Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About hartfoml
hartfoml
Motivator
Member since:
10-05-2010
06-05-2020
Community Statistics
| Posts | 584 |
| Solutions | 20 |
| Karma Given | 37 |
| Karma Received | 122 |
| Member Since | 10-05-2010 |
Activity Feed
- Got Karma for Re: Multiple Where Claus in the same search. 01-14-2022 04:00 PM
- Karma Re: How to search and filter emails of the same subject where "[email protected]" is the sender? for lguinn2. 06-05-2020 12:48 AM
- Karma Re: Who to split up $SPLUNK_DB and colddb for lycollicott. 06-05-2020 12:48 AM
- Karma Re: create summary index in transforms.conf for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Can I manualy create "_telemetry" index on older version indexer. 06-05-2020 12:48 AM
- Got Karma for Re: Can I manualy create "_telemetry" index on older version indexer. 06-05-2020 12:48 AM
- Got Karma for Re: How to get Linux OS logs off a Splunk server, where Splunk is started as a non root account, to index in an indexer cluster?. 06-05-2020 12:48 AM
- Got Karma for What permissions can I give a role that will allow users to share searches and dashboards?. 06-05-2020 12:48 AM
- Got Karma for how to convert dbquery search to dbxquery search. 06-05-2020 12:48 AM
- Got Karma for how to convert dbquery search to dbxquery search. 06-05-2020 12:48 AM
- Got Karma for Re: How to allow users to share their dashboard?. 06-05-2020 12:48 AM
- Got Karma for Why is Splunk Web limited to 50 users when using Scripted Authentication Input for RSA & TFTI?. 06-05-2020 12:48 AM
- Karma Re: How to convert a timestamp field to epoch format? for vasanthmss. 06-05-2020 12:47 AM
- Karma Re: How to write a search and set up an alert using the metadata command to find hosts that are not reporting in? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Why am I seeing repeated LMDirective warnings in the splunkd.log and how to troubleshoot this? for aaronkorn. 06-05-2020 12:47 AM
- Karma Re: Can VMware and DataOntap share the same DCN for Masa. 06-05-2020 12:47 AM
- Got Karma for Firewall indexing latency: How to track when syslog is read by file monitor when the log is seen in search GUI?. 06-05-2020 12:47 AM
- Got Karma for Re: Firewall indexing latency: How to track when syslog is read by file monitor when the log is seen in search GUI?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect 1: How to enrich the dbquery output to show the database name that systems come from?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect 1: How to enrich the dbquery output to show the database name that systems come from?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
11-15-2016
08:31 AM
Any help with this would be great. Do I still need a TSIDX entry in the index.conf on a UF
... View more
11-14-2016
02:29 PM
1 Karma
Thank you @davpx for your fast responce. I know I can do it. The question, Although not plainly stated is, should I? I don't know if manually doing this will mess-up the upgrade of the indexers in the future.
... View more
11-14-2016
12:29 PM
1 Karma
My indexers are 6.2.3 I upgraded one of my searchheads to 6.5.1 to test my apps and it is trying to put data in the _telemetry index
Can i just create the index on my 6.2.3 indexers?
Will this cause problems when I upgrade my indexers to 6.5.1?
... View more
11-03-2016
11:27 AM
@koshyk It would be great is you could find an answer here and try it out. If you do find an answer please select the answer you like.
... View more
11-03-2016
11:23 AM
@starcher thanks for the link to github. I went to this talk and I agree with Matt. In slide #13 he basicly put in what I had said above. Matt said
Create a “log reading” group and add the spunk user to it, or simply change group ownership to splunk
groupadd syslog
chown -R :syslog /var/log
chmod -R g+s /var/log
usermod -a -G syslog splunk
... View more
11-03-2016
10:57 AM
thank you @crodgers and @satya2p for you help with this problem. I did some experimenting before I posted this question and could see that Power user is the role that allows the ability to share dashboards and searches but I did not want to give a whole organization the power user function. I was hoping there was one attribute that I could add to my custom role for the Organization so that they all would have the right to share items if they so chose.
Thanks again.
... View more
I have a role that has access to apps and indexes and I want the searches created by these users to be able to be changed for sharing within the app and with other users in the app. What permission can I give a role (other than power user) that will let users share searches and dashboards?
... View more
10-14-2016
11:40 AM
1 Karma
three ways that I know of.
1) chmod -r 777 the log directory
2) add the splunk user to the wheel or root group
3) chown -R root:SplunkGroup /var/log/
Hope this helps? Don't know there may be a more restrictive way to do this?
... View more
10-11-2016
05:55 AM
When I do this on my RHEL indexer:
lscpu | egrep 'Thread|Core|Socket|^CPU\('
I get these results:
*
CPU(s): 32
Thread(s) per core: 2
Core(s) per socket: 8
Socket(s): 2
*
Yet in the "Distributed Management Console", I see that my system has 16 CPU's.
Could this be slowing Splunk Processes down or is it just a bug with the "Distributed Management Console"?
I know that the "Thread(s) per core:" means hyper-threading.
Does Splunk not know how to use hyper-threading?
... View more
10-11-2016
05:35 AM
@Koshyk Thanks for the answer this makes sence but the system is a universal forwarder and is not indexing any inputs. Why would I need to put in a TSIDX data path on a universal forwarder?
... View more
10-07-2016
08:21 AM
I upgraded my Windows universal forwarder from 5.2 to 6.5.0. All I did was grab the installer from download and install on top of the older config. I am getting a fatal error on the "parameter=tstatsHomePath not configured" is this a typical issue with the upgrade? What should I put in for the tstatsHomePath on the universal forwarder? Should I change the config at the deployment server? for the nix app or any app that uses the os index? How come this didn't error out on any other index config file?
10-07-2016 09:26:18.372 -0500 WARN IndexerService - Indexer was started dirty: splunkd startup may take longer than usual; searches may not be accurate until background fsck completes.
10-07-2016 09:26:18.372 -0500 ERROR IndexConfig - stanza=os Required parameter=tstatsHomePath not configured
10-07-2016 09:26:18.372 -0500 FATAL IndexerService - Cannot load IndexConfig: stanza=os Required parameter=tstatsHomePath not configured
10-07-2016 09:26:18.372 -0500 INFO IndexerService - adjusting tb licenses
10-07-2016 09:26:18.372 -0500 ERROR IndexConfig - stanza=os Required parameter=tstatsHomePath not configured
10-07-2016 09:26:18.372 -0500 FATAL IndexerService - Cannot load IndexConfig: stanza=os Required parameter=tstatsHomePath not configured
10-07-2016 09:26:18.372 -0500 INFO IndexProcessor - Initializing: readonly=false reloading=false
... View more
09-22-2016
06:18 AM
@somesoni2 you're solution is fascinating. I don't use the mvrange or mvcount much. Can you explain what is happening in the eval | eval dates=mvrange(strptime(Receivedate,"%m/%d/%Y"),strptime(Processdate,"%m/%d/%Y"),86400) please
... View more
09-16-2016
04:44 AM
@iguinn this is the right answer and you are so good at answering. you have helped me several times. I just have one very slight correction in your search.
index=*network sourcetype=switches
| stats count by source_ip
| where source_ip > 200
should be
index=*network sourcetype=switches
| stats count by source_ip
| where count > 200
@iguinn Hope to meet you at .conf2016
... View more
08-24-2016
08:44 AM
Sorry I called support and they said Skip would take the case. That probably means it will be answered by Skip as he is the (cats meow) at splunk support.
If your going to get point for this you have to hurry cause Skip is on the case...
... View more
08-24-2016
06:04 AM
@gfuente I thing you and I are thinking alike. I did the very same troubleshooting steps you suggested in fact the LicenseUsage - type=RolloverSummary logs for each day only show up on one indexer per day. when I do the search with the timeframe earliest=-29d@d latest=-4d@d I get
1 (139) events
2 (68) events
3 (136) events
When I do the search per day by indexer
1 has 10 days
2 has 5 days
3 has 10 days
The data is not evenly balanced but when I do the earliest=-29d@d latest=-4d@d the search returned fast with a dispatch.fetch time of just over 7 seconds. If I change the day by one, later or earlier, one of the search peers times out.
Thanks for the suggestion
... View more
08-24-2016
05:46 AM
I have three indexers. All configured the same all with the same hardware (16 cores 32 GB ram).
I have a simple search for internal data
index=_internal host=My-License-Manager source=*license_usage.log type="RolloverSummary" earliest=-30d@d
This search runs in just over 5 seconds on indexer #1 and times out on indexer #2 and #3
If I change the time to earliest=-35d@d latest=-4d@d indexer #2 returns in 5 seconds but only #3 times out.
If I change the time to earliest=-29d@d latest=-4d@d all three indexers return results in just over 5 seconds.
One day later or one day earlier will cause indexer #2 or #3 to time out.
how do I start to troubleshoot what is causing this. I am sure this can't be isolated to this one data set and has to be affecting other data sets as well.
I opened a Case Number 387826 Date/Time Opened 8/23/2016 7:31 AM with splunk support but no response yet
... View more
08-22-2016
08:59 AM
@somesoni2, since the accepted answer in the "Have forwarder duplicating data to 2 indexes." answer is using the crcSalt command the duplicate log events sent to both indexes will be seen as individual records and count twice against the splunk license. If summery of accelerated search is done to put the data in a tsidx OR summarydb it will not be charged against the license. I get that if this is done at the forwarder or at index time rather than at search time this could potently save CPU cycles or at lease READ IO but overall I don't think you are really saving resources by doing it at index rather than at search time so why use extra licensing to index the same event twice??? -- Sorry just my opinion --( :-] )
See you all at the end of September >DOT CONF IS COMING<>DOT CONF IS COMING<
... View more
08-17-2016
08:57 AM
thanks much this helped
... View more
08-17-2016
08:55 AM
I think I figured it out. Regex is case sensative and I had two source zones on with a lower "u" and one with an upper "U" so i had to add the "|" OR symbol to add the second source-zone-name
[srxDropDeny]
REGEX = (RT\_FLOW\_SESSION\_DENY.+(source-zone-name\=\"untrust\"|source-zone-name\=\"Untrust\"))
DEST_KEY = queue
FORMAT = nullQueue
... View more
08-17-2016
08:35 AM
here is a sample of the firewall log that I am trying to drop
<14>1 2016-08-17T10:32:06.470-05:00 Astraeos RT_FLOW - RT_FLOW_SESSION_DENY [[email protected] source-address="y.y.y.y" source-port="37949" destination-address="x.x.x.x" destination-port="80" service-name="junos-http" protocol-id="6" icmp-type="0" policy-name="my policyname" source-zone-name="Untrust" destination-zone-name="my zone" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="reth0.0" encrypted="UNKNOWN" reason="none"]
... View more
08-17-2016
07:54 AM
I am trying to filter out all inbound deny syslog that the firewall is sending
I have a props.conf like this
[srx_log]
TRANSFORMS-srxDrop = srxDropDeny
I have transforms.conf like this
##############################
# Drop Firewall inbound deny
###############################
[srxDropDeny]
REGEX = (RT\_FLOW\_SESSION\_DENY.+source-zone-name\=\"untrust\")
DEST_KEY = queue
FORMAT = nullQueue
I can see that the logs are not being dopped.
How do I ..... Or where do I look to see why this is not working. Is there an internal log that tracks the transforms and props activity? is there a log file that tracks if or if not a filter is working?
... View more
08-10-2016
05:39 AM
thanks much for the help. I haven't used sed before. I'm more of a windows guy but I have done a little perl and a few .sh simple scripts
... View more
08-10-2016
05:32 AM
@skoelpin thanks for any help you can be. The OS is RHEL 6 the output is in key-value pairs as I am use the eval command to create the correct syntax for the outlput values. Check the eval commands in the above search. I use the bdquiry to get the 'URL' and 'CI Name' values. Then do the eval commandss to put those values in the right syntax for the CSV style output.
in the output I get the header row ping,interval,title,url,agent then in each row after that I get the individual values, comma separated of course.
I can put this in word-processor and manipulate it like this;
delete the first row
delete all the quote marks
everywhere there is a line break put two line breaks
everywhere there is a comma put a line break
this gives me the right format for the input.conf
If you could help with the automation of the "search and replace" as above that would help a great deal
... View more
08-10-2016
05:19 AM
@cusello thanks for the response. I think the input.conf for this app will refresh with the new entries without having to restart splunk. if not I can automate , schedule, cron job the restart.
... View more
08-09-2016
01:46 PM
I have a dbquery that outputs the 5 fields needed for the inputs.conf file used in the Website Monitoring app.
I would like to automate the writing from the dbquery into the format of the .conf file
[web_ping://Sharepoint]
interval = 15m
title = Sharepoint
url = https://collaboration.sp.local
user_agent = Splunk Website Monitoring (+https://splunkbase.splunk.com/app/1493/)
How can I convert the 5 fields to write in this way and not in a CSV file like I am used too?
The five field are like this
mysearch | eval ping=("[web_ping://".'CI Name'."]") | eval interval=("interval = 15") | eval title='CI Name' | eval url=("url = ".'URL') | eval agent=("user_agent = Splunk Website Monitoring (+".'URL'.")") | fields ping interval title url agent
Thanks in advance
... View more
