Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About anthonymelita
anthonymelita
Contributor
Member since:
05-30-2017
01-11-2022
Community Statistics
| Posts | 76 |
| Solutions | 8 |
| Karma Given | 17 |
| Karma Received | 13 |
| Member Since | 05-30-2017 |
Activity Feed
- Got Karma for Re: Alert doesn't run each minute. 05-18-2021 08:55 PM
- Posted Re: Alert doesn't run each minute on Alerting. 05-18-2021 04:01 PM
- Got Karma for Re: | rest /services/cluster/master/peers. 04-23-2021 05:18 PM
- Posted Splunk Add-on for MySQL false description on All Apps and Add-ons. 09-16-2020 10:11 AM
- Posted Re: Convert to HTML not working when setting and unsetting tokens through drilldown on Dashboards & Visualizations. 09-14-2020 03:48 PM
- Posted Re: Convert to HTML not working when setting and unsetting tokens through drilldown on Dashboards & Visualizations. 09-11-2020 12:54 PM
- Karma Re: Display only the top 5 values in count column for ITWhisperer. 09-09-2020 09:05 AM
- Got Karma for Re: Display only the top 5 values in count column. 09-09-2020 04:38 AM
- Posted Re: Display only the top 5 values in count column on Splunk Search. 09-08-2020 05:55 PM
- Posted Re: TA-webtools - CURL command error - schema not specified on All Apps and Add-ons. 07-24-2020 05:50 PM
- Got Karma for Re: Why doesn't CSS work in dashboards?. 07-09-2020 03:09 PM
- Posted Re: How to forward entire .txt file in splunk from batch file on Getting Data In. 07-02-2020 01:01 PM
- Posted Re: Choosing "settings" - "indexer clustering" takes me to "Clustering: Sea on Deployment Architecture. 06-10-2020 05:52 PM
- Karma Re: What will happen with my license during the upgrade from version 7.0.3 to 7.3? for richgalloway. 06-05-2020 12:51 AM
- Karma Re: How do I get Solarwinds data into Splunk with Syslog? for Richfez. 06-05-2020 12:51 AM
- Got Karma for Re: With no .conf this year, how am I supposed to update my t-shirt collection?. 06-05-2020 12:51 AM
- Karma Re: How to field extract one or more times to the same field? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: 誤って追加してしまったデータの削除方法 for jacobpevans. 06-05-2020 12:50 AM
- Karma Re: Default Credentials on Splunk Trial License for codebuilder. 06-05-2020 12:50 AM
- Karma Re: how do you comment in splunk? for HattrickNZ. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
02-17-2020
05:19 PM
In my experience Splunk attempts to auto-extract json objects to fields and frequently fails. Try adding an |spath command as your first pipe after basic search criteria like index, source, etc...
... View more
12-19-2019
05:04 PM
+1 to what adonio said. Your Account Manager can help you with a maturity assessment at no cost.
... View more
12-13-2019
02:08 PM
2 Karma
I'm just discovering the same issue today an found in the release notes that Splunk broke CSS in 7.3.3. This also breaks in-line CSS which I have yet to figure out how to fix.
Uncategorized issues
Date filed Issue number Description
2019-12-03 SPL-180371, SPL-175319 CSS outside of <html> tag in SimpleXML doesn't work
Workaround:
Add <style> tag inside of <html> tag, with <p /> in front of the style tag:
<dashboard>
<label>built-in css</label>
<row>
<panel>
<html>
<p/>
<style>#text {background: red;}</style>
<div id="text">text with red background</div>
</html>
</panel>
</row>
</dashboard>
... View more
10-30-2019
02:35 PM
I'm not sure if it will get you what you need, but you can wrap an eval inside of a stats function.
count(eval(team=$team$ AND project=*))
... View more
10-23-2019
09:10 AM
You can also use the split() eval command.
| makeresults
| eval sample="4 12 22 87 2"
| eval sample=split(sample, " ")
| mvexpand sample
... View more
10-21-2019
05:59 PM
You need to provide an example of what the returned event data looks like. With an accurately formatted example, someone can assist you with regex. Or if you already know regex, look up documentation for the "| rex" command. Generic example would be like:
| rex field=_raw "(something\sbefore)(?<shipping point>\d{4})"
... View more
10-21-2019
05:53 PM
The installer attempts to stop the service.
... View more
10-21-2019
05:46 PM
You should probably provide an example with delimiters, but you can do this with regex if nothing else.
... View more
10-18-2019
03:27 PM
In python you can use the "requests" package. Basic example:
import requests
r = response.get('https://myurl.com/health')
print(r.content)
In powershell you can use Invoke-WebRequest
$r = Invoke-WebRequest https://myurl.com/health
echo $r.Content
... View more
10-16-2019
05:37 PM
1 Karma
The rest endpoint you're hitting there is for indexer clustering and will only work on an indexer cluster master. If you are trying to get the status of all distributed search peers then use |rest /services/search/distributed/peers/
Also if you want to avoid errors from downstream search peers, then you should specify the splunk_server=
For the case of getting indexer cluster peers you would do like
|rest /services/cluster/master/peers splunk_server=ClusterMasterNameGoesHere and then it won't try to distribute the rest command to all search peers, and avoid them throwing errors.
... View more
10-11-2019
04:30 PM
Did you make sure the files have the same permissions? For example owned by the splunk user.
... View more
10-07-2019
05:33 PM
I don't see this as being possible, or why Splunk would allow it. Your diag gets attached to a case, for the purpose of troubleshooting the issue that case.
... View more
10-03-2019
05:35 PM
To delete data in the method described, the user requires the can_delete role.
説明した方法でデータを削除するには、ユーザーにcan_deleteロールが必要です。
... View more
10-03-2019
05:19 PM
Follow Step 5 above. Contact Splunk Support and tell them you need a reset license to clear violation.
... View more
09-19-2019
04:36 PM
Trying to setup Splunk Add-on for Java Management Extensions.
Added a server, connection is successful
Created an input with that server with default interval
nothing else happens, no data
I ran tcpdump for a good 30 minutes, starting right before adding the server. It captured the packets of the initial server connection during the add process. After setting up the input (with default 60 second interval) I never saw additional traffic, and no data is generated/ingested.
Also ta_jmx_task_monitor.log is empty.
There is literally nothing to go off of in the logs, even while set to DEBUG. Just the constant flow of
"Total JMX Account retrieved :: 0" OR "stanza count:0" OR "Retrieving log level with NS" OR "Log level update"
... View more
08-23-2019
04:59 PM
It does not prevent the forwarder from sending data or indexers from receiving it. It only prevents the forwarder from downloading apps assigned to the serverclass. If all of your forwarder inputs are configured through deployment apps, then you basically accomplish that; but it would still be possible for someone to manually configure the forwarder to send data and bypass the deployment server.
... View more
06-21-2019
04:06 PM
Sounds like you're trying to do index time extraction with transforms. You may want to include your actual stanza to get the best advice. I'm not sure but you might need quotations around the captures, "$1" and "$2".
... View more
05-30-2019
05:32 PM
In Splunk because you only really care about the named extracted field, you don't need to worry about the non-capture groups. Just move the bracket outside the extraction:
(Source\sid:|Source\sNumber:)(\sMeter\s|\s)(<*)(?\d+)
I had to change the d(star) to d+ because it's interpreting as italics
... View more
05-01-2019
10:12 AM
You may want to add other characters like - and _ to the regex. This is primitive and just catching the word and . characters on either side of the @ and assumes your url is delimited with other special chars like = from your examples
| makeresults
| eval foo="macplatform.wondershare.com/interface.php?m=co&client_sign={CD1AABB2-586E-55A5-A891-877563550973}∏uct_id=735&version=10.3.2&[email protected]⟨=en_us&type=0&cc=92445606E83D64D283AD3A5EF2A9869E∫erface_version=1.1
link.defensenews.com/manage/5ba/[email protected]
www2.criver.com/form/checkEmailAjax/account_id/60962/form_field_id/129003/tracker_id/278458707/field_id/[email protected]
login.yahoo.com/account/comm-channel/refresh?display=login&.intl=us∫l=us&.lang=en-US&src=finance&.src=finance&[email protected]&tn=arinfo_review&context=spreg_cc&.
www.borisfx.com/BCCAVXActivation.php?UPID=MCHITNB-ADRELHQ-OSJZBFU-VYIQAAM&[email protected]&firstname=Ron&lastname=nobody∁anyname www.idevmail.net/unsubscribe.aspx?d=94&m=1319&[email protected]";
| makemv foo delim=" "
| mvexpand foo
| rex field=foo "(?<email>[\w\.]+@[\w\.]+)"
| table foo email
... View more
03-29-2019
03:36 PM
You have that in the $SPLUNK_HOME/etcsystem/local, but if you chose to index IIS logs during the MSI install process then it will probably be in a different app under $SPLUNK_HOME/etc/apps
... View more
03-29-2019
03:29 PM
You have several things wrong. Note: I'm also a RegEx novice.
Replace spaces with \s
You didn't name an extracted field <>
If the extracted word will always be between "upon" and "Notification" you can shorten the rest.
| makeresults
| eval sentence="info [native] Creating Memory Dump upon ResourceExhausted Notification: unable to create new native thread"
| rex field=sentence "(upon\s)(?<extracted_thing>\w+)(\sNotification)"
... View more
03-25-2019
05:58 PM
Both of the options you mention for creating Data Inputs are mechanisms for generating an "inputs.conf" file/entry. This is what tells the splunkd process to read a file. So what you have done with creating the TCP listener for 9997 is the correct portion of Receiving data. It's telling your Splunk Enterprise instance that remote forwarders will send data over that channel.
Have a read through the documentation for a better understanding. Splunk® Enterprise
Getting Data In
... View more
03-25-2019
05:38 PM
Interested to see what the answer ends up being. I'm having a very similar but larger issue. I tried granting extra permissions and even mapping a new group to a new role and the users seem to be stuck with only their original limited access. One of the users I deleted their profile folder from $SPLUNK_HOME/etc/users and it was re-created the next time they logged in, but they did not appear in the Users list (through UI or |rest search) nor did their role get updated.
In my case it's on a search head cluster.
... View more
02-19-2019
05:31 PM
It sounds like you're seeing standard HTML URL encoding. For example %20 replaces a [space] character
www.w3schools.com/tags/ref_urlencode.asp
This is expected behavior and your urls may not even work if not for the encoding. For example type https://www.splunk.com/dog cat into your browser bar. It will automatically encode as https://www.splunk.com/dog%20cat
... View more
12-20-2018
05:57 PM
I've seen similar behavior where in a normal search Splunk is auto-extracting the field name. However when you try to specify the field in the search it seems to happen before the auto-extraction and therefore you get no events because the field doesn't exist and you are requiring it by the search command. You may need to configure a field extraction in that case.
The part about positioning the wildcard is odd and I have not suggestion based on that.
... View more
