All Topics

Cardonymous · ‎07-28-2021

Hello, I added some Javascript functionality to my multi selections (see: https://www.advisori.de/splunk-struggles-with-multiselects-and-how-to-rule-them-all-or-at-least-some/). The script works...

Hello, I added some Javascript functionality to my multi selections (see: https://www.advisori.de/splunk-struggles-with-multiselects-and-how-to-rule-them-all-or-at-least-some/). The script works totally fine and works for my dashboard, until I edit the XML. If I click edit, change some code and click either save or discard, the multi selections behave as if the script would not exist. That means the automatic option removal is not working at all anymore. Clearing the cache locally in my browser or using the _bump endpoint solves the problem and makes the dashboard and the script work fine again - just until the XML is edited again. Is there a better (permanent) solution except for clearing the cache after each edit? Thanks in advance!

Vishal2 · ‎07-28-2021

By using below Query it's working for to find out the only one windows server but can you please post by using lookup containing all the hosts to Monitor. index=<your_index> source=WinEventLog* ...

By using below Query it's working for to find out the only one windows server but can you please post by using lookup containing all the hosts to Monitor. index=<your_index> source=WinEventLog* EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 | stats count by host | where count > 1

Vishal2 · ‎07-28-2021

Hi Team , I would like to monitor the Linux machines up time and down time/ a alert needs to triggered when a server rebooted or shutdown in Splunk please suggest which solution is best

moonie · ‎07-28-2021

Hello, I have a search where I need to combine two inputlookups to find incommon values in a field they both have. The inputlookups are quite big so my current search with JOIN or Search NOT are n...

Hello, I have a search where I need to combine two inputlookups to find incommon values in a field they both have. The inputlookups are quite big so my current search with JOIN or Search NOT are not working most of the time since they result in a timeout. Is there a better way to find incommon values, without join or search not? My current search with join looks like this: | inputlookup table1 | join type=left "ip" [| inputlookup table2 | mvexpand ip | eval xy="xy" | table ip xy] | where isnull(xy) | table ip I've tried another search with NOT but it's working even worse: | inputlookup table1 | search NOT ([| inputlookup table2 | return 10000 ip]) As I said, both searches result in a timeout. I've been stuck with this problem for hours, so any help would be highly appreciated!

JM19 · ‎07-28-2021

Hi all, we have just installed Wazuh app on Splunk. We see booth wazuh and splunk active but the forwarder only sends datas when restarted and after few seconds stops to send them. Does anyone ...

Hi all, we have just installed Wazuh app on Splunk. We see booth wazuh and splunk active but the forwarder only sends datas when restarted and after few seconds stops to send them. Does anyone knows how to solve this issue? Ty in advance, J

ebs · ‎07-27-2021

Whenever I've created eval fields before in a data model they're just a single command. Is it possible to do a multiline eval command for a field? This is what I want to make into a single field: | ...

Whenever I've created eval fields before in a data model they're just a single command. Is it possible to do a multiline eval command for a field? This is what I want to make into a single field: | eval AEST_time=_time+36000 | convert timeformat="%Y-%m-%dT%H:%M:%S.%3Q %Z" ctime(AEST_time) | eval epoch=strptime(AEST_time, "%Y-%m-%dT%H:%M:%S.%3Q %Z") | eval date=strftime(epoch, "%Y-%m-%d")

bongo · ‎07-27-2021

Hi. I need to extract container timeline events via the REST API in order to generate analyst, playbook and action timeline reports. The closest endpoint I can find is briefly mentioned in the REST...

Hi. I need to extract container timeline events via the REST API in order to generate analyst, playbook and action timeline reports. The closest endpoint I can find is briefly mentioned in the REST API documentation: /rest/container/<container id>/actions I can't find any other mention of this endpoint in the documentation. This endpoint is useful however it only provides action history, not analyst or playbook activity history. The Phantom web portal calls an undocumented API which returns exactly what I need: /rest/container/<container ID>/timeline?<many required query parameters> ...however it requires many query parameters. If you don't get the query parameters correct it returns empty results. My questions: 1. Can someone refer me to documentation for the container timeline API endpoint mentioned above? 2. If not, is there an alternative "documented" endpoint that will return all container timeline information? Thanks

anirbandasdeb · ‎07-27-2021

We are planning upgrade our clustered deployment from 8.0.5 to 8.2.1 In case we plan to migrate the KVStore engine to WiredTiger, do we have to mandatorily go through the v8.1 step as mentioned in h...

We are planning upgrade our clustered deployment from 8.0.5 to 8.2.1 In case we plan to migrate the KVStore engine to WiredTiger, do we have to mandatorily go through the v8.1 step as mentioned in https://docs.splunk.com/Documentation/Splunk/8.2.1/Admin/MigrateKVstore ? Per my understanding, the steps for this method stands like this Upgrade cluster from 8.0.5 to 8.1.5 Migrate the KV store after an upgrade to Splunk Enterprise 8.1 in a clustered deployment Upgrade cluster from 8.1.5 to 8.2.1 In case we decide not to use WiredTiger for now and complete the upgrade to 8.2.1, can we migrate the KV Store to WiredTiger at a later point of time? To elaborate, will the following work: Upgrade cluster from 8.0.5 to 8.2.1 At a leter time, if WiredTiger is needed, migrate the KV Store as instructed in Migrate the KV store after an upgrade to Splunk Enterprise 8.1 in a clustered deployment We do not use KV Store at all now, apart from whatever internal functions that Splunk Enterprise uses it for (no ITSI or ES as well), but want to plan ahead in case we use it in the future. Thanks in advance!

splunkcol · ‎07-27-2021

Hello, My client requests to ingest G Suite logs, when searching I see several APPs which do not have Splunk support. Question 1: What should I understand when an APP does not have Splunk suppo...

Hello, My client requests to ingest G Suite logs, when searching I see several APPs which do not have Splunk support. Question 1: What should I understand when an APP does not have Splunk support? Question 2: What is the best way to ingest the GSuite logs? https://splunkbase.splunk.com/app/3793/ or https://splunkbase.splunk.com/app/4560/ or https://splunkbase.splunk.com/apps/#/search/G%20Suite/

thaitran2021 · ‎07-27-2021

I'm trying to count of the number of occurrences / frequency /variations of arguments appearing for a bat file. For example, GradeReport.bat has this template: GradeReport.bat "grade criteria" "star...

I'm trying to count of the number of occurrences / frequency /variations of arguments appearing for a bat file. For example, GradeReport.bat has this template: GradeReport.bat "grade criteria" "start date" "end date" course# CSV_format Example: 1) GradeReport.bat "Best grade" "07/20/2021" "07/27/2021" 135629 CSV 2) GradeReport.bat "Average grade" "" "07/27/2021" "" CSV 3) GradeReport.bat "Best grade" "" "" 225386 CSV 4) GradeReport.bat "Student grade" "07/16/2021" "" "" CSV The query would return: First argument count: 4 Second argument count: 2 Third argument count: 2 "Best grade" = 2 "Average grade" = 1 "Student grade" = 1 etc. Thanks for the help.

bedwards · ‎07-27-2021

My audit logs are not being sent to splunk. The inputs.conf file is configured to monitor everything under /var/log. Please see below. Any assistance would be helpful, Thanks. [monitor:///var/log] ...

My audit logs are not being sent to splunk. The inputs.conf file is configured to monitor everything under /var/log. Please see below. Any assistance would be helpful, Thanks. [monitor:///var/log] disabled=false index=linux sourcetype=linux_messages_syslog I also tried to specify the log in the inputs.conf file as seen below. But still no luck. [monitor:///var/log/audit/audit.log] disabled=false index=linux sourcetype=linux_audit

matthewfry57 · ‎07-27-2021

I have gone through the forums looking for an answer to this, but nothing has worked. I am trying to convert a string to a date. I have data in an index that is extracted, with a field named Expira...

I have gone through the forums looking for an answer to this, but nothing has worked. I am trying to convert a string to a date. I have data in an index that is extracted, with a field named Expiration_Date that contains a string that is actually a date/time, such as 5/22/2022 10:10:25 PM. I found that this query works properly: | makeresults | eval x="08/04/16 9:40:41 PM" | eval y=strptime(x, "%m/%d/%y %H:%M:%S") | eval z=strftime(y, "%m/%d/%Y") | table x y z This query outputs the converted time properly in the z field. However, when I try to use this with my data, as such index = ssl_certs | eval x=Expiration_Date | eval y=strptime(x, "%m/%d/%y %H:%M:%S") | eval z=strftime(y, "%m/%d/%Y") | table Expiration_Date, x, y, z The x field is equal to the Expiration_Date field, but y and z fields are empty. Is there something special I am missing here with loading in the values of the Expiration_Date field into the eval statements?

DerrickI54 · ‎07-27-2021

When trying to change the tenant contact information on Phantom in the multi-tenancy section of Product Settings , I am getting this error posted in the screenshot below when I select save. Has anybo...

When trying to change the tenant contact information on Phantom in the multi-tenancy section of Product Settings , I am getting this error posted in the screenshot below when I select save. Has anybody experienced this, and how do I resolve this issue?

thomas_art · ‎07-27-2021

Has anyone had good results when showing Dashboard Studio Dashboard in Splunk Mobile APP? I'm getting the same result as with the Simple XML dashboard. I would like to know if it's possible to show ...

Has anyone had good results when showing Dashboard Studio Dashboard in Splunk Mobile APP? I'm getting the same result as with the Simple XML dashboard. I would like to know if it's possible to show the whole dashboard with the Background image in it. Thanks.

Stefanie · ‎07-27-2021

I have a scripted input created to monitor certificate expiration. An example event: Tue Jul 27 12:07:55 CDT 2021,/opt/splunk/etc/auth/server.pem,notAfter=Nov 29 16:58:08 2023 GMT Splunk ingests t...

I have a scripted input created to monitor certificate expiration. An example event: Tue Jul 27 12:07:55 CDT 2021,/opt/splunk/etc/auth/server.pem,notAfter=Nov 29 16:58:08 2023 GMT Splunk ingests the data using the first timestamp (Tue Jul 27 12:07:55 CDT 2021). Which is not a problem. I am wanting Splunk to recognize the portion after 'notAfter=' as a second date to where I can sort based upon month, day, and year in order to report when a certificate is nearing expiration. I have a regular field extraction to include the expiration date in a table, but sorting it only sorts by the first letter of the month. Is it possible for Splunk to recognize a secondary date/timestamp? Possibly though a regex?

snigam78 · ‎07-27-2021

Hi, using splunkjs we can display a search or saved search(report). is there a way where I can display an existing dashboard in my own webapp? is there anything other than splunkjs that can be use...

Hi, using splunkjs we can display a search or saved search(report). is there a way where I can display an existing dashboard in my own webapp? is there anything other than splunkjs that can be used for this? Thanks

sarves · ‎07-27-2021

Hi All, I am trying to write simple & single query to alert when a process is down and alert again when the same process is up. However, it seems there is no straightforward way. used below query t...

Hi All, I am trying to write simple & single query to alert when a process is down and alert again when the same process is up. However, it seems there is no straightforward way. used below query to get alert when process is down and it is working perfectly. | mstats latest(_value) as RSS_Memory WHERE index=telegraf metric_name=procstat.memory_rss host=<hostname> process_name=<processname> by process_name pid However, I am seeking help in writing single query alert when a process is down and alert again when the same process is up. Please help, struggling from many days on this. -- Thanks Sarves

andymalato · ‎07-27-2021

Hello All, We currently have a single standalone deployment (index and search head on single system). In addition, we have deployed a new index cluster (3 nodes) and single search head. We will be...

Hello All, We currently have a single standalone deployment (index and search head on single system). In addition, we have deployed a new index cluster (3 nodes) and single search head. We will be migrating all of our forwarders to point to the newly deployed cluster. However, we still have data on the single deployment server that has not aged out yet. Does anyone know if it is possible to configure our search head to also search the old standalone Splunk environment ? Thanks.

Vardhan · ‎07-27-2021

Hi, I am trying to build a alert action where I have an drop down with fixed values. But when I am passing the data to internal value . I am getting error like Internal Value can only contain alpha...

Hi, I am trying to build a alert action where I have an drop down with fixed values. But when I am passing the data to internal value . I am getting error like Internal Value can only contain alphanumeric characters and underscores. How to resolve this issue can anyone help? Internal Value: 4-Minor/Localized

ashishmgupta · ‎07-27-2021

Below the excerpt from my HTTP request and I'm trying to get the User-Agent value from it and so far not successful. Will appreciate any help. This Splunk editor is removing the carriage return and ...

Below the excerpt from my HTTP request and I'm trying to get the User-Agent value from it and so far not successful. Will appreciate any help. This Splunk editor is removing the carriage return and line feed characters so below is the regex101 link.https://regex101.com/r/rdu8yE/1 Also attached is the screenshot of the HTTP request.

All Topics

All Topics

Edit XML disables Javascript?

Windows alert..

How to Create alert for Linux server ??

Find incommon values within two Inputlookups without JOIN / Search NOT

Wazuh App not sending data

Can you do a multiline eval command in a datamodel for an eval field?

Get container timeline history via REST

Cluster Upgrade 8.0 > 8.2: KVStore Migration to WiredTiger

Get logs for G Suite

count number of arguments in bat file

Unable to view RHEL Audit Logs in Splunk

Convert String to Date Issue

Splunk Phantom

Has anyone had good results when showing Dashboard Studio Dashboard in Splunk Mobile APP?

How to extract a seconday date/time?

splunkjs dashboard

Single Query to alert when a process is down and alert when it is up on a linux server

integrate standalone server into index cluster for search only

Splunk Addon builder error Internal Value can only contain alphanumeric characters and underscores.

Extract the User-Agent from HTTP request

All Topics

Are you a member of the Splunk Community?

All Topics