Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About hartfoml
hartfoml
Motivator
Member since:
10-05-2010
06-05-2020
Community Statistics
| Posts | 584 |
| Solutions | 20 |
| Karma Given | 37 |
| Karma Received | 122 |
| Member Since | 10-05-2010 |
Activity Feed
- Got Karma for Re: Multiple Where Claus in the same search. 01-14-2022 04:00 PM
- Karma Re: How to search and filter emails of the same subject where "[email protected]" is the sender? for lguinn2. 06-05-2020 12:48 AM
- Karma Re: Who to split up $SPLUNK_DB and colddb for lycollicott. 06-05-2020 12:48 AM
- Karma Re: create summary index in transforms.conf for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Can I manualy create "_telemetry" index on older version indexer. 06-05-2020 12:48 AM
- Got Karma for Re: Can I manualy create "_telemetry" index on older version indexer. 06-05-2020 12:48 AM
- Got Karma for Re: How to get Linux OS logs off a Splunk server, where Splunk is started as a non root account, to index in an indexer cluster?. 06-05-2020 12:48 AM
- Got Karma for What permissions can I give a role that will allow users to share searches and dashboards?. 06-05-2020 12:48 AM
- Got Karma for how to convert dbquery search to dbxquery search. 06-05-2020 12:48 AM
- Got Karma for how to convert dbquery search to dbxquery search. 06-05-2020 12:48 AM
- Got Karma for Re: How to allow users to share their dashboard?. 06-05-2020 12:48 AM
- Got Karma for Why is Splunk Web limited to 50 users when using Scripted Authentication Input for RSA & TFTI?. 06-05-2020 12:48 AM
- Karma Re: How to convert a timestamp field to epoch format? for vasanthmss. 06-05-2020 12:47 AM
- Karma Re: How to write a search and set up an alert using the metadata command to find hosts that are not reporting in? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Why am I seeing repeated LMDirective warnings in the splunkd.log and how to troubleshoot this? for aaronkorn. 06-05-2020 12:47 AM
- Karma Re: Can VMware and DataOntap share the same DCN for Masa. 06-05-2020 12:47 AM
- Got Karma for Firewall indexing latency: How to track when syslog is read by file monitor when the log is seen in search GUI?. 06-05-2020 12:47 AM
- Got Karma for Re: Firewall indexing latency: How to track when syslog is read by file monitor when the log is seen in search GUI?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect 1: How to enrich the dbquery output to show the database name that systems come from?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect 1: How to enrich the dbquery output to show the database name that systems come from?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
10-29-2013
09:36 AM
Thanks again for the help.
I should have put in the things I tried at the beginning.
I tried (?i) \w+ (?P<fieldname>[^ ]+)
and this (?i) \w+\s (?P<fieldname>[^ ]+)
and this (?i)\w+\s(?P<fieldname>[^ ]+)\s\-\s
... View more
10-29-2013
07:52 AM
Right Thanks, I did think of doing this but what if there is a WARN or ERROR. I didn't want to put (DEBUG|ERROR|WARN|INFO) I was hoping for a more elegant way to right it.
... View more
10-29-2013
07:29 AM
I have these btool logs:
10-29-2013 09:15:34.551 INFO AdminManager - added factory for admin handler: 'licenses'
10-29-2013 09:15:34.551 DEBUG AdminManager - Found path '/opt/splunk/etc/apps/search/bin' for handler 'sendemail'.
29-2013 09:15:34.551 DEBUG HTTPRestDispatcher - loadConfig for masterlm _isProServer=1
When I do the automated extraction if looks like this:
(?i) DEBUG (?P<FIELDNAME>[^ ]+)
This does not find the valus followed by INFO. How could I right this so it is not dependent on the word "DEBUG"
... View more
- Tags:
- regex
10-22-2013
05:40 PM
HELP if you can.
I used this in the props.conf
[dns]
LINE_BREAKER = ([\r\n]+)\w+\s\d+\s[\d:]+
NO_BINARY_CHECK = 1
TZ = America/Chicago
SHOULD_LINEMERGE = false
TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N
TIME_PREFIX = \]:\s
pulldown_type = 1
This is not taking the Time Zone for some reason
Help if you can
... View more
10-21-2013
10:27 AM
Thanks Kristian this helps.
Like I said above I was hoping to get the FQDN.
Thanks for the help.
... View more
10-21-2013
08:36 AM
Here are my _internal Phonehome logs for UF client connections:
xxx.xxx.128.89 - - [21/Oct/2013:09:49:47.820 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.128.89_8089_xxx.xxx.128.89_iuppiter.sub.com_ea HTTP/1.0" 200 1226 - - - 45ms
xxx.xxx.254.211 - - [21/Oct/2013:09:49:47.470 -0500] "POST /services/broker/phonehome/connection_128.157.254.211_8089_sub-ia-dump1.sub.domain.com_sub-ia-dump01.sub.domain.com_ia HTTP/1.0" 200 1300 - - - 42ms
xxx.xxx.182.29 - - [21/Oct/2013:09:49:47.451 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.182.29_8089_sub-ia-render02.sub.domain.com_sub-IA-RENDER02_ia HTTP/1.0" 200 278 - - - 41ms
xxx.xxx.15.201 - - [21/Oct/2013:09:49:47.440 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.15.201_8089_agdl.sub.domain.com_blade014_ea HTTP/1.0" 200 1303 - - - 44ms
xxx.xxx.182.29 - - [21/Oct/2013:09:49:47.384 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.182.29_8089_sub-ia-render02.sub.domain.com_sub-IA-RENDER02_ia HTTP/1.0" 200 2277 - - - 43ms
xxx.xxx.94.221 - - [21/Oct/2013:09:49:47.189 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.94.221_8089_sub-it-bak01a.sub.domain.com_sub-it-bak01a.sub.domain.com_ia HTTP/1.0" 200 278 - - - 41ms
xxx.xxx.138.96 - - [21/Oct/2013:09:49:47.161 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.138.96_8089_sub-ia-snlmdc02.sub.domain.com_sub-ia-snlmdc02.ndc.domain.com_ia HTTP/1.0" 200 1302 - - - 42ms
xxx.xxx.226.17 - - [21/Oct/2013:09:49:47.158 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.226.17_8089_xxx.xxx.226.17_skynet.sub.domain.com_ea HTTP/1.0" 200 1314 - - - 43ms
xxx.xxx.10.12 - - [21/Oct/2013:09:49:47.015 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.10.12_8089_subb-dacs2.dacs.subb.sub.domain.com_subb-dacs2_w-ra HTTP/1.0" 200 278 - - - 101ms
xxx.xxx.10.4 - - [21/Oct/2013:09:49:46.920 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.10.4_8089_subb-pta.dacs.subb.sub.domain.com_subb-PTA_w-ra HTTP/1.0" 200 1073 - - - 102ms
xxx.xxx.10.12 - - [21/Oct/2013:09:49:46.826 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.10.12_8089_subb-dacs2.dacs.subb.sub.domain.com_subb-dacs2_w-ra HTTP/1.0" 200 1075 - - - 101ms
xxx.xxx.10.4 - - [21/Oct/2013:09:49:46.735 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.10.4_8089_subb-pta.dacs.subb.sub.domain.com_subb-PTA_w-ra HTTP/1.0" 200 1073 - - - 101ms
xxx.xxx.94.117 - - [21/Oct/2013:09:49:46.489 -0500] "POST /services/broker/phonehome/connection_xxx.xxx.94.117_8089_sub-ia-fs01b.sub.domain.com_sub-IA-FS01B_ia HTTP/1.0" 200 1281 - - - 42ms
I want to extract the client host name.
I could use this [ (?i).+phonehome.+_8089_(?P<FIELDNAME>.+?)_ ] but in some cases this produces an IP (see first event in logs above)
I don't know who to get the host name when it is preceded by the client IP first.
Can you help?
... View more
10-17-2013
02:23 PM
1 Karma
Here is my DNS raw data:
Oct 17 19:47:09 ns1 named[15517]: 17-Oct-2013 19:47:09.314 queries: client xxx.xxx.xxx.xxx#57938: query: mail.server.domain.com IN A + (xxx.xxx.xxx.xxx)
When I do data preview Splunk has this as the timestamp;
"19:47:09 ns1 named[15517]: 17-Oct-2013"
I don't know if I should use this "Oct 17 19:47:09" OR "17-Oct-2013 19:47:09.314"
Which ever one I use I don't know the regex to use for the extraction.
Also there is the question about braking. If I use the second one, I can't break before the timestamp.
Any help would be great.
... View more
10-15-2013
07:08 AM
great thanks: i did correct the typo of which I had a few.
Still not getting the sourcetype "juniper_sa_log"
I have the props.conf in the local directory and the transforms.conf in the default directory. Do you think this is the problem? since this is a search time transform I should not have to restart anything? Do you think i need to add the "priority=" value?
... View more
10-14-2013
10:09 AM
I have the Juniper device sending to syslog-NG and I am reading the file as a monitored input to splunk.
I created a PROPS.conf like below in the local directory in the Juniper SA app:
### Transform Juniper SA Log SourceType
[source::/mnt/log/128.157.91.130/messages]
TRANSFORMS-sasourcetype= sa_sourcetypersouce
[source::/mnt/data/log/remote/r2s-my.server.com/messages]
TRANSFORMS-sasourcetype= sa_sourcetypersource
Do I need to create a transforms.conf in the local directory?
do I need to escape the "/" like this "//"
... View more
10-09-2013
03:01 PM
I was looking in the nix app today and ran the 'Failed_Logins_by_Host(*)' Macro
This macro expands to
remoteSearch litsearch index=os ( ( "failed login" OR "FAILED LOGIN" OR "Authentication failure" OR "Failed to authenticate user" OR "authentication ERROR" OR "Failed password for" ) ) host=* | addinfo type=count label=prereport_events | fields keepcolorder=t "*" "host" "index" "linecount" "prestats_reserved_*" "psrsvd_*" "source" "sourcetype" "splunk_server" | remotetl nb=300 et=1381338000.000000 lt=1381355354.000000 max_count=10000 | prestats count by host
My question is that I don't know what the term "remotetl" is used for in this search.
Anyone know what that term is used for?
... View more
10-09-2013
08:26 AM
I have inherited 6 indexers in my deployment.
Some of the SoS searches don't work because they are pulling data from the SoS index. All of the indexers are running PS commands for the NIX app into index=os and only three of them are running PS command script into the index=SoS. if I run the SoS searches and change the index=os the search comes back with data.
What would be the best way to handle this
1) turn off/uninstall the NIX app on all the indexers and reinstall the SOS app
2) edit the SOS app to search both the SOS index and the OS index
Also is it too much to have both the SOS app running slimier system request scripts as the NIX app?
... View more
10-08-2013
10:16 AM
Thanks this is very helpfull
... View more
10-08-2013
07:39 AM
Thanks to both of you this is very helpful I will use this info if I don.t get the matrix from someone else. This is not exactly what I was looking for but I appreciate the help just the same.
... View more
10-08-2013
07:05 AM
I am looking for a matrix for Splunk Skill sets.
I know I've seen this somewhere but cant seem to find it.
Job skills with task for each skill.
Something like:
Admin
Developer
User
Architect or Engineer
With Tasks. I might have seen this during the 2013 .conf but I can't remember which talk it was in.
Any help would be appreciated.
... View more
- Tags:
- skill_set
09-24-2013
10:48 AM
This is exactly what I needed thank for both options.
One question if you don't mind. If there is no value I would like to have the value for the "pctCPU" for each server to be 0 this will insure a place holder oven if the CPU for SPlunkd drops to zero. Can you help with that?
... View more
09-24-2013
10:29 AM
I am using the top command to see splunkd resource use just like SOS
I would like to see the total CPU and MEMORY use for Splunkd but there are several PID numbers for splunkd.
I can user the transaction command like this
host=MyIndexers sourcetype=top | multikv fields USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY s ELAPSED COMMAND ARGS | search COMMAND=splunkd | transaction _time | timechart span=1m sum(pctCPU) by host
The problem is this isn't too accurate and the timechart span=1m could contain two or no results depending on the sync.
I would also like to device the sum(pctCPU by 8 since I have 8 cores in each box. this would give me an Percent of 100% rather than Percentage of 800%
Any help would be appreciated.
... View more
09-20-2013
06:50 AM
this seems to be the right answer. will you put it in as an answer so I can give you credit. Also if you have any suggestions on how (if you wanted to) would you fixing this issue.
Thanks for the speedy help!!!
... View more
09-20-2013
06:34 AM
I have a Linux client with a UF reporting two different formats of host name.
1) host.name.local.net
2) host.name
I looked in all input and output.conf and the server.conf and could only find the host=host.name.local.net
I noticed that in only two types of events are the hostname different.
source=/var/log/messages
source=/var/log/cron
two commands (ifconfig and sadc) are recorded in the messages log and both are failing to collect information due to permissions. these two are not the only two logs in the messages but are by far the dominant record.
The other job or item with the wrong host name is crond[21282]: (root) CMD (/usr/lib64/sa/sa1 1 1)
I don't know why these jobs are failing or why the host name is wrong.
Any sugestions?
... View more
- Tags:
- host
09-12-2013
11:52 AM
I even tried this but the eval command didn't work
sourcetype="WinEventLog:System"
| EVAL computerName=if(ComputerName="*.network.*",regex=ComputerName\=(?)\.network,ComputerName)
| where upper(host)!=upper(computerName)
| dedup host computerName
| table host computerName index
... View more
09-12-2013
11:39 AM
Hi I have this problem in my enviorment but the search didn't work.
The host=myhost the Computername=myhost.network.com
this shows in the mismatch above.
I tried this:
sourcetype="WinEventLog:System”
| rex "ComputerName\=(?<computerName>.*)\.network"
| where upper(host)!=upper(computerName)
| dedup host computerName
| table host computerName
But it misses the ones where Computer name dosn't not have the FQDN.
Any sugestions on how this would work for both conditions where the ComputerName is FQDN OR ComputerName is netbios?
... View more
09-11-2013
02:57 PM
The MAC address as well as several other extractions are not working correctly
Here is an example of my logs. is this so different from what you wrote the app to?
Sep 11 11:01:36 ns1 /opt/qip/usr/bin/dhcpd[25911]: Sent DHCPACK to Client MAC= 001b786eb865 ciaddr= x.x.x.x yiaddr= x.x.x.x client ID= 01001b786eb865
Sep 11 11:01:36 ns1 /opt/qip/usr/bin/dhcpd[25911]: Received DHCPREQUEST from Client MAC= 001b786eb865 ciaddr= x.x.x.x requestedIP= client ID= 01001b786eb865
Sep 11 11:01:36 ns1 /opt/qip/usr/bin/dhcpd[25911]: DHCP_RenewLease: Host= IP=x.x.x.236 MAC=001b786eb865 Domain=My.Domain.me ClientID=01001b786eb865
Sep 11 11:01:36 ns1 /opt/qip/usr/bin/dhcpd[25911]: Sent DHCPACK to Client MAC= 001b786eb865 ciaddr= x.x.x.236 yiaddr= x.x.x.236 client ID= 01001b786eb865
Sep 11 11:01:36 ns1 /opt/qip/usr/bin/dhcpd[25911]: Received DHCPREQUEST from Client MAC= 001b786eb865 ciaddr= x.x.x.236 requestedIP= client ID= 01001b786eb865
Sep 11 11:01:36 ns1 /opt/qip/usr/bin/dhcpd[25911]: DHCP_RenewLease: Host= IP=x.x.x.236 MAC=001b786eb865 Domain=My.Domain.me ClientID=01001b786eb865
Sep 11 11:01:36 ns1 /opt/qip/usr/bin/dhcpd[25911]: Sent DHCPACK to Client MAC= 001b786eb865 ciaddr= x.x.x.236 yiaddr= x.x.x.236 client ID= 01001b786eb865
x
Sep 11 11:01:37 ns1 /opt/qip/usr/bin/dhcpd[25911]: Received DHCPINFORM from Client MAC= 000f4402ca93 ciaddr= x.x.x.28 requestedIP= client ID= giaddr= x.x.x.5
... View more
- Tags:
- Linux DHCP
09-11-2013
08:36 AM
Thanks so much for the help. I will try it out right now.
One question if you don't mind
Can I do this on the heavy forwarder before it is sent to the indexer? I have 3 indexers do I have to setup the props and transforms on all three or can i just do this on the Heavy Forwarder
... View more
