Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About treinke
treinke
Builder
Member since:
05-05-2010
08-05-2024
Community Statistics
| Posts | 147 |
| Solutions | 16 |
| Karma Given | 117 |
| Karma Received | 69 |
| Member Since | 05-05-2010 |
Activity Feed
- Got Karma for Re: Upgrade Splunk using RPM. 09-08-2025 07:04 AM
- Got Karma for Re: How to timechart the count of a field by day?. 08-21-2024 11:44 AM
- Got Karma for Re: Upgrade Splunk using RPM. 07-20-2023 09:42 AM
- Karma Re: how to replace using SED command ? for horsefez. 05-24-2022 08:26 AM
- Posted Re: Has anyone attempted to run Splunk with indexes stored on AWS Elastic File System (EFS)? on All Apps and Add-ons. 03-30-2022 12:26 PM
- Karma Announcing Our New Splunk Community MVPs Program for jhupka_splunk. 02-09-2022 03:54 PM
- Karma Re: Inserting whitespace in an app's nav menu? for John_Mark. 07-07-2021 07:23 AM
- Got Karma for Re: Splunk Security Cloud Makes Security Offerings Easier to Buy/Use In The Cloud. 06-22-2021 01:35 PM
- Karma Splunk Security Cloud Makes Security Offerings Easier to Buy/Use In The Cloud for bjennewein. 06-22-2021 01:23 PM
- Got Karma for Re: How can I find out which email server Splunk uses?. 06-19-2021 01:22 PM
- Posted Dashboard Studio - Remove the _tc column in table on Dashboards & Visualizations. 06-03-2021 10:18 AM
- Karma Re: termsOfServiceDirectory which web.conf should this stanza be placed in, in a distributed environment. Using btool for Yorokobi. 06-05-2020 12:50 AM
- Got Karma for Re: what kind of communication happens between Splunk Cloud Gateway app installed on onprem Splunk Enterprise and cloud gateway service? is it a push or pull mechanism of data?. 06-05-2020 12:50 AM
- Got Karma for Re: Are there any apps or add-ons to integrate Microsoft Teams with Splunk Enterprise?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there any kind of additional cost involved in setting up splunk mobile?. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk integration with service now ticketing tool. 06-05-2020 12:50 AM
- Karma Re: Splunk DB Connect upgrade (v2>v3) -- search error for mbrazington. 06-05-2020 12:49 AM
- Got Karma for Re: How can I find out which email server Splunk uses?. 06-05-2020 12:49 AM
- Karma Re: How to generate a real-time dashboard that shows a list of currently logged in users on a server? for richgalloway. 06-05-2020 12:48 AM
- Karma Re: Is it possible to get a 2 week trial of the Splunk User Behavior Analytics (Splunk UBA) app? for scruse. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 1 | |||
| 2 |
07-20-2016
06:31 AM
1 Karma
I am using 6.4.2 and use the following in XML of the dashboard. I simply call the HTML tag and then use the standard iframe commands inside a panel. Hope this helps.
<row>
<panel>
<title>Testing HTML</title>
<html>
<iframe src="http://www.splunk.com" height="200" width="1000" style="border:none;"></iframe>
</html>
</panel>
</row>
... View more
06-30-2016
06:18 AM
Does Splunk nativity support 2 factor?
No
Are their products that you can add to Splunk to make it support 2 factor?
Yes. I have used Duo in the past to handle multiple different 2 factor (https://duo.com/docs/splunk). It does look like they require being in legacy mode to handle the 2 factor passing of accounts.
... View more
03-31-2016
05:12 AM
Then to combine the fields that were extracted you can use the eval command to join different fields together.
... View more
03-31-2016
05:01 AM
Typically I add a statement in props.conf to let Splunk know it is XML.
[yoursourcetype]
KV_MODE = xml
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1
... View more
02-01-2016
10:51 AM
are you seeing the packets with tcpdump/wireshark on the Splunk server?
... View more
10-21-2015
02:10 PM
3 Karma
I think what you are trying to do would be something like this:
(sourcetype=iis host=Server1) OR (source="WinEventLog:*" index="wineventlog" host=Server1)
This would give you the results from either search.
... View more
10-21-2015
01:23 PM
you are adding an ip address to limit the input selection. if you added [udp://514] to the inputs.conf file, you are saying any ip address on UDP port 514. This is really more like [udp://*:514] . When you add the ip address in to the stanza, you are narrowing down the parameters. So [udp://123.456.789:514] is saying from this ip on this port, do the following the in the stanza.
... View more
10-13-2015
06:10 AM
In your indexes.conf file, you can point where the path to the index is.
More information on the indexes.conf file at:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf
Example:
homePath = $SPLUNK_DB/MyIndex/db
coldPath = $SPLUNK_DB/MyIndex/colddb
thawedPath = $SPLUNK_DB/MyIndex/thaweddb
... View more
08-12-2015
07:34 AM
Are you going to define the indexes and host? Are you saying show me the sourcetypes for index=A OR index=B and host=AA Or host=BB? Or are you looking for in the last 60 minutes show me all of the indexes getting data by any host and then also show me the sourcetypes that were logged?
... View more
Take a look in Settings - Searches, reports, and alerts. Adjust the owner to yourself and then look in the table below. If you still don't see it, change the app context to All.
... View more
06-25-2015
06:10 AM
What error are you getting?
... View more
06-24-2015
06:57 AM
1 Karma
The documentation for the installation of the JDBC drivers is at: http://docs.splunk.com/Documentation/DBX/2.0.4/DeployDBX/Installdatabasedrivers
For Microsoft SQL, the Microsoft JDBC Drivers 4.1 and 4.0 for SQL Server is what you will want.
http://www.microsoft.com/download/details.aspx?id=11774
The steps to install them are here:
http://docs.splunk.com/Documentation/DBX/2.0.4/DeployDBX/Installdatabasedrivers#Microsoft_SQL_Server
... View more
06-16-2015
11:54 AM
What does your props.conf file look like? I was having this issue with some of my SendGrid logs. Example of some of the logs:
[{"response":"550 5.1.1 User Unknown ","sg_event_id":"1234567890","sg_message_id":"7410258963","event":"deferred","email":"[email protected]","attempt":"23","timestamp":1432305797,"smtp-id":"<[email protected]>"}]
[{"email":"[email protected]","timestamp":1432305792,"smtp-id":"<[email protected]>","sg_event_id":"2345678901","sg_message_id":"4108529637","event":"processed"}]
[{"email":"[email protected]","timestamp":1432305793,"smtp-id":"<[email protected]>","sg_event_id":"3456789012","sg_message_id":"1085296374","event":"processed"},
{"email":"[email protected]","timestamp":1432305793,"smtp-id":"<[email protected]>","sg_event_id":"4567890123","sg_message_id":"0852963741","event":"processed"},
{"email":"[email protected]","timestamp":1432305793,"smtp-id":"<[email protected]>","sg_event_id":"5678901234","sg_message_id":"852963710","event":"processed"},
{"email":"[email protected]","timestamp":1432305793,"smtp-id":"<[email protected]>","sg_event_id":"6789012345","sg_message_id":"5296374108","event":"processed"},
{"email":"[email protected]","timestamp":1432305795,"smtp-id":"<[email protected]>","response":"250 Message Queued (No RCPTS) ","sg_event_id":"7890123456","sg_message_id":"2963741085","event":"delivered"},
{"email":"[email protected]","smtp-id":"<[email protected]>","timestamp":1432305796,"response":"250 Backend Replied [7531598520.abcd.server.local]: 2.0.0 Ok: queued as A1B2C3D4 (Mode: n ","sg_event_id":"8901234567","sg_message_id":"9637410852","event":"delivered"},
{"email":"[email protected]","timestamp":1432305796,"smtp-id":"<[email protected]>","response":"250 Message Queued (No RCPTS) ","sg_event_id":"9012345678","sg_message_id":"637410852963","event":"delivered"},
{"email":"[email protected]","timestamp":1432305796,"smtp-id":"<[email protected]>","response":"250 Message Queued (No RCPTS) ","sg_event_id":"0123456789","sg_message_id":"3741085296","event":"delivered"}]
My props.conf for this sourcetype:
[sendgrid_json]
INDEXED_EXTRACTIONS = json
KV_MODE = none
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = timestamp
category = Structured
disabled = false
pulldown_type = true
Now it shows up in the nice JSON format.
... View more
05-25-2015
07:19 AM
To Open UDP:514 in Standard Windows Firewall
netsh firewall add portopening UDP 514 "Open UDP 514"
To Open UDP:514 in Advance Windows Firweall
netsh advfirewall firewall add rule name="Open UDP 514" dir=in action=allow protocol=UDP localport=514
... View more
Is the built in Windows Firewall on?
... View more
05-25-2015
06:56 AM
also make sure the local firewall is allowing udp port 514. What OS is Splunk on?
... View more
04-17-2015
09:57 AM
1 Karma
Try the following:
| timechart span=1d count by "Failover Time"
... View more
02-18-2015
06:28 AM
Are you talking about C2 audits or getting data out of the databases in to Splunk? Can you provide a little more detail about your request?
... View more
01-17-2015
02:19 PM
I am looking to pull in some data from a sensor device. The device does outputs an xml file. I can see the file if I go to http://10.0.0.10/data.xml
What is the best way to grab this file every 10 seconds?
Splunk Indexer: CentOS 7 x64 with Splunk 6.2.1
... View more
01-17-2015
09:28 AM
Make sure to look at what AD groups the person is in. It sounds like they are in a group that you mapped and that would be why you can''t delete them from Splunk.
I should check in map groups what is mapped to the admin role. On the right side you can see the role the group has. In the left column it shows the AD group. You can click on the AD group to see who is in that group.
Hope this helps.
... View more
12-30-2014
09:24 PM
When you configure the inputs from the website, the inputs.conf file will be in the app folder that you were in before you when in to the inputs section. For example if you were in the Search & Reporting app, current location for your inputs.conf would be in
$SPLUNK_HOME/etc/apps/search/local/inputs.conf
If you are not sure where to store your file with these stanzas, you can use
$SPLUNK_HOME/etc/system/local/inputs.conf
... View more
12-29-2014
06:56 AM
1 Karma
You can use the following in your inputs.conf
[udp://123.456.789:514]
index = networking
sourcetype = cisco
[udp://123.456.890:514]
index = networking
sourcetype = fortinet
... View more
12-15-2014
09:03 AM
Looking to do a chart and even if the count of a value is 0 still diplay the name of the value. My search so far is:
sourcetype=app3* (app3_level="Fatal" OR app3_level="Error") | chart count by app3_level,app3_message
I tried to add to the end of the statement but it didn't help.
| fillnull value=0 app3_level
Most of the time there is not a "app3_level=Fatal" but I still want it to show up in the column. Any ideas?
... View more
06-05-2014
06:16 AM
1 Karma
The best way for this is to use lookup tables. Since they are internal ip addresses, you can create a csv file and then tell Splunk to reference that for the location.
Here is the documentation setting up lookups:
http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Addfieldsfromexternaldatasources
... View more
