Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About helge
helge
Builder
Member since:
11-20-2012
07-05-2023
Community Statistics
| Posts | 193 |
| Solutions | 14 |
| Karma Given | 277 |
| Karma Received | 68 |
| Member Since | 11-20-2012 |
Activity Feed
- Got Karma for Re: Why is KV Store certificate renewal not working?. 02-07-2026 01:16 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 11-24-2025 10:06 PM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 03-12-2025 02:38 PM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 01-23-2025 01:16 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 11-16-2024 04:59 PM
- Got Karma for Re: Some events missing from data model - only if accelerated. 02-15-2024 08:23 AM
- Got Karma for Some events missing from data model - only if accelerated. 02-15-2024 08:21 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 02-02-2024 11:35 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 07-07-2023 08:04 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 01-06-2023 10:30 AM
- Posted Re: Why is KV Store certificate renewal not working? on Knowledge Management. 11-01-2022 01:27 PM
- Tagged Re: Why is KV Store certificate renewal not working? on Knowledge Management. 11-01-2022 01:27 PM
- Karma Re: Renewing server.pem certificate for vishaltaneja070. 11-01-2022 11:11 AM
- Got Karma for How to escape equal signs (=) in key value data?. 09-29-2022 11:35 PM
- Posted Re: Accelerated data model 100% complete even though most populating searches are skipped on Other Usage. 01-19-2022 06:10 AM
- Karma Re: SimpleXML: text size of single value element ignores height with version="1.1" for vagrawal. 09-23-2021 12:37 PM
- Posted Re: SimpleXML: text size of single value element ignores height with version="1.1" on Splunk Dev. 09-23-2021 09:12 AM
- Karma Re: SimpleXML: text size of single value element ignores height with version="1.1" for thellmann. 09-23-2021 09:02 AM
- Posted SimpleXML: text size of single value element ignores height with version="1.1" on Splunk Dev. 07-29-2021 02:52 PM
- Posted Re: SimpleXML dashboard version=1.1 backwards compatibility on Splunk Dev. 07-29-2021 02:37 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 0 |
10-24-2018
06:52 AM
Small memory dumps, typically placed in the C:\Windows\Minidump directory, are written if the system is configured to do so in the "Startup and Recovery" dialog. They provide an alternative to kernel or complete memory dumps which are typically stored in C:\Windows\memory.dmp .
There are some tools available to analyze small memory dumps: NirSoft BlueScreenView (http://www.nirsoft.net/utils/blue_screen_view.html) and Microsoft's DumpChk (https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/dumpchk). You might be able to automate the analysis of small memory dumps with the help of these tools and a script executed through Universal Forwarder or uberAgent.
... View more
10-24-2018
05:28 AM
1 Karma
In order to identify the cause of a BSOD, the computer must be configured to write a memory dump file to disk. This dump file can subsequently be analyzed in WinDbg. In some cases, WinDbg is able to point to a driver as the likely root cause of the blue screen. In other cases, kernel memory may be too corrupted for that to be possible. Analyzing those second type of dumps requires expert-level know-how.
uberAgent does not analyze memory dumps, therefore it cannot suggest which driver might have caused a blue screen. Instead, uberAgent helps identify common issues that warrant further troubleshooting.
To analyze blue screens with uberAgent:
Go to the Stop Errors (Blue Screen & Power Loss) dashboard
Use the Stop errors grouped table to identify types of stop errors that happen often enough to warrant troubleshooting
Click the row in the Stop errors grouped table that you are interested in
The table Stop error detail lists all related stop errors along with timestamps, hosts, parameters and additional information
Pick one of the machines from the Stop error detail table and analyze the memory dump with WinDbg
... View more
09-11-2018
03:46 PM
That remark about fields whose names begin with underscores not being included in wildcards for fields is a life-saver. Is that documented anywhere?
... View more
08-13-2018
08:27 AM
The uberAgent app is built in Simple XML with just a little JavaScript. It only uses technologies officially supported by Splunk. Unfortunately, only Splunk can fix the crashes. Also, they are the only ones who can figure out where exactly Splunkd crashed with the help of the dump files. You need to contact Splunk support and open a ticket for this.
Regarding the dump files that quickly fill up your disk: if you are referring to dump files created by Windows Error Reporting (WER), you can disable the creation of these files by deleting the registry key HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps (details).
Disclaimer: I work for vast limits, the uberAgent company.
... View more
06-10-2018
01:15 PM
As of version 5.0, uberAgent determines page load duration and other web app performance metrics. This functionality requires a browser extension to be installed. Currently, a Chrome extension is available and an add-on for Internet Explorer is being developed. Extensions for Firefox and Edge are to follow suit.
The collected data is stored with the sourcetypes uberAgent:Application:BrowserPageLoads (page loads) and uberAgent:Application:BrowserWebRequests (background requests, e.g. XmlHttpRequests) (documentation).
Please see this blog article for more information.
IO latency refers to the duration of disk IO, by the way.
... View more
06-01-2018
08:57 AM
1 Karma
@Esky73 Please see the accepted answer which I just added to this question.
... View more
06-01-2018
08:55 AM
1 Karma
To fix the issue of the high number of skipped data model acceleration searches Splunk added auto-skewing in Splunk 7.1. Auto-skewing needs to be enabled per data model. Once enabled, Splunk distributes the searches across the available time range instead of trying to run them all at the same time.
To enable auto-skewing add the following to your datamodels.conf :
acceleration.allow_skew = 100%
More information on the uberAgent blog.
... View more
04-24-2018
03:14 PM
It should REALLY be documented that you can access the env tokens (e.g. env:version ) by specifying "env" as token model.
... View more
03-04-2018
03:10 PM
Scenario
I have laptops with Universal Forwarder. The UFs are configured as Deployment Clients. They download and run any package a Deployment Server offers them.
Obviously, I want to make sure the packages actually come from my Deployment Server and are not malware an attacker offered through a spoofed Deployment Server. This is particularly relevant if the laptops are frequently connecting to public WiFi networks.
Task: How to make it as difficult as possible to spoof a Deployment Server?
Research - Configuring Deployment Server
I know I can configure Deployment Server to use a TLS certificate of my choosing via server.conf. Let's assume I have configured TLS 1.2 correctly on the Deployment Server.
Research - Configuring Deployment Client
The remaining task is to ensure UF's Deployment Client only talks to my Deployment Server. The Deployment Client's TLS configuration is also in server.conf (on the UF), more specifically in the sslConfig stanza.
I found the following relevant settings:
# Talk to Deployment Server via TLS 1.2 only
sslVersionsForClient = tls1.2
# Make Deployment Client actually verify the server's certificate is valid
sslVerifyServerCert = true
# Deployment Server the Deployment Client is allowed to talk to
sslCommonNameToCheck = NAME-OF-MY-DEPLOYMENT-SERVER
# Depending on the TLS certificate, the Deployment Server name has to go here
sslAltNameToCheck = NAME-OF-MY-DEPLOYMENT-SERVER
This is all straightforward enough.
Question 1: is the above correct and complete?
The docs for sslCommonNameToCheck state:
This feature does not work with the deployment server and client communication over SSL.
Question 2: is that supposed to mean that sslCommonNameToCheck is not supported on the Deployment Server? In that case, it would not matter for this scenario, as long as it is honored on the Deployment Client.
... View more
02-27-2018
02:21 PM
We have translated the uberAgent dashboard app (written in Simple XML) to German. While doing so we found that:
Inline HTML elements cannot be localized.
HTML can only be localized when loaded from a file, e.g.: <html src="update_inventory_explanation.html"></html> . Provide one file per target language, e.g. for German: update_inventory_explanation-de.html
Localizing content that comes from JavaScript seems to be possible, but we have not tried it yet.
See this blog post for some more detail.
... View more
01-24-2018
05:47 AM
You should post this as a new question. Mixing topics is a no-no.
... View more
11-20-2017
12:59 PM
1 Karma
I can confirm the workaround works on Splunk 6.6.3 on Windows, too.
... View more
11-20-2017
12:36 PM
Thanks for your answer. I would love to report this to Splunk Support, however, as a lowly Splunk Technology Partner, I do not have a support entitlement.
... View more
10-26-2017
04:31 PM
Yes, that should not be a problem.
... View more
10-25-2017
06:46 AM
uberAgent reads Citrix XenApp published application names from the registry of the VDA. The format of the names is internal to the VDA - uberAgent does not change it. It should, however, be easy enough to figure out which published application a name refers to.
... View more
09-27-2017
08:22 AM
Thanks for your time, Sanford. After our discussion I noticed that I still do not understand the following: why is the data model showing a status of "100% completed" when it clearly is not?
... View more
08-23-2017
06:58 AM
In case you want to take a look, uberAgent is available here: https://uberagent.com/download/
If you have any questions please email [email protected]. Thanks!
... View more
08-23-2017
05:34 AM
Not really. Every endpoint sends at least a few dozen events twice a minute, and uberAgent is typically deployed to hundreds/thousands of endpoints.
... View more
08-23-2017
04:27 AM
I noticed the following fixed issues in the release notes for Splunk 6.6.3 - maybe they help with this?
SPL-142801, SPL-142771: Only one root event search in a DM gets accelerated
SPL-141887, SPL-141823: SearchParser Errors for Datamodel Acceleration prevents other scheduled searches from being executed
... View more
07-20-2017
03:23 PM
Now you mention it the answer is quite obvious 😉
Thanks!
... View more
07-20-2017
03:14 PM
1 Karma
In an eval expression, is there any difference between using NULL and null() ?
Use case: I want to return null in an eval expression. I am finding that the following two expressions give the same result and I want to make sure that both are officially correct:
if (isnotnull (fieldX), fieldX * 10, NULL)
if (isnotnull (fieldX), fieldX * 10, null())
... View more
06-27-2017
06:24 AM
I am running 64-bit Splunk on 64-bit Windows Server 2012 R2.
... View more
06-27-2017
03:09 AM
Thanks for verifying on a different platform. I tried your exact search, too, and it confirms my findings. On Windows 6.5.3 it gives me the clipped 0x8E8C7864.
... View more
06-26-2017
06:50 PM
I would like to convert 64-bit numbers stored as decimal integers to a hexadecimal representation.
I am aware of the eval command tostring(dec, "hex") . It works well enough but seems to be limited to 32-bit integers.
Example: tostring(140726995023972, "hex") gives me 0x8E8C7864. The correct result would be 0x7FFD8E8C7864.
My question: is this documented?
I found this on Splunk 6.5.3 on Windows.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-05-2023
07:16 AM
|
