All Topics

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Topics

Hello Splunkers, I've a event with hexadecimal data which I extracted as a field named X and I need to convert this X into text value which will be in human readable format i.e decoding hexadecima... See more...
Hello Splunkers, I've a event with hexadecimal data which I extracted as a field named X and I need to convert this X into text value which will be in human readable format i.e decoding hexadecimal value to text via splunk query.. Is there any way to do so via splunk search commands? Thanks in Advance! Sarah
So this is a prerequisite-free kind of question about a field disappearing from "All Fields" section. By prerequisite-free I mean that search time frame, number of events found, search string and sea... See more...
So this is a prerequisite-free kind of question about a field disappearing from "All Fields" section. By prerequisite-free I mean that search time frame, number of events found, search string and search mode are stable/same and all events have a single sourcetype. Say I have a field called "info.event_type" that has coverage of 100% (all of the conditions from the first paragraph stay the same throughout all steps). This is what is happening: 1. I do a search and see the field in "All Fields" and "Interesting Fields". I can select it or it can already be selected by me previously, this does not matter (it seems). 2. I repeat the exact same search by clicking the search button and the field disappears from everywhere - selected, interesting and all fields, it's not searchable in the filter box of all fields window. 3. I repeat the search again, maybe a couple of times in a row, field does not appear. 4. On one of the retries it appears and is present everywhere, as before. 5. Next search request makes it disappear again and the circle continues... What could be the reason for this behavior? Do you know where I can look in order to check for inconsistencies in configuration, etc? Thanks!
Hi, We need to set up AppDynamics MRUM for native android webview. So my question is do we need to setup browser RUM as well or what approach & setup is required to get the business transaction ... See more...
Hi, We need to set up AppDynamics MRUM for native android webview. So my question is do we need to setup browser RUM as well or what approach & setup is required to get the business transaction for a particular session.  And the second thing is when using the below snippet for automatic upload, I'm getting a build error: Bad Credentials, please verify the account and licenseKey in your build.gradle file. proguardMappingFileUpload { failBuildOnUploadFailure true //should build fail if upload fails? Defaults to false. enabled true //enables automatic uploads. Defaults to true. } Looking forward to your advice. Thanks
I have the Microsoft 365 App for Splunk installed and most of our panels have data. The only one that does not is the "Mailbox Migration" panel under Exchange Overview. Seems the panel is looking f... See more...
I have the Microsoft 365 App for Splunk installed and most of our panels have data. The only one that does not is the "Mailbox Migration" panel under Exchange Overview. Seems the panel is looking for "Operation="Remove-MigrationBatch" which I do not have. What am I missing?
I have a custom command that returns results in tabular format with a _time column as well. Its something like below | dyntapplications dynt_server=psg-dynatrace-qa.abc.com | search name=* | ma... See more...
I have a custom command that returns results in tabular format with a _time column as well. Its something like below | dyntapplications dynt_server=psg-dynatrace-qa.abc.com | search name=* | map search="| dyntmetricdata dynt_server=psg-dynatrace-qa.abc.com application=$name$ metric_path=\"Application Infrastructure Performance|*|Agent|Agent Channels|App Config Poll\" earliest=-1d@d latest=@d " time application dynt_server count current frequency sum 4/28/2020 0:00 PBM-Analytics-UAT psg-dynatrace-qa.abc.com 20 11 TEN_MIN 7 . . 4/28/2020 23:00 PBM-Analytics-UAT psg-dynatrace-qa.abc.com 20 11 TEN_MIN 78 4/28/2020 0:10 APM-Analytics psg-dynatrace-qa.abc.com 23 14 TEN_MIN 77 . . . 4/28/2020 23:10 APM-Analytics psg-dynatrace-qa.abc.com 26 19 TEN_MIN 73 I need to calculate the total of sum column and compare it with the total of today's I get the total for yesterdays using this command | dyntapplications dynt_server=psg-dynatrace-qa.abc.com | search name=* | map search="|dyntmetricdata dynt_server=psg-dynatrace-qa.abc.com application=$name$ metric_path=\"Application Infrastructure Performance|*|Agent|Agent Channels|App Config Poll\" earliest=-1d@d latest=@d " | addcoltotals sum | tail 1 But I dont know how to compare with todays. Can someone please help I did try this https://www.splunk.com/en_us/blog/tips-and-tricks/compare-two-time-ranges-in-one-report.html but it doesnt work for me since my data is from a custom command I guess
I need to change the default output separator of ouputcsv or outputlookup, is there any way to change it? For example: Date,Time -> Default delimiter in outputcsv Date;Time -> Expected delim... See more...
I need to change the default output separator of ouputcsv or outputlookup, is there any way to change it? For example: Date,Time -> Default delimiter in outputcsv Date;Time -> Expected delimiter in outputcsv
Hi Experts, I am creating an addon in my local splunk using Splunk Add on builder with REST API option. I have created an input with some fields including one in which i want user to select multip... See more...
Hi Experts, I am creating an addon in my local splunk using Splunk Add on builder with REST API option. I have created an input with some fields including one in which i want user to select multiple options out of the range of options i will be configuring in the addon. So i am trying to use multiple dropdown option available in addon builder but using that is not fetching the correct response. While with single dropdown option i am able to get the proper response. Is there any different method to pass the parameter value when using multiple dropdown option in add on builder app in splunk apart from ${param_name}. Your help would be greatly appreciated. Thanks in Advance !
Hi at all, for one of my customers, i have to use MS Explorer 11 as a browser. It seems to work correctly in the dashboards with the only exception of Lookup Editor App: I can list the looku... See more...
Hi at all, for one of my customers, i have to use MS Explorer 11 as a browser. It seems to work correctly in the dashboards with the only exception of Lookup Editor App: I can list the lookups to open but I cannot open one of them; I tried with and without Compatibility Mode (yes I know that in Compatibility Mode IE11 isn't supported!). I found that from version 2.0.1 was solved the issue with IE11. Is there a way or a workaround to open lookups using Lookup Editor App using IE11? Ciao and thanks. Giuseppe
Hi, My scenario is that I have Counts of Total Requests, Success, Failure & Failure% for time span of every 30 mins over last 2 hours Let's say first 30mins I got 100 hits and failure% is more th... See more...
Hi, My scenario is that I have Counts of Total Requests, Success, Failure & Failure% for time span of every 30 mins over last 2 hours Let's say first 30mins I got 100 hits and failure% is more than 60% then I want to send an alert immediately but let's say if first 30mins failure% is between 30-50% then I want to see the failure% of previous 30mins and if the failure% of this 30mins is also b/w 30-50% then I want to see one more previous 30mins failure% and if that interval also has same failure% then I want to trigger alert but if the 2nd or 3rd 30min interval has less then 30% failure then I do not want to send alert I want this alert to be running for every 15 mins. How can I do this in splunk? I have written below query to get the events for last 2 hours but could not move ahead on the next steps. index=dte_fios sourcetype=dte2_Fios FT=*FT | eval Interval=strftime('_time',"%d-%m-%Y %H:%M:%S") | eval Status=case(Error_Code=="0000","Success",1=1,"Failure") | timechart span=30m count by Status | eval Total = Success + Failure | eval Failure%=round(Failure/Total*100) | table _time,Total,Success,Failure,Failure% Output is below: _time Total Success Failure Failure% 2020-04-20 05:00:00 75 61 14 19 2020-04-20 05:30:00 207 129 78 38 2020-04-20 06:00:00 25 10 15 60
Hi I have the below post process search but little confused on the base search.Kindly help. Post process search: Search id="base" Query - index = |regex for field1 | regex for field2| regex f... See more...
Hi I have the below post process search but little confused on the base search.Kindly help. Post process search: Search id="base" Query - index = |regex for field1 | regex for field2| regex for field3 | chart count over field1 by field4(already extracted one) Now i would like to perform a cell drilldown and on clicking a value field1 i want the below 3 panels to be dispayed Panel 2 : where field1 =$field1$ | stats count by field4 Panel 3 : where field1 =$field1$ | table _time _ raw Panel 4 :where field1 =$field1$ | stats count by field3 How can i achieve this. Timechart to stats & To raw logs
I am trying to create a souretype "meraki" on the GUI. But it is saying "Sourcetype meraki already exists" sourcetype meraki does not exist in the list of sourcetypes. What could be the probl... See more...
I am trying to create a souretype "meraki" on the GUI. But it is saying "Sourcetype meraki already exists" sourcetype meraki does not exist in the list of sourcetypes. What could be the problem. Why it is not allowing me to create sourcetype. Earlier I created an index with name "meraki".
HI, how to properly (completly) remove Splunk addon and install it again ? My deployment script redeploying all Splunk addons/apps using this command: $HOME_SPLUNK/bin/splunk remove app ap... See more...
HI, how to properly (completly) remove Splunk addon and install it again ? My deployment script redeploying all Splunk addons/apps using this command: $HOME_SPLUNK/bin/splunk remove app app_name $HOME_SPLUNK/bin/splunk install app app_name What is strange, You will be able to redeploy applications this way, till You will create some dashboard in app or You will modify something in Your app/addon. Afterwards, when You will reinstall Your app with this two commands - You will not have an access to it anymore. I have tested it with Cisco ESA addon. Everything is working fine till I will start using that app. Afterwards, when app is configured and my script will remove and install app again - I see error 404. I suspect that application generating some searches which are not properly removed by "./splunk remove app" command. This problem appear for example in addon: Splunk-App-CISCO-ESA. Maybe some one will be able to help me and show me the way how to properly deploy/redeploy apps in searchhead using command line. How to avoid 404 errors afterwards ? Thanks in advance for Your support. Dlugi
Hi to all, i get a strange errorr using python SDK when connecting to balanced url instead of single host. HOST = "splunk.balanced.url" PORT = 8089 USERNAME = "admin" PASSWORD = "changeme" SCHEME ... See more...
Hi to all, i get a strange errorr using python SDK when connecting to balanced url instead of single host. HOST = "splunk.balanced.url" PORT = 8089 USERNAME = "admin" PASSWORD = "changeme" SCHEME = "https" APP = "my_app" # Create a Service instance and log in to Splunk service = client.connect( host=HOST, port=PORT, username=USERNAME, password=PASSWORD, scheme=SCHEME, app=APP ) for app in service.apps: print app.name But i got this error: Traceback (most recent call last): File "test_connection.py", line 32, in <module> verify=False File "/opt/splunk/etc/apps/framework/contrib/splunk-sdk-python/splunklib/client.py", line 288, in connect return Service(**kwargs).login() File "/opt/splunk/etc/apps/framework/contrib/splunk-sdk-python/splunklib/binding.py", line 753, in login session = XML(body).findtext("./sessionKey") File "/usr/lib64/python2.6/xml/etree/ElementTree.py", line 964, in XML return parser.close() File "/usr/lib64/python2.6/xml/etree/ElementTree.py", line 1254, in close self._parser.Parse("", 1) # end of data xml.parsers.expat.ExpatError: no element found: line 1, column 0 If i connect directly to the splunk host search head i got correct result: all app name. Bhind the balanced url there is only one host at the moment (the same host from which i get correct result). Someone got a similar problem? Could be a certificate issue? It seems that the XML returned is not correct. Thanks very much and regards
https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html same as above post, would like to have a pie chart with its count, so followed the post and its wo... See more...
https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html same as above post, would like to have a pie chart with its count, so followed the post and its work, it can show the Count in Pie Chart ... | stats Count by Severity | eval SeverityCount=Severity." : ".Count | fields SeverityCount, Count Beside, we still have a token to Pass the Severity Critical/High/Medium to chart 2 for drilldown base on what we click unfortunately, it's now passing Critical : 25 instead of passing Critical to chart 2 when we click on it, which cause the chart 2 not working. <drilldown> <set token="Severity">$click.value$</set> </drilldown> would like to seek any way can fulfill both requirements ( Show Count in Pie Chart + Pass the correct Value to Chart 2 ) ?
hi All, After setting up the incoming webhooks in the slack and provided the webhook url in the Slack setup configuration in splunk. Post these steps have tested from the search Manually and it do... See more...
hi All, After setting up the incoming webhooks in the slack and provided the webhook url in the Slack setup configuration in splunk. Post these steps have tested from the search Manually and it does works. | sendalert slack param.channel="#soc_alert" param.message="Lorem ipsum" But its not sending the Notification to the slack channel for the Triggered Alert actions. Can someone help me here what might have went wrong. from the log events i don't find any useful info. 04-29-2020 10:12:08.984 +0200 INFO sendmodalert - Invoking modular alert action=slack for search="Threat - Test to sand alert to Slack - Rule Clone" sid="scheduler_devo01SplunkEnterpriseSecuritySuite_RMD5ea696853f5a89cc2_at_1588147800_75240" in app="SplunkEnterpriseSecuritySuite" owner="devo01" type="saved" Thanks, Devon
Hello, I wanted to ask if anyone knows when newer versions of F5 BIG-IP (v14.1 for example) will be supported by the Splunk Add-on for F5 BIG-IP. Currently, ASM Logging and iControl API Logging... See more...
Hello, I wanted to ask if anyone knows when newer versions of F5 BIG-IP (v14.1 for example) will be supported by the Splunk Add-on for F5 BIG-IP. Currently, ASM Logging and iControl API Logging only support versions 12.0 and below. Thanks in advance!
Hi, I am using Splunk Enterprise 8.0.3 and Log4j 2.13.0. My java application can push log messages to splunk but I am failing to see application name in splunk. I am using the following configurati... See more...
Hi, I am using Splunk Enterprise 8.0.3 and Log4j 2.13.0. My java application can push log messages to splunk but I am failing to see application name in splunk. I am using the following configuration. As multiple java applications will be sending log messages so I want admin to find easily which application has sent which message on splunk. Is there a workaround? I am using the following log4j setting. As you can see I am setting appName here but don't see this in splunk.
Dear All, I faced the following issue. I was using AWS add-on (5.0.0) to collect Generic S3 input from AWS but as soon as I start the collection the python script consume all memory and CPU of the... See more...
Dear All, I faced the following issue. I was using AWS add-on (5.0.0) to collect Generic S3 input from AWS but as soon as I start the collection the python script consume all memory and CPU of the host. More interesting thing is that if I use the older version(4.6.1) the issue does not come up. Thank you, Eduardo
Hi, I have dropdown, where are 30 values. This count can be dynamically changed depends on the search. I want to show some panels, rows, objects in the dashboard ony by choosing 1 value from the d... See more...
Hi, I have dropdown, where are 30 values. This count can be dynamically changed depends on the search. I want to show some panels, rows, objects in the dashboard ony by choosing 1 value from the dropdown. Otherwise I want to hide these objects. I can do it. I know, if I write hard in xml set and unset condition for all of the values from the dropdown. But, ist there any possibility to do it dynamicaly? E.G. with some OTHERWISE condition for unset the token? I also tried this method. Everytime at change in the dropdown, unset at first the token. <change> <condition> <unset token="show_token"></unset> </condition> <condition label="show"> <set token="show_token">true</set> </condition> </change> but it didn't work. By default should be the token show_token set to true. Can you help me, please?
We are getting an alert that "Maximum Custom Metric Limit is reached" for Databases. What does it means? Did we ignore this alert?