Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Prewin27
Prewin27
Contributor
Member since:
12-12-2019
Thursday
Community Statistics
| Posts | 111 |
| Solutions | 11 |
| Karma Given | 2 |
| Karma Received | 30 |
| Member Since | 12-12-2019 |
Activity Feed
- Got Karma for Re: add new fieldname to empty and also filled csv lookup. Friday
- Posted Re: Sometimes searches are not running on iPad on Splunk Search. Thursday
- Posted Re: The is_risky parameter not working as expected on Splunk Enterprise. Thursday
- Got Karma for Re: Writing regex for specific /var/log/*.log files. Thursday
- Posted Re: Writing regex for specific /var/log/*.log files on Getting Data In. Thursday
- Posted Re: Writing regex for specific /var/log/*.log files on Getting Data In. Thursday
- Posted Re: add new fieldname to empty and also filled csv lookup on Splunk Search. Thursday
- Posted Re: add new fieldname to empty and also filled csv lookup on Splunk Search. Wednesday
- Posted Re: Error saving event-based detection. Missing detection_id for the detection= on Splunk Enterprise Security. Wednesday
- Posted Re: Error saving event-based detection. Missing detection_id for the detection= on Splunk Enterprise Security. Wednesday
- Posted Re: Sometimes searches are not running on iPad on Splunk Search. Wednesday
- Got Karma for Re: Data Model Accelerations are very slow. Tuesday
- Got Karma for Re: Data Model Accelerations are very slow. Tuesday
- Posted Re: Replicate tags.conf between search heads on Splunk ITSI. Tuesday
- Posted Re: Data Model Accelerations are very slow on Knowledge Management. Tuesday
- Posted Re: [Errno -2] Name or service not known on All Apps and Add-ons. Tuesday
- Posted Re: Splunk install, upgrade on different hardware on Splunk Enterprise. Tuesday
- Posted Re: Data Model Accelerations are very slow on Knowledge Management. Tuesday
- Posted Re: Data Model Accelerations are very slow on Knowledge Management. Tuesday
- Got Karma for Re: Data Model Accelerations are very slow. Tuesday
Topics I've Started
No posts to display.
a week ago
@tbarn005 Your props and transform looks ok. Make sure you are applying this to HF or Indexer not on the UF. Also add one more transform to filter out other noise. props.conf [source::E:\\SPLogs\\CLGDEVSPAPPSO1*] TRANSFORMS-debug = route_high_to_debug,drop_noise In transforms.conf [drop_noise] REGEX = . DEST_KEY = queue FORMAT = nullQueue Restart Splunk and check again. Also make sure you have new high category logs from this server. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
a week ago
@sylviee_o It appears there may be remnants from previous Splunk installations, and I’m assuming you’re running Windows. Please follow the steps below to ensure you completely remove any old Splunk -Open Services (services.msc), find Splunk and stop it -Go to Control Panel → Programs → Programs and Features ->Find Splunk and uninstall -Manually delete the Splunk installation directory (eg: C:\Program Files\Splunk) -Clean Up the Windows Registry also, Open regedit and search for any remaining keys related to Splunk under and delete it HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ HKEY_LOCAL_MACHINE\SOFTWARE\ Reboot your machine and try again with the latest Splunk Enterprise installation file. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
a week ago
@Jayanthan In this case, as mentioned before you can use ingest action. It allows you to filter, mask, or route events before they are indexed. For reference check this out #https://lantern.splunk.com/Splunk_Platform/Product_Tips/Data_Management/Using_ingest_actions_in_Splunk_Enterprise Settings > Data > Ingest Actions and create rule set. Alternatively, you can use the traditional method with your Heavy Forwarder by configuring props.conf and transforms.conf Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
a week ago
@SN1 You can create a Webhook in Microsoft Teams and use splunk alert action. #https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=newteams%2Cdotnet Splunk alert action webhook - #https://docs.splunk.com/Documentation/Splunk/9.4.2/Alert/Webhooks Also you can check Splunk App #https://splunkbase.splunk.com/app/5335 Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
a week ago
@SN1 Does the user who created/modified the savedsearch have enough permissions? Also whats the value of enableSched in savedsearches.conf. Make sure your search is having enableSched = 1 in savedsearches.conf. #https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/Savedsearchesconf Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
a week ago
@Jayanthan You have multiple options depending on your architecture. Always best approach is to filter at the source itself, but if its not possible Use props.conf and transforms.conf on splunk enterprise to drop events before indexing If you're on Splunk 9+, you can use Ingest Actions Ref #https://docs.splunk.com/Documentation/Splunk/9.4.2/Data/DataIngest #https://lantern.splunk.com/Splunk_Platform/Product_Tips/Data_Management/Using_ingest_actions_to_filter_Windows_event_logs You can also consider using Splunk Edge Processor #https://help.splunk.com/en/splunk-cloud-platform/process-data-at-the-edge/use-edge-processors/9.3.2411/getting-started/about-the-edge-processor-solution Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
a week ago
@TestAdminHorst This add-on is primarily designed for standard Microsoft 365 environments. GCC High and DoD tenants operate in different cloud environment with restricted endpoints. So this standard add-on endpoints may not work with GCC High. #https://learn.microsoft.com/en-us/office/dev/add-ins/publish/government-cloud-guidance But you can consider having custom script for gcc high endpoints. #https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-u-s-government-gcc-high-endpoints?view=o365-worldwide Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@DineshElumalai Are you using splunk native csv export? or using any script or rest api to export the results? If you are using outputcsv i agree with @gcusello export the result to splunk folder and create a script to move to your folder. Also you can consider using exporting data using rest api with curl. curl -k -u <username>:<password> https://<splunk-host>:8089/services/search/jobs/export \ -d search="search index=test sourcetype=test earliest=-7d@d latest=now" \ -d output_mode=csv > /external/path/to/destination/results.csv To append new results to an existing file, use >> instead of > curl -k -u <username>:<password> https://<splunk-host>:8089/services/search/jobs/export \ -d search="search savedsearch test_weekly_export" \ -d output_mode=csv >> /path/to/your/target/folder/test_report.csv #https://help.splunk.com/en/splunk-enterprise/search/search-manual/9.3/export-search-results/export-data-using-the-splunk-rest-api Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@sylviee_o It appears you're upgrading from a much older version of Splunk to 9.4.x, which is causing the issue shown in your screenshot. To resolve this, you need to follow the supported upgrade path to ensure all components, including KV Store, are properly updated. Skipping intermediate versions can result in compatibility problems and failed upgrades. Before upgrading to 9.4.x, verify that your KV Store server version is at least 4.2. If it isn't, first upgrade to an intermediate version (such as 9.3.x) that brings KV Store to the required level, then proceed to 9.4.x. Also refer, #https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/MigrateKVstore Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@jessieb_83 Do your proxy log events include fields that identify a user or a device (such as src, dest, src_ip, dest_ip, host ...)? Typically, proxy logs should be mapped to the Web data model. Check that your logs contain the necessary fields for proper mapping. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@HA-01 Looks like app doesn't support fetching Dynamic test data.Ref #https://docs.appdynamics.com/appd/24.x/latest/en/end-user-monitoring/thousandeyes-integration-with-browser-real-user-monitoring/thousandeyes-network-metrics-in-browser-rum #https://docs.thousandeyes.com/product-documentation/integration-guides/custom-built-integrations/splunk-app You can consider using ThousandEyes API calls to pull Dynamic data. #https://developer.cisco.com/docs/thousandeyes/create-endpoint-dynamic-test/ #https://docs.thousandeyes.com/product-documentation/end-user-monitoring/viewing-data/endpoint-agent-automated-session-tests-view Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@nordinethales You are correct, there might be significant difference in Splunk Cloud license usage between INDEXED_EXTRACTIONS=json and KV_MODE=json INDEXED_EXTRACTIONS=json - Fields are extracted at index time and stored, which increases the size and license usage KV_MODE=json - Fields are only extracted at search time, so license usage is based on the raw data size. Also you can refer this #https://splunk.github.io/splunk-add-on-for-crowdstrike-fdr/fieldextractions/ Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@chenfan Any error messages on splunkd.log? You can also refer #https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.3/authenticate-into-the-splunk-platform-with-tokens/troubleshoot-token-authentication Can you create another token with admin account and test the same. Also test without token, curl -k -u admin:yourpassword https://mysplunkserver:8089/servicesNS/nobody/my_app/saved/searches/testalertapi -d enabled=0 Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@NickEot I dont think it's possible to directly back up a .conf file from a Heavy Forwarder to a specific folder on your Splunk Enterprise server using port 9997 or 8089. Best method is to use standard file transfer methods(SCP,SFTP...) Workaround is to create a script/input on the Heavy Forwarder that reads the contents of the .conf file and sends it as a log event to the Splunk Enterprise server. On the Enterprise server, you could then use a Splunk alert or script to reconstruct the file from the received event and save it. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
1 Karma
@jessieb_83 Before adding event data to your UBA, make sure you have already integrated your HR, Asset, and Identity data. The error eventHasNoEntities occurs when your data lacks entity-related CIM-compliant fields or values. Ensure that, Your UBA contains Asset and Identity data before importing any event data. Your event data is CIM-compliant and includes the necessary entity data fields. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
1 Karma
@TestUser I don't think you can prefill a file upload field with a previously uploaded file. It's a standard security and privacy feature in web browsers and web applications Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@danielbb I dont think there is any public document available from Splunk for this field-to-field explanations. They doesn't seem mutually exclusive, as it can be same or differ depends on the search. Also you can refer - #https://community.splunk.com/t5/Splunk-Search/index-audit-contents/m-p/338588 Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
1 Karma
@mristic confining Splunk Forwarder with a custom SELinux policy is extremely challenging because of Splunk's complex architecture. There is a community project for your ref. #https://github.com/doksu/selinux_policy_for_splunk Also you can try splunk in permissive mode, colelct denials and build policy with audit2allow #https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security-enhanced_linux/sect-security-enhanced_linux-fixing_problems-allowing_access_audit2allow Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@_pravin I don't think SH unresponsive issue is because of config issue on your Indexer Discovery. With your classic approach(static indexers list) the indexers themselves remained reachable and responsive to the SH for search and metadata operations. The SH normally becomes slow or unresponsive when it cannot communicate with the indexers for distributed search/query. You can set up alerts on the license master to notify you as you approach your daily license limit. If you must block data, do so at the forwarder level (disable outputs or even disabling FW port if possible(not recommended)) Also you can consider using null queue to drop data at HF. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
2 Karma
@_pravin If i understood you correctly, you flip indexer receiving port whenever you have license overage and your SH becomes unresponsive. SH becomes unresponsive, because it keeps trying to communicate with those indexers, waiting for timeouts and retries. This causes high network activity, resource exhaustion, or unresponsive. If indexers are unresponsive, the SH waits for each connection to time out, which can block UI and search activity eventually. I would suggest not to use port flipping as a workaround. This destabilizes the cluster and SH. Instead, address license overages at the source (reduce ingestion, increase license, or use Splunk’s enforcement). Also for a quick workaround is to restart SH, which will clear the active connections. But the best approach is to address license issues at the source rather than blocking ingestion. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
1 Karma
@L_Petch Can you make sure your service name filter is not having case sensitivity issue. Try, #!/bin/bash
# Check if the container named 'sc4s' is running
if ! podman ps --filter "name=sc4s" --filter "status=running" | grep sc4s > /dev/null 2>&1; then
exit 1
fi
# Optionally, check if the service inside the container is healthy (e.g., port 514)
if ! ss -ltn | grep ':514 ' > /dev/null 2>&1; then
exit 1
fi
exit 0 Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
2 weeks ago
@Alan_Chan Is your ES IP added to your SOAR allow list? Check connection before pairing - Confirm that Enterprise Security can initiate a TCP connection for REST calls to the SOAR port Also error highlights SSL handshake failure-Are you using self signed or valid CA certificate in the SOAR? Also note that, Splunk Enterprise Security requires a valid SSL certificate to communicate with Splunk SOAR Ref:#https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.0/configuration-and-settings/pair-splunk-enterprise-security-with-splunk-soar Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
3 weeks ago
1 Karma
@super_edition You can either use append or eval match condition to combine both for your scenario using append ( index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" "/my_service/user-registration" | dedup req_id | stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster | eval avgResponse=round(avgResponse,2) | eval nintyPerc=round(nintyPerc,2) ) | append [ search index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" "/my_service/profile-retrieval" | eval url="/my_service/profile-retrieval" | stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster | eval avgResponse=round(avgResponse,2) | eval nintyPerc=round(nintyPerc,2) ] | table url method kubernetes_cluster hits avgResponse nintyPerc combined index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" ("/my_service/user-registration" OR "/my_service/profile-retrieval") | eval url=if(match(url, "^/my_service/user-registration"), "/my_service/user-registration", if(match(url, "^/my_service/profile-retrieval"), "/my_service/profile-retrieval", url)) | dedup req_id | stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster | eval avgResponse=round(avgResponse,2) | eval nintyPerc=round(nintyPerc,2) | table url method kubernetes_cluster hits avgResponse nintyPerc Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
3 weeks ago
@BraxcBT Issue started after an upgrade or new app/add-on install? Or first time you logged in and observed this? Try from different browser and see if it's still the same. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
3 weeks ago
@DarthHerm Your inputs.conf looks good. Check splunkd.log on the affected forwarder for errors related to perfmon or permissions try upgrading - test the same config on one host with Universal Forwarder 9.3.5 Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
