Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About splunkreal
splunkreal
Influencer
Member since:
05-26-2016
yesterday
Community Statistics
| Posts | 633 |
| Solutions | 32 |
| Karma Given | 891 |
| Karma Received | 50 |
| Member Since | 05-26-2016 |
Activity Feed
- Karma Re: AI toolkit (MLTK) & Ollama for VatsalJagani. yesterday
- Posted Re: Intermediate findings in analyst queue ES v8.3 on Splunk Enterprise Security. yesterday
- Karma KVStore does not start when running Splunk 9.4 ( WITH A SOLUTION ) for triptraptresko. 3 weeks ago
- Karma Re: Splunk KV store does not start for claudio_manig. a month ago
- Karma Re: Splunk Add-on for Check Point Log Exporter for kknairr. 04-17-2026 09:00 AM
- Posted Re: How to resolve disk usage show negative value on monitoring console after adding storage. on Splunk Enterprise. 04-16-2026 03:23 AM
- Posted Re: How to resolve disk usage show negative value on monitoring console after adding storage. on Splunk Enterprise. 04-14-2026 09:02 AM
- Posted Re: No result using sourcetype on Splunk Search. 04-08-2026 07:24 AM
- Karma Re: Search by sourcetype returns no results for bmaupin. 04-08-2026 07:24 AM
- Karma Re: Splunk Forwarder SSL unsupported certificate purpose? for cbtadmin. 04-08-2026 02:34 AM
- Karma Re: Indexer/UF SSL: requireClientCert and SSL3_GET_RECORD:wrong version number (7.3.2) for harsmarvania57. 04-07-2026 02:27 PM
- Karma Re: How to quickly validate the metadata files of a given index and of all its buckets? for hexx. 04-06-2026 05:11 AM
- Posted Re: No result using sourcetype on Splunk Search. 03-30-2026 08:11 AM
- Karma Re: No result using sourcetype for isoutamo. 03-30-2026 02:06 AM
- Posted Re: No result using sourcetype on Splunk Search. 03-26-2026 04:23 PM
- Posted No result using sourcetype on Splunk Search. 03-26-2026 01:44 PM
- Posted Re: Splunk Add-on for Check Point Log Exporter on Getting Data In. 03-20-2026 05:13 AM
- Karma Re: Splunk Add-on for Check Point Log Exporter for kknairr. 03-20-2026 05:12 AM
- Posted Splunk Add-on for Check Point Log Exporter on Getting Data In. 03-20-2026 03:35 AM
- Posted Re: Log ingestion delay on Splunk Enterprise Security. 03-19-2026 08:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
11-12-2025
07:34 AM
Hello @verbal_666 on a Splunk distributed or cluster, did you apply on HF, SHC or IDX side(s) then? In our case we receive json logs from HF. @isoutamo what do you think? 🙂 Thanks for your help!
... View more
11-12-2025
07:27 AM
If we index JSON data from HF and want to extend TRUNCATE setting for long logs, should we also do it on (clustered) indexers or HF is enough? Also when looking at https://community.splunk.com/t5/Splunk-Search/Why-are-not-all-field-values-are-extracted-for-long-JSON-files/m-p/573446 it seems TRUNCATE=0 isn't enough? Thanks!
... View more
11-06-2025
02:31 AM
Hello @jkat54 noticed in splunkbase release notes "-Removed ability to specify user and pass with the command, use splunkpasswdname & splunkpasswdcontext OR token=<token> OR splunkauth=true instead." You should update the curl commands on Details tab of splunkbase app as this is misleading. For the moment using v3.1.2 could only make work using token not username/password. Getting error 401 when it works correctly with CLI curl command. I'm using "REST storage/passwords Manager for Splunk" syntax: | curl method=get uri="https://xxx/internalqueries?queryguid={3A798982-3D8F-465C-BB01-9E90CE4D3B4D}&filterguid={73B09AC4-6C...}" splunkpasswdname="api.xxx" splunkauth=f I could make it work using v3.1.0 so maybe there is a bug with latest version? Thanks for your help and thank you for this app!
... View more
Labels
- Labels:
-
administration
-
configuration
11-06-2025
01:54 AM
Hello, like username/password is it possible to hide tokens? This could help secure @jkat54 Webtools add-on. Thanks for your help!
... View more
Labels
- Labels:
-
administration
-
configuration
10-31-2025
07:42 AM
Hello @jkat54 please have a look at https://community.splunk.com/t5/All-Apps-and-Add-ons/Error-401-with-Webtools-v3-1-2-and-username-password/m-p/755264#M82473 thanks for your help!
... View more
10-30-2025
10:09 AM
Thanks @M4rv1m it works. I hope @jkat54 will add an option for that 🙂
... View more
10-29-2025
09:23 AM
Hello, in ssh CLI running Redhat linux, how to launch splunk offline on indexers and on splunk manager node, enable or disable maintenance-mode without credentials (it asks for local admin username and password)? This way we could automate OS updates by properly stop services. Thanks for your help.
... View more
Labels
10-10-2025
03:10 AM
Hi @livehybrid @PickleRick doesn't seem to work with HEC port (8088)
... View more
10-09-2025
09:12 AM
Hello, is this query valid to check incoming network traffic to heavyforwarders? index=_internal source=*metrics.log* group=tcpin_connections (host=s*HF*) | eval mb=floor(kb/1024) | timechart sum(mb) as mb span=5min useother=f usenull=f by host Thanks.
... View more
Labels
10-09-2025
07:46 AM
Hi @livehybrid yes it's http, do you use it on SHC cluster? We are using v1.1.5 FYI
... View more
10-09-2025
06:42 AM
Hello, is Splunk opencti addon compatible on Splunk cluster (shc)? From 2/3 search heads we are getting this error: "2025-10-09 16:22:56,618 ERROR pid=31312 tid=MainThread file=base_modinput.py:log_error:309 | Error in ListenStream loop, exit, reason: HTTPSConnectionPool(host='sXXX.XXX.XXX', port=8080): Max retries exceeded with url: /stream/4484559f-66f8-4107-9afc-1d9c141377fb?recover=2025-07-22T10:27:24Z (Caused by SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:1143)')))" Even if we are not configured as SSL. Thanks.
... View more
Labels
- Labels:
-
other
09-22-2025
06:06 AM
1 Karma
Hello, we disabled sources which were not available anymore and it's ok now. Support told us provider subscriptions are now required.
... View more
09-03-2025
07:28 AM
Hello guys, since 08/20/2025 we have issues in ES downloading these feeds from Splunk servers. When we try with curl then it doesn't return any data. No error. We use proxy. Thanks for your help! phishtank https://data.phishtank.com/data/online-valid.csv.gz iblocklist_piratebay https://list.iblocklist.com/?list=nzldzlpkgrcncdomnttb iblocklist_web_attacker https://list.iblocklist.com/?list=ghlzqtqxnzctvvajwwag iblocklist_tor https://list.iblocklist.com/?list=tor iblocklist_logmein https://list.iblocklist.com/?list=logmein iblocklist_proxy https://list.iblocklist.com/?list=bt_proxy iblocklist_rapidshare https://list.iblocklist.com/?list=zfucwtjkfwkalytktyiw mozilla_public_suffix_list https://publicsuffix.org/list/effective_tld_names.dat
... View more
07-25-2025
09:09 AM
Hello @kiran_panchavat @Rhidian maybe we could filter special characters with REGEXP_REPLACE(sql_text… in the SQL query? Thanks.
... View more
06-26-2025
08:36 AM
Hello @livehybrid looks like the json is from Vector agent to Kafka, that's why we may end up with json or is it possible to convert json to raw log in Splunk?
... View more
06-18-2025
05:44 AM
Thanks @livehybrid then Splunk should parse correctly fields for addons? Do you mean _raw will be the original event from source host and sending to targered index/sourcetype?
... View more
06-18-2025
05:14 AM
Hello, is it possible in Splunk HEC from Kafka to receive raw events on HF in order to parse fields with addons? It seems we can only receive json data with "event" field and may not be able to extract fields within standard addons? The HEC event may also contain target index and sourcetype. Thanks.
... View more
Labels
06-05-2025
07:45 AM
Hello, I put this regex on SHC inline extraction : "<(?<pri>\d+)>1\s(?<timestamp>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?[+-]\d{2}:\d{2})\s(?<hostname>[^\s]+)\s(?<appname>[^\s]+)\s(?<procid>[^\s]+)\s(?<msgid>[^\s]+)\s(?<structured_data>\S+)\s(?<json_msg>\{.*\})" however json_msg needs | spath input=json_msg Is it possible to auto extract fields contained in json_msg to avoid adding | spath input=json_msg at search time? Thanks.
... View more
Labels
- Labels:
-
inputs.conf
-
props.conf
-
syslog
-
transforms.conf
05-16-2025
12:24 AM
Hello @dshpritz looks like this is "officially" documented at https://splunk.my.site.com/customer/s/article/How-To-Use-Wildcards-with-Sourcetype
... View more
04-22-2025
02:30 AM
metadata is not reliable compared to tstats, with tstats I get accurate lastTime field info.
... View more
04-18-2025
09:14 AM
@jkat54 Hello, I find out I get lastTime tstats metadata from export api endpoint ran from CLI and not getting this lastTime field on web search with same query, even if lastTime info is from last year from offline UF. I guess there is maybe web filtering. This only applies to single result though. Results can be different I guess due to different user/role, app context, api endpoint which may be my case. Thanks.
... View more
04-18-2025
12:51 AM
Hello @Jawahir how are you? Found out we can filter by search_title also, where can we find list of IR fields? Thanks for your help!
... View more
04-08-2025
05:26 AM
Hi @richgalloway thanks, how do you add library to custom app? In bin folder with .py file?
... View more
04-08-2025
03:17 AM
Hello guys, how to add cryptography or other python lib to Splunk python own environment for scripted input on HF? Preferred solution is to put beside my app in etc/apps/myapp/bin/ folder. Thanks for your help!
... View more
Labels
- Labels:
-
add-on
-
app
-
Python
-
scripted input
04-07-2025
08:34 AM
Hello, we found solution, there was metadata index source key that was possible to use. Thanks for your help guys.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
Karma given to
