About burwell

burwell · ‎06-12-2020

Build onto what Rich said. Seems like the search Splunk Web Login Attempts is not getting run or getting delayed. The Monitoring Console can show you info about the reason for skipped searches.

burwell · ‎06-11-2020

Hello. What version of Splunk? Have you looked in index=_internal source=*splunkd.log for any clues?

burwell · ‎06-11-2020

You should check out btool to find out which configs are in effect. /opt/splunk/bin/splunk btool deploymentclient list --debug You will see where the configs from each file come from.

burwell · ‎04-17-2020

Scheduled jobs run using the time zone of the user who scheduled the job. This can lead to great debugging confusion. I strongly urge my users to use UTC which is what all our logs use.

burwell · ‎04-03-2020

Hi. Can you share the version of Splunk and what the error is as you create the alert?

burwell · ‎03-12-2020

Hi. We use Slack and set up a channel for general splunk questions and one for admins. This way the community can answer questions and not just a few of us. We have a central place for Splunk announcements like local user group meetings and we store documents specifically relating to Splunk users in our company. Encourage the power users to document Splunk best practices around their area of expertise. We organize internal brown bag meetings to bring users together. We got Splunk training included in our license so we encourage people to take the classes.

burwell · ‎01-30-2020

Hi. What version of Splunk are you running? I can't find anything in the release notes about your issue but I see someone else had a similar problem with Splunk 7.2.x https://answers.splunk.com/answers/737480/did-the-cron-scheduler-change-between-versions.html

burwell · ‎01-30-2020

Hi. If you want to run at :15 and :45 every hour you want 15,45 * * * *

burwell · ‎01-30-2020

Great @smiejascott Want to accept the answer?

burwell · ‎01-29-2020

@smiejascott Hi so be clear: This sentence was in the above docs. Do not try to upgrade Splunk Enterprise or Splunk universal forwarders directly to version 8.0 from a version that is lower than 7.0.

burwell · ‎01-22-2020

Hi. You should read https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST This clearly says don't go from 6.x to 8.x universal forwarder. You need to go to version 7 first.

burwell · ‎01-16-2020

Hi. What errors are you seeing? What is your query? Are you getting any results?

burwell · ‎01-09-2020

Haha. I didn't know the default was 100 days. if this is the answer you need can you accept the answer? Thanks!

burwell · ‎01-09-2020

There is a way to limit search execution time. You do it by role and you put the configs in authorize.conf. For example you can limit power users to 30 minutes. This is applicable for ad-hoc or scheduled searches [role_power] srchMaxTime = 1800

burwell · ‎01-03-2020

Hello. You have asked for stats. In smart mode you won't see the actual events when you have | stats. If you want to see the actual events as well as stats, switch to Verbose mode The cool thing about Smart mode with stats is that it is quicker because the computation is performed by the indexers.

burwell · ‎12-24-2019

Yes you can have your indexers listen in two different ports: one with SSL and one not.

burwell · ‎12-23-2019

I am not familiar with SubCA. For us in 7.x we do the following on our heavy forwarders (like indexers). For inputs,conf [splunktcp-ssl:<port>] [SSL] requireClientCert = true sslCommonNameToCheck = <comma separated list of common names> serverCert = <concatenated server cert> In the server.conf we have this [sslConfig] enableSplunkdSSL = true requireClientCert = true sslRootCAPath = <our ca cert> serverCert = <our concatenated cert; see below) sslCommonNameToCheck = <our common name> For our cert we concatenate together: cert key caCert

burwell · ‎12-20-2019

In addition to the Smart store documentation, you could watch the recording from the SF Bay area user group in July. https://usergroups.splunk.com/group/san-francisco-bay-area-splunk-user-group/a1400214-6d20-479e-8c8a-72becc4ddcab.html We had a vendor talk about SmartStore and there were some good questions.

burwell · ‎12-17-2019

WIthout seeing your search, as others have commented, it's hard to know how to speed things up. As a suggestion: create a scheduled search to run each day. Then use loadjob to load the results in: | loadjob savedsearch="yoursusername:yourapp:yoursearchname" For example: | loadjob savedsearch=burwell:search:mysearch1 You can add events=false to speed things up

burwell · ‎12-16-2019

Thanks. I was looking for a solution that didn't involve updating each savedsearch. This is a technique I will test.

burwell · ‎12-15-2019

Thanks @woodcock so what would the search be for a non admin to get that sid with Unix date?

burwell · ‎12-14-2019

Thanks! I modified this search to avoid the error about not being able to access the REST call per https://answers.splunk.com/answers/712773/error-on-overview-pane-failed-to-fetch-rest-endpoi.html | rest splunk_server=local /services/saved/searches/mysearch/history | search isDone=1 | stats max(published) as search_date | eval search_date=strftime(strptime(search_date,"%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d %H:%M:%S") | rename search_date AS "Search Date" | table "Search Date" This works. @aromanauskas BTW if you convert to answer I can accept this answer. Thanks.

burwell · ‎12-13-2019

I have non Admin users with dashboards. The base search uses a loadjob of a job that is scheduled each day to look at a day's worth of events. Other searches in the dashboard use the loadjob command. This all works well. The scheduled job takes a long time to run and sometimes the scheduled job fails. We change the job TTL to keep the results for 3 days to keep the results. The user wants to see the date that the scheduled job loadjob command is using. The user isn't an admin so does NOT have access to the _audit index. Is there any way for a non admin to display the job date of the latest saved search to display in a dashboard? The user wants to know which day the job results are for. FYI if they did they could do something like index=_audit savedsearch_name="MySearch" info=completed result_count>0 | eval job_start_time=strftime(exec_time,"%Y-%m-%d %H:%M:%S")

burwell · ‎12-03-2019

Hello. I would install the Linux add on to collect data about your operating system. https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About There's version.sh which would collect the data. Then I would figure out what the current version is on your situation and alert on hosts that need patching.

burwell · ‎11-16-2019

So you are doing scripted input? Splunk runs the script on the interval you specify and then indexes the output. I don't think there's an intermediate location.

Posts	466
Solutions	50
Karma Given	145
Karma Received	165
Member Since	‎05-01-2014

Online Status	Offline
Date Last Visited	a month ago

Splunk bug in Enterprise 9.1 and 9.2: Indexers are...

Upgrading Enterprise from 9.1.7 -> 9.2.4: hit cloc...

Changing permission of a private knowledge object ...

Run a generating command over a set of values

Non-admin user needs savedsearch job date in dashb...

Best practices for deployment server: make sure ap...

MLTK: How best to conditionally update model in an...

Replacing third party server certificate while Spl...

How does Splunk log keyword pair extraction overwr...

How can I combine stats count by host into a singl...

Re: Health Red

Re: Splunk WEB GUI Hang up On Loading

Re: What if we place the deploymentclient file und...

Re: How to change time zone from EST to CET on sc...

Re: Server Error while setting up an alert

Re: Looking for ways to socialise Splunk in the co...

Re: Splunk Ignores my cron and sets his own daily

Re: Splunk Alert - Cron Schedule Help

Re: Universal Forwarder 8.0 upgrade path from 6.x

Re: Universal Forwarder 8.0 upgrade path from 6.x

Re: Universal Forwarder 8.0 upgrade path from 6.x

Re: No indication of error in job manager

Re: Is there a way to limit a scheduled search by ...

Re: Is there a way to limit a scheduled search by ...

Re: Your search did not return any events because ...

Re: How to set up SSL/TLS for the Splunk indexer

Re: How to set up SSL/TLS for the Splunk indexer

Re: SmartStore with on-prem S3 : Best Practices & ...

Re: Improve dashboard performance

Re: Non-admin user needs savedsearch job date in d...

Re: Non-admin user needs savedsearch job date in d...

Re: Non-admin user needs savedsearch job date in d...

Non-admin user needs savedsearch job date in dashb...

Re: Splunk query to see Linux patching

Re: where does splunk store output of shell script...

Join the Conversation