Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Log_wrangler
Log_wrangler
Builder
Member since:
11-09-2017
06-05-2020
Community Statistics
| Posts | 265 |
| Solutions | 9 |
| Karma Given | 0 |
| Karma Received | 18 |
| Member Since | 11-09-2017 |
Activity Feed
- Got Karma for How to Eval urldecode and then regex?. 08-03-2021 02:51 AM
- Got Karma for base64 decoding fails because of padding. 06-25-2021 03:05 AM
- Got Karma for Getting an error with Service NOW add-on.... 08-18-2020 06:06 AM
- Got Karma for Where is the installation and configuration documentation for the Elasticsearch Data Integrator app?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me with my query involving a saved search and summary indexing?. 06-05-2020 12:50 AM
- Got Karma for Can you configure a Universal Forwarder output to send to two separate Heavy Forwarders?. 06-05-2020 12:50 AM
- Got Karma for How to use the current Deployment Server to configure remote UFs with a new Deployment Server IP?. 06-05-2020 12:50 AM
- Got Karma for Where is the installation and configuration documentation for the Elasticsearch Data Integrator app?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I upgrade a non-clustered search head to 7.1?. 06-05-2020 12:49 AM
- Got Karma for Splunk Add-on for Microsoft Cloud Services, splunk is not able to read .gz blob files, how do I fix this?. 06-05-2020 12:49 AM
- Got Karma for Re: how to calculate a running average of events by user for 'All time' (Part 2). 06-05-2020 12:49 AM
- Got Karma for how to calculate a running average of events by user for 'All time' (Part 2). 06-05-2020 12:49 AM
- Got Karma for Can splunk monitor a google drive folder as a data input?. 06-05-2020 12:49 AM
- Got Karma for Create a sourcetype to index map. 06-05-2020 12:49 AM
- Got Karma for Re: How to send syslog data to the indexer and another TCP listener?. 06-05-2020 12:49 AM
- Got Karma for Getting an error with Service NOW add-on.... 06-05-2020 12:49 AM
- Got Karma for Getting an error with Service NOW add-on.... 06-05-2020 12:49 AM
- Got Karma for Invalid key in stanza. 06-05-2020 12:49 AM
- Posted Re: How do you set the License Usage App to use UTC time ? on All Apps and Add-ons. 06-06-2019 03:01 PM
- Posted How do you set the License Usage App to use UTC time ? on All Apps and Add-ons. 06-05-2019 05:48 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-17-2018
06:06 AM
Thank you, we will look into this option. Yes the azure apps have been a pain.
... View more
08-17-2018
06:05 AM
I am not sure what you mean, the TA inputs are default. I set it up through the GUI under data inputs activity_log. Please explain which inputs I should look at. Thank you
... View more
08-16-2018
02:44 PM
08-16-2018 16:31:19.869 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-Azure_Monitor/bin/azure_activity_log.sh" Modular input azure_activity_log://azure-event-hub-dev Error getting event hub creds: SyntaxError: Unexpected end of JSON input
Does anyone know how to fix this?
... View more
08-16-2018
08:30 AM
the query did not work
... View more
08-16-2018
08:17 AM
thank you for the reply, unfortunately the index is on v5.x , and there is no Monitor console on that version.
I am afraid to run your query as it might overload the indexer.
But I will look at it... and give it a shot.
... View more
08-16-2018
07:51 AM
I received a warning
Search peer ip-1-1-1-1.ec2.internal has the following message: skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block
Uptime shows very high CPU utilization on the server.
Is there some query in _internal I can use to see if an app or alert or source or schedule task is causing this?
Thank you
... View more
08-15-2018
08:24 AM
thank you, I think I found some of this info already.
will followup with specific questions
Thanks
... View more
08-14-2018
01:22 PM
I have tried all the base64 decoding apps in splunk base with no luck. The apps decode the first character and stop at the first null.
I want to add a custom command (.py) or script that will decode the base64 encode field value and remove the nulls. Preferrably, I would like a command I invoke at will with and eval, like
|eval decoded_val = myCommand encoded_val | table decoded_val
Please advise how I would create a custom command like this.
Thank you
... View more
08-13-2018
12:59 PM
1 Karma
I am trying to decode base64.
I have tried three apps
base64 helper
base64
TA-base64pl
none of them are able to decode the entire string, because as soon as the first null/pad character is read, splunk stops.
does anyone know how to fix this?
Thank you!
... View more
08-08-2018
01:55 PM
So the main problem is that splunk stops decoding after the first character because there is an "square" null space between the characters, how do I keep it decoding the entire encoded_data??
... View more
08-08-2018
07:19 AM
thank you for the reply, however I am not sure I explained correctly.
The problem is after |base64 encoded_data the results are broken.
The base64 helper app I believe is different than other base64 apps, and it does not work with eval either, so I cannot create a "field".
Which base64 app are you using??
thank you
... View more
08-07-2018
02:56 PM
I have tried the base64 helper app as follows
index=A sourcetype=App_A |table encoded_data |base64 encoded_data
if I am decoding > WwBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA==
the result is > [ i n t p t r ] : : s i z e
there are spaces between each character and splunk will only see the first character, in this case [
I want it to be > [intptr]::size
is there a way to base64-decode, remove the spaces, and string it back together?
Please advise, thank you
... View more
08-01-2018
12:37 PM
must be a fw issue, nvm... thx
... View more
08-01-2018
11:32 AM
only thing I see on the new instance splunkd.log
is
ERROR LMAdminHandlerTracker - editTracker failed, reason='unable to contact master=https://x.x.x.x:8089
... View more
08-01-2018
11:29 AM
yes license master is running, checking splunkd.log thx
... View more
08-01-2018
11:12 AM
I created two new splunk instances that I am trying to set as slaves to a license master.
I add the https;//x.x.x.x:8089 as the master license server URI but then I get this error
Splunkd daemon is not responding: ('The read operation timed out',)
Please advise how to troubleshoot and fix.
Thank you
... View more
07-30-2018
08:45 AM
I am having a bit of trouble changing the index = main to index =azure_data.
I installed the TA on a heavy forwarder.
In /opt/splunk/etc/apps/TA-Azure_Monitor/default I see inputs.conf,
[azure_activity_log]
index=main
interval=60
sourcetype=amal:activityLog
I made a copy of inputs.conf to /opt/splunk/etc/apps/TA-Azure_Monitor/local
and modified it to
[azure_activity_log]
index=azure_data
interval=60
sourcetype=amal:activityLog
Then I did a restart... no errors seen on restart or with btool. But no data rolls into the new index = azure_data
The index azure_data was previously created on the indexer, and I have other data from Splunk_TA_microsoft-cloudservices currently rolling into it no problem.
Please advise.
Thank you
... View more
07-24-2018
01:12 PM
I really needed the OUTPUT example, and It works ( I added a pipe before the lookup) but the results are not consistent. I think there is a formatting issue or something because the result says "City Not Same" when they are...
... View more
07-24-2018
07:47 AM
I have waf logs for an application that provides userID and srcIP which I pipe to geoinfo to get the city state country info.
I have an "active_list" that provides userID, account_city, account_state, account_country.
index=someApp sourcetype=WAF | [inputlookup active_list.csv | fields userID] | table srcIP userID| geoip srcIP
Now I want to find a way that I can compare the geoip info, which outputs a "srcIP_city" to the active_list "account_city" and see all matches and non-matches.
I have been testing some methods but no luck. I am thinking I need results to go to an outputlookup and then compare the two lists.
I have tried this but I am not sure if this is correct
index=someApp sourcetype=WAF (some key words) | table userID srcIP | geoip srcIP | table usrID srcIP srcIP_city srcIP_state srcIP_country | lookup active_list.csv userID
Here I am running my basic search first and listing field by userID, which makes it easy to see when the srcIP_city and account_city doesn't match.
But I am not sure if this is correct. Please advise, thank you.
... View more
07-20-2018
11:11 AM
I have some logs rolling into splunk (via HF) in UTC time, and it is throwing off users' searching with CST (local time).
Is there a way to edit props or transforms to keep the UTC time but convert it to local CST time?
Or is that not an option?
Thank you
... View more
07-20-2018
09:03 AM
I am using Splunk Add-on for Microsoft Cloud Services to ingest .json logs from blob storage. When I look json log samples in the blob and then compare to what is the index, the events are not parsing correctly.
Is this an Azure problem?
I am not having the issue with s3 files from AWS? using the standard json time parsing conf...
Is there any way to troubleshoot why json parses correct from sources other than Azure, but does not parse correctly from Azure?
I am also having a problem with .gz source files not unzipping from Azure, but files unzip without a problem from AWS?
Please advise.
Thank you
... View more
07-20-2018
08:02 AM
1 Karma
I am using Splunk Add-on for Microsoft Cloud Services to ingest .gz log files from blob storage.
When I look in the index for these logs.gz, all I see is garble. The source indicates .gz, but I don't understand why Splunk cannot unzip and read it.
Here is a sample...
�Y�Q[��MK�@����%��k6���� � I{YD�x��R��L�����0�3sN��0<���&�R�Tf��B����ZICB�Tt�a�̛۪X��.�6ܶ���n���Pn �����u<��ٿ������ܺ+�k�� <ɕ��'���C�"��M]U����0�� �0 �A�O��P��y��N bLNM&;�H.����f���f��!�S�F�B}x|3�>��a�k$3;��[`v�!7gg�ah�����"�o�)!��z<[��,��S� 0ة�|����
-�s�
source = logs/20180720-11_0.gz
Please advise.
Thank you
... View more
07-17-2018
12:07 PM
index = _internal is correct. fyi, when looking for s3fs events I have to search for the s3fs mount point like
the following (where foo is the s3fs mount point).
index=_internal source="/opt/splunk/var/log/splunk/splunkd.log" "/foo/frozen_archive/some_index_of_interest"
... View more
07-17-2018
07:38 AM
I have an ec2 splunk instance writing frozen data to an s3 bucket (via s3fs).
Where would I find in the splunk logs a history to monitor: when data is written to, and how much data is written to the frozen dir?
Thank you
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
