All Topics

zpasplunk · ‎01-10-2023

Anyone know what's going on here? It won't let me delete a local user. I can see them in the UI, but cannot manage them. I tried to delete via the CLI and this is what I get: $ sudo /opt/splunk/...

Anyone know what's going on here? It won't let me delete a local user. I can see them in the UI, but cannot manage them. I tried to delete via the CLI and this is what I get: $ sudo /opt/splunk/bin/splunk remove user test1 Attempted to delete a user that does not exist: test1 $ sudo /opt/splunk/bin/splunk list user | grep 'test1' username: test1

zpasplunk · ‎01-10-2023

I have a bunch of indexes, but one in particular I want to keep smaller. How do I do this? From the docs it looks like this could work? Adding maxTotalDataSizeMB to the index config? Anyknow know ...

I have a bunch of indexes, but one in particular I want to keep smaller. How do I do this? From the docs it looks like this could work? Adding maxTotalDataSizeMB to the index config? Anyknow know for sure? /opt/splunk/etc/master-apps/_cluster/local/indexes.conf: [webapp1] maxTotalDataSizeMB = <nonnegative integer> * The maximum size of an index (in MB). * If an index grows larger than the maximum size, the oldest data is frozen. * This parameter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets. * CAUTION: This setting takes precedence over other settings like 'frozenTimePeriodInSecs' with regard.....

saivijayr · ‎01-10-2023

Hi Folks, From last couple of weeks we have observed an issue in our newly developed Splunk app(Radware Bot Risk Scanner ). our app schedules a saved search which runs every hour and extract some d...

Hi Folks, From last couple of weeks we have observed an issue in our newly developed Splunk app(Radware Bot Risk Scanner ). our app schedules a saved search which runs every hour and extract some data from indices and forwards to custom search command which we developed and saves the result in result indices. Flow: Splunk Search -> Custom Search Command (which preforms REST API call for each record) -> save result to new indice. Saved Searches got stuck in Running state. when I try to stop it manually, its going to Finalizing state not done state. Ideal time for this saved search to finish is ~2mins including all Rest API calls, yet you can see often its running from a very long time. please refer attached screenshot for the same Wanted to attach search log as well but can't due to message restriction Any help or idea over here is very much appreciated, thanks in advance . P.S: Very important thing to notice is if I run any job for any hour manually, I wasn't facing any issues at all .

Splunkadmin1876 · ‎01-10-2023

Hi All, I have a search with a subsearch that references a lookup file test.csv with a single field. "Account_Name". I want to remove names from the lookup table that meet a certain criteria. Th...

Hi All, I have a search with a subsearch that references a lookup file test.csv with a single field. "Account_Name". I want to remove names from the lookup table that meet a certain criteria. The search below currently gives the results that I want removed from the lookup file test.csv, but I cannot seem to figure out how to get the inverse of these results from the lookup file. I want everything in the lookup that does not match the result of the below query. Any advice? For example, if the below search outputs Bob and the lookup contains Bob, Alice, and Dave, I would want my final results to be Alice and Dave to overwrite back into test.csv. That's my line of thinking at least, I could be approaching this in a bad way. index=exampleindex EventCode=4722 | stats by Target_Account_Name | rename Target_Account_Name as Account_Name | search [inputlookup test.csv | table Account_Name] | table Account_Name

karu0711 · ‎01-10-2023

I am uploading DevOps scan result to Splunk, and these scans also have new result and some old flaw that not remediated. How can I match events and return unique. example SPL Index= demo sour...

I am uploading DevOps scan result to Splunk, and these scans also have new result and some old flaw that not remediated. How can I match events and return unique. example SPL Index= demo sourcetype= demoscan table date, aaa, ccc, xxx, yyy, zzz

mv10 · ‎01-10-2023

I have read the documentation about breaker characters, but within our organization there is disagreement about when they actually come into play in the main search. The docs don't say anything abou...

I have read the documentation about breaker characters, but within our organization there is disagreement about when they actually come into play in the main search. The docs don't say anything about it either way, but some say we must use quotes around sourcetype, for example: index=iis sourcetype="http_err_logs" status=500 ...etc It goes without saying that they're needed within literal search phrases; the text of a specific error message, for example. But do they really also apply to comparisons for standard fields like index or sourcetype? As another example, we have sourcetypes with names like "WinEventLog:Application" and "WinEventLog:System" and some are saying that colon becomes a breaker which leads to a search of the entire raw event data. We also have index names with underscores, and so on. As a result, at this point we're playing it safe and quoting anything that has breaker characters, but is there any documentation that describes where they're actually applied or not?

Vivekmishra01 · ‎01-10-2023

I am trying to find few strings in my search query and count occurrences of them and I want to put them in a two column table. I am able to do it with stat command, but it's coming like string as col...

I am trying to find few strings in my search query and count occurrences of them and I want to put them in a two column table. I am able to do it with stat command, but it's coming like string as column name and count in the row bwlow. Below is what I am using and what I ma getting. index=<index> <search String > "Failed" | stats count AS Failed count(eval(searchmatch("Failed Acknowledged"))) AS "Failed Acknowledged" count(eval(searchmatch("UnexpectedException Caught"))) AS "UnexpectedException Caught" count(eval(searchmatch("NonRetryableException Caught"))) AS "NonRetryableException Caught" However I want a result like below. Can anyone help? Thanks in advance.

buttsurfer · ‎01-10-2023

I'm trying to identify all the dashboards broken from lookup files being deleted. But since there's way too many dashboards, is there any not-so-manual way to find out all the inconsistencies regardi...

I'm trying to identify all the dashboards broken from lookup files being deleted. But since there's way too many dashboards, is there any not-so-manual way to find out all the inconsistencies regarding lookup files without running the dashboards one by one?

evallja · ‎01-10-2023

Hello everyone, I have the following results when running my search: _time user connection 1 2023-01-09 20:36:04 john Transport closin...

Hello everyone, I have the following results when running my search: _time user connection 1 2023-01-09 20:36:04 john Transport closing 2 2023-01-09 20:32:45 brian DPD failure 3 2023-01-09 19:44:26 tom assigned to session Please, I want to configure an alert to send the _raw field by email to the specific user (by adding @Anonymous.com), every time it returns results from that user, (ex. john@gmail.com, brian@gmail.com, tom@gmail.com) Thank you in advance.

anjuliwyles · ‎01-10-2023

When I place event.code into an if statement, it will not evaluate as true Currently I have this code: index = windows-security event.code IN (4624) | eval Success=if(event.code = "4624", 1,...

When I place event.code into an if statement, it will not evaluate as true Currently I have this code: index = windows-security event.code IN (4624) | eval Success=if(event.code = "4624", 1, 0) | stats count by Success Success always evaluates to 0. I have tried using match(event.code, "4624") match(event.code, '4624') match(event.code, ".+") like(event.code, "4624") like(event.code, '4624') I even tried event.code = event.code Always 0.

Nitesh_Rai · ‎01-10-2023

How the pricing is calculated in Kubernetes cluster for CPU core? Based on how much core is assigned to the services or based on how much core is being used the services. Suppose I have one cluster...

How the pricing is calculated in Kubernetes cluster for CPU core? Based on how much core is assigned to the services or based on how much core is being used the services. Suppose I have one cluster containing 2 nodes and each node has 4 cores, but I'm running only 2 application and 3 cores have been assigned to these application but these are using only 2 cores at max. Then what will be the cost for Enterprise Edition?

chandankr · ‎01-10-2023

was using this below Search, ***| rex field=_raw "<measResults>\d+\s\d+\s\d+\s\d+\s\d+\s\d+\s\d+\s\d+\s(?<active_state>\d{0,3})\s\d+\s(?<idle_state>\d{0,3})" | eval date_month=upper(date_month) | ...

was using this below Search, ***| rex field=_raw "<measResults>\d+\s\d+\s\d+\s\d+\s\d+\s\d+\s\d+\s\d+\s(?<active_state>\d{0,3})\s\d+\s(?<idle_state>\d{0,3})" | eval date_month=upper(date_month) | eventstats avg(active_state) as Active_UEs avg(idle_state) as Idle_UEs by date_month | eval Active_UEs=round(Active_UEs,0), Idle_UEs=round(Idle_UEs,0) | stats count by date_month,Active_UEs,Idle_UEs | table date_month,Active_UEs,Idle_UEs but now i was trying to sort month in chronological order i used the below Search ***| eventstats avg(active_state) as Active_UEs avg(idle_state) as Idle_UEs by date_month | eval Active_UEs=round(Active_UEs,0), Idle_UEs=round(Idle_UEs,0) | eval Month=date_month | eval orden = if(Month="january",1,if(Month="february",2,if(Month="march",3,if(Month="april",4,if(Month="may",5,if(Month="june",6,if(Month="july",7,if(Month="august",8,if(Month="september",9,if(Month="october",10,if(Month="november",11,12))))))))))) | sort num(Month) | stats count by Month,Active_UEs,Idle_UEs | table Month,Active_UEs,Idle_UEs here also month are sorted in alphabetically order not in chronilogical order.

McMac84 · ‎01-10-2023

Hi everyone, I've a scenario where Splunk is timing out in querying customer SIEM environments and reporting as potential dropped logs. If I check in the customer's SIEM, I see that there are no dr...

Hi everyone, I've a scenario where Splunk is timing out in querying customer SIEM environments and reporting as potential dropped logs. If I check in the customer's SIEM, I see that there are no dropped logs, so I know the issue is to do with Splunk querying their environment. Knowing that, I am trying to craft an SPL that looks for searches that were canceled or timed out. Can someone help me with this? What I've tried using is below but it's not accurately correlating to the time stamps I am seeing in the ticket for my customer. Can someone help me build this out more. index=<customer name> cancelled

kpavan · ‎01-10-2023

Hi All, Greetings! Need help on splunk query, I have 2 indexes assets and vulns, am trying to build report to analyze percent % assets are not scanned, with below query am getting results perce...

Hi All, Greetings! Need help on splunk query, I have 2 indexes assets and vulns, am trying to build report to analyze percent % assets are not scanned, with below query am getting results percent, but some of the ip's are having duplicate entries which are showing as as scanned and not scanned for same ip, i need query to remove from SCANNED =0 if the same ip SCANNED=1, I tried using dedup but since its removing randomly so scanned ip's also getting removed. Please help me with correct query ((index=index1 sourcetype=asset) OR (index=index1 sourcetype=vulns)) | eval vuln=if('sourcetype'="vulns","yes","no") | eval assets=if('sourcetype'="asset","yes","no") | stats max(eval(if(vuln="yes",1,0))) AS SCANNED max(eval(if(assets="yes",1,0))) AS ASSETS latest(ip) as ip by uuid | search ASSETS=1 | stats count(eval( SCANNED > 0)) AS scanned, count(uuid) as total | eval percent = round((scanned/(total))*100,2) Result example scanned ASSETS ip 0 1 192.168.1.1 1 1 192.168.1.1 Thanks!

MadhuMS · ‎01-10-2023

Hi, Can someone assist how to integrate Dell OpenManage Enterprise with Splunk.

GaetanVP · ‎01-10-2023

Hello Splunkers, For a specific index I configured repFactor = auto and I suppose that the logs are exactly the same on my two indexers for this specific index. How could I verify that all buckets...

Hello Splunkers, For a specific index I configured repFactor = auto and I suppose that the logs are exactly the same on my two indexers for this specific index. How could I verify that all buckets and data has been correctly replicated ? When I launch a search on that index, should I see the splunk_server field showing 50% of indexer1 and 50% of indexer2 ? Thanks for the help, GaetanVP

RJ1997 · ‎01-10-2023

I have a question How I can send the SNMP logs of the FortiGate firewall to splunk? Can any one help ??

robertisimos · ‎01-09-2023

Currently we are ingesting a big amount of AWS VPC FlowLogs in to the Splunk and I am wondering if there is any usage of them? Maybe someone has to suggest some use cases for them?

Rony · ‎01-09-2023

We have registered to the splunk on call trial and configured our Production instances to splunk so that if something is wrong, we get a phone call. The trial ended and we are trying to actually pay ...

We have registered to the splunk on call trial and configured our Production instances to splunk so that if something is wrong, we get a phone call. The trial ended and we are trying to actually pay for the service but we are getting payment errors. We have sent emails to the billing email, but no ones has responded after multiple follow ups. I tried calling the support number and no one has been responding for the past 2 days. I left a message on the voice mail. Below is the error we get when attempting a payment. code: 51000021 message: Invalid parameter(s): 'requestId'.

MrIncredible · ‎01-09-2023

In few logs I can see escape character is also printed. My rex is working fine when i am testing it on regex101.com but when i use the same in Splunk Search, its throwing error. I tried different com...

In few logs I can see escape character is also printed. My rex is working fine when i am testing it on regex101.com but when i use the same in Splunk Search, its throwing error. I tried different combination by putting quotes but then different error comes. Regex: https://regex101.com/r/Nm32kd/2 Splunk error:

All Topics

All Topics

Managing users - deleting user says user does not exist?

How to limit the max size of a single index?

Saved search running from very long time and not finishing?

How to remove Search Results from lookup file?

I want to compare events upload to Splunk in two different times. and compare those and return match and new events?

When do breaker characters apply?

Count occurrences of string and put them in table row wise?

Is there any way to track deleted lookup files?

Configure alert to send email to a certain field value?

Why won't If statement evaluate as true?

Cost Calculation in Kubernetes cluster

Trying to sort month in chronological order and not getting the desired output?

What is the SPL for cancelled / timed out searches?

Splunk search to remove duplicated ips?

Can someone assist how to integrate Dell OpenManage Enterprise with Splunk?

How to verify the repFactor behavior set up in indexes.conf

Fortigate SNMP LOGS to Splunk?

Are there any use cases for AWS VPC FlowLogs?

How do I pay for splunk on call service?

How to remove ( \" ) characters from search?

All Topics

Are you a member of the Splunk Community?

All Topics