Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About skirven
skirven
Communicator
Member since:
08-27-2019
09-07-2023
Community Statistics
| Posts | 52 |
| Solutions | 2 |
| Karma Given | 1 |
| Karma Received | 4 |
| Member Since | 08-27-2019 |
Activity Feed
- Got Karma for Re: How to drop data from a HEC Collector?. 09-07-2023 03:44 AM
- Posted Re: How to drop data from a HEC Collector? on Getting Data In. 09-07-2023 03:43 AM
- Posted Re: How to truncate the entire event to a max number of characters? on Getting Data In. 07-05-2022 11:18 AM
- Posted Re: How to truncate the entire event to a max number of characters? on Getting Data In. 06-29-2022 02:04 PM
- Posted How to truncate the entire event to a max number of characters? on Getting Data In. 06-23-2022 05:44 AM
- Posted How to drop data from a HEC Collector? on Getting Data In. 05-04-2022 04:13 AM
- Posted Re: Why am I getting "Unknown search command" on ipv6compress app on All Apps and Add-ons. 04-29-2022 03:04 AM
- Posted Why am I getting "Unknown search command" on ipv6compress app on All Apps and Add-ons. 04-28-2022 03:28 AM
- Posted Re: Parsing out asterisk delimited format on Getting Data In. 04-13-2022 08:36 AM
- Posted Re: Parsing out asterisk delimited format on Getting Data In. 04-13-2022 06:08 AM
- Posted How to parse out asterisk delimited format? on Getting Data In. 04-13-2022 05:31 AM
- Posted Why is there an error when using Splunk Addon For New Relic - Alerts? on All Apps and Add-ons. 02-22-2022 02:21 AM
- Posted Dropping or Modifying data based on metadata tags on Getting Data In. 02-08-2021 08:29 AM
- Posted Re: tcpin_cooked_pqueue blocking on Monitoring Splunk. 11-23-2020 03:59 AM
- Posted Re: tcpin_cooked_pqueue blocking on Monitoring Splunk. 11-23-2020 03:36 AM
- Posted Re: tcpin_cooked_pqueue blocking on Monitoring Splunk. 11-22-2020 09:38 AM
- Posted Re: Executor_threads and Search Heads on Deployment Architecture. 11-13-2020 12:27 PM
- Posted Executor_threads and Search Heads on Deployment Architecture. 11-13-2020 12:05 PM
- Posted Re: Question on a Splunk Searchhead app and distsearch.conf on Splunk Enterprise. 10-22-2020 12:30 PM
- Posted Question on a Splunk Searchhead app and distsearch.conf on Splunk Enterprise. 10-21-2020 10:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-28-2020
03:23 AM
Looking at this solution closer, I actually proposed this solution to the user, and awaiting feedback. What I didn't think of was just dropping it into a table:
| makemv delim="\\n" log | table _time, log
... View more
05-28-2020
03:06 AM
Yes. That's a lot of work, and seems highly tailored to the one result. The problem I'm really just wanting to solve is to replace the "\n" with a normal regex \n and show the new line.
When the string was parsed with other data, it didn't represent the rest of the lines correctly. 😞
Thanks!
Stephen
... View more
05-28-2020
01:20 AM
@ppeeters_splunk - Hi! I actually have tried that too, and it didn't work.
I think this also mirrors the test case, and it's not parsing out what I was hoping. 😞
| makeresults | eval _raw="{\"log\":\"2020-05-28 06:52:34,671 GMT TRACE [com.xxx.oss.core.servlets.TransactionFilter] (http-nio-8080-exec-7|R:lB6-JwrDGgR-ZvKy|ThreadId=55|ThreadPriority=5) Responding with outbound response: HTTP 200\\ncontent-length: 85\\ncontent-type: application/json\\n\\n{\"results\":true,\"internalTransactionId\":\"lB6-JwrDGgR-ZvKy\",\"executionTimeInMillis\":0}\n\",\"container_name\":\"idm-geoservices\",\"namespace_name\":\"dev\",\"host\":\"server\"}" | rex field=log mode=sed "s/\\\n/\n/g"
... View more
05-28-2020
12:32 AM
Hi! I'm trying to see if I can get a JSON Payload like this:
{"log":"2020-05-28 06:52:34,671 GMT TRACE [com.xxx.oss.core.servlets.TransactionFilter] (http-nio-8080-exec-7|R:lB6-JwrDGgR-ZvKy|ThreadId=55|ThreadPriority=5) Responding with outbound response: HTTP 200\\ncontent-length: 85\\ncontent-type: application/json\\n\\n{\"results\":true,\"internalTransactionId\":\"lB6-JwrDGgR-ZvKy\",\"executionTimeInMillis\":0}\n","container_name":"idm-geoservices","namespace_name":"dev","host":"server"}
To replace where I have a literal "\n", and present it as a New Line and also represent the JSON payload in the pretty JSON format, if possible.
I have tried something like:
| eval log=replace(log,"\\\\n","[\n]")
I can get the replacement to show when I do something like "TEST", but what I really want to do is have the "log" field present the \n in the message as a new line.
Longer term, we're going to implement Splunk Connect for Kubernetes, but we're trying to get our user taken care of with being able to parse out a multi-line JSON message from Kubernetes.
Thank you!
Stephen
... View more
05-14-2020
05:08 AM
I think I found my answer in the documentation here: https://docs.splunk.com/Documentation/Splunk/8.0.3/RESTREF/RESTsearch
Basically, the REST value is read-only...?
... View more
05-14-2020
12:50 AM
Hi! We are on Splunk 7.2.0, and I am trying to automate setting up a Saved Search using an Ansible Playbook that would dump data into a Summary Index. What's odd is that I can get everything to work correctly, except for the "Enable Summary Index" (action.summary_index) won't go to "true" or accept the value of 1, but it does accept everything else.
- name: Create Splunk Search to populate Summary Index
uri:
url: https://<server>:8089/servicesNS/admin/chargeback/saved/searches
method: POST
user: admin
password: "{{ splunk }}"
body_format: form-urlencoded
validate_certs: false
status_code: 201
body:
name: "name"
search: 'index=_internal"'
dispatch.earliest_time: -1d@h
dispatch.latest_time: now
cron_schedule: 0 0 * * *
action.summary_index: 1
action.summary_index._name: index_utilization_summary
is_scheduled: 1
register: searchquery
Can someone please take a look and see perhaps if I'm using the wrong tag? I would appreciate it!
Thanks!
Stephen
... View more
03-13-2020
01:06 AM
AHA! mvexpand !
| table scn*
| eval temp=""
| foreach scn*
[ eval temp=temp ." ". <<FIELD>>]
| makemv temp
| stats values(temp) as result delim=","
| makemv delim="," result
| mvexpand result
Thanks everyone!
... View more
03-13-2020
12:50 AM
This might work for what I need anyway. I was hoping to get them all in one table list, but my ultimate goal was to get it to send to a API via the JSON endpoint, so one string in that may be OK. But I couldn't get makeenv to split the values back into a list by rows.
Thanks!
Stephen
... View more
03-13-2020
12:40 AM
This gets me closer, but it's dropping all of the values into one row. I wanted to get them all in different rows, so that I could run the dedup again to get unique values.
-Stephen
... View more
03-12-2020
04:54 AM
Hmmm... This gets me closer, but nothing's quite right yet.
| eval scn_combine = "" | fillnull value="" | foreach scn* [append scn_combine scn*] | table scn_combine
I see the point about looping through scn(x). But I'm thinking I want to append the values to a temp table, then running another dedup on that temp table? This search tossed an error.
Thanks!
Stephen
... View more
03-12-2020
04:16 AM
Hi! I'm trying to create a search that would return unique values in a record, but in one list.
The search "basesearch | table scn*" would come up with a table where I have values across scn01 to scn20. So what I want to do is make a unique list of values combined into one column, of all of the fields values. I don't need to preserve the previous field name.
How might I do that?
Thanks!
Stephen
... View more
02-26-2020
04:42 AM
Hi!
I've inherited an app which contains custom searches only (this isn't a Splunkbase app, but an "in house" app.) My users want to be able to delete searches, etc from the app, but they can't. I want them to be able to both manage the searches in the app without having a new deployment, and also not have a subsequent push of all apps cause searches to come back.
To fix this, can I do the following:
1) On the SH Deployer, move the searches from default/savedsearches.conf to local
2) Set app.conf to use Full Deployment
3) Push the deployment
4) Set the app back to local?
Looking at this: https://docs.splunk.com/Documentation/Splunk/8.0.2/DistSearch/PropagateSHCconfigurationchanges, I think this will work, but I want to make sure.
"Use [full deployment] mode if you have a configuration on the deployer in the app's /local directory, and you want to push it to the members and then delete it from the deployer." - This is saying basically that it wipes out the app, and then pushes the new one, correct? Then, when I'm done, change it back to "local_only".
Am I reading that correctly? What I don't want to do is start having searches from the previous version being stored in users folders, etc.
Thanks!
Stephen
... View more
02-03-2020
02:34 PM
After much research, I figured this one out. I had installed the HEC app on the same server. It binds to port 8088, which is not going to allow the DB Connect app to run. I disabled HEC, and all was well.
Thanks!
Stephen
... View more
02-03-2020
01:21 PM
Hi! I'm trying to get a DB Connect 3.1.4 running, and what's strange is I had one working, but it stopped. Now, even with a fresh installation, I can't get it to start. I also tried from another server, and it's also failing It looks from the logs like the Task Server is failing with a 404. I do have Java in the path, so I can't see why this wouldn't be working. Any help would be appreciated.
020-02-03 16:16:55.187 -0500 45786@ [main] INFO org.eclipse.jetty.server.AbstractConnector - Started application
@62b26bef{HTTP/1.1,[http/1.1]}{127.0.0.1:9998}
2020-02-03 16:16:55.187 -0500 45786@[main] ERROR io.dropwizard.cli.ServerCommand - Unable to start server, shutti
ng down
javax.servlet.ServletException: io.dropwizard.jersey.setup.JerseyServletContainer-71daf5d6@74ee0fd6==io.dropwizard.jersey.setup.
JerseyServletContainer,jsp=null,order=1,inst=false
at org.eclipse.jetty.servlet.ServletHolder.initServlet(ServletHolder.java:691)
at org.eclipse.jetty.servlet.ServletHolder.initialize(ServletHolder.java:427)
at org.eclipse.jetty.servlet.ServletHandler.initialize(ServletHandler.java:760)
at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:374)
at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:848)
at org.eclipse.jetty.servlet.ServletContextHandler.doStart(ServletContextHandler.java:287)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:138)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:108)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at com.codahale.metrics.jetty9.InstrumentedHandler.doStart(InstrumentedHandler.java:103)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:138)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:117)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:138)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:108)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.doStart(GzipHandler.java:403)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:138)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:108)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:138)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:108)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.server.handler.StatisticsHandler.doStart(StatisticsHandler.java:252)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:138)
at org.eclipse.jetty.server.Server.start(Server.java:419)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:108)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.server.Server.doStart(Server.java:386)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at io.dropwizard.cli.ServerCommand.run(ServerCommand.java:53)
at io.dropwizard.cli.EnvironmentCommand.run(EnvironmentCommand.java:44)
at io.dropwizard.cli.ConfiguredCommand.run(ConfiguredCommand.java:85)
at io.dropwizard.cli.Cli.run(Cli.java:75)
at io.dropwizard.Application.run(Application.java:93)
at com.splunk.dbx.server.bootstrap.TaskServerStart.startTaskServer(TaskServerStart.java:121)
at com.splunk.dbx.server.bootstrap.TaskServerStart.streamEvents(TaskServerStart.java:72)
at com.splunk.modularinput.Script.run(Script.java:66)
at com.splunk.modularinput.Script.run(Script.java:44)
at com.splunk.dbx.server.bootstrap.TaskServerStart.main(TaskServerStart.java:150)
Caused by: java.lang.RuntimeException: com.splunk.HttpException: HTTP 404 -- Could not find object id=http
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollectorFactory.create(HttpEventCollectorFactory.java:71)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollectorFactory.create(HttpEventCollectorFactory.java:52)
at com.splunk.dbx.server.TaskServer.createHecService(TaskServer.java:487)
at com.splunk.dbx.server.TaskServer.access$300(TaskServer.java:158)
at com.splunk.dbx.server.TaskServer$2.configure(TaskServer.java:238)
at org.glassfish.hk2.utilities.binding.AbstractBinder.bind(AbstractBinder.java:187)
at org.glassfish.jersey.model.internal.CommonConfig.configureBinders(CommonConfig.java:676)
at org.glassfish.jersey.model.internal.CommonConfig.configureMetaProviders(CommonConfig.java:641)
at org.glassfish.jersey.server.ResourceConfig.configureMetaProviders(ResourceConfig.java:829)
at org.glassfish.jersey.server.ApplicationHandler.initialize(ApplicationHandler.java:453)
at org.glassfish.jersey.server.ApplicationHandler.access$500(ApplicationHandler.java:184)
at org.glassfish.jersey.server.ApplicationHandler$3.call(ApplicationHandler.java:350)
at org.glassfish.jersey.server.ApplicationHandler$3.call(ApplicationHandler.java:347)
at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
at org.glassfish.jersey.internal.Errors.processWithException(Errors.java:255)
at org.glassfish.jersey.server.ApplicationHandler.<init>(ApplicationHandler.java:347)
at org.glassfish.jersey.servlet.WebComponent.<init>(WebComponent.java:392)
at org.glassfish.jersey.servlet.ServletContainer.init(ServletContainer.java:177)
at org.glassfish.jersey.servlet.ServletContainer.init(ServletContainer.java:369)
at javax.servlet.GenericServlet.init(GenericServlet.java:244)
at org.eclipse.jetty.servlet.ServletHolder.initServlet(ServletHolder.java:670)
... 45 common frames omitted
Caused by: com.splunk.HttpException: HTTP 404 -- Could not find object id=http
at com.splunk.HttpException.create(HttpException.java:84)
at com.splunk.DBXService.sendImpl(DBXService.java:131)
at com.splunk.DBXService.send(DBXService.java:43)
at com.splunk.HttpService.get(HttpService.java:154)
at com.splunk.Entity.refresh(Entity.java:381)
at com.splunk.Entity.refresh(Entity.java:24)
at com.splunk.Resource.validate(Resource.java:186)
at com.splunk.Entity.validate(Entity.java:462)
at com.splunk.Entity.getContent(Entity.java:157)
at com.splunk.Entity.size(Entity.java:416)
at java.util.HashMap.putMapEntries(HashMap.java:501)
at java.util.HashMap.<init>(HashMap.java:490)
at com.splunk.dbx.model.repository.JsonMapperEntityResolver.apply(JsonMapperEntityResolver.java:34)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollectorFactory.enableGlobalHec(HttpEventCollectorFactory.jav
... View more
01-08-2020
03:24 AM
Hi folks. What I want to do is have a Text Box capture a value, and store it in token $client_action$. This works fine with a Default value, but when I actually edit the text in the box (changed?)
@niketnilay - O actually started with the example like the one you provided, and also validated against what @gcusello has said, and it all looks correct from my side.
What I have now (which still doesn't affect searches when the text changes, is:
<fieldset submitButton="false" autoRun="true">
<input type="text" token="timeout">
<label>Timeout Value</label>
<default>10000</default>
</input>
**<input type="text" token="client_action" searchWhenChanged="true">
<label>Client Action</label>
<default>*</default>
</input>**
<input type="checkbox" token="clientaction" searchWhenChanged="true">
<label></label>
<choice value="set">NOT IN</choice>
<delimiter> </delimiter>
<change>
<condition value="set">
<set token="clientaction">NOT Client_Action IN ( $client_action$ )</set>
</condition>
<condition>
<set token="clientaction">Client_Action IN ( $client_action$ )</set>
</condition>
</change>
</input>
<input type="time" token="time_period" searchWhenChanged="true">
<label>Time Period</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
... View more
01-07-2020
11:35 AM
Hi! In Splunk 7.2.0, I'm trying to get a Dashboard that has a Text Box in it, and when you type a value in, I would expect it to update the Dashboard.
I've tried multiple ways, even trying with the changed of the token, but nothing's ever refreshing the dashboard. 😞 My sample code is below. I've seen some references to having to possibly use JavaScript to do this? Are we needing to install another app to make this work? I know the tokens work, because they impact other areas of my dashboard.
Thanks!
Stephen
<input type="text" token="client_action" searchWhenChanged="true">
<label>Client Action</label>
<default>*</default>
<change>
<condition value="changed">
<set token="clientaction">$client_action$</set>
</condition>
</change>
</input>
... View more
12-04-2019
12:20 PM
Or maybe, would this work?
1) Create the same Summary Index on the LM
2) Run the Summary Reports for the older data on the LM
3) Then, would the data flow over to the main index?
Thanks!
Stephen
... View more
12-04-2019
12:11 PM
I am trying to see how I can basically re-push historical license data from our License Master to a Summary Index.
What I have now is: 1) Data from the LM is being forwarded to the main indexers 2) I have the Chargeback app running and helping create Summary Data to the Summary Index.
My challenge is that for data before the beginning of November, we were not forwarding data to the main indexers. Might it be possible to have the LM be a Search Head for the main indexers, and then run the Search Reports to dump to the Summary index to help with backfill?
Thanks, Stephen
... View more
Labels
- Labels:
-
summary indexing
11-23-2019
11:55 AM
1 Karma
Thanks all. Yes, I think now that the issue is that the props/transforms was not done on the first HF in the chain. I'm going to work next week with the owner of the other HF to get them to update settings.
I will update/mark as answered when I have confirmation it works.
Thanks!
Stephen
... View more
11-21-2019
02:03 PM
Ah! OK. I think I understand. So only the first HF in the chain can impact/change the data, and if you don't have a use case to do so at that point, use a UF, then you can use a HF later down the line to do that? But once you introduce a 2nd HF in the chain, it's automatically demoted to more of a UF in that sense?
-Stephen
... View more
11-21-2019
01:54 PM
@hrottenberg_splunk et al, I asked internally (Hal, I think this gets back to some of the HEC convos we have had) and find out.
-Stephen
... View more
11-21-2019
01:47 PM
Network segmentation, mostly, I believe. I wasn't the one to set that up, unfortunately. (Queue the document on Inherited Deployments).
I will check with the Server Owner, but I think the server where those logs reside just have a HF installed on it, which forwards to our HF and then to Indexers. So then, would it be better to put that on the first HF in the chain?
Thanks!
Stephen
... View more
11-21-2019
12:11 PM
1 Karma
Hi! I'm trying to filter out data, and nothing I have tried seems to work.
What we're doing is taking our data inbound from a Heavy Forwarder, and then parsing it on another Heavy Forwarder, then sending it to the Indexer.
My use case is I want to filter out any event with "Closing" anywhere in the event for this particular file mask.
My setup is:
Target event has Source=/var/log/containers/iceservices-sales-32-n65ld_cct_iceservices-sales-22a0f7bd882bd61c179be102ade62c328ff15e5bdd963774f4313e12d877d263.log
Props.conf:
[source::/var/log/containers/iceservices*.log]
TRANSFORMS-ice=ice_drop
Transforms.conf
[ice_drop]
REGEX = Closing
DEST_KEY = queue
FORMAT = nullQueue
I've tried many permutations of this source, with restarts, and nothing seems to work.
Can someone help?
Thanks!
Stephen
... View more
- « Previous
-
- 1
- 2
- Next »
