Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About dfronck
dfronck
Communicator
Member since:
03-13-2013
04-17-2024
Community Statistics
| Posts | 73 |
| Solutions | 4 |
| Karma Given | 49 |
| Karma Received | 56 |
| Member Since | 03-13-2013 |
Activity Feed
- Got Karma for Re: Specifying multiple LDAP static group filters. 09-02-2025 10:24 AM
- Got Karma for Re: Can you update the Splunk manifest so that it will not throw warnings about it being modified?. 03-03-2025 05:01 PM
- Got Karma for Re: Specifying multiple LDAP static group filters. 03-14-2024 10:47 AM
- Posted Re: Has anyone been able to use Certificate Transparency Log add-on for Splunk Enterprise version 9? on All Apps and Add-ons. 09-27-2023 09:57 AM
- Posted Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authenticatio on Security. 08-31-2023 01:20 PM
- Karma Re: Can the REST call to delete a user from Splunk be called from the search command "|rest /services/authenticatio for ASierra. 08-31-2023 01:18 PM
- Karma Re: Is it possible to use wildcards in tag definitions? for alacercogitatus. 05-03-2023 08:42 AM
- Karma Re: ADFS SAML: IDP failed to authenticate request (Splunk 6.4) for walker_liu. 12-01-2022 12:08 PM
- Posted Re: Warning in internal log: unable to parse site_label on Splunk Search. 05-11-2022 04:06 AM
- Posted Re: Missing Audit logs on Monitoring Splunk. 04-27-2022 06:53 AM
- Karma Re: rlog.sh using too much CPU for Lowell. 01-21-2022 11:38 AM
- Karma Why did the Splunk Add-on for Microsoft Office 365 TA fail to get data and service status stop working? for fde. 01-19-2022 07:41 AM
- Posted Re: Splunk Add-on for Microsoft Cloud Services not line breaking JSON docs from event hub on All Apps and Add-ons. 09-04-2021 07:02 AM
- Got Karma for Re: Can you update the Splunk manifest so that it will not throw warnings about it being modified?. 08-17-2021 04:20 AM
- Got Karma for Re: Mac OS client logs into splunk. 10-07-2020 07:03 AM
- Posted Remote Work Insights Executive Dashboard - Improvements on All Apps and Add-ons. 08-27-2020 04:22 AM
- Karma Are there any monitoring experienced suggestions for watchdog no response errors? for kpkeimig. 06-05-2020 12:50 AM
- Karma Re: How come the comment "macro" is not working? for dflodstrom. 06-05-2020 12:50 AM
- Karma Re: Why am I getting the following Http Event Collector (HEC) errors?: {"text":"Invalid token","code":4} for sylim_splunk. 06-05-2020 12:50 AM
- Karma McAFee DLP logs into splunk. for agcorreia_asml. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 |
09-09-2015
01:05 PM
1 Karma
Instead of changing the registry, could we just add this setting to the UF config on the servers?
tcpSendBufSz = 16384
TCP send buffer size in bytes.
Useful to improve thruput with small size events like windows events.
Only set this value if you are a TCP/IP expert.
Defaults to system default.
... View more
07-29-2015
05:51 AM
I agree with hgrow. I don't think you can have 2 stanzas dealing with the same log source.
So instead of using _TCP_ROUTING in inputs, use props and transforms.
props.conf (Not sure about the source.)
[source::///var/log/mule/.../*]
TRANSFORMS-routingto2splunks = log_to_splunk1, log_to_splunk2
transforms.conf
[log_to_splunk1]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = splunk_prod
[log_to_splunk2]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = twd104
... View more
07-24-2015
06:21 AM
2 Karma
Answer by hlarimer
"the props and transforms are not set to be globally shared across apps for this app. These settings are found in SplunkforPaloAltoNetwork/metadata/default.meta. I changed props, transforms, lookups to system and the fields are now being extracted from the search app."
Edit SplunkforPaloAltoNetwork/metadata/default.meta and change none to system in props, transforms and lookups.
By default...
### PROPS
[props]
export = none
### TRANSFORMS
[transforms]
export = none
[lookups]
export = none
Taken from http://answers.splunk.com/answers/208987/after-upgrade-to-splunk-621-why-are-fields-no-long.html
... View more
06-30-2015
11:35 AM
If you only restore the db files, "bucket is not serviceable" is a permanent state. Well, 20 hours at least so I assume never. I assume that's because they are in the thaweddb directory and the code probably says not to replicate that.
I restored all the rb files and the errors went away and I did not get dups. I assume because the Master Node is smarter than me and said, "don't search those rb files!"
... View more
06-30-2015
04:03 AM
1 Karma
Add-on McAfee 2.1.1 now supports db connect 2.
McAfeeEPO Hardwareandsoftwarerequirements
... View more
06-29-2015
11:28 AM
1 Karma
Our Splunk implementation uses a cluster, so we have db_nnnnnn and rb_nnnnnn files in the frozendb directory. The rb directories are the replicated buckets.
Do I have to restore the db and rb directories?
The doc says to do the following.
cp -r db_1181756465_1162600547_1001 $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb
splunk rebuild $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/db_1181756465_1162600547_1001
splunk restart
The problem is, if I only restore the db files, I get the following errors in the Master Node on the Fixup Tasks - Pending screen.
Search Factor: cannot fix up search factor as bucket is not serviceable
Replication Factor: cannot replicate as bucket is not serviceable
Generation: cannot fix up search factor as bucket is not serviceable;
If I also restore the rb files, I do not get those errors, but I'd think that I might get duplicate data.
... View more
06-26-2015
11:43 AM
Thanks! This looks good. I just got a request to recover some data so I'll test this next week.
We use a cluster so all of the directories end with the indexer id.
db_1268768214_1268768057_1670_ABCDEFAB-6666-EEEE-9999-AAAAAAAAAAAAA
They also have buckets that begin with rb_ for the replicated buckets.
rb_1329872628_1268768214_1670_ABCDEFAB-6666-EEEE-9999-AAAAAAAAAAAAA
I'll hard code $1 as db and add a $5 after the $4s.
... View more
06-18-2015
07:58 PM
Yes. We're deployed to a couple hundred servers now running 6.2.2 UF to 3 6.2.3 HFs. We're using this as the source now instead of splunktcp.
[source::WinEventLog:Security]
... View more
06-15-2015
05:52 PM
Since it looks like you're still on 6.0, the Forwarder Health app might help. Hopefully Mark will update this for 6.2.
Additional views include looking at field descriptor and throughput limits being hit, duplicate GUIDs, and the version distribution and log volumes being generated by your agents.
Forwarder Health App
... View more
06-15-2015
12:30 PM
1 Karma
Can't you just set the "Timestamp column" to JobFinishTime in the Outputs section of the "Database Inputs" page?
... View more
03-26-2015
05:14 AM
1 Karma
I've been running 5.0.3 for about a week now with no issues.
Thanks for the fix!
Hopefully you can now spend some time on adding template caching between reloads! 😉
... View more
03-18-2015
08:56 AM
The Citrix TA default inputs.conf should set the sourcetype to appflow.
IPFix sets the source and host to Host:Port:Observer. I use a transform to set host to the IP address.
[netscaler_appflow-change-host2source]
SOURCE_KEY=MetaData:Source
REGEX=source::(\d+.\d+.\d+.\d+):\d+:\d+
FORMAT=host::$1
DEST_KEY=MetaData:Host
... View more
03-18-2015
08:06 AM
1 Karma
I'm testing a 5.0.3 beta of this and it hasn't crashed since I installed it; about a day. No strange errors and it doesn't seem to be dropping any logs. It does still log to ipfix.log AND splunkd.log but there is a logging.conf.sample in defaults that might be able to correct that.
I've provided support with this same info. Hopefully it'll be released soon.
... View more
03-09-2015
04:40 AM
6 Karma
You should use "splunkd clean-dispatch" to get rid of these.
usage: splunkd clean-dispatch '<destination directory where to move jobs>' '<latest job mod time>'
splunk clean-dispatch /opt/splunk/old-dispatch-jobs/ -3d
... View more
01-26-2015
12:26 PM
2 Karma
We just upgraded to v6.2.1 and the Email Addresses are now being populated by LDAP.
... View more
01-23-2015
09:54 AM
It's being thrown out.
... View more
01-23-2015
08:13 AM
I have case 205515 for v5.0.1 crashing. But my numerous complaints are included in that one!
I've rolled back to 5.0.1 for the time being.
... View more
01-23-2015
06:21 AM
Just a note that this is dropping about 80% of the logs so I'm rolling back to the one that crashes 10 times a day!
... View more
01-23-2015
04:50 AM
1 Karma
OK, I think I'm missing something. These are supposed to be ints and floats not strings.
They're defined in the XML as "unsigned64" and "unsigned32" and "unsigned8" and "dateTimeMilliseconds" and "dateTimeMicroseconds" which I assumed were integers or floats.
The warning message says that netscalerFlowFlags should be an unsigned64.
2015-01-22 15:05:28,027 WARNING pid=15901 tid=MainThread file=IPFIXData.py:init:129 | Parsed netscalerFlowFlags of type unsigned64 (8) [Id 5951:132] for template 280. Data(!Q): Encode '8673961984' failed because of the non-unicode data. Use 8673961984 instead.
Are you saying that the NetScaler should be passing these numbers as Unicoded strings?
... View more
01-22-2015
01:14 PM
So basically you're saying that ALL NetScalers running v10 are broken?
Only 1 of the templates is data from our apps. The rest is just NetScaler Built-In performance metric crap like Round Trip Times and Response Status. If that's broken for us, I'd assume that it's broken for everyone. I'll try to compare what we're getting in Splunk to what the NetScalers are sending once the NetScaler guy gets back but it appears that what's making it into Splunk is valid.
Also, we were only crashing about 10 times a day, not 300,000 times a minute!
... View more
01-22-2015
12:16 PM
1 Karma
We had an issue with IPFIX crashing about 10 times a day. Splunk fixed that in IPFIX v5.0.2 but now we're getting 300,000 WARNING events; over 75MB of logs a minute in /opt/splunk/var/log/ipfix.log.
Is anyone else seeing this issue?
Basically, we get en error for every number that is in the appflow data. Here's a couple log lines.
2015-01-22 15:01:59,886 WARNING pid=15901 tid=MainThread file=IPFIXData.py:__init__:129 | Parsed egressInterface of type unsigned32 (4) [Id 0:14] for template 262. Data(!L): Encode '2147483651' failed because of the non-unicode data. Use 2147483651 instead.
2015-01-22 15:05:28,027 WARNING pid=15901 tid=MainThread file=IPFIXData.py:__init__:129 | Parsed netscalerFlowFlags of type unsigned64 (8) [Id 5951:132] for template 280. Data(!Q): Encode '8673961984' failed because of the non-unicode data. Use 8673961984 instead.
... View more
I had originally set the delay to 500ms but that was just too damn slow. I tested down to 100ms and it works consistently for me in FF and IE.
... View more
Put a {DELAY=X} into your Auto-Type sequence for your Splunk logon entry.
This "fixed" it for me.
{USERNAME}{TAB}{DELAY=10}{PASSWORD}{ENTER}
... View more
12-10-2014
05:20 PM
1 Karma
splunk _internal call /services/apps/local/dbx/_reload -auth admin:$ADMINPWD
Restarts the DBX app. Restarting the app also encrypts plaintext passwords in database.conf so we're updating our script to just replace the old encrypted password with the new plaintext password. Much simpler.
... View more
12-10-2014
09:06 AM
1 Karma
We're monitoring a lot of databases and we have to change passwords frequently.
We have a password manager that changes an account's DB password and then calls a python script with the account name and the new password. Our python script uses a DBX python script to encrypt the password and then our script replaces the old encrypted password with the new one but Splunk does not see the change until we restart Splunk.
I know that I can reload input.conf by running
splunk _internal call /services/data/inputs/monitor/_reload -auth admin:$ADMINPWD
but this doesn't seem to reload "/opt/splunk/etc/apps/dbx/local/database.conf"
Is there a command that will reload database.conf?
... View more
- Tags:
- Splunk DB Connect 1
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-17-2024
02:07 PM
|
