About richgalloway

richgalloway · ‎11-20-2023

Splunk has "free" licenses and "trial" licenses (also free) with different capabilities. Which do you have? Splunk forwarders typically send data to Splunk indexers on port 9997. Splunk can receive syslog data on port 514, but it's not recommended. To set that up, go to Settings->Data inputs->TCP (or UDP, if you prefer) and click the green button. Then fill in the form and click Save.

richgalloway · ‎11-20-2023

We need more information. How exactly are you trying to add a receiver port? What command are you issuing and where are you entering it?

richgalloway · ‎11-20-2023

The general form is <<some search that returns field 'foo'>> NOT [ | inputlookup mylookup.csv | field foo ] If the lookup file does not contain 'foo' then you'll need a rename command to change what it has to 'foo'.

richgalloway · ‎11-20-2023

The timechart command has a limit option that will give you the top n results. | timechart span=5min limit=5 count(action) by applicationname

richgalloway · ‎11-20-2023

Check your firewalls to confirm they allow connections to Splunk Cloud port 8088.

richgalloway · ‎11-20-2023

Verify the script runs correctly when run manually splunk cmd python <<your script>> Are you trying to run the script on a heavy forwarder or universal forwarder? UFs cannot run python scripts because they don't have in interpreter. Confirm the forwarder successfully connects to the indexer(s), by verifying the forwarder's logs are in the _internal index. Tell us how you are trying to find the data in Splunk.

richgalloway · ‎11-18-2023

Something's not right in that screenshot. The contents of indexes.conf should not be indexed. I suspect some instructions are being misinterpreted. Please tell us more details about how you are trying to load the data. Provide the exact steps followed or a link to them.

richgalloway · ‎11-18-2023

For a 2-D plot, you'll have to somehow reduce the number of arguments to 3. Perhaps you can concatenate two of the values (| eval foo=bar . baz) and graph the remaining three.

richgalloway · ‎11-17-2023

Scatter plots are two-dimensional so they take 3 arguments: value, x-axis, and y-axis. A fourth argument would call for a three-dimensional chart and that calls for an add-on like https://splunkbase.splunk.com/app/3138. See https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/ScatterChart

richgalloway · ‎11-17-2023

1) Please show the SPL you've tried and tell us how it failed you. It would help to see an actual (sanitized) event, too. The options to the extract command are swapped. kvdelim is the character that separates key from value, usually "="; pairdelim is the character that separates kv pairs, usually comma or space. 2) The props.conf file has a TRUNCATE setting that defaults to 10000. Perhaps your system has a lower value.

richgalloway · ‎11-17-2023

None of those. The SEDCMD setting must be on the indexer(s) and/or heavy forwarders. It should go in the stanza where the sourcetype it goes with resides (if the file is in a default stanza then put the setting in the associated local directory).

richgalloway · ‎11-17-2023

A [monitor] stanza reads a file and indexes new data written to that file. A [script] stanza runs a script and indexes the output of it.

richgalloway · ‎11-17-2023

I wouldn't say that at all. One of the features of KVStore is to replace large lookup files.

richgalloway · ‎11-17-2023

The monitor stanza in inputs.conf is looking for updates the abc.sh file - something unlikely to happen often. To run a scripted input, use a script stanza [script://./bin/abc.sh] interval = 500 index = xyz sourcetype = script:abc

richgalloway · ‎11-17-2023

I'm not sure there are best practices around automatic lookups. There are some for lookups in general, however. Monitor lookup size (in bytes) to make sure they don't cause the knowledge bundle to become too large (2GB). Large lookups should be blocked from the bundle or converted to KVStore.

richgalloway · ‎11-17-2023

In case the field may be in a different order, use multiple rex commands to extract them. | rex "approved=(?<approved>[^,]+)" | rex "from=(?<from>[^,]+)" | rex "until =(?<until>[^,]+)" I hope you see the pattern.

richgalloway · ‎11-17-2023

Splunk Cloud fully supports SEDCMD.

richgalloway · ‎11-17-2023

At some unknown point in the future, Splunk will stop supporting non-compliant Python code. When that happens, your scripts will fail.

richgalloway · ‎11-16-2023

That can be accomplished with a single list by good list management. Anything on the baddomains list should not be in the gooddomains list and vice versa. That said, what you have should work, but not as efficiently as a single list. A domain on both lists will not appear in the results, which is the intent. For debugging purposes, run each subsearch on its own with | format appended to verify it returns the expected results. You may need to leave the format command in the final query, combined.

richgalloway · ‎11-16-2023

It should be done with two SEDCMD statements since the fields may not be next to each other. SEDCMD-no_cs4 = s/cs4=.*?(\w+=)|$/\1/ SEDCMD-no_cs4Label = s/cs4Label=.*?(\w+=)|$/\1/ SEDCMD-no_cs3 = s/cs3=.*// SEDCMD-no_cs3Label = s/cs3Label=.*?(\w+=)|$/\1/ I've also assumed the cs3 field is always last, but that may be erroneous..

richgalloway · ‎11-16-2023

Use that regex in SEDCMD in props.conf. [mysourcetype] SEDCMD-no_UTF-8 = s/\x1B\[[0-9;]*[mK]//g

richgalloway · ‎11-16-2023

I think that would depend on how the syslog data is received, but I believe it's still possible.

richgalloway · ‎11-15-2023

I don't have a SEDCMD that would do that well. SEDCMD applies to _raw rather than individual fields so a regex would have to be very specific to avoid removing too many spaces or otherwise damaging other fields.

richgalloway · ‎11-15-2023

A common way to re-ingest data is by using the splunk add oneshot command. Splunk will re-ingest everything in the file, however, without regard to events that were previously indexed. To ingest only missing events, I would copy the file and remove the events that you don't want to read in again.

richgalloway · ‎11-15-2023

That's an intriguing idea. I think it would work except for the matter of the cs4Label value contains embedded spaces. Field names with spaces can be a problem in Splunk.

Posts	16783
Solutions	2989
Karma Given	2036
Karma Received	6728
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	yesterday

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Getting error when entering port number for a ...

Re: Getting error when entering port number for a ...

Re: Splunk query to compare a field from search wi...

Re: Get the top n results when searched by count a...

Re: Cannot connect to HEC on cloud

Re: scripted input not working

Re: I cant get Splunk to read Boss Of SOC v1 Data ...

Re: How to read a fourth value from scatter plot?

Re: How to read a fourth value from scatter plot?

Re: Not all fields in log line extracted

Re: [Splunk Cloud] UTF-8 characters in a log file ...

Re: scripted input not working

Re: Best Practice for Automatic Lookups

Re: scripted input not working

Re: Best Practice for Automatic Lookups

Re: How do we Parse logs of Secret Server in Splun...

Re: [Splunk Cloud] UTF-8 characters in a log file ...

Re: Error Messages Uprading Splunk

Re: Using multiple lookup tables in a query

Re: How do we Parse logs of Secret Server in Splun...

Re: [Splunk Cloud] UTF-8 characters in a log file ...

Re: How do we Parse logs of Secret Server in Splun...

Re: How do we Parse logs of Secret Server in Splun...

Re: How do i re-ingest data from a particular sour...

Re: How do we Parse logs of Secret Server in Splun...

Join the Conversation