message=D:\PROGRAM FILES\LACERTE\19TAX\W19TAX.EXE was allowed to run.
Labels
- Labels:
-
count
09-29-2021
12:47 PM
So I have a search that triggers based upon how much memory is being used on any of my linux machines. index=nix sourcetype=freemem host=`<mySystemHosts>`
| eval pctUsed=(totMemory-cacheMemo...
See more...
So I have a search that triggers based upon how much memory is being used on any of my linux machines. index=nix sourcetype=freemem host=`<mySystemHosts>`
| eval pctUsed=(totMemory-cacheMemory)/totMemory * 100
| where pctUsed > 85
| table _time host pctUsed That alert triggers fine, but I would like to add some details from my 'ps' data set about each individual job that is running on said host. so let's assume that the above alert triggers, and generates a table of 3 hosts. I would like to add 'ps' contextual details to each of those devices within the alert itself.
09-29-2021
12:00 PM
Attackers might be trying to steal your information from www. staging.splunk.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_DATE_INVALID I am trying on Google Chrome ...
See more...
Attackers might be trying to steal your information from www. staging.splunk.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_DATE_INVALID I am trying on Google Chrome in my personal as well as company laptop. When I click to access my 14 days free trial for splunk cloud page throwing this error. Thank you in advance for your time.
Labels
- Labels:
-
encryption
09-29-2021
11:46 AM
Need direction, information on any ways like Apps , TAs to work & pull logs from Cloud.gov. Am new at cloud.gov stuff. I appreciate any help. We have Splunk Ent. + ES in our environment.
Labels
- Labels:
-
using Splunk Enterprise
09-29-2021
11:32 AM
Hi, I have setup the forwarder, however I get the following when I try to run commands: What am I missing and what would the commands be to add them into Raspberry PI os (32bit) newest version?...
See more...
Hi, I have setup the forwarder, however I get the following when I try to run commands: What am I missing and what would the commands be to add them into Raspberry PI os (32bit) newest version? I used the ARM version listed as the newest version Or should I find other linux versions?
Labels
- Labels:
-
inputs.conf
-
Linux
-
universal forwarder
09-29-2021
11:21 AM
| rex field=_raw "(?<dscvIP>[^\.]\d+\.\d+\.\d+\.\d+[\s|\:])" Using the above rex command to try to capture IP addresses, an it works most of the time, but I still get a few false positives for ESX l...
See more...
| rex field=_raw "(?<dscvIP>[^\.]\d+\.\d+\.\d+\.\d+[\s|\:])" Using the above rex command to try to capture IP addresses, an it works most of the time, but I still get a few false positives for ESX log entries that contain the following Rcv-tx-10.20.30.45.78.80 The rex field captures 30.45.78.80 as the dscvIP field. I thought by adding the [^\.] to the beginning of the regex match it would not capture an string matching the IP syntax that had a period(.) immediately preceding the string. And I also thought this string would be skipped all together because for it to not start with a period(.) , the match would have to go to the dash(-) following tx, but then would not match because there is not a space or colon after the 4th \d+ match. What am
09-29-2021
11:18 AM
Hey guys, I need some quick help creating a nested stats table and grouping by multiple values within that table. My data contains the following data points that I am trying to correlate / visual...
See more...
Hey guys, I need some quick help creating a nested stats table and grouping by multiple values within that table. My data contains the following data points that I am trying to correlate / visualize: Client IP Address, Unique Hash ID, Unique Document ID, and the count that shows the number of times an IP Address accessed a Unique Hash ID, and Doc ID. An example data set is: 192.168.1.1 (client IP), abcdefg1 (hash 1), 12948(DocID1), 129584(DocID2), 1029384(DocID3) 192.168.1.1(Client IP), abcdefg2 (hash 2), 10294 (DocID 1), 192.168.1.5(Client IP), abcdefg1 (hash1), 12948(DocID1), 1029484(DocID2) I'm looking to create the following table to help visualize these relationships | Client IP Unique Hash Document ID Count 192.168.1.1 abcdefg1 12948 5 129584 10 1029384 15 abcdefg2 12948 2 1029484 3 192.168.1.5 abcdefg1 12948 1 1029484 4 I've created nested tables before but I'm really stumping myself on this one. Any advice?
Labels
- Labels:
-
field extraction
-
regex
-
stats
-
table
09-29-2021
11:00 AM
Hi good morning. I am working on concentrating security events in Splunk Cloud and I would like to add a dashboard related to the threats that exist in the security environment, such as issues with...
See more...
Hi good morning. I am working on concentrating security events in Splunk Cloud and I would like to add a dashboard related to the threats that exist in the security environment, such as issues with redhat, oracle, payments tech companies, etc. I would like to know if you know of any way to make connections with sources like SANS, CVE Detail or even with Twitter accounts. Hope you can help me. Thanks!
Labels
- Labels:
-
Splunk Investigate
09-29-2021
10:10 AM
Hello, I use the following grid structure to define source and destination filters in one of my dashboards. I would like to add a button to each panel to reset the content of the input text box, how...
See more...
Hello, I use the following grid structure to define source and destination filters in one of my dashboards. I would like to add a button to each panel to reset the content of the input text box, however I am struggling to create the CSS code to align the link list input correctly. I would like to move them to the top-right corner of the wide input panels (the position is highlighted with a red box on the screenshot). Could someone please help me write the correct CSS code which would align the button correctly? I have added a run anywhere dashboard with the CSS scripts included. <form theme="dark">
<label>Dashboard CSS Alignment Example</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel id="inputFilterFirstColumnRow1">
<title>Filters</title>
<html/>
</panel>
<panel id="inputFilterSecondColumnRow1">
<input type="link" token="tokClearSrcFilter" searchWhenChanged="true" id="button_clear_src_filter">
<label></label>
<choice value="clear_src_filter">X</choice>
<change>
<condition value="clear_src_filter">
<unset token="tokClearSrcFilter"></unset>
<unset token="form.tokClearSrcFilter"></unset>
<set token="tokSrcFilter">*</set>
<set token="form.tokSrcFilter">*</set>
</condition>
</change>
</input>
<input type="text" token="tokSrcFilter" searchWhenChanged="true" id="wideInputBox_SourceFilter">
<label>Source Filter</label>
<default>*</default>
</input>
</panel>
<panel id="inputFilterThirdColumnRow1">
<input type="link" token="tokClearDestFilter" searchWhenChanged="true" id="button_clear_dest_filter">
<label></label>
<choice value="clear_dest_filter">X</choice>
<change>
<condition value="clear_dest_filter">
<unset token="tokClearDestFilter"></unset>
<unset token="form.tokClearDestFilter"></unset>
<set token="tokDestFilter">*</set>
<set token="form.tokDestFilter">*</set>
</condition>
</change>
</input>
<input type="text" token="tokDestFilter" searchWhenChanged="true" id="wideInputBox_DestinationFilter">
<label>Destination Filter</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
</panel>
</row>
<row depends="$alwaysHideCSSStyleOverride$">
<panel>
<html>
<style>
/* Wide text input box style. Use id="wideInputBox_unique_id" in the input header */
div[id^="wideInputBox"] .splunk-textinput {
min-width: 20vw !important;
width: 40vw !important;
max-width: 40vw !important;
color: yellow;
}
div[id^="wideInputBox"] .splunk-textinput input[type="text"] {
min-width: 20vw !important;
width: 40vw !important;
max-width: 40vw !important;
color: yellow;
}
</style>
<style>
/* This section sets the width of the three columns of secondary filter panels - 10% - 45% - 45% */
div[id^="inputFilterFirstColumn"]{
width:10% !important;
}
div[id^="inputFilterSecondColumn"]{
width:45% !important;
}
div[id^="inputFilterThirdColumn"]{
width:45% !important;
}
</style>
<style>
/* Clear Button positioned to the right side of the panel */
div[id^="button_clear"]{
width:20px !important;
float: right;
}
div[id^="button_clear"] button[data-test="option"]{
flex-grow: 0;
border-radius: 2px;
border-width: thin;
border-color: lightgrey;
border-style: inset;
width: 20px;
padding: 2px 2px;
}
div[id^="button_clear"] label{
display:none;
}
div[id^="button_clear"] span[data-test="label"]:hover{
}
div[id^="panel"].fieldset{
padding: 0px;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>
| makeresults
| eval src=$tokSrcFilter|s$, dest = $tokDestFilter|s$
| table src, dest
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form> Regards
Labels
- Labels:
-
CSS
09-29-2021
09:40 AM
I'm trying to figure out the Search function to be able to look for a client. It doesn't return any logs that when i put in two strings/words My examples that don't return anything in the search fun...
See more...
I'm trying to figure out the Search function to be able to look for a client. It doesn't return any logs that when i put in two strings/words My examples that don't return anything in the search function are as follows. BigTechU and ERROR BigTechU|ERROR BigTechU; ERROR also i don't know how to look for parts of dates in my query. I'm just trying to build a POC to use SPLUNK fully for our support system but i'm new and struggling. any help would be wonderful. regards, JG
Labels
- Labels:
-
search
09-29-2021
09:39 AM
Hi Team, How to hide cloumns in the table the basis of multiselect choices? For example, I have options in multiselect , Critical, high,medium and Low. When i select high and low from multiselect, c...
See more...
Hi Team, How to hide cloumns in the table the basis of multiselect choices? For example, I have options in multiselect , Critical, high,medium and Low. When i select high and low from multiselect, critical and low column should be hide from table.Only I need to show High and low column and there respective total in table. Please give me solution on this.Thank you
09-29-2021
09:32 AM
hello I use a one hour span in my timechart but I dont understand why a two hour span is displayed on the timechart abscissa instead one hour? | timechart span=1h max(debut) as "Début de session", ...
See more...
hello I use a one hour span in my timechart but I dont understand why a two hour span is displayed on the timechart abscissa instead one hour? | timechart span=1h max(debut) as "Début de session", max(fin) as "Fin de session" thanks
- Tags:
- other
09-29-2021
09:25 AM
Hello, I need a help with a search that seems very easy, but I'm unable to achieve the results I want. The events are recieved in diferrent days, but no more than 3 days and the date is in the fiel...
See more...
Hello, I need a help with a search that seems very easy, but I'm unable to achieve the results I want. The events are recieved in diferrent days, but no more than 3 days and the date is in the field event.Date. The date format is "yyyy-mm-ddT00:00:00". What I need is to search for all the events within the 3 days and then filter by the date. So i've tried the following search: index=something daysago=3
| eval dayOfSearch = strftime(relative(now(), "-2d@d"), "%Y-%m-%dT%H:%M:%S")
| search event.Date = dayOfSearch It does not result to what I was expecting, but if I run the search replacing the variable dayOfsearch with the actual date, like "2021-09-05T00:00:00" it works. What am I doing wrong or is that I better way to achieve this results? Thank you!
Labels
- Labels:
-
eval
-
search job inspector
