About mzorzi

mzorzi · ‎10-18-2012

You should use the mvzip function of eval: | eval fields = mvzip(field_1,field_2) | mvexpand fields | rex field=fields "(? \d+),(? \d+)" | table _time alpha beta'

mzorzi · ‎07-26-2012

Currently, we've got four indexers and about 1400 forwarders. These forwarders all send their data to the indexers over the Internet. The autoLB parameter is set on the forwarders to send to all four indexers. I'm curious if there is any way to set up a reverse proxy so that we can have one externally facing IP address and port, but then have the incoming traffic divided up between the indexers. Many of our forwarders are at customer sites, and having them update their firewall rules every time we add a new indexer is frustrating for the customer and cumbersome for us.

mzorzi · ‎06-11-2012

I'm planning to export and data out of Splunk, anonymize it and import it back. The idea is to use export/import command or event exporttool/importtool Do those commands count against the license usage?

mzorzi · ‎05-29-2012

It is not at all a permission problem as the error suggests. The service fails to start with error " Error 193 oxc1" which is described in: http://support.microsoft.com/default.aspx?scid=kb;en-us;Q325680 . The problem was caused by the presence of a file called C:\Program ; once removed the installation runs like a charm

mzorzi · ‎05-29-2012

My Splunk Installation failed with the error << Splunk Installer was unable to start Splunk Services. Please make sure you have provided the correct username and/or password, and the user you are trying to run Splunk as has the correct privileges. Exitcode='4' >> After that the installation is rolled back. We double checked the permission and run the installation as local Administrator, still not chances

mzorzi · ‎04-30-2012

We are interested in Splunk but we need to know which open source package are shipped within Splunk and which version

mzorzi · ‎01-23-2012

This situation seems to happen when there was a previous Splunk instance running under C:\ and then an uncomplete uninstall was not performed ( not sure if because of the uninstall program or what ) and in the registry there are still reference of the old Splunk Instance. In particular after performing an uninstall there was this suspicious entry still there: HKEY_LOCAL_MACHINE\SOFTWARE\Python\PythonService You can try: 1) Stop Splunk 2) Make a backup of buckets and configuration files 3) Uninstall Splunk 4) Search the registry with every entry with Splunk and/or Python on it and clean them 5) Perform a full installation 6) restore the configuration files & buckets 7) create an empty file called ftr under %SPLUNK_HOME% 8) Restart Splunk Alternatively you can try to remove only the python key above and perform another upgrade on top of your %SPLUNK_HOME

mzorzi · ‎01-23-2012

Upgrading FreeBSD to 7.3-RELEASE-p10 has resolved this issue.

mzorzi · ‎01-23-2012

On Freebsd 7.1-RC2: After upgrading from splunk-4.2.3-105575 to splunk-4.3-115073 an error was returned with Undefined symbol "closefrom". I need to know what I can do to recover from this. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Validated databases: _audit _blocksignature _internal _thefishbucket ciscoswitches firewall history hotran ironport junos main os summary webcluster Done Unexpected EOF from process runner child! helper process seems to have died (child exited with code 1)! Error from ProcessRunner helper process: /libexec/ld-elf.so.1: /opt/splunk/bin/splunkd: Undefined symbol "closefrom" SSL certificate generation failed.

mzorzi · ‎11-18-2011

Create an empty file $SPLUNK_HOME/ftr and restart Splunk. This will validate your configuration files and eventually creates the required one if they are not there yet, as described in this answer: http://splunk-base.splunk.com/answers/32434/how-to-change-hostname-of-a-universal-forwarder-on-vmsxendesktop-agent

mzorzi · ‎11-18-2011

I've copied my configuration files from Splunk 4.1 to my new Splunk 4.2 and now I would need to run the Migration process even if it is not an update, in order to validate my configuration files. How can I do that?

mzorzi · ‎11-16-2011

via REST point as described on the Documentation page: http://docs.splunk.com/Documentation/Splunk/4.2.4/RESTAPI/RESTsearch#alerts.2Ffired_alerts

mzorzi · ‎10-03-2011

You should use the TIME_PREFIX, instead of ^[^,], I would use a regex for the ip, then a non space, like \S

mzorzi · ‎09-13-2011

A subsearch is limited by default and it is meant to be used for small searches. You can find more useful on this page: http://docs.splunk.com/Documentation/Splunk/4.2.3/User/HowSubsearchesWork

mzorzi · ‎09-05-2011

try: source="/logs//.log" NOT source="/logs///.log" eventually with backslashes. But really you should avoid the wildcard in searches for performance reason

mzorzi · ‎09-05-2011

If you are connecting through a reverse proxy and IIS certificate is expired I believe you shouldn't even come so far to talk to splunkd. Since the error is recorded by splunkd, I believe it is Splunk certificate which is expired

mzorzi · ‎08-26-2011

With the option followTail enabled Splunk is going to monitor only events being added into the monitored stanza after restarting Splunk. Maybe the old files are in compress format and their modification time has been changed. Or maybe you have an incorrect timestamp extraction problem, and the events are not really from last year. You can find more information on how to troubleshoot this problem by reviewing the content of this twiki page: http://www.splunk.com/wiki/Community:Troubleshooting\_Monitor_Inputs and this answer: http://splunk-base.splunk.com/answers/1162/is-there-some-way-to-see-the-current-tailing-status-of-my-files-from-splunk-ui

mzorzi · ‎08-23-2011

There are few ways to do this: You can extract and name the fields using a Interactive Field Extractor included into Splunk. Here you can find link to documentation page and video: http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample http://www.splunk.com/view/SP-CAAADUY You can use the Field Extractor App: http://splunk-base.splunk.com/apps/22291/field-extractor You can extract your fields using configuration files, like described here: http://splunk-base.splunk.com/answers/13580/teach-splunk-42-to-identify-positions-in-a-csv-file

mzorzi · ‎08-23-2011

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

mzorzi · ‎08-17-2011

I have a long xml file with many < host id> stanzas. Each one of these stanza has an < ip> value associated and many < vulnerability id> stanzas. Each one of these has a set of 3 values made of < score> < port> < protocol> this is an extract: <hosts> <host id="565558" persistent_id="98487"> <ip>85.205.34.28</ip> <vulnerabilities> <vulnerability id="2099" custom="0"> <score>8671</score> <port>0</port> <protocol>smb</protocol> </vulnerability id> </vulnerabilities> </host id> <host id="565560" persistent_id="98485"> <ip>85.205.34.27</ip> <vulnerabilities> <vulnerability id="552" custom="0"> <score>8</score> <port>137</port> <protocol>udp</protocol> </vulnerability id> <vulnerability id="1492" custom="0"> <score>0</score> <port>139</port> <protocol>tcp</protocol> </vulnerability id> </vulnerabilities> I would like to create searches that: 1) Give me all vulnerabilities with vulnerability id=552 and port=137 and make a result table with fields ip, vulnerability id, port, score 2) Give me all hosts / ips with existing risks with a score higher than 5000 and make a result table with fields ip,score, vulnerability id, port How can I achieve this?

mzorzi · ‎08-16-2011

index=* | stats count by productNames | sort -count

mzorzi · ‎08-16-2011

let's say the search that returns your event is: index=myindex errorfield="corrupted file" You could use the not condition: NOT ( index=myindex AND errorfield="corrupted file" ) And then trigger the Alert when the number of these events is greater than zero

mzorzi · ‎08-16-2011

Can you please specify exactly how often do you want to run this search?

mzorzi · ‎08-16-2011

try this search with all the time: index="*" sourcetype="*131228018*"

mzorzi · ‎08-02-2011

If that happens periodically I would check the Windows Event Logs

Posts	109
Solutions	14
Karma Given	74
Karma Received	231
Member Since	‎02-24-2010

Online Status	Offline
Date Last Visited	‎08-28-2022 04:48 AM

How do I route data based on the Index field

Timechart Per Day With Tick Mark Per Calendar Week

Hong Kong Timezone HKT not being recognised ?

How to Extract Fields from McAfee Vulnerability M...

Can I Export PDF Via Rest?

Splunk App for Enterprise Security: Why am I getti...

How to Best Test if my SSL Certificate is valid

Splunk Mobile App: How to Open a Dashboard Directl...

Hadoop Export functionality is failing

XML multivalue field extraction

Re: Can splunk do this? search command -> mvexpand...

Forwarders and Reverse Proxy

Does Import Command Count Against License?

Re: Why Splunk installation fails with Exitcode='...

Why Splunk installation fails with Exitcode='4' ...

Which Open Source Packages Are Shipped With Splunk...

Re: Splunkweb starts, then ends and the service is...

Re: Freebsd 7.1-RC2: Error 'closefrom' After Updat...

Freebsd 7.1-RC2: Error 'closefrom' After Updating ...

Re: How do I re-run the Migration process?

How do I re-run the Migration process?

Re: Delete fired-alerts via endpoint?

Re: failed to parse timestamp for event

Re: Subsearch limit is 10,500 results ?

Re: search question

Re: how do i know if it is Splunk SSL Certificates...

Re: Monitor advice needed

Re: how to show top talker information based on th...

Re: Indexes Overloaded?

XML multivalue: N vulnerabilities per Host id

Re: Grouping events

Re: Alerting on undefined events.

Re: Schedule search to run every 15 seconds

Re: How to find events with invalid date prior to ...

Re: Splunk Forwarder Service continually stops

Join the Conversation