About dshpritz

dshpritz · ‎12-12-2017

From those, it looks like there are two things: The action field is not being extracted properly for the source data You should edit the network_traffic_tstats and network_traffic_tstats_pre to include the allow_old_summaries=true at the end (it defaults to false, but if your DMAs are rebuilding or in process, setting it to true can help display data in a more prompt manner.

dshpritz · ‎12-12-2017

From that screenshot, it looks like some of your fields may not be mapped correctly, but it's a hard thing to try to fix over answers. What kind of results do you get if you run: | tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic by All_Traffic.action vs | tstats summariesonly=true allow_old_summaries=false count from datamodel=Network_Traffic by All_Traffic.action

dshpritz · ‎12-12-2017

And this is on the same search head as the Network Traffic App? can you post some screenshots of the particular dashboard you are having issues with?

dshpritz · ‎12-12-2017

Have you accelerated the Network_Traffic data model? You can run the following to test: | tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic This should be run over the time range you for which you would like to see reports. This will give you a count of the number of events present in the accelerated data model. If that number is zero, there there is nothing in there, so the accelerations have either not been configured, or have not completed. If the number seems like it may be accurate for the number of events you expect to see, then there is something else going on. Thanks, Dave

dshpritz · ‎10-06-2017

We only include the inputs.conf.

dshpritz · ‎08-07-2017

I know this is late, but it could help others: If you have the Splunk Add-on for Windows installed, you will get two fields when looking at 4720 events, the user and the src_user . In the context of this event, the src_user is the user creating the account and the user is the user being created. Note that per the Common Information Model, this isn't correct, and you would expect the user to be the user creating the action and the user being created should be in a field named object . So, in this case, the TA is incorrect. HTH, Dave

dshpritz · ‎06-06-2017

Those are searches for report acceleration. If you get the "savedsearch_id" field from the results it will give you the name of the user and the app, and the "search_type" field will tell you the type of acceleration.

dshpritz · ‎04-27-2017

The Web data model has a child object of "Proxy" which is usually used for outbound proxy events (think Bluecoat, Websense, etc). This would mean that your "normal" proxy data would be tagged as "web" and "proxy" whereas you reverse proxy/other web data (F5, Apache, etc.) would only be tagged as "web". This would allow you to filter results in tstats query on the "nodename" field. HTH, Dave

dshpritz · ‎04-07-2017

As a self plug here, I work for a company called Aplura. We are based outside of Baltimore, and I am sure we would be able to meet your needs. We regularly deliver Professional Services as well as longer term O&M. We can be found at https://www.aplura.com. Thanks!

dshpritz · ‎03-17-2017

Hello mcbradfords, This isn't something that getwatchlist does, mostly because it really isn't something I have found was needed, outside of Splunk's capabilities. My suggestion here would be to create a lookup which points to a local file, and then update the file that the lookup is pointing to. Failing that, you would have to have some kind of http server that is serving up the file, but if you are local system access already, I would go with the lookup route. You may also want to look at the inputcsv command. Hope this helps. Dave

dshpritz · ‎02-24-2017

Updated! It has been tested on 6.5 and works correctly.

dshpritz · ‎02-03-2017

Yep, you are correct, this is an issue with the Splunk_TA_bluecoat-proxysg.

dshpritz · ‎02-03-2017

There are a few issues here. The first is that some of these field values are malformed, or the value appears to be from bad extractions ("TCP_N", "image/gif"). The second is that there is a lookup in the app called bluecoat_proxy_actions.csv which translates the "vendor_action" to the "action" field, and it appears to be missing some possible "vendor_action" values. You can add these values yourself, but you should also open a ticket with Splunk, as this will need to be corrected in the Addon, so that when you update it it doesn't cause problems.

dshpritz · ‎02-03-2017

what is the value of the "vendor_action" field for the events?

dshpritz · ‎02-03-2017

Is this bluecoat data? what is the value of the "vendor_action" field for the events?

dshpritz · ‎02-03-2017

That's going to depend on your extractions and data. Try a search like: | datamodel Web Proxy search | search Web.action="unknown" to get an idea of what the data looks like.

dshpritz · ‎12-21-2016

You shouldn't this is the only correct answer at the moment. Tstats is not CIDR aware for WHERE clauses.

dshpritz · ‎12-21-2016

tstats is not CIDR aware for where clauses. Sorry 😞

dshpritz · ‎11-28-2016

Per the previous releases page, 5.0.17 is the last version of the Splunk forwarder that supports XP. I don't expect that Splunk is interested in supporting XP in anything past that. Even Win7 isn't supported by the latest version of Splunk (6.5 drops Win7 support). Sorry.

dshpritz · ‎11-28-2016

From looking at the docs, it looks like the indexers would be running a custom command: http://docs.splunk.com/Documentation/CEFapp/2.0.0/DeployCEFapp/Howtheappworks#Technical_implementation So, although the search head would kick off the search, part of that command would be a custom command that runs on each indexer and would output the data. HTH, Dave

dshpritz · ‎10-26-2016

in this case, the impact is that the events will be larger, and the errors will go away. Generally, adjusting that value will allow for larger events. If your linebreaker is wrong, and you allow jumbo events, the possibility exists that your indexers/HFs will become unhappy.

dshpritz · ‎09-19-2016

If that is correct, then you should most likely accept my answer above 🙂 Thanks!

dshpritz · ‎09-08-2016

The most likely cause is that you have accelerated data models enabled, which will cause some very long searches to be run. To solve this, you will need to adjust the truncate setting for that sourcetype on your indexers: props.conf: [splunkd_remote_searches] TRUNCATE = 999999 yes, that's a large number, but in my experience it works just fine.

dshpritz · ‎09-07-2016

Are the items that you want to separate the data by available in the data? That is, are the hostnames in the eventdata itself?

dshpritz · ‎09-07-2016

You should still do a reload. I've gotten this error before and have found that it helps if you specify the class that you made adjustments to: ./splunk reload deploy-server -class newclass I would also suggest that you open a support ticket, because I believe this is a bug.

Posts	302
Solutions	61
Karma Given	501
Karma Received	400
Member Since	‎12-15-2010

Online Status	Offline
Date Last Visited	4 weeks ago

How can I override the timezone for Splunk DBX 3.1...

How can I get actual host names or IPs for Rapid7 ...

Why is syslog right into Splunk so bad/wrong?

SimpleXML, piecharts, percentages and custom drill...

dispatch.finalizeRemoteTimeline taking a long time...

Creating a multivalue field from a result?

Re: Dashboards not working

Re: Dashboards not working

Re: Dashboards not working

Re: Dashboards not working

Re: Different configs for Splunk_TA_windows depend...

Re: How to search Windows event logs for the "crea...

Re: How to track the cause of skipped saved search...

Re: How do I distinguish inbound vs outbound in th...

Re: Anyone familiar with any good SPLUNK consultan...

Re: Getwatchlist Add-on for Splunk Enterprise: How...

Re: Getwatchlist Add-on for Splunk Enterprise: Is ...

Re: App for Web Proxies: Why is Action showing as ...

Re: App for Web Proxies: Why is Action showing as ...

Re: App for Web Proxies: Why is Action showing as ...

Re: App for Web Proxies: Why is Action showing as ...

Re: App for Web Proxies: Why is Action showing as ...

Re: How do I do a cidr match/not match in a tstats...

Re: Is it possible to do a CIDR match in a tstats ...

Re: How to install the latest Splunk Universal For...

Re: Splunk App For CEF 2.0: How do indexers run se...

Re: Numerous messages WARN LineBreakingProcessor ...

Re: Can I run Splunk DB Connect versions 1 and 2 s...

Re: Numerous messages WARN LineBreakingProcessor ...

Re: How to direct incoming data from heavy forward...

Re: Is it necessary to reload if we do any changes...