Hi cmerriman, thanks for you effort, could please tell me where to include this splunk_server="local" in the search query. Kindly guide me on this please. ... View more

Hi Jkat thanks for your effort on this, I had tried the above query to fetch the summarization details by executing the query for 24 hrs time frame from the search head cluster web console. But I am getting the following errors while executing the query. | rest /servicesNS/nobody/SA-critical_security_controls/admin/summarization/ Error Details: REST Processor: Failed to fetch REST endpoint uri=https://x.x.x.x:8089/servicesNS/nobody/SA-critical_security_controls/admin/summarization/?count=0 from server https://x.x.x.x:8089. Check that the URI path provided exists in the REST API. Learn More [splunk01] REST Processor: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-critical_security_controls/admin/summarization/?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. Learn More [splunk02] REST Processor: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-critical_security_controls/admin/summarization/?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. Learn More [splunk03] REST Processor: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-critical_security_controls/admin/summarization/?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. Learn More Splunk01,02 & 03 are the indexer nodes Job : Unexpected status for to fetch REST endpoint uri=https://x.x.x.x:8089/servicesNS/nobody/SA-critical_security_controls/admin/summarization/?count=0 from server=https://x.x.x.x:8089 - Forbidden [splunk01] Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-critical_security_controls/admin/summarization/?count=0 from server=https://127.0.0.1:8089 - Not Found Kindly guide me on this please ... View more

Hi All, Can anyone guide me, on how to find the saved search name from the below saved search names. _ACCELERATE_C090FDA2-105E-4875-A110-3F13FF986151_SA-critical_security_controls_admin_2472f801659441b4_ACCELERATE ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_DA-deployment_monitor_nobody_1a56f43bf8d5bf20_ACCELERATE ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_search_nobody_365ca83246f2cca8_ACCELERATE Kindly guide me on this please. thanks in advance ... View more

Hi All, Can anyone guide me how to find out the exact saved search name from the below saved search names. _ACCELERATE_C090FDA2-105E-4875-A110-3F13FF986151_SA-critical_security_controls_admin_2472f801659441b4_ACCELERATE ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_DA-deployment_monitor_nobody_1a56f43bf8d5bf20_ACCELERATE ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_search_nobody_365ca83246f2cca8_ACCELERATE As I need to fix the skipped searches issue, kindly guide me on this please. thanks in advance. ... View more

thanks jkart, after changing the TIMESTAMP_FORMAT to TIME_FORMAT stanza in our Heavy forwarder where the splunk sees the event first . Invalid Key Stanza got corrected. But need to validate whether the _time field be the same as the log_time field, as we have some issue in the symantec node current we are not getting the data in splunk from this node. ... View more

Hi Jkat54, After updating the above stanza i am getting this error after updating the above stanza. Checking conf files for problems... Invalid key in stanza [symantec:tap:incidents] in /opt/splunk/etc/apps/TA-symantec_tap/default/props.conf, line 83: TIMESTAMP_FORMAT (value: %FT%T.%3N). Invalid key in stanza [symantec:tap:incidentevents] in /opt/splunk/etc/apps/TA-symantec_tap/default/props.conf, line 100: TIMESTAMP_FORMAT (value: %FT%T.%3N). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' Bad strptime format value: '%Y-%m-%dT%H:%M:%S.%L%z', of param: props.conf / [oracle:auth:ovd] / TIME_FORMAT One or more time-format strings in your configuration are not valid. For details, please see btool.log or directly above. Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-6.6.1-aeae3fe0c5af-linux-2.6-x86_64-manifest' All installed files intact. Done Kindly guide me on this please. ... View more

Hi All, Can anyone guide me on this issue please. thanks in advance ... View more

Hi Dal Jeanis, thanks for your effort on this issue, I had executed the above query and found the list of users, host and saved search name from the query. index="_internal" source="*scheduler.log" savedsplunker | stats count BY user, savedsearch_name, host,status Based on the search result, I found skipped status are getting generated from two splunk instance node 1) Search head cluster master 2) Deployment server User: Admin & nobody But unable to get the exact saved search name from the list, I could see the below name under saved search column _ACCELERATE_C090FDA2-105E-4875-A110-3F13FF986151_SA-critical_security_controls_admin_2472f801659441b4_ACCELERATE ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_DA-deployment_monitor_nobody_1a56f43bf8d5bf20_ACCELERATE ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_search_nobody_365ca83246f2cca8_ACCELERATE So kindly let me know how to get the saved search name and fix the issue. Please guide me on this thanks in advance. ... View more

Hi All, Can anyone guide me on how to list out all the auto-summarization searches in splunk from search head cluster. thanks in advance. ... View more

Hi Kalmira, thanks for your effort on this issue, i could successfully install the splunk 6.6.1 in our test machine. As cpetterborg had commented in his comments, that by installing the libxmlsec1-1.2.18-123.1.x86_64.rpm file from this site had fixed the issue. After installing the rpm, i could install and launch the splunk application. http://rpm.pbone.net/index.php3/stat/4/idpl/23752033/dir/redhat_el_6/com/libxmlsec1-1.2.18-123.1.x86_64.rpm.html thanks ... View more

Hi cpetterborg, thanks for your effort on this issue, i could successfully install the splunk 6.6.1 in our test machine. As you had commented that by installing the libxmlsec1-1.2.18-123.1.x86_64.rpm file from this site. After installing the rpm, i could install and launch the splunk application. http://rpm.pbone.net/index.php3/stat/4/idpl/23752033/dir/redhat_el_6/com/libxmlsec1-1.2.18-123.1.x86_64.rpm.html thanks ... View more

Hi Garethatiag, Good Morning, hey need to know how to take the list of all auto-summarization searches from search head cluster. Could you please guide me on how / where I can get this list . thanks in advance. ... View more

Jkat, when checked for the props stanza in the Heavy forwarder, I could see the below stanza details for this app and I have added the your stanza along with this stanza. So that fine to push it and restart the service to match the _time field be the same as the time field. [symantec:tap:incidents] SHOULD_LINEMERGE = false FIELDALIAS-event_host = tap_host as event_host FIELDALIAS-dest = domainId{} as dest FIELDALIAS-file_hash = filehash{} as file_hash FIELDALIAS-severity_id = priority_level as severity_id DATETIME_CONFIG = CURRENT KV_MODE = json TRUNCATE = 0 TIME_PREFIX=time:\s TIMESTAMP_FORMAT=%FT%T.%3N MAX_TIMESTAMP_LOOKAHEAD=32 TZ=EDT thanks in advances. ... View more

thanks Jkat. ... View more

Hi Jkat, thanks for your effort on this, can I configure the props.conf stanza for the sourcetype=symantec:tap:incidentevents. In order to make _time field be the same as the log_time field. [symantec:tap:incidentevents] TIME_PREFIX=log_time:\s TIMESTAMP_FORMAT=%FT%T.%3N MAX_TIMESTAMP_LOOKAHEAD=32 TZ=EDT thanks in advance. ... View more

Hi Jkat, thanks for your effort on this, after executing the below query i am got this event details for a duration of 7 days index=sem sourcetype=symantec:tap:incidentevents log_time="2017-08-22T13:38:04.899Z" 8/24/17 3:46:06.000 PM { [-] actual_action: Left alone actual_action_idx: 4 agent_version: 12.1.7004.6500 tap_host: 10.x.x.x data_source_url_domain: xxx-my.sharepoint.com device_ip: 10.x.x.x device_name: xxxxxx device_time: 2017-08-22T13:32:17.000Z device_uid: d424209e-a2fc-4956-8355-0657630e9f13 domain_name: test.com external_ip: file: { [+] } host_name: xxxxx incident: 20147330-873f-11ex-e5x8-00000000024b internal_ip: 10.x.x.x local_host_mac: xx-8b-xx-xx-0d-xx log_name: xxx_incident-2017-08-22/event log_time: 2017-08-22T13:38:04.899Z no_of_viruses: 1 sep_installed: true source: Real Time Scan threat: { [+] } type_id: 4123 user_name: xxxx uuid: 204dxxx-873f-11e7-fff5-000000005819 virus_def: 2017-08-22 rev. 001 virus_name: xx.Reputation.1 } Kindly help me on how to make the _time field be the same as the log_time field ? thanks in advance ... View more

Hi Jkat54, thanks for your effort on this, i had run the above query provide by Dal Jeanis and got the above output. Based on the out put can I try this above stanza will that work. Kindly guide on this, as I need to get this fixed. index=sem sourcetype="symantec:tap:incidents" | head 5| eval indextime = strftime(_indextime, "%Y-%m-%dT%H:%M:%S")| table time indextime time 2017-08-29T16:22:01.597Z 2017-08-29T15:59:59.853Z 2017-08-29T15:59:59.852Z 2017-08-29T15:59:59.852Z 2017-08-29T15:42:05.321Z indextime 2017-08-29T12:25:44 2017-08-29T12:05:44 2017-08-29T12:05:44 2017-08-29T12:05:44 2017-08-29T11:45:44 Also we have another sourcetype=symantec:tap:incidentevents with same issue in this indextime should match the log_time field value in the events. index=sem sourcetype=symantec:tap:incidentevents | head 5 | eval indextime = strftime(_indextime, "%Y-%m-%dT%H:%M:%S") | table log_time indextime log_time indextime 2017-08-29T16:40:58.819Z 2017-08-29T12:45:43 2017-08-29T16:40:58.821Z 2017-08-29T12:45:43 2017-08-29T16:40:58.800Z 2017-08-29T12:45:43 2017-08-29T16:40:58.798Z 2017-08-29T12:45:43 2017-08-29T16:40:58.778Z 2017-08-29T12:45:43 Please guide me how to make the _time field be the same as the log_time field ? thanks in advance. ... View more

Hi Dal Jeanis, thanks for guiding me, I had executed the query and got this output and as you said the two fields are matching all the five records. index=sem sourcetype="symantec:tap:incidents" | head 5 | eval indextime = strftime(_indextime, "%Y-%m-%dT%H:%M:%S") | table time indextime time indextime 2017-08-29T16:22:01.597Z 2017-08-29T12:25:44 2017-08-29T15:59:59.853Z 2017-08-29T12:05:44 2017-08-29T15:59:59.852Z 2017-08-29T12:05:44 2017-08-29T15:59:59.852Z 2017-08-29T12:05:44 2017-08-29T15:42:05.321Z 2017-08-29T11:45:44 Kindly let me know what I have right in props stanza to match the _time field to be the same as the time field in the event. Similarly i have another sourcetype=symantec:tap:incidentevents which is also having the same issue. in this indextime is not matching the log_time field value in the events. index=sem sourcetype=symantec:tap:incidentevents | head 5 | eval indextime = strftime(_indextime, "%Y-%m-%dT%H:%M:%S") | table log_time indextime log_time indextime 2017-08-29T16:40:58.819Z 2017-08-29T12:45:43 2017-08-29T16:40:58.821Z 2017-08-29T12:45:43 2017-08-29T16:40:58.800Z 2017-08-29T12:45:43 2017-08-29T16:40:58.798Z 2017-08-29T12:45:43 2017-08-29T16:40:58.778Z 2017-08-29T12:45:43 Kindly guide me on this, on how to fix this issue. ... View more

Hi Garethatiag, I have captured everything from the search head console--settings-datamodels-app in the above comments. Kindly guide me to fix the issue. thanks in advance. ... View more

Hi Duke, thanks for your effort on this, instead of mapping/remapping of the server class, can we re-install the splunk agent for the 22 odd servers. Kindly let me know, by re-installing the UF agent will fix this issue. thanks in advance. ... View more

Hi esix, we are using linux based os for deployment server. Currently we are facing an issue with 22 nodes only rest of the nodes got the required app. Kindly guide why we are getting this above mentioned error only for 22 nodes and how to fix that out. thanks in advance. ... View more