Hi aengelstad, try to use MartinMcNutt's suggestion and have the load balancer also test on port 8089 and if this fails remove port 8000 from the load balancer pool. Other solution would be the script cron job that you suggested. cheers, MuS ... View more

do you have req_time, pmi_nodename and pmi_servername fields in all events? ... View more

You're welcome and thx for accepting the answer 🙂 ... View more

now it's perfect form my understanding...some regex gurus would probably find some tuning possibilities 🙂 ... View more

Hi ashrafmr, I did some testing with supportSSLV3Only = true and you need to have at least one cipherSuite set in web.conf. If you remove it splunkweb will not start returning this error: 2014-04-10 10:16:39,534 ERROR [5346535fe020bd8d0] root:555 - 'cipherSuite' Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 550, in <module> run(blocking=True) File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 250, in run ssl_ciphers = str(global_cfg['cipherSuite']) KeyError: 'cipherSuite' In your default web.conf there is a cipherSuite entry like this: # For the HTTP server, Diable ciphers lower than 128-bit and disallow ciphers that # don't provide authentication and/or encryption. # Use 'openssl ciphers -v' to generate a list of supported ciphers cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM You can check for any overlapping .conf settings (I did not have any) with btool like this: /opt/splunk/bin/splunk cmd btool --debug web list | grep cipher If you now open up Splunk in your browser, you will see something like this: Connection Encrypted: High-grade Encryption (TLS_RSA_WITH_AES_128_CBC_SHA, 128 bit keys) The message may differ based on your browser (I used Firefox). Based on that the default cipher would be: AES_128_CBC On the other hand chrome will display something like this: TLS 1.0 AES_256_CBC SHA1 RSA since I did not set any specific cipher in web.conf , it just disables the weak ciphers. hope this helps ... cheers, MuS ... View more

if this is a default *uix setup try: /opt/splunk/bin/splunk cmd openssl version ... View more

did you run this like $SPLUNK_HOME/bin/splunk cmd openssl version ? Otherwise you will probably get a response from your servers openSSL installation not the one from Splunk ..... ... View more

Hi rileyken, set in your props.conf for that sourcetype something like this: LINE_BREAKER = \| Maybe you also need to set SHOULD_LINEMERGE = [true|false] * Defaults to true. to false..... hope this helps ... cheers, MuS ... View more

Ok, you misunderstood my answer. Inside Sideview App there is an example about how to detect if Sideview is installed or not. This means if you look at this example you will find a 'native way' on how to check for installed apps. ... View more

Hi flo_cognosec, inside the sideview utils app there is a key techniques document on detecting sideview utils. Maybe you could use this a sample and adapt it to your needs. cheers, MuS ... View more

Kieler Woche wird nichts, eventuell bin ich im Herbst in der Nähe von Flensburg. Würde mich dann melden 😉 ... View more

arrrgghhhllll ...... Ich spendier 'ne Runde Flens für die Lösung ohne transaction | join | append 😉 😄 ... View more

That's true, this was an early morning answer and I did not consider all possibilities. In this case, it would be better to use something like this: base search yielding events from both sources | stats last(Time) AS Time, last(Site) AS Site, last(Used) AS Used by IP, MAC ... View more

Regarding the configuration: basically you could also use any other tool that is able to change files on a server, like Puppet. Regarding the filtering: no, this is how it is done 🙂 ... View more

Hi frank_zhang, give this a try: base search yielding events from both sources | stats last(Site) AS Site, last(Used) AS Used by IP, MAC, Time that should provide what you described in the last comment. hope this helps, also take a look at this answer cheers, MuS ... View more

I can only show you a path to your possible solution, I cannot do your work, since you did not tell what exactly your needs are. Test your data and maybe add some dedup gerne before the stats to get what you want.... ... View more

thx and you're welcome ... View more

Hi SplunkCSIT, either setup on your Search Head in props.conf the option KV_MODE = xml to have the key=value mapping done or your use spath to do it on the fly. With spath it would be like this: Table 1: YourBaseSearchHere | spath | stats values(gerne) AS gerne by id Table 2: YourBaseSearchHere | spath | stats values(id) AS id by gerne Or if you did set KV_MODE, like this: Table 1: YourBaseSearchHere | stats values(gerne) AS gerne by id Table 2: YourBaseSearchHere | stats values(id) AS id by gerne hope this helps ... cheers, MuS ... View more

Hi Meena27, sure there is, you can use iplocation to get this kind of information and use geostats to show it on a google map inside Splunk. cheers, MuS ... View more

Check this out http://apps.splunk.com/app/413/ ... View more