Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ansif
ansif
Motivator
Member since:
10-07-2017
11-28-2022
Community Statistics
| Posts | 323 |
| Solutions | 17 |
| Karma Given | 32 |
| Karma Received | 29 |
| Member Since | 10-07-2017 |
Activity Feed
- Posted Re: Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 07:33 PM
- Posted Re: Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 07:19 PM
- Posted Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 12:40 PM
- Got Karma for Re: SH clustering and monitoring console. 04-18-2022 12:20 PM
- Got Karma for Re: License pools for Indexes rather than Indexers. 07-27-2021 02:40 AM
- Posted Re: How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 04-22-2021 04:00 AM
- Posted Re: Is there a base_config available for SHC? on Deployment Architecture. 12-09-2020 07:59 PM
- Posted Re: License usage over 7days on Monitoring Splunk. 07-20-2020 11:15 AM
- Posted curl command not working may be a format issue - webtools addon on All Apps and Add-ons. 06-11-2020 12:09 AM
- Karma Re: windows 2003 servers monitor using Splunk 8.0 for Richfez. 06-05-2020 12:51 AM
- Got Karma for Is there a base_config available for SHC?. 06-05-2020 12:51 AM
- Karma Re: Universal Forwarder to report 2 Indexer for gcusello. 06-05-2020 12:50 AM
- Karma Re: SolarWinds Add-on for Splunk in Splunk 7 Version for vishaltaneja070. 06-05-2020 12:50 AM
- Karma Verifying Secure Communication between forwarders and indexers for anoopdi. 06-05-2020 12:50 AM
- Karma Re: SAP Solman Technology Addon License for Esky73. 06-05-2020 12:50 AM
- Karma Re: Query about Architect Exam (recertification) for koshyk. 06-05-2020 12:50 AM
- Got Karma for Exported addon from Splunk addon builder but unable to see inputs or configuration form. 06-05-2020 12:50 AM
- Got Karma for How to enable basic authentication in Splunk addon builder rest api input?. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk Integration with HPE Systems Insight Manager. 06-05-2020 12:50 AM
- Karma Re: Load Balancer between Heavy Forwarder and Indexers for harsmarvania57. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-08-2018
03:44 AM
I could see an app in splunkbase,try
https://splunkbase.splunk.com/app/507/
... View more
05-16-2018
11:07 PM
If the JSON response is from REST API call then I can help you with rest_ta response handler script.
... View more
05-15-2018
10:15 PM
1 Karma
Hi @teddyidc1101
If @xpac answer helped you then accept his answer. He deservers the karma points then.
... View more
05-10-2018
11:11 PM
1 Karma
Consider your current overhead in indexer ,if it is fine to handle snmp polling or trap process then go ahead and deploy.
Splunk is not restricting to use instance to act as multi splunk component,only performance matters.
... View more
05-03-2018
10:42 PM
Assume this search returns 20 events in 24 hours:
Check which field is unique in each event.Take that field as Threshold Field.In the calculation window count the field value gives you number of events.This gives you how many failures in 24 hours.Try to select time in ITSI KPI creation and not in Search itself. Let me know if you need any help.
NB:- If there is no time out in last 24 hours and you wish to show this KPI as normal then you need to select treat gap as Normal while creating KPI.
... View more
05-03-2018
02:36 AM
Create a dbinput or clone existing one.Disable it.
Enable if it demands.
... View more
05-03-2018
02:31 AM
Can you check the script running server to url server has communication.
Use Ping and telnet.
... View more
05-03-2018
02:21 AM
Can you try with a service restart.
... View more
05-03-2018
02:18 AM
I am not at all good in Tally,but for integration just check if tally's data are in DB.If it is in DB you can use DB connect appp to pull data using the database query.
Check if tally data can be exported to a file.This method is classic ,since data in flat files anyone who has access to server can read file.(Security issue)
Check if Tally has a capability of WSAPI.
Check if any scripts can be developed to get data from Tally.
Hope my answer helps.
... View more
05-02-2018
10:52 PM
Require more details, can you paste the search,result and your expectations in ITSI.
... View more
05-02-2018
10:43 PM
1 Karma
Please find the sample JSON data:
{
"cis" : [ {
"ucmdbId" : "8b3d2f99df09c3d7e9f33ade6f18f4af",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "C",
"disk_size" : 101897.0,
"free_space" : 76.44
}
}, {
"ucmdbId" : "e1d3952c4f07bae8d8f470b29d263180",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "C",
"disk_size" : 101897.0,
"free_space" : 75.17
}
}, {
"ucmdbId" : "0125be84efd2436561f35b7debf9fdfa",
"globalId" : null,
"type" : "nt",
"properties" : {
"display_label" : "dexxxxxxxx18",
"Server_Model" : "Silver",
"Status" : "Active",
"discovered_model" : "VMware Virtual Platform",
"create_time" : "2018-02-01T07:05:42.332Z",
"nt_physicalmemory" : "4193712",
"Storage_Class" : "Silver",
"Business_Unit" : "xxxxxxxxxxxxxxx",
"Application" : "xxxxxxxxxxxxxxxx",
"nt_processorsnumber" : 1
}
}, {
"ucmdbId" : "07a757b4b6918800674a87ce6be0a2ff",
"globalId" : null,
"type" : "nt",
"properties" : {
"display_label" : "dxxxxxxxxxxxxxxx3",
"Server_Model" : "Silver",
"Status" : "Active",
"discovered_model" : "VMware Virtual Platform",
"create_time" : "2018-01-24T16:35:40.521Z",
"nt_physicalmemory" : "4193712",
"Storage_Class" : "Silver",
"Business_Unit" : "xxxxxxxxxxxxxxxxxxx",
"Application" : "xxxxxxxxxxxxxxxxxxxx",
"nt_processorsnumber" : 1
}
}, {
"ucmdbId" : "16cb902378fa5cc3d250c2d5e79fba1f",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "D",
"disk_size" : 102269.0,
"free_space" : 98.57
}
}, {
"ucmdbId" : "17840c5200f445d33669eb62a69bc1a7",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "D",
"disk_size" : 102269.0,
"free_space" : 99.89
}
}, {
"ucmdbId" : "4490191ade98235da67be691724e9fce",
"globalId" : null,
"type" : "nt",
"properties" : {
"display_label" : "dxxxxxxxxxxxxx2",
"Server_Model" : "Gold",
"Status" : "Active",
"discovered_model" : "VMware Virtual Platform",
"create_time" : "2018-03-19T14:10:12.310Z",
"nt_physicalmemory" : "67108272",
"Storage_Class" : "Gold",
"Business_Unit" : "xxxxxxxxxxxxxx",
"Application" : "xxxxxxxxxxxxxxxxxxxxx",
"nt_processorsnumber" : 4
}
}, {
"ucmdbId" : "4b685f01d6d0c5c181cdcde7b9c6b1a5",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "D",
"disk_size" : 102269.0,
"free_space" : 98.3
}
}, {
"ucmdbId" : "4fbeb8fc1633f3908114cb3648f6b799",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "C",
"disk_size" : 102047.0,
"free_space" : 17.99
}
} ],
"relations" : [ {
"ucmdbId" : "d7246031c9d5e09661978c0dddddb17d",
"globalId" : null,
"type" : "composition",
"properties" : null,
"end1Id" : "0125be84efd2436561f35b7debf9fdfa",
"end2Id" : "8b3d2f99df09c3d7e9f33ade6f18f4af"
}, {
"ucmdbId" : "e66b04516c2e0668539e22691714449b",
"globalId" : null,
"type" : "composition",
"properties" : null,
"end1Id" : "0125be84efd2436561f35b7debf9fdfa",
"end2Id" : "17840c5200f445d33669eb62a69bc1a7"
}, {
"ucmdbId" : "4923aa1c20f639b39253df8e302c15ae",
"globalId" : null,
"type" : "composition",
"properties" : null,
"end1Id" : "4490191ade98235da67be691724e9fce",
"end2Id" : "4fbeb8fc1633f3908114cb3648f6b799"
}, {
"ucmdbId" : "4f74124d9094579db77fba59aff89a80",
"globalId" : null,
"type" : "composition",
"properties" : null,
"end1Id" : "4490191ade98235da67be691724e9fce",
"end2Id" : "4b685f01d6d0c5c181cdcde7b9c6b1a5"
}, {
"ucmdbId" : "4fb1429a6b6c429b59c8ba0835b97d19",
"globalId" : null,
"type" : "composition",
"properties" : null,
"end1Id" : "07a757b4b6918800674a87ce6be0a2ff",
"end2Id" : "16cb902378fa5cc3d250c2d5e79fba1f"
}, {
"ucmdbId" : "76522e3fa85c7c8354bae9653336ebaf",
"globalId" : null,
"type" : "composition",
"properties" : null,
"end1Id" : "07a757b4b6918800674a87ce6be0a2ff",
"end2Id" : "e1d3952c4f07bae8d8f470b29d263180"
} ]
}
Things to do:
Split events with ucmdbid,like (not sure splitting helps to parse json easily,but the JSON response is really gonna huge)
If REST API python response handler is good,help me with the code. Let timestamp is REST API call time.
{
"ucmdbId" : "8b3d2f99df09c3d7e9f33ade6f18f4af",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "C",
"disk_size" : 101897.0,
"free_space" : 76.44
}
{
"ucmdbId" : "e1d3952c4f07bae8d8f470b29d263180",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "C",
"disk_size" : 101897.0,
"free_space" : 75.17
}
Find the Filesystem drives for each servers:
Example :
Server JSON Response:
{
"ucmdbId" : "0125be84efd2436561f35b7debf9fdfa",
"globalId" : null,
"type" : "nt",
"properties" : {
"display_label" : "dexxxxxxxx18",
"Server_Model" : "Silver",
"Status" : "Active",
"discovered_model" : "VMware Virtual Platform",
"create_time" : "2018-02-01T07:05:42.332Z",
"nt_physicalmemory" : "4193712",
"Storage_Class" : "Silver",
"Business_Unit" : "xxxxxxxxxxxxxxx",
"Application" : "xxxxxxxxxxxxxxxx",
"nt_processorsnumber" : 1
}
Server ucmdb id:
0125be84efd2436561f35b7debf9fdfa
2 Matches:
{
"ucmdbId" : "d7246031c9d5e09661978c0dddddb17d",
"globalId" : null,
"type" : "composition",
"properties" : null,
"end1Id" : "0125be84efd2436561f35b7debf9fdfa",
"end2Id" : "8b3d2f99df09c3d7e9f33ade6f18f4af"
}, {
"ucmdbId" : "e66b04516c2e0668539e22691714449b",
"globalId" : null,
"type" : "composition",
"properties" : null,
"end1Id" : "0125be84efd2436561f35b7debf9fdfa",
"end2Id" : "17840c5200f445d33669eb62a69bc1a7"
}
Find the drive using the end2Id:
{
"ucmdbId" : "8b3d2f99df09c3d7e9f33ade6f18f4af",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "C",
"disk_size" : 101897.0,
"free_space" : 76.44
}
{
"ucmdbId" : "17840c5200f445d33669eb62a69bc1a7",
"globalId" : null,
"type" : "file_system",
"properties" : {
"display_label" : "D",
"disk_size" : 102269.0,
"free_space" : 99.89
}
Calculate the total space :
Sum(All drives) for each server
Plot in a table like below:
Server_Name Application Business_Unit Discovery_Model Server_Model Status Physical_Memory Procesor_Num Create_Time Storage_Class Sum(All drives)
... View more
04-26-2018
11:34 PM
Hi All,
Is there anyway to read email messages from Exchange server? Using Splunk app for MS-Exchange,but it cant extract email body by default.
Found an app in Splunk base "IMAP Mailbox" but which seems to be not supported for >6.5 version.Any idea?
Thanks
... View more
04-20-2018
12:41 AM
I knew this and I am following your answers silently 🙂
... View more
04-20-2018
12:05 AM
Issue Resolved:
class TokenKeyAuth(AuthBase):
def __init__(self,**args):
self.auth_url = args['auth_url']
pass
def __call__(self, r):
if not 'Authorization' in r.headers:
#perform auth
data = {'username':'xxxxx','password':'xxxxxxx','clientContext':'1'}
req_args = {"verify" : False}
headers = {'Content-Type': 'application/json'}
auth_response = requests.post(self.auth_url,data=json.dumps(data),headers=headers,**req_args)
response_json = json.loads(auth_response.text)
token_key = response_json["token"]
r.headers['Authorization'] = "Bearer "+token_key
return r
'clientContext':'1' should be included in the message body. And a splunk service restart is required since the script checks header "Authorization" and uses the old token to communicate.
The funny part is ,it returns token even if it is not included with content context but unusable.
And thanks @damien for the mental support 🙂 . Atleast I have a person to discuss about Splunk REST API.
... View more
04-19-2018
10:26 PM
Thanks for your response. I am eagerly waiting for you.
After restarting the splunk service now I am getting 401 unauthorized error.
04-20-2018 07:25:08.155 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" HTTP Request error: 401 Client Error: Unauthorized
I took the returned token and tried REST API call on SOAP UI, the returned token seems to be not working in SOAP UI as well.
{"error": "The following error has occurred: Token is invalid or was tampered with. Please consult logs for more details"}
But when I try to get token using SOAP UI, that token is valid and working.
Both token (one returned in splunk rest api python and SOAP UI) format seems to be same with 177 characters and starting letters are similar in nature.
I think I need to check on HP uCMDB wsapi logs on why the token returned using the script is not working.
Any suggestions?
... View more
04-19-2018
05:59 AM
I am new to python,can you help me with few lines?
... View more
04-19-2018
05:35 AM
@damien ,pelase help
... View more
04-19-2018
05:19 AM
Getting below error for custom Authentication:
04-19-2018 14:10:40.506 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: 'token'
Input:
Authhandlers.py:
from requests.auth import AuthBase
import hmac
import base64
import hashlib
import urlparse
import urllib
import requests,json
#add your custom auth handler class to this module
class SessionKeyAuth(AuthBase):
def __init__(self,**args):
self.auth_url = args['auth_url']
pass
def __call__(self, r):
if not 'X-HP3PAR-WSAPI-SessionKey' in r.headers:
#perform auth
credentials = {'user':'xxxxx','password':'xxxxxx'}
req_args = {"verify" : False}
headers = {'content-type': 'application/json'}
auth_response = requests.post(self.auth_url,data=json.dumps(credentials),headers=headers,**req_args)
response_json = json.loads(auth_response.text)
session_key = response_json["key"]
r.headers['X-HP3PAR-WSAPI-SessionKey'] = session_key
return r
class TokenKeyAuth(AuthBase):
def __init__(self,**args):
self.auth_url = args['auth_url']
pass
def __call__(self, r):
if not 'Authorization' in r.headers:
#perform auth
credentials = {'username':'xxxxx','password':'xxxxxx'}
req_args = {"verify" : False}
headers = {'content-type': 'application/json'}
auth_response = requests.post(self.auth_url,data=json.dumps(credentials),headers=headers,**req_args)
response_json = json.loads(auth_response.text)
token_key = response_json["token"]
r.headers['Authorization'] = "Bearer "+token_key
return r
Class SessionKeyAuth is for 3PAR storage and Class TokenKeyAuth is for HP uCMDB
HP uCMDB REST API :
http://cmshelpcenter.saas.hp.com/CMS/10.33/ucmdb-docs/docs/eng/doc_lib/Content/REST_API/REST_API_Query_CIs_step_by_stey.htm
HP 3PAR is working but not uCMDB REST API class. Please help.
... View more
03-16-2018
02:00 AM
Is this app(CMDB-to-ITSI) chargeable? Anyone knows how much is the price and licensing type?
... View more
- Tags:
- CMDB-to-ITSI
02-22-2018
01:19 AM
Check the below few things:
Change the time range of your search. (check with All Time)
Check whether you have created any custom index for this input.
Check which column you have given as time stamp.
... View more
02-21-2018
11:06 PM
Try below steps:
Move the $SPLUNK_HOME/etc/passwd file
to $SPLUNK_HOME/etc/passwd.bak
Restart Splunk. After the restart you
should be able to login using the
default login (admin/changeme).
... View more
