Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About jodros
jodros
Builder
Member since:
01-18-2011
06-13-2024
Community Statistics
| Posts | 231 |
| Solutions | 23 |
| Karma Given | 26 |
| Karma Received | 48 |
| Member Since | 01-18-2011 |
Activity Feed
- Posted Re: Stream App + Netscaler AddOn: Why are Netflow elements not decoded? on All Apps and Add-ons. 02-16-2023 06:24 PM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-11-2020 12:56 PM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-11-2020 08:56 AM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-10-2020 06:37 AM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-10-2020 06:36 AM
- Posted Search That Looks Back in Time and Checks Fields on Splunk Search. 08-07-2020 02:33 PM
- Got Karma for Create alert when average events greater than 2 standard deviations from rolling average. 06-05-2020 12:49 AM
- Got Karma for Why am I getting "ERROR:root:code for hash md5 was not found." running a Python script on a search head?. 06-05-2020 12:48 AM
- Karma Re: How to find the average of daily indexed data by host for a given time range and show all hosts on a timechart, not just the top 10? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Is there a way i can schedule a saved search to run for every 2 weeks? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to get Windows logs into my Splunk instance on Ubuntu? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to assign syslog file to specific index based on file name in transforms.conf? for strive. 06-05-2020 12:47 AM
- Karma Re: What is the quickest way to see if a host was ever indexed in Splunk? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Google Maps not working after upgrade to 6.1.2 for southeringtonp. 06-05-2020 12:47 AM
- Karma Re: Does Splunk for Juniper SA SSL VPN support Syslog over TCP? for xinger. 06-05-2020 12:47 AM
- Karma Re: Where is the Splunk logrotate file located? for yannK. 06-05-2020 12:47 AM
- Karma Re: At what point do you need to consider scaling horizontally for Syslog collection and what would that architecture look like? for ltrand. 06-05-2020 12:47 AM
- Got Karma for Where is the Splunk logrotate file located?. 06-05-2020 12:47 AM
- Got Karma for Re: At what point do you need to consider scaling horizontally for Syslog collection and what would that architecture look like?. 06-05-2020 12:47 AM
- Got Karma for Google Maps not working after upgrade to 6.1.2. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
10-28-2013
12:29 PM
How would this affect this server? This isn't one of our distributed indexers. Would every search scheduled to run on our searchhead send knowledge bundles to the license master even though it will not house any data? All searchheads, forwarders, deployment server, and license master forward all logs, including internal logs to the indexers. I was hoping I would only have to look to them for data.
Let me know, and thanks for the assistance.
... View more
10-28-2013
08:24 AM
I have an issue trying to fix a dashboard in Deployment Monitor App, the License Report for last 60 days. It is utilizing a rest command to pull license slaves. The server running the Deployment Monitor App is not the license master. I need to modify the rest url in the search to point to the license master. I have verified that the new rest URL is correct for pulling a listing of license slaves but is not returning results. I tried the rest URL directly in a separate browser and it appears that the license master is prompting for a username/password.
What is the best way to accomplish passing credentials with the rest command?
Thanks in advance.
... View more
10-17-2013
06:12 AM
2 Karma
We have successfully installed the Splunk for Citrix NetScaler app as well as the Splunk_TA_IPFIX_UDP_NIX. We are getting syslog data in the app. We are also getting data over the AppFlow port, but it appears to be a listing of ViP's on the NetScaler, not application flow data.
We have enabled AppFlow on the netscaler as detailed in this video http://www.youtube.com/watch?v=ZRfVBEjocSM. The AppFlow policy shows active, but is not getting any hits. If anyone can assist, I would greatly appreciate it.
A sanitized sample log received over the AppFlow port is below.
TimeStamp="2013-10-17T08:02:07"; Template="265"; Observer="0"; Address="10.x.x.x"; Port="62526"; observationDomainId="0"; incarnationNumber="2152"; appNameAppID="12345"; appName="Generic_App_Name"; appTemplateName="";
Thanks
... View more
09-18-2013
08:58 AM
Thanks for the reply. I forgot to mention a few other key points.
We do have an app for all license slaves. I can easily update that app and push out the changes.
Secondly, the master_uri is a DNS record that we could change the IP and all slaves would link up. We planned to use DNS names instead of IP's for this very reason.
My main concerns are with disabling the license master on the standalone, and enabling it at the new location. Pointing the slaves to the new location should not be an issue.
Thanks
... View more
09-18-2013
08:18 AM
I have a case open, but I thought I would ask here too, since time is a factor.
We have a distributed environment with several indexers, a searchhead pool for general users, and a standalone searchhead for the security team, and a deployment server. Currently the standalone searchhead is acting as the license master. We need to migrate the license master duties. Could the searchhead pool as as the license master? If not, we could migrate it to the deployment server. I need to know the best way to migrate the license master.
Thanks in advance.
... View more
09-03-2013
05:58 AM
Early morning bump. Anyone know if this can be accomplished? I am fine if I can use wildcards with the full path name. Any info would be appreciated.
... View more
09-03-2013
05:55 AM
1 Karma
We are currently running a setup that is similar to the second option, where each indexer has it's own directory on the NFS share. It is working fine.
... View more
08-30-2013
11:01 AM
So when I change it to the exact log name [WinEventLog:ABC-CustomApp] it works fine. Would really love to use the wildcard here in order to automatically pull in any new custom application logs.
... View more
08-30-2013
05:49 AM
Our programmers code events to custom logs stored in the WinEventLog viewer. Instead of having to update the inputs.conf file for each new application and it's corresponding custom event log, is there a way to utilize wildcards? I know that they work for monitoring file directories, but I am unsure if that approach would work for WinEventLogs. We were thinking of prefacing each custom log with the same text and using wildcard in the inputs.conf. Currently this is not working for us. Example is below:
Log Names would begin with "ABC-"
[WinEventLog:ABC-*]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
sourcetype = dotnet
index = web
Any assistance would be appreciated.
... View more
05-01-2013
06:14 AM
3 Karma
Here is how I was able to get the Teradata connections working.
First you need to load the Teradata JDBC drivers to the $SPLUNK_HOME/etc/apps/dbx/bin/lib/ directory. The files I have loaded are tdgssconfig.jar and terajdbc4.jar
Next you will need to create a new database type called "Teradata". I copied the database_types.conf to local and added the following lines:
[teradata]
displayName = Teradata
jdbcDriverClass = com.teradata.jdbc.TeraDriver
defaultPort = 6105
connectionUrlFormat = jdbc:teradata://{0}/DATABASE={2}
testQuery = SELECT 1
I was able to get some of this information from the Teradata site as well as glean some of the information from the postgresql database_type as far as formatting.
Once the new database_type is created and a restart of Splunk has been done, you can reference it with new database_type in the GUI. I went to Manage Database Connections and clicked New, provided a unique name for the database within Splunk, selected the newly created Teradata database type from the dropdown, entered in the hostname, left port blank (since it was default), got the database name and credentials from the Teradata DBA and entered them in respectively, and checked both the read-only and validate database connection boxes, and hit Save.
Splunk verified the connection was good and I am able to connect to our Teradata instance.
If there are any questions, I will do my best to answer them.
Thanks
... View more
04-17-2013
05:38 AM
This would not accommodate what we need. The only way I can think to currently accomplish our needs is to have separate search heads for different user access within DBX, which isn't optimal. I would love to be able to assign roles to database connections or be able to utilize the restrict search terms to prevent unauthorized access to databases.
Thanks
... View more
04-10-2013
02:23 PM
Does anyone know how to accomplish this? I have tried utilizing the "Restrict search terms" but it is not working. Currently if I allow a user access to DBX they would see all database connections.
Any ideas would be appreciated.
Thanks
... View more
04-10-2013
06:20 AM
Top Interfaces Table
index="os" sourcetype="interfaces" host=$host$ | multikv fields name, inetAddr, RXbytes, TXbytes | streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by host Name | eval time=_time | strcat Name "-" inetAddr "@" host Interface_Host | eval RX_Thruput_KB = (lastRX-RXbytes)/1024 | eval TX_Thruput_KB = (lastTX-TXbytes)/1024 | search RX_Thruput_KB OR TX_Thruput_KB >= 0 | stats sum(TX_Thruput_KB) as "Total KB Transmitted" sum(RX_Thruput_KB) as "Total KB Received" by Interface_Host | sort -"Total KB Received" | head 20
... View more
04-10-2013
06:18 AM
Thruput Chart
index="os" sourcetype="interfaces" host=ho-splunkds1 | multikv fields name, inetAddr, RXbytes, TXbytes | streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by host Name | eval time=_time | strcat Name "-" inetAddr "@" host Interface_Host | eval RX_Thruput_KB = (lastRX-RXbytes)/1024 | eval TX_Thruput_KB = (lastTX-TXbytes)/1024 | search RX_Thruput_KB OR TX_Thruput_KB >= 0 | timechart eval(sum(TX_Thruput_KB)/dc(time)) as TX eval(sum(RX_Thruput_KB)/dc(time)) as RX by Interface_Host
... View more
04-10-2013
06:18 AM
1 Karma
@lemikg, I finally encountered an instance where this chart displayed negative integers. This was due to the server rebooting. Due to the way the search is calculating thruput, servers rebooting, splunk services stopping for a period of time, etc, can cause those negative integers to appear in charting. In order for the charts to be accurate, they need to have had the search run at least twice normally after all server related issues are corrected. An easy fix for this is to search for only positive integers to chart. I have modified the searches below. Thanks.
... View more
04-08-2013
06:15 AM
@lemikg, are you still having issues with the chart?
... View more
04-08-2013
06:14 AM
After doing a bit more research, this has something to do with the "lastlog" command and the Centrifydc client. It appears that when the lastlog command is run, either by the Splunk_TA_nix lastlog.sh script, or manually, Centrifydc will sweep the AD tree if the cache is stale.
Since we still want the lastlog events, we just tuned the interval back so as to not generate as many AD logs.
If anyone else has any suggestions or experience with Centrifydc and the lastlog command, let me know.
Thanks
... View more
04-05-2013
07:15 AM
1 Karma
We recently started testing the DBX app. So far we have successfully connected to Microsoft SQL databases. Now we would like to test connecting to Teradata databases. Has anyone successfully connected DBX to Teradata? Would we be able to use the generic ODBC type, or would we have to set up a custom database type and import JDBC drivers?
Thanks in advance!
... View more
03-22-2013
10:46 AM
@lemikg, that is unusual. I just tested and I am not experiencing that behavior, either with the negative values or with the differing peak times.
Did you modify the search in anyway in your environment?
... View more
03-22-2013
09:41 AM
@lemikg, which search are you referring, the Interface Throughput, or the Top Interfaces?
Thanks
... View more
03-22-2013
09:14 AM
I recently installed the *nix app along with the Splunk_TA_nix on all search peers. Recently I noticed an increase in AD logs. I researched it and it appears that the increased started soon after I loaded the *nix app and Splunk_TA_nix. Further investigation points to the lastlog.sh script being the culprit.
The lastlog.sh script runs every 5 minutes and normally completes within 800 milliseconds. On occasion, it takes upwards of 30 seconds! Correlating the time when this happens shows that particular Splunk server generating thousands of wineventlog:security eventcode=4662 showing audit failure with operation properties "Default Property Set unixUserPassword". The objects appear to be EVERY OBJECT in AD starting in alphabetical order. This is just slightly alarming. Disabling the lastlog.sh script on a server as a test stopped the AD log events for that specific server.
A bit of background with our environment, we are running Centrify to integrate our RHEL 5.9 x64 bit servers with AD. We are seeing this from both physical and virtual servers with the lastlog.sh script running.
Anyone know why this might be happening? Why would the lastlog.sh script run fine several times, then take 30+ seconds and try to comb the entire AD tree? I don't know enough about the script and would like to tweak it to keep it enabled, but I would rather disable that input if it is going to generate these logs against AD.
Any assistance would be appreciated.
... View more
03-19-2013
01:16 PM
@araitz, you think you could help me tweak the vmstat.sh script? 🙂
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-13-2024
05:04 PM
|
Karma from
Karma given to
