Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About BrendanCO
BrendanCO
Path Finder
Member since:
02-05-2015
02-17-2023
Community Statistics
| Posts | 111 |
| Solutions | 0 |
| Karma Given | 20 |
| Karma Received | 3 |
| Member Since | 02-05-2015 |
Activity Feed
- Got Karma for Re: Where are alerts stored in Linux directory structure?. 02-07-2024 01:55 AM
- Posted Re: Missing menus in Enterprise Security? on Splunk Enterprise Security. 02-17-2023 01:27 PM
- Posted Missing menus in Enterprise Security? on Splunk Enterprise Security. 02-17-2023 11:53 AM
- Posted Re: Suspected Network Scanning - Fine tuning - exclude DNS and external IPs on All Apps and Add-ons. 01-31-2023 08:24 AM
- Karma Re: Search lag error for DalJeanis. 10-27-2022 03:25 PM
- Posted Re: When trying to create a self-sign certificate, why am I receiving "unknown option -config" and "can't on Getting Data In. 09-15-2022 02:12 PM
- Karma Re: When trying to create a self-sign certificate, why am I receiving "unknown option -config" and "can't open config file" errors? for dstaulcu. 09-15-2022 01:59 PM
- Karma Re: Splunk ES datamodels broke (search delayed) after upgrade for richgalloway. 03-29-2022 03:53 PM
- Posted Re: Splunk Add-on for Microsoft Windows - Remote Active Directory domain on Splunk Search. 02-10-2022 10:12 AM
- Posted Re: Splunk Add-on for Microsoft Windows - Remote Active Directory domain on Splunk Search. 02-10-2022 09:25 AM
- Karma Re: Splunk Add-on for Microsoft Windows - Remote Active Directory domain for PickleRick. 02-10-2022 09:25 AM
- Posted Splunk Add-on for Microsoft Windows - Remote Active Directory domain on Splunk Search. 02-10-2022 08:21 AM
- Posted Re: Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS on Getting Data In. 02-03-2022 06:47 AM
- Karma Re: Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS for PickleRick. 02-03-2022 06:46 AM
- Posted Re: Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS on Getting Data In. 02-01-2022 06:46 PM
- Karma Re: Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS for PickleRick. 02-01-2022 07:24 AM
- Posted Re: Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS on Getting Data In. 01-31-2022 09:57 AM
- Posted Re: Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS on Getting Data In. 01-31-2022 09:51 AM
- Posted Re: Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS on Getting Data In. 01-31-2022 09:49 AM
- Posted Re: Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS on Getting Data In. 01-28-2022 12:38 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-20-2017
01:43 PM
I have an update for those interested in this. I added an input in one of the dashboards. It didn't work. So, I went back in and deleted the input and saved. This broke the dashboard, permanently. I checked out the source code of the dash and couldn't find anything related to what I did, but it sure as sh*t didn't work again until I deleted the app and reinstalled.
... View more
04-20-2017
11:15 AM
Hello! I'm trying to edit a dashboard and add an input to filter by "dvc_host". We are now bringing in multiple PANs and I'd like to be able to look at these dashboards by each individual PAN.
Looking at the input "src_ip" I see the format looks like this:
http://imgur.com/MaikAM7
Now, I try to add the input "dvc_host" and mirror the input with the appropriate field name:
http://imgur.com/h4YRL2t
And it doesn't work.
A little help, please?
... View more
Awesome. Looking through them (there were like 10 instances of that file), I found the ones I needed. I just copied $OldSPlunk/etc/users/admin/search/local/savedsearches.conf to #Splunk_home/etc/users/admin/search/local/savedsearches.conf and it worked like a charm! Thanks a lot somesoni2!
... View more
Hello. I had to move my entire old Splunk directory to a new filesystem for archiving as it was pretty hosed. Did a reinstall back to /opt/splunk and have just been setting it all up again. I created some pretty specific alerts previously that I would like to see if I can just copy over from the old instance. Does anyone know where those are stored?
... View more
04-18-2017
02:14 PM
Adonio - did this change to completed? I still don't have the dashboards working and everything is running from user splunk. I can confirm that I installed Splunk as the user splunk.
... View more
04-18-2017
02:00 PM
I changed all the permissions, restarted splunk with user splunk and then went back in. I'm still getting a blank dashboard
... View more
04-18-2017
01:38 PM
Question. I have the $SPLUNK_HOME/var/run/dispatch linked to forward to another drive. It looks like this:
http://imgur.com/w0vW1hJ
The dispatch folder is where I believe searches are saved. Could this be causing an issue? Also, I see it's owner is root. Is that correct?
... View more
04-18-2017
01:33 PM
Looks good:
http://imgur.com/5yQyhVy
... View more
04-18-2017
01:17 PM
Gotcha. I think I'm putting it in right?
http://imgur.com/AgWpwdJ
... View more
04-18-2017
01:07 PM
That doesn't seem to be getting any results:
http://imgur.com/3AFLyDy
... View more
04-18-2017
12:55 PM
OK, that one worked.
http://imgur.com/qlPZYzk
... View more
04-18-2017
12:42 PM
I think I have it right this time, but still no results.
http://imgur.com/dP7GIdL
Weird how copying from this site doesn't always paste correctly.
... View more
04-18-2017
12:33 PM
You'll be happy to know that there are no more results in the palo logs when i restart Splunk.
index = _internal log_level = ERROR OR log_level = WARN paloalto
No new results! Just ones that triggered earlier
... View more
04-18-2017
12:23 PM
Nothing for that search either:
http://imgur.com/LP9LDVC
... View more
04-18-2017
12:09 PM
Hmm. Also nothin...
... View more
04-18-2017
12:00 PM
I believe I have it typed correctly now, but it returned zero results:
http://imgur.com/2fTKhRR
... View more
04-18-2017
11:46 AM
I'm sorry that I'm missing something here. This is what I'm typing and this is what the error is:
http://imgur.com/npGdNCb
... View more
04-18-2017
11:31 AM
I must be missing something. I put in:
` pan_logs sourcetype="pan:" log_subtype="" | timechart span=10s count by log_subtype`
and it says:
Error in 'SearchParser': You must provide a macro expression.
... View more
04-18-2017
11:06 AM
I also just fixed the hard fd error, via this article:
https://splunkgeek.blogspot.com/2015/05/the-hard-fd-limit-is-lower-than.html
... View more
04-18-2017
10:55 AM
Ok, I copied the file to the correct directory. The dashboards are still not populating.
... View more
04-18-2017
08:07 AM
Ok, I just changed SplunkforPaloAltoNetworks to Global. It was set on "App". Splunk_TA_paloalto was correctly set to global.
Running the search you have provided, here are the results:
http://imgur.com/Z7UCmm7
... View more
04-17-2017
05:49 PM
Due to the error on transparent huge pages, I followed the instructions at this link to disable that...
https://docs.mongodb.com/manual/tutorial/transparent-huge-pages/
... View more
04-17-2017
05:30 PM
Ok, here's what I'm showing... I took 5 screen shots of logs. Being newer to Splunk, I was wondering how to query multiple log files from the console! Thanks for that trick. Looks like there's a BUNCH of stuff going on.
http://imgur.com/Mrt7Cdt
http://imgur.com/GmchHsN
http://imgur.com/NqRtDkq
http://imgur.com/L6wdL03
http://imgur.com/uUTMFs5
... View more
04-17-2017
02:02 PM
I don't know if this means anything but when tailing splunkd.log I see this:
04-17-2017 15:00:37.206 -0600 INFO DatabaseDirectoryManager - idx=_internal Writing a bucket manifest in hotWarmPath='/splunkdata/_internaldb/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
04-17-2017 15:00:37.207 -0600 INFO DatabaseDirectoryManager - idx=_introspection Writing a bucket manifest in hotWarmPath='/splunkdata/_introspection/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
04-17-2017 15:00:37.208 -0600 INFO DatabaseDirectoryManager - idx=main Writing a bucket manifest in hotWarmPath='/splunkdata/defaultdb/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).'
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-17-2023
11:56 AM
|
Karma given to
