×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
las
Builder
Member since: ‎12-05-2011
‎06-22-2026
Community Statistics
Posts 152
Solutions 15
Karma Given 52
Karma Received 28
Member Since ‎05-12-2011
Activity Feed
Topics I've Started
View All

Re: Index Service-Now MID server logs

by in Monitoring Splunk
‎04-17-2019 03:38 AM
‎04-17-2019 03:38 AM
I had a few issues, but now it seems to work [snow:mid] NO_BINARY_CHECK = true CHARSET = AUTO TIME_FORMAT = %m/%d/%y %H:%M:%S TIME_PREFIX=^ TZ = Europe/Copenhagen MAX_TIMESTAMP_LOOKAHEAD=30 SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) category=Custom Kind regards ... View more

Re: Dependency on Oracle java?

by in All Apps and Add-ons
‎04-17-2019 03:25 AM
‎04-17-2019 03:25 AM
Thank you. ... View more

Re: Dependency on Oracle java?

by in All Apps and Add-ons
‎04-17-2019 01:37 AM
‎04-17-2019 01:37 AM
Hi. I can't see a download for windows on the openJDK page referenced in the doc. Do you know if OpenJDK is just supported on Linux? Kind regards las ... View more

Re: Dependency on Oracle java?

by in All Apps and Add-ons
‎04-17-2019 01:29 AM
‎04-17-2019 01:29 AM
I forgot to mention, the Splunk installation is on Windows, and I can't find an OpenJDK for Windows Binary download. I did find AdoptOpenJDK, but that is not supportet. ... View more

Dependency on Oracle java?

by in All Apps and Add-ons
‎04-17-2019 01:17 AM
‎04-17-2019 01:17 AM
Hi. With Oracles new licensing policy for java, does anybody know if the Splunk DB Connect can use another Java? Kind regards las ... View more

Re: Index Service-Now MID server logs

by in Monitoring Splunk
‎04-11-2019 11:51 PM
‎04-11-2019 11:51 PM
This props.conf seems to work [snow:mid] NO_BINARY_CHECK = true CHARSET = AUTO TIME_FORMAT = %m/%d/%y %H:%M:%S TIME_PREFIX=^ MAX_TIMESTAMP_LOOKAHEAD=30 category=Custom Thank you very much ... View more

Re: Index Service-Now MID server logs

by in Monitoring Splunk
‎04-11-2019 11:29 PM
‎04-11-2019 11:29 PM
Sorry, I should have been more clear on the second text box. That is a screen copy of Splunk. So lines 1 and 2 are Splunk Timestamp as extracted from the log Lines 3 thru 15 included are the Splunk event Line 16 (Collapse) event Line 17 Splunk info on the event (host, source and sourcetype) Lines 18 and 19 are Splunk Timestamp as extracted from the log Line 20 is the event Line 21 Splunk info on the event (host, source and sourcetype) I will try your config and get back with the result. Kind regards ... View more

Index Service-Now MID server logs

by in Monitoring Splunk
‎04-10-2019 04:07 AM
‎04-10-2019 04:07 AM
Hi. I'm indexing the log from the Service-now MID-Server, that should be nice and easy, most lines start with a timestamp, and a few are multiline events. 04/10/19 11:50:24 (365) LogStatusMonitor.60 stats threads: 67, memory max: 910.0mb, allocated: 402.0mb, used: 29.0mb, standard.queued: 0 probes, standard.processing: 0 probes, expedited.queued: 0 probes, expedited.processing: 0 probes, interactive.queued: 0 probes, interactive.processing: 0 probes 04/10/19 11:51:24 (373) LogStatusMonitor.60 stats threads: 67, memory max: 910.0mb, allocated: 402.0mb, used: 29.0mb, standard.queued: 0 probes, standard.processing: 0 probes, expedited.queued: 0 probes, expedited.processing: 0 probes, interactive.queued: 0 probes, interactive.processing: 0 probes 04/10/19 11:52:24 (406) LogStatusMonitor.60 stats threads: 67, memory max: 910.0mb, allocated: 402.0mb, used: 30.0mb, standard.queued: 0 probes, standard.processing: 0 probes, expedited.queued: 0 probes, expedited.processing: 0 probes, interactive.queued: 0 probes, interactive.processing: 0 probes 04/10/19 11:52:45 (197) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Worker starting: JDBCProbe source: 7f753a46db16a740c53f6c16ca9619a9 04/10/19 11:52:45 (275) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Waiting for connection semaphore 04/10/19 11:52:45 (275) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Obtained connection semaphore 04/10/19 11:52:45 (275) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af SELECT DISTINCT pco.PCO_Ref, pco.Act_Plan, pco.Description, pco.Impact, pco.Prioritet, pco.risk, pco.Txt_type, convert(varchar(MAX), pco.Txt) as Txt, pco.Urgency, status.CloseType, status.PCOClose, status.PCOPlan2, status.PCOrelease3, act.SenesteStart, act.SenesteEnd FROM "PobPco"."dbo"."PCO" pco join "PobPco"."dbo"."PCO_status" status on pco.PCO_Ref = status.PCO_Ref FULL outer join "PobPco"."dbo"."Act" act on pco.PCO_Ref = act.PCO_Ref and (act.Sequence='430' OR act.Sequence='491') WHERE (pco.Act_Plan='LEV_UDK_LEVERANCESITE' OR pco.Act_Plan='APPL_TWS_INITIERET' OR pco.Act_Plan='TEK_GENEREL_WEB') 04/10/19 11:53:24 (392) LogStatusMonitor.60 stats threads: 67, memory max: 910.0mb, allocated: 402.0mb, used: 30.0mb, standard.queued: 0 probes, standard.processing: 1 probes, expedited.queued: 0 probes, expedited.processing: 0 probes, interactive.queued: 0 probes, interactive.processing: 0 probes On the universal forwarder, there's just an input.conf, that sets sourcetype and index. On the indexer I have a props.conf with this content: [snow:mid] SHOULD_LINEMERGE = true NO_BINARY_CHECK = true CHARSET = AUTO disabled = false TIME_FORMAT = %m/%d/%y %H:%M:%S category = Custom My problem is that for some reason Splunk doesn't do event break correctly 10/04/2019 11:53:24.000 04/10/19 11:53:38 (565) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Enqueuing: D:\ServiceNow\MID_Server\atp-34umid02_dev01\agent\work\monitors\ECCSender\output_s\ecc_queue.16a06aacf050000001.xml 04/10/19 11:53:38 (596) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Enqueuing: D:\ServiceNow\MID_Server\atp-34umid02_dev01\agent\work\monitors\ECCSender\output_s\ecc_queue.16a06aacf140000001.xml 04/10/19 11:53:38 (611) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Enqueuing: D:\ServiceNow\MID_Server\atp-34umid02_dev01\agent\work\monitors\ECCSender\output_s\ecc_queue.16a06aacf240000001.xml 04/10/19 11:53:38 (627) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Enqueuing: D:\ServiceNow\MID_Server\atp-34umid02_dev01\agent\work\monitors\ECCSender\output_s\ecc_queue.16a06aacf430000001.xml 04/10/19 11:53:38 (643) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Enqueuing: D:\ServiceNow\MID_Server\atp-34umid02_dev01\agent\work\monitors\ECCSender\output_s\ecc_queue.16a06aacf530000001.xml 04/10/19 11:53:38 (643) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Enqueuing: D:\ServiceNow\MID_Server\atp-34umid02_dev01\agent\work\monitors\ECCSender\output_s\ecc_queue.16a06aacf530000002.xml 04/10/19 11:53:38 (643) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af Worker completed: JDBCProbe source: 7f753a46db16a740c53f6c16ca9619a9 time: 0:00:53.368 04/10/19 11:53:38 (880) ECCSender.1 Sending ecc_queue.16a06aacf050000001.xml 04/10/19 11:53:38 (989) ECCSender.1 Sending ecc_queue.16a06aacf140000001.xml 04/10/19 11:53:39 (098) ECCSender.1 Sending ecc_queue.16a06aacf240000001.xml 04/10/19 11:53:39 (192) ECCSender.1 Sending ecc_queue.16a06aacf430000001.xml 04/10/19 11:53:39 (270) ECCSender.1 Sending ecc_queue.16a06aacf530000001.xml 04/10/19 11:53:39 (364) ECCSender.1 Sending ecc_queue.16a06aacf530000002.xml Collapse host = ATP-34UMID02 source = D:\ServiceNow\MID_Server\atp-34umid02_dev01\agent\logs\agent0.log.0 sourcetype = snow:mid 10/04/2019 11:53:24.000 04/10/19 11:53:24 (392) LogStatusMonitor.60 stats threads: 67, memory max: 910.0mb, allocated: 402.0mb, used: 30.0mb, standard.queued: 0 probes, standard.processing: 1 probes, expedited.queued: 0 probes, expedited.processing: 0 probes, interactive.queued: 0 probes, interactive.processing: 0 probes host = ATP-34UMID02 source = D:\ServiceNow\MID_Server\atp-34umid02_dev01\agent\logs\agent0.log.0 sourcetype = snow:mid ... View more

Re: Unable to create incident from Splunk in Servi...

by in All Apps and Add-ons
‎03-28-2019 06:50 AM
1 Karma
‎03-28-2019 06:50 AM
1 Karma
Sometimes it helps to try to do the request instead of just looking, at the logs. I was missing the list_storage_passwords capability in the roles. ... View more

Re: Unable to create incident from Splunk in Servi...

by in All Apps and Add-ons
‎03-27-2019 11:48 PM
‎03-27-2019 11:48 PM
Hi. I'm on a windows system. It is spot on, that the 'user' making the call to passwords/username stored in Splunk_TA_snow is unable to get the correct creds. The user making the call gets a HTTP returncode 403, when they try to call /servicesNS/nobody/Splunk_TA_snow/storage/passwords/ So Splunk is preventing the 'user' from getting the passwords. I don't think that is done by ACLs on the filesystem. Kind regards ... View more

Re: How to migrate a clustered indexer peer to a n...

by in Deployment Architecture
‎03-25-2019 08:30 AM
1 Karma
‎03-25-2019 08:30 AM
1 Karma
Hi great answer, just a small follow-up. What happens if the indexer was convertet to a cluster-member, will this approach work for the non-clustered data on the indexer? Kind regards Lars ... View more

Re: Unable to create incident from Splunk in Servi...

by in All Apps and Add-ons
‎03-25-2019 08:24 AM
‎03-25-2019 08:24 AM
No, no proxy. For me it looks like the alert-script is requesting the credentials to Service-now from the Splunk-ta-snow app with the searchs user, and gets a http request denied. Kind regards Lars ... View more

Re: How do I get the alert actions from splunk_ta_...

by in Splunk Enterprise Security
‎03-25-2019 07:30 AM
‎03-25-2019 07:30 AM
Then I'll have to purchase Phantom, and provision hardware for that also, or have I missunderstood the licenzing and deployment options. I must admit, I haven't really lokked into phantom yet. Kind regards Lars ... View more

Re: Unable to create incident from Splunk in Servi...

by in All Apps and Add-ons
‎03-25-2019 07:22 AM
‎03-25-2019 07:22 AM
Yes, the ServiceNow integration is installed and configured. The problem is not on the ServiceNow side, it is on the Splunk side. This is URL that has the problem: GET /servicesNS/nobody/Splunk_TA_snow/storage/passwords/https%5C%3A%252F%252Fservicenow instance%3Adummy%3A Called with https://127.0.0.1:8089, as the host ... View more

How do I get the alert actions from splunk_ta_snow...

by in Splunk Enterprise Security
‎03-25-2019 03:07 AM
‎03-25-2019 03:07 AM
Hi. It seems like the alert_actions defines in splunk_ta_snow misses param._cam parms, so they don't show up, as adaptive responses in Enterprise Security. How do I get them to do that? Kind regards Lars Søndergaard ... View more

Unable to create incident from Splunk in Service-N...

by in All Apps and Add-ons
‎03-25-2019 02:27 AM
‎03-25-2019 02:27 AM
Hi. I've tried to create an incident in Service-Now using Splunk add on for Servicenow. This failed when it tried to get the password to Service-Now. 127.0.0.1 - user [23/Mar/2019:05:02:53.239 +0100] "GET /servicesNS/nobody/Splunk_TA_snow/storage/passwords/https%5C%3A%252F%252Fservicenow instance%3Adummy%3A HTTP/1.0" 403 228 - - - 0ms How do I make this URL available, so it is possible to create incidents? Kind regards Lars Søndergaard ... View more

Why does the prepare_token_request() got multiple ...

by in All Apps and Add-ons
‎04-03-2018 03:27 AM
‎04-03-2018 03:27 AM
Hi. I'm hoping you can help me, I'm trying to access a REST API with oauth2 Bearer Token, and need to set grant_type=password. When I'm doing it in OAUTH 2 Token Refresh properties I get the following error: Exception performing request: prepare_token_request() got multiple values for keyword argument 'grant_type' If I need to set this property how do I do it? Kind regards las ... View more

Re: Why am I having a line breaking problem with s...

by in Getting Data In
‎03-22-2018 05:15 AM
‎03-22-2018 05:15 AM
Just to make double sure, I restarted one more time, and as I'm running thru a UF, I added EVENT_BREAKER_ENABLE = true EVENT_BREAKER = ()\d{2,3}\s+<\d{2,3}> to the UF config, and ended up with [isamlog_trace] DATETIME_CONFIG = NO_BINARY_CHECK = true TIME_PREFIX = category = Custom pulldown_type = 1 TIME_FORMAT = %b %d %H:%M:%S disabled = false LINE_BREAKER = ()\d{2,3}\s+<\d{2,3}> EVENT_BREAKER = SHOULD_LINEMERGE = false On the indexer. This seems to be working, but I'll monitor it over some time now. ... View more

Re: Why am I having a line breaking problem with s...

by in Getting Data In
‎03-22-2018 04:33 AM
‎03-22-2018 04:33 AM
And I agree, this should work. ... View more

Re: Why am I having a line breaking problem with s...

by in Getting Data In
‎03-22-2018 04:33 AM
‎03-22-2018 04:33 AM
It's on the indexer, in the search app. ... View more

Re: Why am I having a line breaking problem with s...

by in Getting Data In
‎03-22-2018 04:28 AM
‎03-22-2018 04:28 AM
Thanks for the suggestion, but unfortunately I still see the same behavior. ... View more

Why am I having a line breaking problem with syslo...

by in Getting Data In
‎03-22-2018 04:00 AM
‎03-22-2018 04:00 AM
Hi. I'm having some issues with a datasource comming from TCP:514 (Syslog like). 239 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern Aqp4 rO0ABXQAKHV1aWQ0ZDM0OTU5MS0wMTYyLTFmYWQtYTQ1YS1kMjBkZWMxMDI5NDc= itfim/distributedmaps/ssops_plugins -1 UPDATE DMAP_ENTRIES SET DMAP_VALUE = ? WHERE (DMAP_KEY = ? AND DMAP_PARTITION = ? )264 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:742 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBTransaction > prepareStatement ENTRY UPDATE DMAP_ENTRIES SET DMAP_VALUE = ? WHERE (DMAP_KEY = ? AND DMAP_PARTITION = ? )181 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:742 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBTransaction < prepareStatement RETURN187 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBHelper < executeUpdateStatement RETURN179 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBHelper < insertOrUpdate RETURN169 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBHelper > close ENTRY170 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBTransaction > commit ENTRY171 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBTransaction < commit RETURN169 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBTransaction > close ENTRY170 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBTransaction < close RETURN170 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDBHelper < close RETURN3343 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.distributed.jdbc.JDBCDistributedMap < put RETURN SAML20Session [sessionId = uuid4d349591-0162-1fad-a45a-d20dec102947 signOutInfo = null Session Attributes = [ ; key = SAMLSESS-UserInteractionActionList value = [com.tivoli.am.fim.saml20.protocol.actions.sso.SAML20LocalLoginAction]; key = SAMLSESS-ContextState value = {RequestContext.RelayState=uuid4d349591-0162-1fad-a45a-d20dec102947, RequestContext.ProtocolBinding=Protocol Binding:HTTPPost urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST, RequestContext.Target=null, RequestContext.InitialSAMLRequestProtocolBinding=null, ResponseContext.RelayState=uuid4d349591-0162-1fad-a45a-d20dec102947, ResponseContext.ProtocolEndpoint=null, ProtocolRole=REQUESTER, RequestContext.Artifact=null, ResponseContext.SessionOP=STORE, ContextAttributes={SAMLCTX-ProtocolPartner=http://pilotam.prod.atp.local/sso/sps/AtpLoginSpecialistFederationIdp/saml20, SAMLCTX-SamlTokenElement=[saml:Assertion: null], SAMLCTX-IvcredTokenElement=[wss:BinarySecurityToken: null], SAMLCTX-AssertionNameID=null, SAMLCTX-NeedToFederate=false, SAMLCTX-SamlToken=com.tivoli.am.fim.saml.assertion.Saml20AssertionImpl@6df87a89(Version: 2.0, ID: Assertion-uuid4d3495d5-0162-18c0-98ea-d20dec102947, IssueInstant: 2018-03-22T10:15:14Z, Issuer: com.tivoli.am.fim.saml.assertion.Saml20IssuerImpl@8fcdaa76[NameQualifier: null, SPNameQualifier: null, format: urn:oasis:names:tc:SAML:2.0:nameid-format:entity, SPProvidedID: null, value: http://pilotam.prod.atp.local/sso/sps/AtpLoginSpecialistFederationIdp/saml20], Subject: com.tivoli.am.fim.saml.assertion.Saml20SubjectImpl@27fd901a)}, RequestContext.InitialSAMLRequestReturnProtocolBinding=null, ResponseContext.SAMLMessageProtocolBinding=Protocol Binding:HTTPPost urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST, ResponseContext.SignMessage=false, RequestContext.RequestURL=https://privat-pilo.atp.dk/sso/sps/AtpSpecialistPrivatFederation01/saml20/login, RequestContext.SAMLMessage=com.tivoli.am.fim.saml.protocol.Saml20ResponseImpl@fd99163 [IssueInstant: Thu Mar 22 11:15:14 CET 2018, Version: 2.0, ID: FIMRSP_4d3495e1-0162-1808-bfbc-d20dec102947, Consent: null, Destination: https://privat-pilo.atp.dk/sso/sps/AtpSpecialistPrivatFederation01/saml20/login, RelayState: null]} ] Current Requests = [ ; key = FIMREQ_4d349593-0162-1d87-bb79-d20dec102947 value = com.tivoli.am.fim.saml.protocol.Saml20AuthnRequestImpl@69976609 [IssueInstant: Thu Mar 22 11:15:14 CET 2018, Version: 2.0, ID: FIMREQ_4d349593-0162-1d87-bb79-d20dec102947, Consent: null, Destination: http://pilotam.prod.atp.local/sso/sps/AtpLoginSpecialistFederationIdp/saml20/login, RelayState: null] (forceAuthn: false, isPassive: false, AssertionConsumerServiceIndex: <not set>, AssertionConsumerServiceURL: https://privat-pilo.atp.dk/sso/sps/AtpSpecialistPrivatFederation01/saml20/login, protocolBinding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST, AttributeConsumingServiceIndex: <not set>) ] SessionInfos = [ ; key = http://pilotam.prod.atp.local/sso/sps/AtpLoginSpecialistFederationIdp/saml20 value = SAML20PartnerProviderSessionInfo [PartnerProviderId = http://pilotam.prod.atp.local/sso/sps/AtpLoginSpecialistFederationIdp/saml20; SessionIndex = uuid4d3495c2-0162-126c-93ba-d20dec102947 ] ] ]177 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.saml20.session.SAML20SessionManager > setSAMLCookie ENTRY222 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.saml20.session.SAML20SessionManager 3 setSAMLCookie Setting Cookie: javax.servlet.http.Cookie@df2ce41b177 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.om.ObjectManager > get(Class<C>) ENTRY183 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:743 CET] 000850a8 id= com.tivoli.am.fim.om.ObjectManager$Configuration > getObject(Class<C>) ENTRY278 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.om.ObjectManager$Configuration 3 getObject(Class<C>) Class com.tivoli.am.fim.fedmgr2.msg.BrowserResponseImpl$CustomProperties from version 1521468890800.184 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.om.ObjectManager$Configuration < getObject(Class<C>) RETURN178 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.om.ObjectManager < get(Class<C>) RETURN178 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.saml20.session.SAML20SessionManager < setSAMLCookie RETURN177 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.saml20.session.SAML20SessionManager < storeSession RETURN176 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.management.Utils > decodeObject ENTRY194 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.management.Utils < decodeObject RETURN java.lang.String176 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.management.Utils > decodeObject ENTRY194 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.management.Utils < decodeObject RETURN java.lang.String176 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.management.Utils > decodeObject ENTRY209 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.management.Utils < decodeObject RETURN Cached object: java.lang.String176 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:744 CET] 000850a8 id= com.tivoli.am.fim.management.Utils > decodeObject ENTRY242 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:745 CET] 000850a8 id= com.tivoli.am.fim.management.Utils < decodeObject RETURN com.tivoli.am.fim.saml20.protocol.config.SAML20ConfigurationImpl181 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:745 CET] 000850a8 id= protocol.actions.sso.callback.SAML20MultiPhaseSignInCallback < postProcessEvent RETURN176 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:745 CET] 000850a8 id= com.tivoli.am.fim.management.Utils > decodeObject ENTRY263 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:745 CET] 000850a8 id= com.tivoli.am.fim.management.Utils < decodeObject RETURN com.tivoli.am.fim.saml20.protocol.actions.sso.callback.SAML20MultiPhaseSignInCallback179 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:745 CET] 000850a8 id= i.am.fim.fedmgr2.protocol.WebSealSignOutInfoDelegateProtocol < processRequest RETURN280 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:745 CET] 000850a8 id= com.tivoli.am.fim.fedmgr2.proper.FederationManager 3 doInitialRequestOnDelegate(DelegateProtocol, FederationManagerContextImpl, ProtocolActionChainImpl) Delegate returned true271 <47>Mar 22 11:15:19 ATP-00DSAM02 rt_trc_intern [3/22/18 11:15:14:745 CE Every event seems to start with 2 or 3 numbers a space a < 2 to 3 numbers and a > I have tried with the following props.conf: [isamlog_trace] DATETIME_CONFIG = NO_BINARY_CHECK = true TIME_PREFIX = category = Custom pulldown_type = 1 TIME_FORMAT = %b %d %H:%M:%S disabled = false BREAK_ONLY_BEFORE = LINE_BREAKER = ()\d+\s+<\d+> EVENT_BREAKER = But still I get the same result as above. Any help will be much appreciated. Kind regards las ... View more

Re: many splunkd.exe btool server list processes r...

by in Splunk Dev
‎08-29-2017 11:31 PM
‎08-29-2017 11:31 PM
I raised an issue with Splunk Support, and after some investigation we found that it was a corrupt DLL in windows that preventet Splunk from starting some processes. I am in the process of getting a new server, and move the installation to that. ... View more

Re: Can I get some fields from Splunk App for Stre...

by in All Apps and Add-ons
‎06-09-2017 03:20 PM
‎06-09-2017 03:20 PM
Hi mmodestino. Our primary browsers are IE 11, I have tried looking for plugins, but have so far been unsuccessful, so any hint in that direction would be great. Kind regards Lars ... View more

Re: Can I get some fields from Splunk App for Stre...

by in All Apps and Add-ons
‎06-09-2017 05:10 AM
‎06-09-2017 05:10 AM
Hi mmodestino. I do the monitoring on workstations, and do not have access to the servers. Kind regards Lars ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-22-2026 01:38 AM
Karma from
Karma given to