Hi @buschd, I am using SA-ldapsearch 2.1.4, still I am still getting the same error from my Indexer where I have installed the add-on. I thought about going for 2nd solution (modifying commands.conf) but it says, it might degrade search performance. ... View more

I am collecting directly into Splunk HF. Yes, only this particular type of event is coming out of order. ... View more

Hi @xavierashe, please find below sample, It should appear as one event but it is being split into two and since "Requested target not found" line does not have host ip, it is going to wrong sourcetype. Requested target not found. Oct 24 00:00:32 x.x.x.x 80000:20000:MgmtExec:20-Oct-2017 07:14:06.083084:targetAttr.cc:593:ERROR::7.4.3:iSCSI login to target 'x.x.x.x:3000, fqn.2001-05.com.equallogic:4-42a846-545b0c93bdf59ed0-test-dr' from initiator 'x.x.x.x:40000, fqn.1998-01.com:nel-esx1-326532g1' failed for the following reason: ... View more

Finally found the solution to that problem. Solution was to "edit search" option of each panel, select"use time picker" from the time range option then select preferred duration e.g "last 24 hours". I noticed that doing this stopped the Search to re-run and get stuck in the middle. ... View more

This command works for dashboards that dont require any user input. How can we use the above to command to export a dashboard that requires user inputs ? I tried the curl command to export the Splunk for PaloAlto Networks app's main dashboard and it worked. However, when I tried the same command with additional parameters for Cisco app's dashboard, it just generated an unreadable1kb pdf file. Example below, curl -u admin:{password} -k "https://localhost:8089/services/pdfgen/render?input-dashboard=CiscoNetworksOverview&namespace=cisco_ios&paper-size=a4-landscape&earliest=-24h%40h⪭st=now&form.product_selection=WLC" >> C:\Users\admin\Downloads\test.pdf Any workaround for this please? ... View more

This command works for dashboards that dont require any user input. How can we use the above to command to export a dashboard that requires user inputs ? I tried the above command to export the Splunk for PaloAlto Networks app's main dashboard and it worked. However, when I tried the same command with additional parameters for Cisco app's dashboard, it just generated an unreadable1kb pdf file. Example below, curl -u admin:{password} -k "https://localhost:8089/services/pdfgen/render?input-dashboard=CiscoNetworksOverview&namespace=cisco_ios&paper-size=a4-landscape&earliest=-24h%40h&latest=now&form.product_selection=WLC" >> C:\Users\admin\Downloads\test.pdf Any workaround for this please? ... View more

Hi MuS, Thanks for sharing the links. ... View more

Hi @MuS, Whats the Windows equivalent of the above curl command ? Thanks ... View more

It has around 1,735,037 events. I forgot to mention that the above condition occurs after it has already ran its first search and populated the dashboard. This is the link to that image. https://ibb.co/gw6zRR ... View more

Hi @cmerriman, Although I have been able to re-create the dashboard with the same data without the user input option, however, The search still seems to be going with the blue progress bar at the top of any panel stuck in the middle. When I hover mouse over it, it says "0.0% of the time range scanned". how can I solve this ? I have already checked the html code of default page with customised one, the only difference between them is $earliest$ , $latest$ and $product_selection$ is replaced by -24h@h, now and WLC ... View more

@cmerriman, Thanks! This worked quite well. ... View more

Hi @deepak_negi02, were you able to make this finally work ? I am facing this same issue. I have configured port 1515 udp on Splunk for esx syslog using the above method. ... View more

Hi @landen99, Thanks for your input. considering 1st option, would the inputs.conf be in \etc\system\local and look like below ? [udp://X.X.X.X:514] index = main sourcetype = equal_log disabled = 0 in above case, would specifying all 47 IPs work ? I cant use wildcards because the IP range is very discontiguous in nature. Would the 2nd option look something like this ? transform.conf [set_sourcetype_equal_log_for_Equallogic_hosts] REGEX = 199.299.129.19\d|199.169.205.\d\d\d|199.165.200.22|20.90.90.\d SOURCE_KEY = MetaData:Host FORMAT = sourcetype::equal_log DEST_KEY = MetaData:Sourcetype I am not sure how the 3rd option is implemented. Can you please provide an example ? ... View more

So I created a regex and successfully tested it on regex101.com. Regex = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(x.x.x.2\d|x.x.x.1\d)[\w.-]]?\s I used the above regex, and raw logs from Splunk. However, I noticed 2 main things that there were some logs that that had no host IP in it and Splunk split the same event into two. Example: 10/19/17 12:36:05.000 PM Oct 19 12:36:04 x.x.x.x 344237:342551:MgmtExec:19-Oct-2017 12:36:02.821184:targetAttr.cc:582:ERROR::7.4.3:iSCSI login to target 'x.x.x.x:3260, abc.2000-05.com.equallogic:8-jhduyc76-cjdbhc-jhd6hjs-dj78-iscsi-raid50-datastore8' from initiator 'x.x.x.x:49171, aaa.1000-05.com.microsoft:abc-netvault.mail.com' failed for the following reason: 10/19/17 Requested target not found. 12:36:05.000 PM ... View more

Hi @snehalk, I am looking for ways to parse data solely based on the host IP. I had created a regex to extract host IP, but I realised not all of the logs contain the host IP. Hence, I was looking for more ways to parse data. Can you please advise what exact steps did you to take to achieve this solution ? ... View more

I am facing this same issue. Were you able to resolve it ? ... View more

I tested it, it started parsing even the cisco:ios logs into equal_log sourcetype, which I guess, is due to including the default syslog-host transforms. ... View more

Hi @sowings, did you mean the below way ? [set_sourcetype_syslog_for_Equallogic_hosts] REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(host1|host2|host3|host4|host5|host6)[\w.-]]?\s FORMAT = sourcetype::equal_log DEST_KEY = MetaData:Sourcetype [source::udp:514] TRANSFORMS-changesourcetype = set_sourcetype_equal_log_for_Equallogic_hosts TRANSFORMS-changesourcetype = syslog-host ... View more

Hi @agarrison, I cannot set a new udp port as Equallogic has no provision to specify a particular port. It sends on 514 by default. No other option than sourctype overriding. I tried your regex but it parsed unexpected event as well. Example below, Oct 20 06:53:26 x.x.x.x 59368:8696:agent:20-Oct-2017 06:53:25.653704:agent.c:1866:AUDIT:Unknown:22.7.1:SNMP packet validation failed, request received from x.x.x.x Oct 20 06:00:37 x.x.x.x 2130:127:VolExec:20-Oct-2017 06:00:36.190088:VE_VolSetWorker.hh:151:WARNING::43.3.5:Volume MAIL has used 1 percent of its local replication reserve. If the in-use space exceeds the local replication reserve (set to 5 percent of the volume reserve), the group will cancel any in-progress replication for the volume. ... View more

Hi @Iguinn, Is the 2nd option better than 1st ? and why so ? I am curious to know. Thanks. ... View more

I have followed all steps properly and able to get meraki logs as expected. However, I was wondering if there was a Meraki app that provided more visual data like dashboard views or pre-loaded searches ? ... View more

Hi dfigurello , I am facing the same issue and ran the search you mentioned above, however, havent got any data. Please suggest workaround ... View more

Actually, I have started receiving logs from LTM-F5 but so far it has only been from udp 9514. No logs have been collected yet from tcp 9515. ... View more