Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About andrew_burnett
andrew_burnett
Path Finder
Member since:
10-14-2021
08-11-2023
Community Statistics
| Posts | 65 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 10-14-2021 |
Activity Feed
- Posted Re: Splunk Rest Commands Invalid on Monitoring Splunk. 08-11-2023 08:52 AM
- Posted Splunk Rest Commands Invalid on Monitoring Splunk. 08-11-2023 08:39 AM
- Posted Re: Splunk Lookup Editor App on Splunk Enterprise. 08-01-2023 02:02 PM
- Posted Splunk Lookup Editor App: Why are changes to KVstore not being saved after upgrading? on Splunk Enterprise. 08-01-2023 12:45 PM
- Posted Re: Why are we missing data on Tenable Add-On? on All Apps and Add-ons. 07-17-2023 12:59 PM
- Posted Why are we missing data on Tenable Add-On? on All Apps and Add-ons. 07-12-2023 08:55 AM
- Posted Re: Error in splunkd - fileclassifiermanager - Error (bad allocation) encountered ... on Getting Data In. 05-11-2023 10:26 AM
- Karma Re: CSV Header Issues for woodcock. 04-14-2023 12:53 PM
- Posted Re: CSV Header Issues on Splunk Enterprise. 04-14-2023 12:36 PM
- Posted Re: CSV Header Issues on Splunk Enterprise. 04-14-2023 12:35 PM
- Posted Re: CSV Header Issues on Splunk Enterprise. 04-14-2023 12:29 PM
- Posted Any advice on how to resolve multiple CSV header issues? on Splunk Enterprise. 04-14-2023 09:43 AM
- Posted Re: How to find CSV issue? on Knowledge Management. 03-30-2023 11:56 AM
- Posted How to find CSV issue? on Knowledge Management. 03-30-2023 08:40 AM
- Posted Re: KVStore Memory Leak on Splunk Enterprise. 03-20-2023 07:34 AM
- Posted KVStore Memory Leak- How to manage without restarting every week? on Splunk Enterprise. 03-17-2023 12:37 PM
- Karma Re: IDX crashed out of nowhere- What is the cause of this? for richgalloway. 02-13-2023 11:54 AM
- Posted IDX crashed out of nowhere- What is the cause of this? on Splunk Enterprise. 02-13-2023 08:58 AM
- Posted Re: Error in splunkd - fileclassifiermanager - Error (bad allocation) encountered ... on Getting Data In. 02-10-2023 08:09 AM
- Posted Re: Need help with a Search on Splunk Search. 09-28-2022 12:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-02-2022
01:19 PM
Restarting the indexer got rid of the problem for now, not sure it's going to fix the underlying problem.
... View more
06-02-2022
01:01 PM
I am running 8.2.4 with 69% of small buckets and it's only flagging on one of my indexers. And I don't see any errors in splunkd regarding that add-on.
... View more
06-02-2022
12:33 PM
I have no events in the future.
... View more
06-02-2022
12:30 PM
And all the timestamps are the same TZ, so no weird differing times that I can see either.
... View more
06-02-2022
12:29 PM
So the add-on came with props, and what I mean by offset is that all the events are in a timezone 6 hours ahead of us, but when I search it converts it to my time. When I tried to search it failed with this message "Unable to parse the search: Invalid time bounds in search: start=1654750800 > end=1654198380."
... View more
06-02-2022
08:53 AM
We are getting the small hot buckets warning for this index, but the timestamps look fine just with a few hours offset. Not quite sure where to go from here.
... View more
Labels
- Labels:
-
heavy forwarder
06-01-2022
02:05 PM
Commenting on this to be notified of the solution.
... View more
05-19-2022
10:57 AM
I created a custom alert action, but btool is flagging it as wrong. The script is in /opt/splunk/etc/apps/<app>/bin
... View more
Labels
- Labels:
-
alert action
-
alert condition
05-13-2022
09:39 AM
So what I have is this so far, in alert actions.conf. Already have the search, dealing with the alert portion. [restart_splunk] is_custom = 1 filename = restart.sh In /opt/bin/scripts, I have this script curl -k -u admin:test1234 https://$result.host$:8089/services/server/control/restart -X POST
... View more
05-12-2022
04:15 PM
I want to create a custom alert action that when the alert fires, it takes the host from the search results, and uses it is a token to remotely restart a host. I can get the REST URL right, but how do I get the alert to use host as a token?
... View more
Labels
- Labels:
-
alert action
-
Python
05-10-2022
02:23 PM
I don't need to escape them, but it is still broken.
... View more
05-10-2022
10:08 AM
In the eval? That's to actually make them into email strings
... View more
05-10-2022
07:02 AM
Everything before the map command works, until I add that last half.
... View more
05-09-2022
09:39 PM
I mean that the base search I mean the part of the search before the map command
... View more
05-09-2022
04:42 PM
So I have this search looking to send emails to people logging into a legacy SH, but the map command breaks my results.
index=_audit sourcetype = audittrail action="login attempt"|eval user=user.""."@gmail.com"|fields user|map search="sendemail to=$user$ subject=Please Stoping Using Old SH message="Please migrate to new SH" sendresults=true inline=true format=raw"
... View more
Labels
- Labels:
-
search job inspector
05-09-2022
12:58 PM
I keep seeing something similiar, except mine doesn't have any error message.
... View more
04-27-2022
03:26 PM
1 Karma
I've seen this on some older posts, but I am currently battling this issue. For some hosts, restarting it makes the logs start flowing again without the above error message (Suggesting a delayed start is the answer). But on some of them, a restart does nothing, there is real security logs that Splunk is merely reporting above error message for.
... View more
Labels
- Labels:
-
universal forwarder
04-25-2022
09:26 AM
When will this app be updated to support Python 3/jQuery 3.5?
... View more
Labels
- Labels:
-
configuration
04-25-2022
09:25 AM
When will this app be updated to support Python 3/jQuery 3.5?
... View more
Labels
- Labels:
-
configuration
04-25-2022
09:22 AM
When will this app be updated to be compliant with jQuery 3.5?
... View more
Labels
- Labels:
-
configuration
03-24-2022
08:52 AM
My question about it is, when the "Attempting to send email to:" gets stuck, all the logs stop. Would that search work in this case?
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-11-2023
12:33 PM
|
