About smurf

smurf · ‎07-01-2022

Hi, this is not really the answer to your question but based on the docs it says that you cannot change your experience. "Splunk assigns your deployment to an appropriate Splunk Cloud Platform Experience for you. You cannot independently change your current Experience. For further details, contact your Splunk Cloud Platform representative."

smurf · ‎07-01-2022

Hi, I don't know if this is feasible for you but you should be able to rename a sourcetype based on regex (as described here https://community.splunk.com/t5/Splunk-Search/Changing-sourcetype-with-regex/m-p/155058#M43613). With this you could use the default xml sourcetype and the original sourcetype with the rest of your data. I am not sure about the long xml thought.

smurf · ‎07-01-2022

Hi, it is possible to send directly to Splunk. You can set up input in Splunk (it would need to be either some kind of forwarder or indexer) to listen on a port. You can define it in GUI or in inputs.conf and it would look something like this. You can ommit the host and have it listen for any connection on a port. [tcp://syslog.corp.example.net:514] sourcetype = cisco:ise index = cisco On the network device, you would enter the IP address of the Splunk instance and whatever port you specified and you start receiving the data. Keep in mind that it would be better to use a syslog server for this. Because when you restart the ingesting Splunk instance, you could start losing data. If you have multiple devices that you want to set up like this I would look at the SC4S project: https://splunk.github.io/splunk-connect-for-syslog/main/

smurf · ‎07-01-2022

Try checking datamodels.conf for tags_whitelist. According to docs: * Only the tag fields identified in this allow list (and the event types tagged by them) are loaded when you perform searches with this data model. They are defined as default in CIM's DMs but maybe you are rewriting it in you local conf?

smurf · ‎06-29-2022

I tried it today with the latest CIM version and I had it populated. Just as OP had in the query dc(Authentication.tag) worked fine.

smurf · ‎06-29-2022

Hi, I think the issue is that you are renaming the filed and using the original field again. When you rename it, the original field does not exist anymore, so in the next macro call you need to use the new field name.

smurf · ‎06-29-2022

Hi, when searching through accelerated data models with tstats you need to specify FROM. This should work with your query: | tstats summariesonly=t dc(Authentication.tag) as tag from datamodel=Authentication where nodename=Authentication.Failed_Authentication by Authentication.app Authentication.src

smurf · ‎06-29-2022

Hi, what time frame do you have defined for the search? I don't mean the one in SPL, but the one that is to the right of where you right your queries. smurf

smurf · ‎06-28-2022

Hi, | eval date_hour = strftime(_time, "%k"), date_wday = strftime(_time, "%A") | search date_wday IN ("saturday", "sunday") OR (date_hour > 18 AND date_hour < 7) change the times to your likings. usually the date_* fields are included, so you might not need the eval at all.

smurf · ‎05-05-2022

Hi, you can add a blacklist. I am not sure if all your files could be easily matched with regex, but it is a possibility. blacklist = <regular expression> * If set, files from this input are NOT monitored if their path matches the specified regex. * Takes precedence over the deprecated '_blacklist' setting, which functions the same way. * If a file matches the regexes in both the deny list and allow list settings, the file is NOT monitored. Deny lists take precedence over allow lists. * No default.

smurf · ‎05-04-2022

Hello, Yes, it is possible to send logs from UFs to HFs, since you can setup HFs to act as receivers. On HF you need to setup receiving as described here: Enable a receiver - Splunk Documentation in inputs.conf (HF) - setup listening port, 9997 is default [splunktcp://9997] disabled = 0 On UF you need to setup forwarding to the HF as described here: Configure forwarders with outputs.conf - Splunk Documentation in outputs.conf (UF) - setup to send events to HF. You can name the groups whatever you want. You also need to change the server name / IP. [tcpout] defaultGroup=my_HFs [tcpout:my_HFs] server=mysplunk_heavy:9997 [tcpout-server://mysplunk_heavy:9997] Hope this helps.

smurf · ‎04-29-2022

Hi, you can find list of stanzas with sourcetypes and indexes using rest command to all conf-inputs. You can define a certain server, or use * to query all. Basically everything you have in inputs.conf is available like this. | rest splunk_server=* /services/configs/conf-inputs | fillnull value="n/a" | stats values(index) values(sourcetype) by eai:acl.app splunk_server title Here you can see list of all apps per server: | rest splunk_server=* /services/apps/local | search disabled=0 | stats values(label) by splunk_server

smurf · ‎04-28-2022

Hi, it could be permissions issue. If you need to use the command in different apps, it should have Global permissions.

smurf · ‎04-28-2022

Hi, You have to take current time and deduct 15 minutes from it, after that you can compare _time from the event with your variable. `tutu` sourcetype="session" | bin _time span=15m | stats dc(s) as count by _time | eval current_time = relative_time(now(), "-15m") | where _time >= current_time

smurf · ‎04-28-2022

Hi, if the key is not present in the spec for alert_actions.conf, you are safe to remove it.

smurf · ‎04-28-2022

Hi, I think you might be hitting some of the user search limits like the amount of memory it can consume. I would try to switch from Verbose to Fast or specify the _raw field before your eval. index="hcg_oapi_prod" | fields _raw | eval size = len(_raw) ... This should substantially speed the search up as it would not try to extract all the fields.

smurf · ‎04-21-2022

"The asterisk wildcard matches anything in that specific folder path segment. Unlike ..., * does not recurse through subfolders.". You can read more about it in the docs: Specify input paths with wildcards - Splunk Documentation I think your stanza should be working without that typo, but if it doesn't I would try (...). I also noticed that you have disabled = true. If you want it active, it should be false.

smurf · ‎04-21-2022

Hi, if you know that you can find it based on a host, you can use it in the data model too. | tstats count from datamodel=Web where host=not_a_proxy

smurf · ‎04-21-2022

Hi, When any Urgency is selected when editing a Notable (even if it is the same as the original Urgency) can be found like this: index=_audit source=notable_update_rest_handler urgency=* Originally, I thought you were looking for a Notable that has a different Urgency than what you defined in Severity in the correlation search. That could be found like this: `notable` | where severity != urgency

smurf · ‎04-21-2022

Hi, I haven't tried something like this yet. But I think creating a persistent storage with the index config could help. Data Storage ## | docker-splunk

smurf · ‎04-21-2022

Hi, I think your stanza should work with a small change - removing the double backslash [monitor://D:\Logs\*\*\*.txt] I personally would use ... like this: [monitor://D:\Logs\...\*.txt]

smurf · ‎04-06-2022

Hi, fields in the by clause cannot be empty. If it is empty, it does not show up in the results. Try using fillnull before running the stats command like this: | fillnull tutu value="n/a"

smurf · ‎04-06-2022

Hi, not sure if this is the most elegant solution, but I would use replace. | replace <*> with * in src

smurf · ‎04-05-2022

I find Monitoring Console good place for debugging Indexes. Try Monitoring Console -> Indexing -> Indexes and Volumes -> Indexes and Volumes: Instance. There you have a nice overview of all indexes with their sizes, data age, etc.

smurf · ‎04-05-2022

Hi, maxDataSize tells Splunk how large each bucket can be. If you are losing old data, you could look for one of these settings: maxTotalDataSizeMB frozenTimePeriodInSecs coldPath.maxDataSizeMB / homePath.maxDataSizeMB Having any of these would limit the amout of data that is stored in the index. If you are losing everything that is older than 3 months, I would especially look for the attribute frozenTimePeriodInSecs (The number of seconds after which indexed data rolls to frozen.).

Posts	52
Solutions	11
Karma Given	6
Karma Received	19
Member Since	‎02-28-2021

Online Status	Offline
Date Last Visited	Thursday

Re: Splunk Cloud Upgrade from Classic to Victoria:...

Re: Can I use props.conf to parse logfile with som...

Re: Send log file from switch/router directly to s...

Re: tag as datamodel attribute

Re: tag as datamodel attribute

Re: Running multiple macros in the same search

Re: tag as datamodel attribute

Re: How to use Timechart Query

Re: How to write query for including non business ...

Re: I am trying to get all the log files not menti...

Re: Universal Forwarder Send/Forward Events

Re: Splunk Query to get all configured DB Connecti...

Re: Why am I getting "Unknown search command" on i...

Re: How to display only the result corresponding t...

Re: Invalid Key Stanza alert_actions.conf

Re: Error auto-canceled search

Re: Monitor files in a directory which is dynamic

Re: How to build a correlation search for direct w...

Re: How to write a Query to identify Splunk notabl...

Re: Autocreate an index in a docker container?

Re: Monitor files in a directory which is dynamic

Re: help on basic questions about a by clause

Re: How to trim the unusual brackets from url?

Re: Configure maxDataSize for high volume

Re: Configure maxDataSize for high volume

Join the Conversation