Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About wrangler2x
wrangler2x
Motivator
Member since:
03-25-2011
01-10-2021
Community Statistics
| Posts | 374 |
| Solutions | 19 |
| Karma Given | 95 |
| Karma Received | 146 |
| Member Since | 03-25-2011 |
Activity Feed
- Got Karma for Re: How to see all source and sourcetype list. 02-06-2026 07:07 AM
- Got Karma for Why does enabling Duo in Splunk break local admin login and is there a way around that?. 01-06-2026 08:02 AM
- Got Karma for Re: Splunk Admin Password. 12-30-2025 03:38 PM
- Got Karma for Re: Splunk Admin Password. 09-02-2025 08:02 AM
- Got Karma for Re: What do I do if rebuilding a bucket fails?. 06-25-2025 08:10 PM
- Got Karma for Re: Splunk Admin Password. 01-02-2025 02:42 AM
- Got Karma for Re: Splunk Admin Password. 07-29-2024 06:42 AM
- Got Karma for Re: Splunk Admin Password. 07-26-2023 06:54 AM
- Got Karma for Re: Splunk Admin Password. 06-15-2023 02:01 AM
- Got Karma for Re: How to determine how long splunk has been up?. 06-06-2023 12:03 AM
- Got Karma for Re: What does the heartbeatFrequency setting do in outputs.conf?. 06-01-2023 06:21 AM
- Got Karma for Re: Splunk shows vulnerable to CVE-2012-4929 in my Nessus vulnerability scan, what is going on?. 11-17-2022 06:55 PM
- Got Karma for Re: Is there a way to reload server class from the Splunk GUI?. 11-04-2022 11:04 AM
- Got Karma for Re: Splunk shows vulnerable to CVE-2012-4929 in my Nessus vulnerability scan, what is going on?. 07-28-2022 11:41 AM
- Got Karma for Re: How do I list all sourcetypes for each host per index, provided one sourcetype=apache?. 07-26-2022 06:33 PM
- Got Karma for Re: Use a field as the search in searchmatch. 07-08-2022 10:27 AM
- Got Karma for Re: How to log REST API calls?. 11-10-2021 03:15 AM
- Got Karma for Re: How to determine how long splunk has been up?. 08-20-2021 08:38 AM
- Got Karma for Re: How do I disable Transparent Huge Pages (THP) and confirm that it is disabled?. 06-24-2021 08:31 AM
- Got Karma for Fast searches for a count of events in various ways. 06-09-2021 03:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 |
08-31-2017
12:53 PM
1 Karma
Here is a search that you can turn into an alert. It might be handy if you are using grub to disable it, because that could be undone by a kernel upgrade/update.
| rest /services/server/sysinfo
| stats count by transparent_hugepages.effective_state transparent_hugepages.enabled transparent_hugepages.defrag
| rename transparent_hugepages.effective_state AS State, transparent_hugepages.enabled AS Enabled, transparent_hugepages.defrag AS defrag
| eval badstatef=if(State == "ok",tonumber("0"),tonumber("1"))
| eval enabledf=if(Enabled == "never",tonumber("0"),tonumber("1"))
| table State badstatef Enabled enabledf
| where badstatef > 0 OR enabledf > 0
I run this every morning and the Time Range fields in the alert are empty -- not needed on a REST search.
... View more
08-31-2017
10:42 AM
Ryan's page on using systemd for this:
https://www.rfaircloth.com/2017/04/28/using-systemd-squash-thp-start-splunk-enterprise/
... View more
08-31-2017
10:35 AM
Determine if THP is enabled or off (look for effective state = ok)
| rest /services/server/sysinfo
| table transparent_hugepages.enabled transparent_hugepages.defrag transparent_hugepages.effective_state
... View more
08-31-2017
10:34 AM
Lots of good comments here: https://answers.splunk.com/answers/188875/how-do-i-disable-transparent-huge-pages-thp-and-co.html
... View more
08-31-2017
10:28 AM
1 Karma
So that you don't have to scroll:
| rest /services/server/sysinfo | table transparent_hugepages.enabled transparent_hugepages.defrag transparent_hugepages.effective_state
... View more
08-24-2017
01:52 PM
s/\x5C{1}//g works great for this
Really!? Yes, indeedy! Let's test it.
| makeresults
| eval domainUser="theLaTiDahDomain\johndoejr"
| table domainUser
| eval User=domainUser
| rex mode=sed field=User "s/.*\x5C{1}//"
This returns johndoejr in the User column.
| makeresults is a new feature beginning in 6.3, I believe. If you are on an earlier release use | gentimes start=-1 instead.
... View more
08-16-2017
10:11 AM
Cool idea on converting nobody to admin!
If you just want a list of what apps have a nobody in local.meta, try this:
find /opt/splunk/ -name local.meta -exec grep nobody {} \; -print | grep / | sed 's/.*\/apps\///; s/\/metadata\/local.meta//'
... View more
08-16-2017
09:42 AM
I've got this simple transform for dropping unwanted logs which works fine. I went to add something to it and got this Encountered the following error while trying to update: Invalid FORMAT: nullQueue error when I tried to save it. Then I Canceled, and re-clicked on the transform (in Settings>>Fields>>Field transformations) and tried a Save without changing anything and got the same error. Why is that?
[paloaltoNoiseDrop]
REGEX = syslog-conn-status,.*(established|broken)
DEST_KEY = queue
FORMAT = nullQueue
... View more
07-25-2017
03:32 PM
That did the trick. Also, I had someone send me this link: http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall#Indexer_clusters
... View more
07-24-2017
04:14 PM
1 Karma
Is there something that we are supposed to be doing after installing this or is it just broken?
Here is my output during startup of splunkd
Checking conf files for problems...
Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 8: outputMode (value: splunkstream).
Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 14: autotimestamp (value: 1).
Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 15: randomizeCount (value: 0.2).
Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 16: randomizeEvents (value: 0).
Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 18: sourcetype (value: pan:log).
Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 19: source (value: eventgen:pan_globalprotect.samplelog).
Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 27: outputMode (value: splunkstream).
Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 33: randomizeCount (value: 0.2).
Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 34: randomizeEvents (value: true).
Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 36: sourcetype (value: pan:log).
Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 37: source (value: eventgen:pan_incident.samplelog).
Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 68: outputMode (value: splunkstream).
Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 74: randomizeCount (value: 0.2).
Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 75: randomizeEvents (value: true).
Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 77: sourcetype (value: pan:log).
Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 78: source (value: eventgen:pan_endpoint.samplelog).
Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 79: autotimestamp (value: 1).
Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 88: outputMode (value: splunkstream).
Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 94: randomizeCount (value: 0.2).
Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 95: randomizeEvents (value: true).
Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 97: sourcetype (value: pan:log).
Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 98: source (value: eventgen:pan_incident_data_config.samplelog).
Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 119: mode (value: replay).
Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 120: sampletype (value: csv).
Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 121: timeField (value: _time).
Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 122: index (value: main).
Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 128: timeMultiple (value: 2).
Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 129: autotimestamp (value: 1).
Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 134: sourcetype (value: pan:log).
Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 135: source (value: eventgen:pan_wildfire_reports.csv).
Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Done
... View more
07-19-2017
11:31 AM
2 Karma
I noticed that some of the indexes (such as _fishbucket) were in the list more than once, so I used deadup to drop the dupes. I also tossed in days and a row number:
| rest /services/data/indexes
| rename title as index | dedup index | sort index
| streamstats count as Row
| eval Days=frozenTimePeriodInSecs/86400
| fields Row index frozenTimePeriodInSecs Days
... View more
07-18-2017
10:42 AM
You can drop the i in msi if you add A-Z to the character class, viz:
EventCode=4624 | regex "(?ms)^EventCode=4624\D.*Account\s+Name:\s+-.*Account\s+Name:\s+[a-zA-Z0-9-]+[\$]"
The i is for case insensitive, which is overhead you really don't need if you've accurately characterized the various strings (which you have).
... View more
06-13-2017
11:31 AM
| rest /services/deployment/server/clients splunk_server=local
| foreach applications.*.restartSplunkd [eval Apps=if(isnotnull('<<FIELD>>'), mvappend(Apps, "<<MATCHSTR>>"), Apps)]
| foreach serverClasses.*.restartSplunkd [eval ServerClasses=if(isnotnull('<<FIELD>>'), mvappend(ServerClasses, "<<MATCHSTR>>"), ServerClasses)]
| eval Forwarder = lower(dns)
| rex field=utsname "(?<os>[^\-]+)\-(?<arch>.+)"
| eval os = case(os == "linux", "Linux", os == "windows", "Windows", arch == "sun4u", "Solaris", arch == "sun4v", "Solaris")
| fields - utsname
| lookup version2build.csv build
| rename dns AS Forwarder, averagePhoneHomeInterval AS PHI
| stats values(Apps) AS Apps, values(ServerClasses) AS ServerClasses count by Forwarder ip os arch version build clientName splunk_server PHI lastPhoneHomeTime
| fieldformat lastPhoneHomeTime=strftime(lastPhoneHomeTime, "%F %T")
| eval missing=now()-lastPhoneHomeTime-PHI | eval missing=if(missing<0, 0, missing)
| eval Missing=case (missing==0, "No", missing==1, "Yes")
| fields - missing
| addtotals count col=t row=f
If you see that Apps and ServerClass for a system to be blank, it means it is not in your configs on the Deployment Server but the system has a forwarder that is connecting to your indexer (as long as Missing is "No" that is).
... View more
06-13-2017
11:07 AM
1 Karma
Here is a search that provides a bit more information on all the forwarders and provides the apps and serverClasses side-by-side:
| rest /services/deployment/server/clients splunk_server=local
| foreach applications.*.restartSplunkd [eval Apps=if(isnotnull('<<FIELD>>'), mvappend(Apps, "<<MATCHSTR>>"), Apps)]
| foreach serverClasses.*.restartSplunkd [eval ServerClasses=if(isnotnull('<<FIELD>>'), mvappend(ServerClasses, "<<MATCHSTR>>"), ServerClasses)]
| eval Forwarder = lower(dns)
| rex field=utsname "(?<os>[^\-]+)\-(?<arch>.+)"
| eval os = case(os == "linux", "Linux", os == "windows", "Windows", arch == "sun4u", "Solaris", arch == "sun4v", "Solaris")
| fields - utsname
| lookup version2build.csv build
| rename dns AS Forwarder, averagePhoneHomeInterval AS PHI
| stats values(Apps) AS Apps, values(ServerClasses) AS ServerClasses count by Forwarder ip os arch version build clientName splunk_server PHI lastPhoneHomeTime
| fieldformat lastPhoneHomeTime=strftime(lastPhoneHomeTime, "%F %T")
| eval missing=now()-lastPhoneHomeTime-PHI | eval missing=if(missing<0, 0, missing)
| eval Missing=case (missing==0, "No", missing==1, "Yes")
| fields - missing
| addtotals count col=t row=f
And here is that search modified to look for one host inside an XML search form like the one above (same search modified for one host lookup and xml-ified (changed <, >, and " to <, >, and ^quot;). It uses $name$ for the host variable -- you can just drop it into the XML Sloshburch showed, above, replacing what is there between and :
| rest /services/deployment/server/clients splunk_server=local
| foreach applications.*.restartSplunkd [eval Apps=if(isnotnull('<<FIELD>>'), mvappend(Apps, "<<MATCHSTR>>"), Apps)]
| foreach serverClasses.*.restartSplunkd [eval ServerClasses=if(isnotnull('<<FIELD>>'), mvappend(ServerClasses, "<<MATCHSTR>>"), ServerClasses)]
| eval Forwarder = lower(dns)
| search Forwarder = $name$
| rex field=utsname "(?<os>[^\-]+)\-(?<arch>.+)"
| eval os = case(os == "linux", "Linux", os == "windows", "Windows", arch == "sun4u", "Solaris", arch == "sun4v", "Solaris")
| fields - utsname
| lookup version2build.csv build
| rename dns AS Forwarder, averagePhoneHomeInterval AS PHI
| stats values(Apps) AS Apps, values(ServerClasses) AS ServerClasses count by Forwarder ip os arch version build clientName splunk_server PHI lastPhoneHomeTime
| fieldformat lastPhoneHomeTime=strftime(lastPhoneHomeTime, "%F %T")
| eval missing=now()-lastPhoneHomeTime-PHI | eval missing=if(missing<0, 0, missing)
| eval Missing=case (missing==0, "No", missing==1, "Yes")
| fields - missing, count
... View more
06-13-2017
10:16 AM
Hybrid of the above searches:
| rest /services/deployment/server/clients splunk_server=local
| foreach applications.*.restartSplunkd [eval Apps=if(isnotnull('<<FIELD>>'), mvappend(Apps, "<<MATCHSTR>>"), Apps)]
| foreach serverClasses.*.restartSplunkd [eval ServerClasses=if(isnotnull('<<FIELD>>'), mvappend(ServerClasses, "<<MATCHSTR>>"), ServerClasses)]
| eval Forwarder = lower(dns)
| rex field=utsname "(?<os>[^\-]+)\-(?<arch>.+)"
| eval os = case(os == "linux", "Linux", os == "windows", "Windows", arch == "sun4u", "Solaris", arch == "sun4v", "Solaris")
| fields - utsname
| lookup version2build.csv build
| rename dns AS Forwarder, averagePhoneHomeInterval AS PHI
| stats values(Apps) AS Apps, values(ServerClasses) AS ServerClasses count by Forwarder ip os arch version build clientName splunk_server PHI lastPhoneHomeTime
| fieldformat lastPhoneHomeTime=strftime(lastPhoneHomeTime, "%F %T")
| eval missing=now()-lastPhoneHomeTime-PHI| eval missing=if(missing<0, 0, missing)
| eval Missing=case (missing==0, "No", missing==1, "Yes")
| fields - missing
| addtotals count col=t row=f
... View more
06-09-2017
11:14 AM
Add title immediately after table in the second line of the search to get the search name.
... View more
06-01-2017
02:38 PM
I just ran across an old input form which did not allow to execute on a text input. I made the change I mentioned above and it works great. If you tried this and it worked for you, please vote this up.
... View more
05-31-2017
01:02 PM
Could you give me an example of that? I tried to emulate that in search and was unsuccessful.
... View more
05-26-2017
01:19 PM
Can this sort of thing be done in a rex in search?
... View more
05-11-2017
10:47 AM
You can do | metadata type=hosts NOT index="_*"
I think it is interesting that you can specify the index and the splunk_server in the search criteria, but you cannot include them in the search results.
I personally wish that I could see the splunk_server in the results.
... View more
05-05-2017
01:27 PM
@sgarvin55 -- is this fixed in the new 6.6 release?
... View more
05-01-2017
03:01 PM
Okay, I tried this again because of your comment and it does work. Last time I tried it I got no results found. I'm thinking I must have had the time picker on some weird setting. So I'm using this now, including the recommendation. Thanks.
... View more
05-01-2017
11:48 AM
Adding the eval to the timechart was something I had already tried. Does not work.
... View more
05-01-2017
11:13 AM
I have this search
| tstats count AS myCount WHERE index=* by index, _time
| where _time > relative_time(now(), "-1mon@mon") AND _time < relative_time(now(), "@mon")
| timechart span=1mon sum(myCount) by index
which returns one column for each index, with the heading being the indexes name, and the content under that the sum of events for that index in the specified time-frame.
How can I get this sum to display with commas? (like 158,313,959 instead of 158313959.)
... View more
04-28-2017
02:24 PM
Let's find out if the hostname is consistent on the forwarder's environment. To my knowledge, Splunk does not store the IP address anywhere in its .config files.
Look first in $SPLUNK_HOME/etc/system/local/server.conf, for the [general] stanza. There may be a line like this:
serverName = hostname
You'd expect that to be correct if it is there.
Next take a look at $SPLUNK_HOME/var/log/splunk/splunkd.log (copy it off somewhere or edit it with vi -R)
Searching from the bottom up, find the line INFO loader - Splunkd starting . The next line down will be INFO loader - System info: and the hostname that Splunk thinks it is will be there.
INFO ServerConfig - My GUID is 5AEF640C-24F3-4A8A-AD4C-08227E9C4FE5
INFO ServerConfig - My server name is "hostname".
INFO ServerConfig - Found no site defined in server.conf
INFO ServerConfig - My hostname is "hostname".
[snippage]
INFO ServerConfig - Using REMOTE_SERVER_NAME=hostname
All these hostnames should be what you'd expect on that forwarder. If not, that's a clue something is wrong somewhere.
And then look for lines like this:
INFO HttpPubSubConnection - SSL connection with id: connection_xxx.xxx.xxx.xxx_8089_hostname_5AEF640C-24F3-4A8A-AD4C-08227E9C4FE5
The 5AEF640C-24F3-4A8A-AD4C-08227E9C4FE5 string is the GUID you saw earlier in the logs (it will be different on your system. And again here you should see the hostname you expect, and the IP that you expect.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-10-2021
10:38 AM
|
Karma given to
