About richgalloway

richgalloway · ‎06-06-2024

The docs say to use the group ID or UUID. I have little experience with Azure so I can't help much there.

richgalloway · ‎06-06-2024

I thought that was how it was done. The user accounts are still in the renamed passwd file. Put it back (after transferring the admin password from the new passwd file), restart, and the accounts should be restored.

richgalloway · ‎06-06-2024

Yes, SPL has a join command, but it should be avoided because it doesn't perform well. See https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Join

richgalloway · ‎06-06-2024

How did you reset the admin password?

richgalloway · ‎06-06-2024

Did you continue to the next step "Map SAML groups to Splunk Enterprise roles "?

richgalloway · ‎06-05-2024

Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it. https://www.duanewaddle.com/proving-a-negative/ Consider using the TrackMe app (https://splunkbase.splunk.com/app/4621)

richgalloway · ‎06-05-2024

There is no time constraint for warm buckets. Warm buckets roll to cold when there are too many of them (maxWarmDBCount) or there's too much data in the warm volume (homePath.maxDataSizeMB or maxVolumeDataSizeMB). See https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Configureindexstorage for more information.

richgalloway · ‎06-05-2024

Ideally, Splunk would know it's creating an event that's too large and modify TRUNCATE accordingly for that sourcetype. For log messages that glob together several pieces of information at run-time (like many audit events), the true size of the event won't be known in advance.

richgalloway · ‎06-05-2024

The audit log exceeds the limit because Splunk wrote a very long event to the log. Why that happened is impossible to say without knowing more about the event itself. Or is the question more like "shouldn't Splunk never write events longer than 10,000 characters?" If so, I don't disagree, but prefer Splunk give me the option (by increasing TRUNCATE) to log all of the event rather than cut off what might otherwise be important data.

richgalloway · ‎06-05-2024

Generally speaking, yes, you can use a single HF for all of your input scripts. If you will be processing a lot of data then you may need an additional HF.

richgalloway · ‎06-04-2024

If the app is installed on a heavy forwarder then all parsing is done there using the configurations in the app. There is little need for the app also to be on the indexers unless you like to wear suspenders (braces) with your belt. P.S. I challenge the notion that almost every app uses script inputs. Of the thousands of app in splunkbase, comparatively few use input scripts. 🙂

richgalloway · ‎06-04-2024

The Monitoring Console has that at the bottom of the overview page. Click on the magnifying glass icon to see the SPL.

richgalloway · ‎06-04-2024

1. Yes. Such apps should be installed on a heavy forwarder. 2. Some preparation may be necessary, depending on the app. Inputs.conf should be removed or all inputs disabled, for example.

richgalloway · ‎06-04-2024

Splunk can't find something that's not there. You'll need to use makeresults or a lookup to populate what you expect and then replace that with actual indexed data.

richgalloway · ‎06-03-2024

There are two REST endpoints you can use to get that information. This one fetches saved searches (including reports and alerts) | rest splunk_server=local /servicesNS/-/-/saved/searches | search search="*You found a bug!*" This one does the same for dashboards. | rest splunk_server=local /services/-/-/data/ui/views | search eai:data="*You found a bug!*"

richgalloway · ‎06-03-2024

I presume the problem is the table is very wide. If so, try swapping the terms in the chart command index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/CXMLOrders.log" | eval timestamp=strftime(_time, "%F") | chart limit=30 count as count over timestamp by TransactionType Alternatively, try the timechart command. index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/CXMLOrders.log" | eval timestamp=strftime(_time, "%F") | timechart useother=0 limit=30 count by TransactionType

richgalloway · ‎06-03-2024

The index name is specified on another line, similar to how the sourcetype is specified. [monitor:///var/log/snort/*alert_json.txt*] sourcetype = snort3:alert:json index = foo Read The Fine Manual at https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Inputsconf

richgalloway · ‎06-03-2024

The monitor stanza should specify an index name so Splunk knows where to put the data. Without that, everything goes in the 'main' index. Your (and everyone else's) search query should specify the index name to search. This makes the query more efficient and avoids reliance on your default index. The index name in the query must match the index name in the monitor stanza for Splunk to find the data. The message about the tags.conf file is a symptom of a different problem and should be easy to correct. Go to line 1 of the file specified in the message and URL-encode the value.

richgalloway · ‎06-03-2024

Check splunkd.log for replication errors. Verify the AWS security groups allow communication among all indexers on ports 8080 and 9887 and to the Cluster Manager's port 8089.

richgalloway · ‎05-30-2024

We some information to work with. What is the full text of the error message? What is the setting/query that generated the error?

richgalloway · ‎05-30-2024

The inputs.conf stanza tells Splunk to run your script. What the script does depends on how it is written. It may want to get the files it should read from a script-specific configuration file.

richgalloway · ‎05-29-2024

Group the Failed counts by Event. ... [|search index=abcd "API" AND ("Couldn't save") |rex "\[ERROR\] \[API\] \[(?<ID>.+)\] \:" |dedup ID |stats count as Failed by Event ] ... You could do the same thing without a join for better performance. index=abcd ("API : access : * : process : Payload:") OR ("Couldn't save") |eval status = if(searchmatch("Couldn't save"), "Failed", "Success") |stats count as Total, sum(eval(status="Failed")) as Failed by Event |eval Success=Total-Failed |table Event Total Success Failed

richgalloway · ‎05-27-2024

Please explain what is meant by "it is not working". What results do you get and how do they not meet your expectations? The exclude_message field will be null if the lookup fails to find a match.

richgalloway · ‎05-24-2024

Try LINE_BREAKER = ()\d{4}-\d\d

richgalloway · ‎05-24-2024

This run-anywhere example should explain the process. | makeresults | eval STime="9:45" | rex field=STime "(?<hrs>\d+):(?<mins>\d+)" | eval Hours=hrs + round(mins/60,2)

Posts	16782
Solutions	2989
Karma Given	2029
Karma Received	6725
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	yesterday

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: No valid Splunk role found in local mapping - ...

Re: Restore Splunk user account

Re: Azure defender advanced hunting to Splunk SPL

Re: Restore Splunk user account

Re: No valid Splunk role found in local mapping - ...

Re: Create Splunk Alert only when 2 hosts are not ...

Re: What are the criteria for a warm bucket to be ...

Re: Splunk Audit Log Truncate

Re: Splunk Audit Log Truncate

Re: Will index cluster replicate data from script ...

Re: Will index cluster replicate data from script ...

Re: SPL to identify the line breaking and event br...

Re: Will index cluster replicate data from script ...

Re: How to add a dummy row to the table calculatin...

Re: How to find all alerts reports, and Dashboards...

Re: how to group by transaction type

Re: It does not search for Snort json alerts

Re: It does not search for Snort json alerts

Re: Search Factor and Replication Factor not met

Re: How could I solve this error while setting th...

Re: How to assign actual directory source in scrip...

Re: Join with Stats

Re: Exclusion in lookup via wildcard

Re: Line breaking using props.conf

Re: convert time format

Join the Conversation