Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About dural_yyz
dural_yyz
Motivator
Member since:
08-09-2019
04-20-2026
Community Statistics
| Posts | 272 |
| Solutions | 25 |
| Karma Given | 114 |
| Karma Received | 63 |
| Member Since | 08-09-2019 |
Activity Feed
- Got Karma for Re: How to Identify which HF is sending logs/metrics. 01-27-2026 03:40 AM
- Posted Re: How to Identify which HF is sending logs/metrics on Getting Data In. 01-21-2026 08:46 AM
- Got Karma for Re: Data missing from universal forwarder on a Linux host. 08-12-2025 09:19 AM
- Posted Re: How to change the width of panels in xml on Splunk version 9.4.1? on Dashboards & Visualizations. 07-02-2025 10:11 AM
- Karma Re: How to change the width of panels in xml on Splunk version 9.4.1? for bowesmana. 07-02-2025 10:10 AM
- Karma Splunk Answers Content Calendar, June edition! for Anam. 06-06-2025 02:53 PM
- Posted Re: Data missing from universal forwarder on a Linux host on Getting Data In. 06-06-2025 02:49 PM
- Got Karma for Re: Turning off chunked encoding in Universal Forwarder. 04-09-2025 10:52 PM
- Posted Re: Turning off chunked encoding in Universal Forwarder on Getting Data In. 04-09-2025 08:33 AM
- Karma Buttercup Games: Further Dashboarding Techniques (Part 6) for ITWhisperer. 04-03-2025 07:22 AM
- Posted Re: Splunkforwarder 9:.3 failing in docker desktop on Deployment Architecture. 04-03-2025 07:20 AM
- Posted Re: Akamai add-on logs are not populating. on Getting Data In. 04-03-2025 07:14 AM
- Posted Re: heatmap on Dashboards & Visualizations. 04-03-2025 07:09 AM
- Posted Re: Dashboard Studio - Search Result as Token on Dashboards & Visualizations. 03-14-2025 07:39 AM
- Posted Re: Splunk 9.3 - WebUI module won't restart or start. on Deployment Architecture. 03-14-2025 07:33 AM
- Posted Re: use colorpallette to change color of extremes on a dashboard on Dashboards & Visualizations. 03-14-2025 07:18 AM
- Posted Re: Customize tooltip text in line chart on Splunk Cloud Platform. 03-14-2025 07:13 AM
- Karma Re: Find Latency in Days for richgalloway. 03-14-2025 07:11 AM
- Posted Re: Find Latency in Days on Splunk Enterprise Security. 03-14-2025 07:03 AM
- Posted Re: App with deprecated Python on Splunk Enterprise. 02-18-2025 06:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-24-2023
06:58 AM
I'm looking specifically at the index for _configtracker to audit changes to serverclass.conf file. Because the nature of the <filtertype>.n = <value> the behavior is one action to remove all values, then a second action to rewrite all the values in lexi order. This is making auditing add/removals/static very difficult.
I have managed to transact the events so I can compare old values to new values. I struggle with how to compare the results to identify changes when values list is very long.
Current Table Output
Unique Ident
OldValues
NewValues
<transact-x>
A B C D
A C D E
What I'm looking for
Unique Ident
OldValues
NewValue
Audit
<transact-x>
A
A
NoChange
<transact-x>
B
Removed
<transact-x>
C
C
NoChange
<transact-x>
D
D
NoChange
<transact-x>
E
Added
Assumptions
1) stats values(field): I don't believe any of my samples cross over 10,000 which I believe is default limits for values field
2) values function will lexi order all values regardless of original order in raw data feed
... View more
Labels
- Labels:
-
field extraction
-
fields
07-12-2023
05:41 AM
Not a solution to your certificate issue. If your version of Syslog-NG is recent enough I would consider switching to an HTTP Destination configuration. Use the server as a relay to convert syslog protocol to HEC and you can send direct to Indexers or other destinations of your choosing.
... View more
- Tags:
- not
07-05-2023
07:33 AM
1 Karma
To find login and logout sessions here is the search you want. index=_audit sourcetype=audittrail action IN ("login attempt" logout) For some reason the field extractions for action only work on my DMC and not my search heads so be cautious and edit the search where needed. This tracks by user which is really easy. However since most users will not actually log out and rather the behavior is to close the browser window the session will timeout. You can map the log in session which is a field in the above login action. The session timeout does not map a username value though. index=_audit sourcetype=audittrail action=expired_session_token info=expired There will be one log for each search head in your cluster. So if you have a 5 search head cluster you will see a single login action but then 5 session timeout values.
... View more
07-05-2023
05:32 AM
Interesting, from what I have just read this will require you to have three source types but keep an eye on the parsing queue. It would be unhelpful if clone_sourcetype wants to occur before the rewrite of the meta field making this solution a non-option. I've never tested so best of luck and I hope it works.
... View more
06-30-2023
10:28 AM
It was only introduced in 9.x so prior versions of Splunk would not have that index and logging available. Previous to this we had a script which would ingest the outputs of a btool command and then compare changes in values over time.
... View more
06-30-2023
08:33 AM
Leave the DATETIME_CONFIG xml value as is. Set the TZ on the PROPS.CONF that is distributed to the UF for your sourcetype where you do event breaking.
... View more
06-30-2023
06:09 AM
| convert ctime(_time) as Time
... View more
06-30-2023
06:07 AM
1 Karma
https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-JSON-data-in-Splunk/m-p/274976 Look at the answer from javiergn for the solution I would have chosen.
... View more
06-29-2023
06:39 AM
1 Karma
inputs.conf [monitor:///whatever/file.txt] sourcetype = src:type:original props.conf [src:type:original] TRANSFORMS-sourcetype = overridesourcetype_original transforms.conf [overridesourcetype_original] DEST_KEY = _MetaData:Sourcetype REGEX = . FORMAT = sourcetype::src:type:new-value This answers your original question of how to set an override value of the original sourcetype. I haven't tried to change the sourcetype based on a match of _raw but I suspect that it would be possible. Looking over the spec sheet for transforms.conf if you set the SOURCE_KEY = _raw the regex will apply there but the FORMAT would apply to the DEST_KEY. However, your latest comment about cloning an event concerns me because I don't know of any configuration that will duplicate the event into multiple sourcetypes.
... View more
06-29-2023
06:14 AM
After Splunk 9.x they introduced "_configtracker" index to log changes to any files. index=_configtracker data.path=*/macro.conf Throw in some extras afterward to make it how you want.
... View more
06-29-2023
05:47 AM
I can't show how my configuration is exactly so here is a mock up of general rules. [role_user-clone] <omitted but all default user capabilities should be here as well> ## Validate upgrades don't change default capabilities, keep in sync post upgrade srchIndexesAllowed = main; index-1; index-n srchIndexesDefault = main [role_custom] srchIndexesAllowed = index-A; index-B importRoles = user-clone Here the custom user will inherit all rights of the user-clone for search Indexes Allow which doesn't include wild cards so is restrictive, but often environments may have index(es) which all users can view. Post upgrades in our environment we audit all Splunk Default roles against our cloned roles for any capability changes. We use this more to ensure restricted access to indexes than any other capability control (ex: we don't mess with capabilities for sharing or report building). Just make sure that your custom roles do not import default roles or they will inherit default search indexes.
... View more
06-29-2023
04:24 AM
I've never developed custom endpoints but the 404 still makes me think of a permissions issue. Here is a link to developers explanation of permissions. Calls out specifically authorize.conf and restmap.conf files as requirements. I would focus on roles and script folder locations as leading causes of 404 not found. https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/customrestmanageaccess/
... View more
06-28-2023
05:56 AM
You have moved the app from a server with ITSI to a server without ITSI. The permissions might be tied to a role specific to the ITSI app which might not exist on the new server. Look into your app.conf file for hints.
... View more
06-28-2023
05:51 AM
1 Karma
You already have your answer that work for you which is great. In our environment we cloned the default user and removed the allowed=* from the clone. We build all roles to inherit the cloned user account. That way you have all the same capabilities but don't inherit the allowed=* for indexes. Food for thought.
... View more
06-27-2023
08:42 AM
First table out with _time and _indextime and convert to human readable. We can narrow down if the indexer receives but slow to show or the HF is delayed in relaying the event. Compare your active btool outputs.conf as well for any anomalies.
... View more
06-27-2023
08:27 AM
Understood, the UF may be applying local logic from datetime.xml to auto interpret. By adding the TZ key value under props for your source/sourcetype on the UF local then you interrupt the auto interpret process. Try and let me know - I have looked over my own environment and found instances of TZ set to overcome similar issues.
... View more
06-27-2023
08:23 AM
I agree with this suggestion. Going back to your original visual there is no current method to get items grouped the way you suggested. Using a trellis gives you the bar graph that you want and you can break out individual items into separate graphs all on one dashboard/report sourced from a single search.
... View more
06-27-2023
07:42 AM
I believe what is occurring is that the TZ value is set via the default stanza on the UF(local server timezone) and the Indexer props value is being ignored. Update the props.conf on the UF to include the "TZ = UTC" or "TZ = GMT" key value pair and validate results.
... View more
06-27-2023
07:18 AM
Formatting columns with color is answered here: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-color-table-cell-on-dashboard-based-on-value/m-p/347851 They referenced the document link here: http://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML You want to do column color formats for dynamically named columns which does not appear possible based upon current documentation for xml dashboards. In the table settings the color tablet is applied at the field name level. A dynamically named field can not be accounted for unless you were to hard code all possible options.
... View more
06-27-2023
07:02 AM
You have the timezone specified in the indexer PROPS as UTC but you have stated the logs are actually CDT. If you change that timezone value you should notice your log timestamp issues resolve itself. PROPS.conf acts independent of the indexer local time, unless the setting is not explicitly set then the indexer will assume the timezones are the same at the source and the indexer.
... View more
11-25-2022
07:08 AM
Thank you for bumping this up again as I had forgotten about it. Your suggestion was a good idea for me to check but search filters are not something we have implemented in our environment so the values are blank or wildcard. Turns out I was able to solve this by finding the errant sourcetype props. Under that was the following code. [existing:sourcetype]
....
EVAL-sourcetype = case(value_doesnt_occur,"existing:sourcetype") I commented out this EVAL. Since it was only defined under the final value it would never actually execute. However since part of the environment felt that sourcetype was an extracted value and not an indexed field this must be what was causing the litsearch to mysteriously add the content into the search string. The app came built by the vendor and not splunk and since the key = value does not violate any patterns I assumed the app would pass validation checks. I think this comes down to down mix extracted fields with indexed fields for best practice. FYI - we have also carried this forward and re-written many of our eventtype tags so that the raw search does not contain any extracted field references which are also data model destination field names.( ie Eventtypes raw search does not contain action=x or user=y statements). I would only do this in very large environments with processing or search tuning requirements - don't fix if it aint broke!
... View more
08-16-2022
10:13 PM
The DMC comes with most reports you will want to start with. From here you can start to understand some behavior and then when ready deep dive the individual panels to understand what indexes have which values and what those values mean. DMC -> Monitoring Console -> Search Here you can look at "Search usage Statistics: Deployment" OR "Search Activity: Deployment", you can try instance but that is a single server view and not the entire picture if you have search head clusters. Here is a basic interpretation of the start of a DMC search - there is more to it but it is a good place to start. index=_audit sourcetype=audittrail action=search search_id!="rsa_*" | eval user=if((user == "n/a"),null(),user), search_type=case(match(search_id,"^SummaryDirector_"),"summarization",match(search_id,"^((rt_)?scheduler__|alertsmanager_)"),"scheduled",match(search_id,"\\d{10}\\.\\d+(_[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})?$"),"ad hoc",true(),"other"), search=if((isnull(savedsearch_name) OR (savedsearch_name == "")),search,savedsearch_name) | stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id, host
... View more
08-16-2022
09:46 PM
We are spending a tremendous amount of time tuning our search structures lately. One thing we have run across in our Enterprise Security environment is an unwanted key=value in litsearch when reviewing the job board.
SPL
index=any-index-value sourcetype=any-sourcetype-value
litsearch
(index=any-index-value (sourcetype=any-sourcetype-value OR sourcetype=never-mentioned-value))
This 'never-mentioned-value' is always the same regardless of index or sourcetype we place in the SPL. Things I have checked for:
- props-lookups: No 'sourcetype as x' on input side OR 'x as sourcetype' on output side
- props-EVAL-sourcetype = case(x,never-mentioned-value), this exists in our prod but same config in lower environment did not trigger the same action (will be removing this shortly after next push cause I just don't like it)
- TRANSFORMS - can not find any items of interest here
I have tried the following alternative searches
index=any-index-value
OR
index=any-index-value sourcetype::any-sourcetype-value
In both of the above SPL the 'extra' sourcetype key=value does not appear in the litsearch. I do understand the differences in indexed fields and how the searches above are not triggering the addition key=value.
What I need help/direction/input is how do I track down the errant conf edit that is resulting in additional litsearch values when the SPL contains 'sourcetype='.
... View more
Labels
- Labels:
-
field extraction
-
search job inspector
08-08-2022
06:59 AM
Morning, Your search is still using _time which assumes the props or source timestamp is accurate. Try adding in the _indextime field and use some calculations from there. These types of searches will help identify any timestamp issues in your data. https://community.splunk.com/t5/Splunk-Search/How-to-compute-indextime-time-difference-average-with-tstats/m-p/306878
... View more
08-05-2022
11:45 AM
The data picker will work in the exact same capacity as when you create your ad hoc search via the normal search bar. The SPL for your search will be the source of your table visualization. In fact run your ad hoc query to return the results you want with appropriate field names in the output. From there use the "Save As" function to generate a dashboard. With that template you can better manipulate your end vision for your final dashboard.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-20-2026
09:36 AM
|
Karma given to
