Hi, where do i have to change the default "," delimiter so i get my CSV reports delimited with something like ";"? I tried editing /opt/splunk/lib/python2.7/csv.py and /opt/splunk/bin/tocsv.py to no avail. ... View more

I would love to be able to specify the search base when using SA-ldapsearch to avoid having to specify several stanzas with different bases. We have a relatively complex and large directory with several organizations so identical queries with different bases result in vastly different results. I agree that it would be nice to always have a attribute or attribute combination to filter but this does IMVHO not invalidade the request to be able to specify the searchbase. ... View more

when using ldapsearch from SA-ldapsearch i have the following issue: If a text field contains non 7-bit ASCII characters (like "é" in "René") then the Splunk Result has as field value. Is this configurable? The LDAP Directory we use is eDirectory 8.8.1 ... View more

In some logs i have ldap DNs which i want to slice a part out from it like the CN or the PATH without the DN. The DNs i have get potentially in different formats. Format 1: O=xxx\OU=yyy\OU=zzz\CN=xyz Format 2: \xxx\yyy\zzz Format 3: CN=xyz,OU=zzz,OU=yyy,O=xxx I would like to parse the elements and get all elements minus the first one etc. I presume a custom command or macro could help there but i really really hope someone has done something similar. ... View more

I upgraded our preproduction splunk from 4.3 to 5.0 Alas while all files are still there as good as i can tell there seems to not have been any migration as all configuration settings are lost. How can i initiate a migration of the 4.3 stuff? (apps, inputs, ldap configuration, roles, rolemapping to ldap groups yadda yadda) ok, some progress... i now have merged it with enough success for it to dump update: after merging manually the /$splunkhome/splunk/etc i get this " Last few lines of stderr (may contain info on assertion failure, but also could be old): 2012-10-30 16:44:03.553 +0100 Interrupt signal received 2012-10-30 16:47:07.343 +0100 splunkd started (build 140868) terminate called after throwing an instance of 'PluginException' what(): Indexer failed to start, will not continue. 2012-10-30 16:48:22.377 +0100 splunkd started (build 140868) terminate called after throwing an instance of 'PluginException' what(): Indexer failed to start, will not continue. 2012-10-30 16:49:30.096 +0100 splunkd started (build 140868) terminate called after throwing an instance of 'PluginException' what(): Indexer failed to start, will not continue. 2012-10-30 16:53:58.876 +0100 splunkd started (build 140868) terminate called after throwing an instance of 'PluginException' what(): Indexer failed to start, will not continue. " I disabled on CLI the apps that caused warnings on starting splunk service but it must be somewhere else... 😕 ... View more

I have a script which collects the ldap stats of a series of ldap hosts and forward the values to splunk. Now naturally the vaules are increasing - i would want to chart the delta values in a timechart. How do i go about to achieve this? I tried something like " | delta simpleAuthBinds AS deltaSimpleAuthBinds | search deltaSimpleAuthBinds>0 | timechart min(deltaSimpleAuthBinds) by dsaName " with min max etc but i only want the value in deltaSimpleAuthBinds (supposing i use "delta" correctly). ... View more

I have several indexes and created a role in splunk for each index. We have a RBAC system in place to grant users group memberships in our eDirectory based MetaDirectory. I map each splunk role to a LDAP groupmembership. If a user has only one groupmembership all works fine. If a user receives a second group membership it is shown fine in the user overview in Splunk Administration The user does however not see the content of the index to which it received access by the second (N'th) group membership. I modeled the role such that they have access to one index, the capability search and rtsearch. What am i doing wrong? ... View more