@sarithapguptha by backend you mean the splunk UI at http(s)://splunk:8000? do you see 502 errors in internals logs? index=_internal status=502 ... View more

@priyadarshan123 where you run curl command (windows, linux, interactive or within a script?)? do you get an insecure error message? where are the "own self signed certificates"? - on the splunk side or on the client side? ... View more

Hello @jasonwagner can you verifiy the local time on both severs? additionally check for time drift in the syslog/messages/journal of the particular server: index=_internal host=serverB ntp* OR adjust ... View more

Hello @kmueller68 most relevant log line is CarrierError: recvfrom() failed: [Errno 10035] A non-blocking socket operation could not be completed immediately there are many possible solutions/suggestions - google for "python Errno 10035". Will it work if you increase the snmpinterval ? ... View more

Hello @cosmo0630, depending on how VPN is configured, only internal or all/any traffic can be send to HQ. If any traffic is being sent to HQ then most probably the internal firewall doesn't allow an access from HQ to the external mail server. To find something in logs try index=_* (ERROR OR WARN) (mail OR SMTP) ... View more

Hello @jjofret, something like this: | makeresults count=7 | streamstats count | eval Entorno = if((count % 2)=1, "test", "production") | eval "tipo de red" = if((random() % 2)=1, "dmz", "lan") | eval "FW" = if((random() % 2)=1, "yes", "no") | fields - _time count | stats list("tipo de red"), list("FW") by Entorno ... View more

Hello @anubhp in transforms.conf [extract_last_field] REGEX =\s([^ =]+)="+([^="]*)"+\s*$ FORMAT = $1::$2 in props.conf [mysourcetype] REPORT-extract_last_field = extract_last_field what does it do? The regex extracts the last field with the value separated by the equal sign just before the end of the line. check it here: https://regex101.com/r/d3dv5l/1 ... View more

Hello @vadimm what is a problem you facing with? Do you need to debug the HEC input configuration or data itself? To see incoming JSON on the wire or before, during and after splunk processing? to see JSON transmitted on the wire use tcpdump for HTTP input, some MitM Proxy for HTTPS input. Much easier if you can access the sending client. Describe the situation with more than two sentences. ... View more

Hello @sethion, the log is in key=value format and is being automatically parsed by splunk without need to specifiy a format of the log. The order of the fields should not be a problem. All you need is to filter internal domain in the referenced_host field, right? If not, then provide more info please ... View more

Hello @kiddsupreme https://github.com/sghaskell/maps-plus/blob/master/README.md API Key Storage API keys for use with Google Places search, Bing Maps and the Google Streetview comapnion viz must be stored in Splunk's storage/passwords REST endpoint. Every user who needs access to a key must have the list_storage_passwords capability enabled for their role. Set ACL's on credentials to narrow the scope of who can access them. Download and install my REST storage/passwords Manager for Splunk to make this process painless. https://docs.splunk.com/Documentation/Splunk/8.0.3/RESTREF/RESTaccess#storage.2Fpasswords https://splunkbase.splunk.com/app/4013/ REST storage/passwords Manager for Splunk ... View more

Hello @eduardKiyko, your observation is correct, the appinspect checks action.mail.to only and ignores action.mail.cc @splunk_appinspect.tags("splunk_appinspect", "savedsearches") @splunk_appinspect.cert_version(min="1.1.8") def check_for_emails_in_saved_search(app, reporter): """Check that email alerts (action.email.to) set in `savedsearches.conf` do not have a default value. """ saved_searches = app.get_saved_searches() if saved_searches.configuration_file_exists(): file_path = os.path.join("default", "savedsearches.conf") for search in saved_searches.searches(): for key, value in iteritems(search.args): if key == "action.email.to": reporter_output = ( "The saved search {} has specified the" " `action.email.to` property with a" " provided value. This should be left" " empty or removed. File: {}, Line: {}." ).format(search.name, file_path, value[1]) if value: reporter.fail(reporter_output, file_path, value[1]) else: reporter_output = "No savedsearches.conf exists." reporter.not_applicable(reporter_output) you can remove action.mail.to to pass the appinspect and find a way to use it in local/savesearches.conf ... View more

Hello @surekhasplunk this is a confirmed cisco issue ( https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc32906 ) and according to source ( https://github.com/datacenter/acitoolkit/blob/master/acitoolkit/acisession.py ) the script does a fallback to getting the info in pieces. Can you check if the info is complete or is missing? As it looks it should not be categorized as an error but as warning/notice/informational message. elif resp.status_code == 400 and 'Unable to process the query, result dataset is too big' in resp.text: # Response is too big so we will need to get the response in pages # Get the first chunk of entries log.error('Response too big. Need to collect it in pages. Starting collection...') page_number = 0 log.debug('Getting first page') cookies = self._prep_x509_header('GET', url + '&page=%s&page-size=10000' % page_number) resp = self.session.get(get_url + '&page=%s&page-size=10000' % page_number, timeout=timeout, verify=self.verify_ssl, proxies=self._proxies, cookies=cookies) entries = [] if resp.ok: entries += resp.json()['imdata'] orig_total_count = int(resp.json()['totalCount']) total_count = orig_total_count - 10000 while total_count > 0 and resp.ok: page_number += 1 log.debug('Getting page %s', page_number) # Get the next chunk cookies = self._prep_x509_header('GET', url + '&page=%s&page-size=10000' % page_number) resp = self.session.get(get_url + '&page=%s&page-size=10000' % page_number, timeout=timeout, verify=self.verify_ssl, proxies=self._proxies, cookies=cookies) if resp.ok: entries += resp.json()['imdata'] total_count -= 10000 resp_content = {'imdata': entries, 'totalCount': orig_total_count} resp._content = json.dumps(resp_content).encode('ascii') ... View more

@Manoshanni if this one of the major web servers than there is an add-on for it, which does the parsing of all/most fields for you: https://splunkbase.splunk.com/app/3186/ Apache / httpd https://splunkbase.splunk.com/app/3258/ nginx etc ... View more

Hello @Manoshanni this regex is not correct, you can test it here: https://regex101.com/ Post few raw events here so somebody can help you to build a correct regex. Regexes created using field extraction tool are usually not very practical. ... View more

Hello @sarithapguptha , 502 Bad Gateway error is usually generated by a proxy/gateway/loadbalancer between your browser and the backend splunk server. Please describe your setup. Can you reach the backend directly, bypassing the proxy? ... View more

Hello @priyadarshan123 use --cacert to point curl to the ca cert file curl --cacert cert.pem https://cloud.address xxxxxx ... View more

Hello @umairahmad3985 I think the proper way to build a modular input add-on manually without using the builder app, this requires more work ... View more

@sreesh for inline regex use | rex field=source "^[^\-]+\/(?<Repo>[^\/\-]+\-[^\/\-]+\-?[^\/\-]*)\/" ... View more

Hello @ansif you cannot use parameters in the script stanza. Insted you should use .path format, which is more flexible: [script://<cmd>] * Runs <cmd> at a configured interval (see below) and indexes the output that <cmd> returns. * The <cmd> must reside in one of the following directories: * $SPLUNK_HOME/etc/system/bin/ * $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/ * $SPLUNK_HOME/bin/scripts/ * The path to <cmd> can be an absolute path, make use of an environment variable such as $SPLUNK_HOME, or use the special pattern of an initial '.' as the first directory to indicate a location inside the current app. * The '.' specification must be followed by a platform-specific directory separator. * For example, on UNIX: [script://./bin/my_script.sh] Or on Windows: [script://.\bin\my_program.exe] This '.' pattern is strongly recommended for app developers, and necessary for operation in search head pooling environments. * <cmd> can also be a path to a file that ends with a ".path" suffix. A file with this suffix is a special type of pointer file that points to a command to be run. Although the pointer file is bound by the same location restrictions mentioned above, the command referenced inside it can reside anywhere on the file system. The .path file must contain exactly one line: the path to the command to run, optionally followed by command-line arguments. The file can contain additional empty lines and lines that begin with ''. The input ignores these lines. ... View more

Hello @umairahmad3985 Add-on Builder is supported by splunk, so I've added a "Splunk Add-on Builder" tag to your question to get splunk's attention. I hope somebody will check this post and help. Without seeing your files it is difficult to say why you get this issue ... View more