About kmorris_splunk

kmorris_splunk · ‎05-29-2018

Can you share how you defined the syslog server in outputs.conf? Scrubbed is fine.

kmorris_splunk · ‎05-20-2018

Try this: Use the value of one field as the name for a new field In this example, use each value of the field counter to make a new field name. Assign to the new field the value of the Value field. See Field names under the Usage section. index=perfmon sourcetype=Perfmon* counter=* Value=* | eval {counter} = Value Link to the documentation on this topic.

kmorris_splunk · ‎05-10-2018

I think you are missing a name for your capture group. Try this: Test Name\","value":"(?<myfield>.*)"},{"key" I wasn't sure if you wanted the quote at the end so I removed it as well.

kmorris_splunk · ‎04-13-2018

No, there is nothing required on the forwarders to use the Machine Learning Toolkit. The toolkit allows you to build models which you apply to the data you have ingested into Splunk. You will need the Python for Scientific Computing Add-on installed on the Search Head however. Requirements You must install the Python for Scientific Computing Add-on before installing the Machine Learning Toolkit. Please download and install the appropriate version here: Mac: https://splunkbase.splunk.com/app/2881/ Linux 64-bit: https://splunkbase.splunk.com/app/2882/ Linux 32-bit: https://splunkbase.splunk.com/app/2884/ Windows 64-bit: https://splunkbase.splunk.com/app/2883/

kmorris_splunk · ‎04-13-2018

I would first run the base search (before the first pipe), to see if you get results. Then, verify the fieldname (case sensitive). Add the transaction in once you verify the fieldname. It is always a good troubleshooting practice to start at the base search then slowly build until it breaks. Once it breaks, you should be able to identify the problem more easily.

kmorris_splunk · ‎04-09-2018

Without actually seeing the logs, you could most likely use the transaction command. Try something like the following: index=some_index sourcetype=some_sourcetype | transaction otp | table otp CN response_type

kmorris_splunk · ‎11-27-2017

You should receive a message, something like "Received event for unconfigured/disabled/deleted index=" under Messages in your Search Head. The data will just get dropped when it hits the indexer(s). Are you sending other data from the same forwarder? Verify that there are no firewalls blocking data from the forwarder. All in all, you should either create the index manually or by installing any appropriate TAs (Add-ons) per that TAs documentation.

kmorris_splunk · ‎10-25-2017

Try putting your subsearch as part of your base search: index = sourcetype= eventtype=* [|inputlookup clusName.csv | fields cluster] | stats values(eventtype) as Eventtype values(source) as Source values(host) as Host by cluster

kmorris_splunk · ‎10-04-2017

Licensing is by data ingested in a 24 hour period, and is not related to the number of forwarders. The amount of data can vary greatly depending on the source.

kmorris_splunk · ‎10-03-2017

Taking into account the info provided above regarding system requirements and architecture, if you want a search head, an indexer, and a forwarder, here are some notes that might help you get up and rolling quickly. I would recommend reading the docs on this as well so you understand it more deeply, but this will be sort of a quick start. Install Indexers Change default password on each Indexer (required for Search Head to connect) Install Search Head Install Licenses on Search Head (License Master) Configure each Indexer as a License Slave Settings > Licensing Click Change to slave Click Designate a different Splunk instance as the master license server radio button Specify the IP/Hostname and Splunk management port (8089 by default) Save Establish connections from Search Head to all Search Peers. This is the key step. Distributed search > Search peers > Add New Specify the search peer, along with any authentication settings Save Install Universal Forwarders and configure to send to all Search Peers Example Universal Forwarder outputs.conf [tcpout] defaultGroup = my_search_peers [tcpout:my_search_peers] server=10.10.10.1:9997,10.10.10.2:9997 autoLB = true Forward internal SH data to the indexer tier. Create indexes from SH on the indexers (search peers). Internal indexes will already exist, but indexes created by apps can be easily created by installing the apps on the indexers as well. Set SH up to Forward to all Search Peers. Example outputs.conf Turn off indexing on the search head [indexAndForward] index = false [tcpout] defaultGroup = my_search_peers forwardedindex.filter.disable = true indexAndForward = false [tcpout:my_search_peers] server=10.10.10.1:9997,10.10.10.2:9997 autoLB = true

kmorris_splunk · ‎10-03-2017

A heavy forwarder is the same install as Splunk Enterprise. In fact most components of a distributed Splunk architecture are. That components role is determined by the configuration. Here are the docs on deploying a heavy forwarder. http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Forwarding/Deployaheavyforwarder

kmorris_splunk · ‎09-29-2017

Take a look at the Splunk Dashboard Examples app. There is an example there of using single value metrics with color. You will see multiple examples as well as the XML behind the scenes that will allow you to see the parameters required for each example.

kmorris_splunk · ‎09-09-2017

Typically, IIS logs are ingested directly from the web server using a universal forwarder. Take a look at the documentation for the Add-on here. I'm not sure if that gets you around the issue of not logging the host or not.

kmorris_splunk · ‎09-07-2017

Could you take the max for each minute, then sum that. That would give you one data point per minute. For example: YOUR BASE SEARCH ... | timechart max(memory) as maxmem span=1m | stats sum(maxmem) as totalmem

kmorris_splunk · ‎09-05-2017

I believe you need to use seriesColors instead of fieldColors: http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization

kmorris_splunk · ‎08-28-2017

You could use the rex command to extract the first 3 octets into another field and do the top on the new field: sourcetype="cisco:asa" | rex field=src_ip "(?<firstthree>\d+)\.\d+\.\d+\.\d+" | top limit=100 firstthree

kmorris_splunk · ‎08-28-2017

Can you clarify a bit? Are you looking for all of the linux users that exist on the machine where you have a forwarder installed? You wouldn't log in to a Universal Forwarder, so there wouldn't be multiple users defined on one. Are you referring to a Heavy Forwarder? If its a Heavy Forwarder, you could use the following to get a list of users and their roles. |rest /services/authentication/users splunk_server=local |fields title roles realname|rename title as userName|rename realname as Name

kmorris_splunk · ‎08-25-2017

It isn't possible to filter data using a Universal Forwarder, with the exception of Blacklisting or Whitelisting Wiindows event codes. You would need to use the props and transforms settings on the indexers, or use a Heavy Forwarder. If using a Heavy Forwarder, you need to consider how much of the data you are actually filtering out. If it isn't a large percentage, then it isn't worth it since Heavy Forwarders send what is called "cooked data" which is larger than what a Universal Forwarder would send. So you really wouldn't be cutting back on any network traffic. If you aren't filtering a large portion, use the Universal Forwarder and add the props.conf and transforms.conf settings to your indexers.

kmorris_splunk · ‎08-24-2017

I would recommend taking a sample of your data and brining it in through the GUI. When you do this, you can tweak the Breaking, Timestamping, etc... and see how it effects the way the data will be ingested. You can use the BREAK_ONLY_BEFORE parameter to apply a regex that identifies the beginning of each event. Something like: BREAK_ONLY_BEFORE \{\"\w+\": Once you get the linebreaking correct, save the sourcetype and then start feeding your data in through a forwarder.

kmorris_splunk · ‎08-24-2017

Are the values consistent in the multivalue field? If so, you could use mvindex to create a field for each. YOUR BASE SEARCH | | eval field1=mvindex(bytes,0) | eval field2=mvindex(bytes,1)

kmorris_splunk · ‎08-18-2017

You were missing the name for the capture group (imagetype for example) in the rex expression.

kmorris_splunk · ‎08-17-2017

Ingesting this sample through the GUI, seems to parse the events OK. It's also grabbing the timestamp properly. A good practice would be to take a sample, ingest it through the GUI. If things aren't linebreaking or timestamping properly, you can make adjustments in the GUI and save the settings in a sourcetype. Once you have the sourcetype, you can create your input to read the logs in, specifying the new sourcetype you created.

kmorris_splunk · ‎08-17-2017

You could take a look at the outputs.conf file on the forwarder.

kmorris_splunk · ‎08-17-2017

Try using btool on the Universal forwarder to list all of the inputs: ./splunk cmd btool inputs list —debug

kmorris_splunk · ‎08-17-2017

You could use the coalesce command to merge the two fields into a single field: BASE SEARCH | eval AgentVersion = coalesce(AgentVersionold,AgentVersionnew) | stats count by AgentVersion

Posts	324
Solutions	49
Karma Given	27
Karma Received	113
Member Since	‎07-29-2014

Online Status	Offline
Date Last Visited	‎02-24-2021 02:01 PM

Re: Syslog routing

Re: how do I create a variable(or new field name) ...

Re: Regex not working event after validating in re...

Re: Will the Machine Learning ToolKit analyze data...

Re: How to correlate two fields across the same in...

Re: How to correlate two fields across the same in...

Re: What happens when the forwarder is configured ...

Re: subsearch with inputlookup

Re: How is Splunk license usage calculated?

Re: Splunk architecture feedback

Re: Trouble configuring the forwarder when integra...

Re: Can I set an alert that turns my dashboard red...

Re: Splunk Add-On for Microsoft IIS Default Settin...

Re: How can I sum total memory used by a process?

Re: Change color of stats count visualization

Re: How to extract only the first three octets of ...

Re: Help finding all users on my system

Re: How do you exclude log lines from being indexe...

Re: Log file monitoring, wrong parsing

Re: Creating a table from a single event with mult...

Re: Need help with Rex query to get count by Image...

Re: Has anyone successfully parsed Exim logs into ...

Re: Is there a way to check what sourcetypes a un...

Re: Is there a way to check what sourcetypes a un...

Re: Pie chart to display upgrade adoption of our n...

Join the Conversation