Hi All, We starting new Splunk implementation in our company, I wanted to understand that what is advantages/disadvantage and cost comparison when we running Splunk in virtual machines and AWS instances for the below requirement. If you could share your details, that would be great. Since its new setup for me please help me with comparison of both environments. Requirements: We have few applications logs, windows/linux logs, etc approximately indexing 100 GB/Day. Thanks! ... View more

Hi, I have configured Splunk DB Connect input in version 3.1.1 both batch and raising column. But none of them are collecting data/importing data from Oracle connection. While configuring am not getting any errors and am able configure data input without any issues. But still am not getting the data in Splunk. All I get is below message in Splunk internal log for the same connection & input. Could you please help me find issue? 2017-08-31 09:08:50.764 +0000 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=Corp_Prod_DB jdbc_url=jdbc:oracle:thin:@x.x.x.x:1521:prddb status=FAILED input_name=FSA_CERT batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2017-08-31_09:08:33 end_time=2017-08-31_09:08:50 duration=16986 read_count=0 write_count=0 filtered_count=0 error_count=0 2017-08-31 09:08:43.700 +0000 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=Corp_Prod_DB jdbc_url=jdbc:oracle:thin:@x.x.x.x:1521:prddb status=FAILED input_name=FSA_Certification batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2017-08-31_09:08:33 end_time=2017-08-31_09:08:43 duration=9908 read_count=0 write_count=0 filtered_count=0 error_count=0 ... View more

Hi All, Am using Website Monitoring app to monitoring our internal URL's and it was working from day one, as expected. Since from last two days dashboard was looking empty and when check the logs i found below error. Not sure why it is stopped working all of sudden even i haven't changed any settings. Could you please help me to find the resolutions on this issue? ~~~~~~~~~~~~~~~~~~~~~~~ Error log: 2017-07-13 12:36:35,576 ERROR Execution failed Traceback (most recent call last): File "/data/splunk/etc/apps/website_monitoring/bin/modular_input.py", line 1277, in execute self.do_run(in_stream, log_exception_and_continue=True) File "/data/splunk/etc/apps/website_monitoring/bin/modular_input.py", line 1177, in do_run input_config) File "/data/splunk/etc/apps/website_monitoring/bin/web_ping.py", line 468, in run result = WebPing.ping(url, username, password, timeout, proxy_type, proxy_server, proxy_port, proxy_user, proxy_password, client_certificate, client_certificate_key, user_agent, logger=self.logger) File "/data/splunk/etc/apps/website_monitoring/bin/web_ping.py", line 285, in ping auth_type = cls.determine_auth_type(url, proxies=proxies, timeout=timeout, cert=cert, logger=logger) File "/data/splunk/etc/apps/website_monitoring/bin/web_ping.py", line 143, in determine_auth_type http = requests.get(url.geturl(), proxies=proxies, timeout=timeout, cert=cert, verify=False) File "/data/splunk/etc/apps/website_monitoring/bin/website_monitoring_app/requests/api.py", line 65, in get return request('get', url, **kwargs) File "/data/splunk/etc/apps/website_monitoring/bin/website_monitoring_app/requests/api.py", line 49, in request response = session.request(method=method, url=url, **kwargs) File "/data/splunk/etc/apps/website_monitoring/bin/website_monitoring_app/requests/sessions.py", line 461, in request resp = self.send(prep, **send_kwargs) File "/data/splunk/etc/apps/website_monitoring/bin/website_monitoring_app/requests/sessions.py", line 573, in send r = adapter.send(request, **kwargs) File "/data/splunk/etc/apps/website_monitoring/bin/website_monitoring_app/requests/adapters.py", line 415, in send raise ConnectionError(err, request=request) ConnectionError: ('Connection aborted.', gaierror(-3, 'Temporary failure in name resolution')) Thanks! Pavan ... View more

Hi All, Am trying to connect one of ldap server using TA-LDAP app but for some reason am getting this error while running ldap searches |ldap basedn="dc=stg,dc=org" ldap_filter="(ou=SelfRegUser)" and |ldap basedn="ou=SelfRegUser,dc=stg,dc=org" ldap_filter="(ou=SelfRegUser)" Error while executing search command: "External search command 'ldap' returned error code 1." And also tried enabling debug logs and got below error, but i am not sure what this error means Error after enabled debug log: "ERROR myldap:211 - ERROR: unable to get default options from ldap.conf" ldap.conf: [STGLDAP] server = xx.xx.xx.xx port = xxxx usessl = 0 binddn = ou=stgldap,dc=stg,dc=org basedn = dc=stg,dc=org password = UGFzc3dvcmQxMjM= ldap_filter = (ou=SelfRegUser) ... View more

Hi All, Am trying to calculate difference between starttime and endtime for tasksession, both start and end time are in single event like TASKNAME CREATED_TIME LAST_ACCESS_TIME, but using two different query unable to get the expected result 1st query difference is null and second query difference is all 00:00. Not sure where is missing. Could you please help me on getting correct difference values. 1st Query : Result is NULL search | eval StartTime=strftime(strptime(CREATED_TIME, "%Y-%m-%d %H:%M:%S"),"%Y/%m/%d %H:%M:%S") | eval EndTime=strftime(strptime(LAST_ACCESS_TIME, "%Y-%m-%d %H:%M:%S"),"%Y/%m/%d %H:%M:%S") | eval Diff=tostring(EndTime-StartTime,"duration") | table TASKNAME StartTime EndTime Diff Output: TASKNAME NAME StartTime EndTime Diff Registration 2016/11/24 16:08:55 2016/11/24 16:08:58 (NULL) 2nd Query : Result is 00:00 index=cfa_prod_ca_idm_db source=cfa_idm_all_tasks sourcetype=cfa_idm_tasks STATE=128 | dedup TASKSESSIONID | eval StartTime=strftime(strptime(CREATED_TIME, "%Y-%m-%d %H:%M:%S"),"%Y/%m/%d %H:%M:%S") | eval EndTime=strftime(strptime(LAST_ACCESS_TIME, "%Y-%m-%d %H:%M:%S"),"%Y/%m/%d %H:%M:%S") | transaction TASKNAME maxevents=1 | eval Duration=strftime(duration,"%M:%S") | table TASKNAME StartTime EndTime Duration Output: TASKNAME StartTime EndTime Duration Registration 2016/11/24 16:08:55 2016/11/24 16:08:58 00:00 Expected Duration : 00:03 but showing 00:00 Thanks! Pavan ... View more

Hi All, Have a requirement like need to collect AWS LB logs into splunk enterprise to analyse access related stuff and some error via LB logs. So I wanted to know is there a way to collect logs from AWS LB, which is just URL. Please help me with this task. Thanks! ... View more

Hi Team, I have created db input after creation for the first time it gets the data from db, but it doesn't get the updated entries. When go and check the input status will be enabled and its not disabling as well. But still there no updated entries coming in splunk. Splunk Version = Splunk 6.4.1 DB Connect app version = 2.2.0 Below is my db inputs.conf, let me know what need to be changed for getting updated rows from the database. [mi_input://MYINPUT] connection = MYDB index = MYINDEX interval = 600 max_rows = 10000 mode = tail output_timestamp_format = yyyy-MM-dd HH:mm:ss query = SELECT * FROM TASKSESSION12_5 where state=128 source = MYSOURCE sourcetype = MYSOURCETYPE tail_follow_only = 1 tail_rising_column_name = TASKSESSIONID ui_query_catalog = NULL ui_query_mode = advanced tail_rising_column_checkpoint_value = fffce111-ebe6434d-340cb67f-1128 Thanks! Pavan ... View more

Hi All, I was looking for website monitoring found this app https://splunkbase.splunk.com/app/1493/ . After installation initial setup was done, since I didn't have any proxy, just saved as it is. After that I did configure an input for Website Monitoring, but started getting the error below. Not sure how to fix it since I am a newbie for this app. Please help me withthis issue. 2016-07-07 04:53:04,388 ERROR Unable to determine authentication type Traceback (most recent call last): File "/data/splunk/etc/apps/website_monitoring/bin/web_ping.py", line 147, in determine_auth_type auth_header = http.headers['WWW-Authenticate'] File "/data/splunk/etc/apps/website_monitoring/bin/website_monitoring_app/requests/structures.py", line 54, in __getitem__ return self._store[key.lower()][1] KeyError: 'www-authenticate' Thanks! Pavan ... View more

Hi All, Am trying to join multiple searches for authentication failures from UserType (i.e, Windows User, Linux User, DATABASE User) which are there in the lookup file which contains user name and usertype. I would like to create chart for authfailure based on usertype. From the search below, I am getting a result count by usertype which is count of usertype present in the lookup file. But, it's not giving me the result of the user authentication failure count. Could you please help me with the search on how to get the user authentication failure counts only for the lookup file user with usertype? |inputlookup usertype.csv| join type=outer user [search index="wineventlog" source="wineventlog:security" EventCode="4625" |stats count by user] | append [search index=os source=*sshd.log OR source=*secure* | rex "sshd\W\d+\W:\s(?\w+)\s\w+\s\w+\s(?\w+)\s\w+\s(?\d+.\d+.\d+.\d+)"| stats count by user] | append [search index="dba" source=*dba ACTION_NAME="AuthFail" | rename USERNAME as user |stats count by user ]| chart count by UserType This search output is > result is no of user per usertype which is wrong UserType count DATABASE 9 Linux 1 Windows 3 Need output like actual authfailure count ... View more