I see too many search jobs present in the dispatch directory. Even after completing the jobs the expiry date keep on increasing and not removed from the dispatch folder. This impact me in creating other search jobs via REST API. ("Job not yet scheduled by server") Is there any way splunk automatically clears those jobs ? every time i manually clear the dispatch directory for other jobs to get scheduled. OS : Linux 2.6.32-504.16.2.el6.x86_64 x86_64 Splunk v6.0.4 ... View more

Unable to configure iRules in F5 as per the steps given in the Splunk docs: http://docs.splunk.com/Documentation/AddOns/latest/F5BIGIP/Setup#Configure_iRules_for_GTM Error Message: 01070151:3: Rule [/Common/Splunk_DNS_REQUEST] error: /Common/Splunk_DNS_REQUEST:7: error: [undefined procedure: whereami][whereami] /Common/Splunk_DNS_REQUEST:9: error: [undefined procedure: whoami][whoami] /Common/Splunk_DNS_REQUEST:10: error: [undefined procedure: wideip][wideip name] ... View more

App : Splunk Add-on for F5 BIG-IP I already configured F5 LTM and currently its forwarding syslog to my splunk. But., in Configure the modular inputs for the Splunk Add-on for F5 BIG-IP after I configure the Server, templates, tasks - I didn't receive any data from the F5 servers. When i dig into the logs , I get this error message. Can someone please help how to resolve this ? Error logs: Location : source="/opt/splunk/var/log/splunk/Splunk_TA_f5_bigip_main.log" 2016-01-22 07:33:31,055 ERROR pid=23801 tid=Thread-17 file=F5_iControl_Template.py:_fetch:92 | Fail to set active folder as partition "/Common" for Template "call LocalLB.VirtualAddressV2.get_list against LocalLB.VirtualAddressV2.get_address;get_connection_limit;get_enabled_state;get_object_status;get_status_dependency_scope;get_traffic_group interval 60" on F5 BIGIP "http://10.x.x.x" ... View more

I am forwarding data from heavy-forwarder (HF-1) to heavy-forwarder(HF-2) which are in different network IP range. Eg: 10.172.0.1 to 10.234.0.1 I have enabled the forwarding from HF-1 to HF-2 via TCP/9999 port. outputs.conf (HF-1) :forwarding-end [tcpout] defaultGroup = default-autolb-group indexAndForward = 0 [tcpout:default-autolb-group] disabled = 0 server = 10.234.0.1:9999 [tcpout-server://10.234.0.1:9999] inputs.conf in HF-2 : (receiving-end) under launcher app [splunktcp://9999] connection_host = none splunkd.logs: 11-20-2015 10:26:41.868 +0000 WARN TcpOutputFd - Connect to 10.234.0.1:9999 failed. Connection refused 11-20-2015 10:26:41.868 +0000 ERROR TcpOutputFd - Connection to host=10.234.0.1:9999 failed 11-20-2015 10:26:41.868 +0000 WARN TcpOutputProc - Applying quarantine to ip=10.234.0.1 port=9999 _numberOfFailures=2 network troubleshooting: At HF-1 Telnet to HF-2 from HF-1 for 9999 port telnet 10.234.0.1 9999 -- which gets connected for the first time.. But after sometime failed to connect At HF-2: netstat -anp|grep 9999 bash-4.1$ netstat -anp|grep 9999 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 138835 0 10.234.0.1:9999 10.234.0.1:49679 ESTABLISHED 18110/splunkd ... View more

More than Splunk, this question is related to firewall logs - any help is very much appreciated. Desc: Mapping Key-value of pan_logs to OPSEC logs Fields: category vs app_category & signature Vs rule_name ?? Details: sourcetype: Palo alto logs Field name: category (small-letter) Field values: any computer-and-internet-info business-and-economy web-based-email internet-communications-and-telephony web-advertisements search-engines social-networking private-ip-addresses content-delivery-networks sourcetype: opsec - checkpoint logs Field name: I see fields app_category , matched_category --> but all the field values are extracted as= ""***** Confidential ****** How do I map similar category fields in OPSEC to similar fields from Palo Alto? Are there any other fields that map these values? Also, Fieldname: signature (palo_alto logs) Fieldname: rule_name (opsec) Can both fields be mapped? ... View more

Are there a pre-built data models for Splunking checkpoint firewall logs.. ? I have installed Splunk App for Check Point OPSEC LEA and successfully configured my CMA device to pull checkpoint device logs.. any help on the categorization of the CP logs also will be very helpful. ... View more

How to insert apostrophes in all field values Results: group count 10.243.200.14 1 10.243.200.29 1 10.243.200.67 1 expected o/p: group count "10.243.200.14" 1 "10.243.200.29" 1 "10.243.200.67" 1 ... View more

What happens to the deployed apps in the deployments-clients when it phones home and doesn't find the serverclass configs for that IP address? OR the configs/apps exist, but the whitelist IP is removed? Will it remove the deployed apps & configs on the client ? ... View more

Checkpoint firewall log storage policy is set to rotate everyday at midnight where new "file id" is created for the log file "fw.log" every midnight. In the Splunk forwarder - For every new file id - splunk app creates a new stanza under the file : opsec-log-status.conf Eg: [[email protected]] fileid = 1438127971 filename = 2015-07-29_235900.log last_rec_pos = 70000 [[email protected]] fileid = 1438214351 filename = fw.log last_rec_pos = 35441 Every time the script triggers, the old file id (which has been already collected data t splunk) also runs and gets the same data again to Splunk. This causes high license usage. Only the latest file id should be should be monitored with the last loc values it has left. Check point device maintains the log track file clearly, where every day an entry is made (fw.logtrack) with the current status. Why doesn't Splunk ignore the already indexed data? OPSEC LEA should only be made to read the current file id to get the data which doesn't happen! Please advise, is there any workaround , ... View more

Search job Inspector: This search has completed and has returned 31232 results by scanning 434213123 events in 47.204 seconds. Is it possible to estimate a search completion time prior it returns the complete results ? OR possibly an extra column in "Activity -> Jobs" view Use case: Using the REST API, I get search results and displaying them in a customized UI. If I show the user a field called "Estimated Job Completion Time ", the user can wait until the search gets completed or can reduce the time range to get limited results. ... View more