×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
jkat54
SplunkTrust
Member since: ‎07-05-2012
‎06-09-2025
Community Statistics
Posts 3602
Solutions 374
Karma Given 637
Karma Received 919
Member Since ‎07-05-2012
Activity Feed
Topics I've Started
View All

Re: SSL Certificate Checker

by SplunkTrust in All Apps and Add-ons
‎12-29-2020 06:05 AM
2 Karma
‎12-29-2020 06:05 AM
2 Karma
echo | openssl s_client -connect someserver:443 2>/dev/null | openssl x509 -noout -enddate ... View more

Re: Restoring archived indexed data

by SplunkTrust in Deployment Architecture
‎12-25-2020 04:30 AM
‎12-25-2020 04:30 AM
For the restor.sh, change splunkExePath to splunkBinPath everywhere you see it mentioned. ... View more

Re: Unable to initialize modular input Webtools Ad...

by SplunkTrust in All Apps and Add-ons
‎11-29-2020 09:45 AM
‎11-29-2020 09:45 AM
The latest version has been rebuilt with python 3 if you'd like to try it. ... View more

Re: Unable to initialize modular input Webtools Ad...

by SplunkTrust in All Apps and Add-ons
‎11-06-2020 08:40 AM
‎11-06-2020 08:40 AM
Which version of Splunk?   not compatible with 8.x unless you enable python 2.7 support. ... View more

Re: What should be the proper Unix permissions for...

by SplunkTrust in Security
‎10-21-2020 04:12 AM
‎10-21-2020 04:12 AM
UDPATE: Its README not README.txt that is created by the AoB, but i've been using this post over and over again since we wrote it.  Works great. ... View more

Re: How to group values of the same field and disp...

by SplunkTrust in Splunk Search
‎09-29-2020 04:50 AM
‎09-29-2020 04:50 AM
If they are all in the same index you can do this:      index=index | stats count by message_subject OR      index=index message_subject="[TNT-" OR message_subject="[CyberIntel Confidential]" OR message_subject="[CyFin" | stats count by message_subject   If they are in different indexes, you can do this:      index=index1 message_subject="[TNT-" OR index=index2 message_subject="[CyberIntel Confidential]" OR index=index3 message_subject="[CyFin" | stats count by message_subject ... View more

Re: ITSI Maintenance Windows via REST using Web To...

by SplunkTrust in Splunk ITSI
‎09-14-2020 11:37 AM
‎09-14-2020 11:37 AM
Lol, I'll do what I can!  Trying not to leave you holding a bag of bolts! ... View more

Re: ITSI Maintenance Windows via REST using Web To...

by SplunkTrust in Splunk ITSI
‎09-14-2020 08:53 AM
‎09-14-2020 08:53 AM
Im interested enough to spend some time on it tonight / tomorrow morning. This is a common issue and we need to nail it down. If you submit the issue on github i will share the "fame" with you  / give you "credit" for reporting the bug.  If things happen in my life (and they do often due to big family)... i might get distracted though.  So having the issue there serves as a reminder. Thanks, JKat54 ... View more

Re: ITSI Maintenance Windows via REST using Web To...

by SplunkTrust in Splunk ITSI
‎09-14-2020 08:15 AM
‎09-14-2020 08:15 AM
Yeah, its something to do with SPL filter mechanisms and nested dictionaries in json. Can you file a issue over on our github? https://github.com/bentleymi/TA-webtools/issues If you'll submit it with all the same details we will get to it as soon as we can. ... View more

Re: ITSI Maintenance Windows via REST using Web To...

by SplunkTrust in Splunk ITSI
‎09-14-2020 03:35 AM
‎09-14-2020 03:35 AM
Have you tried escaping the square brackets too?         \[{\"object_type\":\"entity\",\"_key\":\"<serviceid>\"}\]}" maybe all the brackets        \[\{\"object_type\":\"entity\",\"_key\":\"<serviceid>\"\}\]}" ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-20-2020 11:27 AM
‎08-20-2020 11:27 AM
Ok  try 4.0.2 and let me know  ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-20-2020 11:02 AM
‎08-20-2020 11:02 AM
I just downloaded and checked bin/ssl_checkerv3.py and the import function is at the top of the page.  maybe you got some hybrid version!? im about to fix the setup page and example dashboard for 4.02.  I'll let you know when it's available. ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-19-2020 07:01 PM
‎08-19-2020 07:01 PM
Oh dang, looks like you got a copy of 4.0.0 not 4.0.1 where I corrected that. ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-19-2020 11:32 AM
‎08-19-2020 11:32 AM
how about   index=_internal log_level=err* OR log_level=warn* ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-19-2020 03:58 AM
‎08-19-2020 03:58 AM
disabled = 0 is what I meant not enabled = true. i always get that mixed up in my head. well then something else is happening on your end if it's not checking the certs at midnight every day (server time). can you check this search for me? index=_internal sourcetype=splunk_python maybe it will show us an exception that is occurring    ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-18-2020 02:48 PM
‎08-18-2020 02:48 PM
Actually the v2 and v3 of the script are the manual (v2) versus the automated (v3) version. both are python2 and 3 compatible. do you have enabled=true? you can use the btool command line argument to debug your config /opt/splunk/bin/splunk btool inputs script --debug | grep ssl Or on windows splunk.exe btool inputs script --debug | findstr ssl ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-18-2020 05:54 AM
‎08-18-2020 05:54 AM
Hey, It looks like the webui "settings" page is broken in relation to the automated input. however, it will run every night at midnight by default. also, you can update the inputs.conf [script....ssl_checker3.py] with a crontab expression or number in seconds for the "interval" .  And then restart splunk to make the new config live.     ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-14-2020 04:48 PM
1 Karma
‎08-14-2020 04:48 PM
1 Karma
I'll be deploying for someone next week and will let you know if I find any bugs.  Thanks! glad it works in some capacity!  It'll save you so much trouble! youll want it everywhere you use kvstore too (typically used by input apps on heavy forwarders) and when server.pem expires your dbconnect and whatever else that relies on it will fail too. ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-13-2020 05:57 PM
1 Karma
‎08-13-2020 05:57 PM
1 Karma
First, please change values(fieldName) to latest(fieldName) in my stats command where fieldName is whatever I used for the expiration date field name. 2nd; it could be taking a moment for the script to run.  Maybe every minute is a little much.  Try at minimum every 5 minutes... unless you're running it on a single core raspberry py or something... then maybe minimum of 15minutes +.     ... View more

Re: SSL Checker - Inaccurate Dashboard Results

by SplunkTrust in All Apps and Add-ons
‎08-13-2020 04:49 PM
1 Karma
‎08-13-2020 04:49 PM
1 Karma
Hello! the dashboard was meant to be an example that you would study and modify.   it looks like I used stats values(date) by cert...  try changing  that to latest(date) instead And if thats doesnt work, please paste the search you have here and we'll fix you right up. ... View more

Re: TA for MS Log Analytics - Failed to establish ...

by SplunkTrust in All Apps and Add-ons
‎08-07-2020 10:29 AM
‎08-07-2020 10:29 AM
I'm closing this thread as answered.  Please open a new thread for additional questions. ... View more

Re: TA for MS Log Analytics - Failed to establish ...

by SplunkTrust in All Apps and Add-ons
‎08-06-2020 01:54 PM
‎08-06-2020 01:54 PM
"Would it be possible to ingest data from Log Analytics with a lag time of less than 5 minutes?" Yes but due to the way azure doesn't guarantee timeliness of the data, you will end up missing events. We built the lag in to overcome the issue. At least 15 minutes of lag is recommended. ... View more

Re: TA for MS Log Analytics - Failed to establish ...

by SplunkTrust in All Apps and Add-ons
‎08-05-2020 09:42 AM
‎08-05-2020 09:42 AM
Possibly you can try &gt;  instead of > ... View more

Re: TA for MS Log Analytics - Failed to establish ...

by SplunkTrust in All Apps and Add-ons
‎08-04-2020 02:41 PM
‎08-04-2020 02:41 PM
Sorry but I don't even have a development environment for this.  I rely on the community to make suggestions and if possible, edits. ... View more

Re: TA for MS Log Analytics - Failed to establish ...

by SplunkTrust in All Apps and Add-ons
‎08-04-2020 01:07 PM
‎08-04-2020 01:07 PM
Ok, try a much simpler query and see if it works. the api only supports a certain version of the log analytics query language.  Some commands won't work. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-09-2025 08:53 AM
Karma from
Karma given to