Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About halr9000
halr9000
Motivator
Member since:
12-09-2011
06-05-2020
Community Statistics
| Posts | 267 |
| Solutions | 34 |
| Karma Given | 266 |
| Karma Received | 142 |
| Member Since | 12-09-2011 |
Activity Feed
- Got Karma for Re: How to embed a Splunk dashboard in an iframe?. 10-28-2023 12:44 PM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 11-24-2020 04:03 PM
- Got Karma for Re: PowerShell sample for HTTP Event Collector. 10-19-2020 11:13 AM
- Got Karma for Re: PowerShell sample for HTTP Event Collector. 07-24-2020 10:34 AM
- Karma Sourcetypes with Docker and HTTP Event Collector for sloshburch. 06-05-2020 12:48 AM
- Karma Why is the Splunk Java SDK returning duplicate events compared to Splunk Web? for wlawrence_inter. 06-05-2020 12:48 AM
- Karma Is anyone using CI/CD to deploy Splunk apps? for mugurelmargarit. 06-05-2020 12:48 AM
- Karma How to fix Docker container JSON logs from not being formatted correctly? for 65pony. 06-05-2020 12:48 AM
- Karma Replace Netcool OMNIbus with Splunk? for larryleeroberts. 06-05-2020 12:48 AM
- Karma PowerShell sample for HTTP Event Collector for gmartins_splunk. 06-05-2020 12:48 AM
- Karma Splunk JS Stack not working from external web page. for friscos. 06-05-2020 12:48 AM
- Karma Powershell Input Log File "splunk-powershell.ps1.log" get's very large and never rolls for fairje. 06-05-2020 12:48 AM
- Karma How to embed a Splunk dashboard in an iframe? for vaibhavagg2006. 06-05-2020 12:48 AM
- Karma Where is the Splunk Forwarder older versions page? for Ant1D. 06-05-2020 12:48 AM
- Karma Re: Where is the Splunk Forwarder older versions page? for piebob. 06-05-2020 12:48 AM
- Karma Unable to get service analyzer ITSI VERSION 2 for naidusadanala. 06-05-2020 12:48 AM
- Karma Re: Why am I not getting introspection data for these indexers? for dwaddle. 06-05-2020 12:48 AM
- Karma Is there a Splunk Slack channel? for jplumsdaine22. 06-05-2020 12:48 AM
- Karma Re: Is there a Splunk Slack channel ? for ChrisG. 06-05-2020 12:48 AM
- Karma Parallel development in Splunk on the same app - use GIT for management and source control?? for yong_ly. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 5 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
11-06-2013
09:12 AM
Your script should inherit the environment from the parent process. Try enumerating $env:, it's a special variable that contains the env vars. you would access it like this:
$env:VarName
So, to get your windows install folder, that would be $env:windir. There are many docs and posts about this topic, here's one: http://technet.microsoft.com/en-us/library/ff730964.aspx
HTH, let us know
... View more
10-29-2013
07:35 AM
It's already parsed credentials by this point, so that file (credentials.csv) is ok
... View more
10-29-2013
07:34 AM
The scripts throws when trying to parse managers.csv. This isn't a file not found/can't read error, so it's not permissions or filename type of issue, it's the content of the file. Perhaps the header is missing or altered? The sample included with the app looks like this:
server,realm
server1,production
server2,development
... View more
10-29-2013
07:31 AM
None of the app dashboards are populating. When searching "index=_internal Collect.py", I see the following error:
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_CiscoUCS\bin\Collect.py", line 53, in <module>
managers = [m for m in DictReader(f) if fnmatch(m['server'], args.manager)]
KeyError: 'server'
Splunk version Splunk 6.0 (build 182037)
Platform Windows x64
Physical Memory (GB) 8.0
Number of CPU cores 8
$SPLUNK_HOME C:\Program Files\Splunk
(Asking this on behalf of a customer.)
... View more
10-28-2013
09:06 PM
Sorry for the horrible delay in answering, I thought I was following the tag, but apparently not.
Splunk ships with Python embedded within the product. Your options are to use that, or to install Python separately. I suggest the former route. The inputs.conf.WINDOWS file shipped with the app have the paths set correctly to work on Windows, and it has been tested.
The app is packaged as an .SPL file which is confusing. I'll be changing that to a tarball/zip for the next release. Regardless, the SPL file extension is actually a gzipped tar file, so on Windows it can be opened easily with 7-zip or your favorite archive software. However, if you install the app from the Splunk web UI, you'll find that the package is placed in $SPLUNK_HOME\etc\apps (e.g. c:\program files\splunk\etc\apps), under the SplunkAppForCiscoUCS. Under there in the appserver/addon folder, as documented in the README, you'll see other apps that you need to move down to etc\apps and configure accordingly.
... View more
10-25-2013
11:08 AM
1 Karma
You also definitely need the Splunk Addon for PowerShell. That will allow you to more easily get data from PowerShell into Splunk. For questions beyond that, you may want to create a new question with specific detail around what you are trying to do.
... View more
10-25-2013
10:48 AM
Check out this Splunk for ServiceNow app, which does provide the capability to create tickets based on a search results.
http://apps.splunk.com/app/1228/
... View more
10-18-2013
08:41 AM
thx @richardgalloway I've added that to the list
... View more
10-17-2013
08:23 PM
2 Karma
@richgalloway can you open a new question on that and include error messages? I'm collecting issues now and am opening an internal bug.
... View more
10-11-2013
12:23 PM
I strongly suspect it will work perfectly. Have not ran it through a test cycle yet. However, the reason that's not been done is because vNext is not too far away, and that one will definitely work with 6 (which is a hard requirement for us of course). Be sure to hit the "subscribe" button on http://apps.splunk.com/app/1293/ so that you are notified when the new app ships.
In the meantime, you could spin up a copy of Splunk 6 on your workstation, setup your existing v5 index server as a search peer, then install the v1 NetApp app on your new Splunk instance and see what happens. Should be a pretty short exercise.
Note that you will not need to actually configure the data gathering on your workstation, so disable any scripted inputs / file monitors. The act of performing a search e.g. "index=netapp" will ask all search peers, and get the data that way.
... View more
10-10-2013
09:42 AM
Congratulations! We chose this question to be answered live on the Splunktalk podcast!
... View more
10-10-2013
08:57 AM
1 Karma
BTW this question is being discussed on Episode 69 of Splunktalk, which we are recording this very instant.
... View more
10-10-2013
08:55 AM
1 Karma
We are testing this right now-ish. Watch the app listing for the SNMP modinput (and click the subscribe button) to be notified for new releases. I expect the "v6 compatible" box will be checked soon, but no promises on a date.
If you want to contribute to the code, the source is on github.
... View more
09-25-2013
04:38 PM
To answer your other question, just omit the equal sign. "-parameter $variable" will do. Make sense?
... View more
09-25-2013
08:50 AM
/sidenote: I know it's commented out, but you can't do "-Body = $aclinfo" like this. That would give a syntax error I think.
... View more
09-25-2013
08:23 AM
Just to be clear, can you give a sample value for what $uri is equal to when it fails?
... View more
09-20-2013
07:34 AM
1 Karma
am checking the "solved" box for this answer for you @froth. Don't forget to do that when your questions are answered, that greatly helps the visibility and quality of content on the site. Thanks!
... View more
09-11-2013
10:05 PM
What @sdaniels said, but if the only thing you are interested in are the actual system logs (and not performance or configuration data, which the app provides in addition), then you can certainly do syslog forwarding. On NetApp 7-mode, it works exactly like any unix, i.e. 'man syslogd.conf'. Here's a blog post with some instructions: http://networkadminkb.com/KB/a455/how-to-configure-a-netapp-fas-to-forward-syslog-messages.aspx
Cluster-mode is different. You would use the 'event' command while logged into a command shell. ONTAP 8.1 reference guide link [may require login to view]: https://library.netapp.com/ecmdocs/ECMP1120736/html/event/destination/modify.html
... View more
09-09-2013
11:10 AM
And be sure to check out the PowerShell add-on, it lets you paste a PowerShell script into inputs.conf if you want. http://apps.splunk.com/app/1477
... View more
09-09-2013
11:03 AM
As a workaround to the point that @pcjunkie made, you could get the data another way. I would play with the Get-WinEvent cmdlet, and the resulting Properties property. I think that's where the details go, but am not 100% certain.
PS C:\Users\hrottenberg> Get-WinEvent -LogName "Microsoft-Windows-TaskScheduler/Operational" -MaxEvents 1 | fl *
Message : Task Scheduler shutdown Task Engine
"S-1-5-21-1559891614-3024993685-3922480044-1000:LAB-WIN-SVR-1\hrottenberg:Interactive:LUA[1]"
process.
Id : 318
Version : 0
Qualifiers :
Level : 4
Task : 318
Opcode : 2
Keywords : -9223372036854775808
RecordId : 207793
ProviderName : Microsoft-Windows-TaskScheduler
ProviderId : de7b24ea-73c8-4a09-985d-5bdadcfa9017
LogName : Microsoft-Windows-TaskScheduler/Operational
ProcessId : 880
ThreadId : 2708
MachineName : lab-win-svr-1.bd.splunk.com
UserId : S-1-5-18
TimeCreated : 9/9/2013 1:49:01 PM
ActivityId :
RelatedActivityId :
ContainerLog : microsoft-windows-taskscheduler/operational
MatchedQueryIds : {}
Bookmark : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName : Information
OpcodeDisplayName : Stop
TaskDisplayName : Task engine properly shut down
KeywordsDisplayNames : {}
Properties : {System.Diagnostics.Eventing.Reader.EventProperty}
PS C:\Users\hrottenberg> Get-WinEvent -LogName "Microsoft-Windows-TaskScheduler/Operational" -MaxEvents 1 | select -ExpandProperty properties
Value
-----
S-1-5-21-1559891614-3024993685-3922480044-1000:LAB-WIN-SVR-1\hrottenberg:Interactive:LUA[1]
... View more
08-28-2013
07:48 AM
I'm editing the question and putting @chadfermanxto 's answer here so that the question appears as answered.
"After digging ito this and running each piece in verbose mode I found that it was looking for 2 libraries that on RHEL 6.4 are named weird. There are:
libssl.so.0.9.8e
libcrypto.so.0.9.8e
I created sylinks to these files and errors went away. "
... View more
08-16-2013
12:45 PM
Am definitely a fan of thinking of Splunk as a platform, not a point solution, and the SNMP suggestion fits right in to that theme! I have played a little bit with the SNMP modinput so far and am planning to use it in another storage-related project of mine. Use what works.
And don't be surprised if the next version of the NetApp app contains volume utilization. 🙂
... View more
08-15-2013
10:57 AM
@vchepkov if you don't mind, submit that as a new question tagged "Splunk App for NetApp ONTAP", please.
... View more
08-15-2013
09:25 AM
Jack, totally doable. I'm in the API (using Zedi zexplore.jar) and if we query the API method "volume-list-info", it returns volume objects with all sorts of utilization properties.
In other words, it's not in the perf class.
... View more
08-07-2013
08:18 AM
Hi, can you update your question to include actual error messages? What steps did you follow during installation so far, etc.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
