Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ehudb
ehudb
Contributor
Member since:
09-16-2014
12-14-2022
Community Statistics
| Posts | 85 |
| Solutions | 17 |
| Karma Given | 26 |
| Karma Received | 23 |
| Member Since | 09-16-2014 |
Activity Feed
- Posted Re: trace and span in enterprise splunk on Splunk Search. 12-14-2022 07:36 AM
- Posted Re: trace and span in enterprise splunk on Splunk Search. 12-14-2022 12:05 AM
- Posted AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability? on Getting Data In. 11-30-2022 03:29 AM
- Tagged AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability? on Getting Data In. 11-30-2022 03:29 AM
- Tagged AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability? on Getting Data In. 11-30-2022 03:29 AM
- Posted Re: What is the best way to monitor webservice is up or down on Getting Data In. 08-14-2022 11:21 AM
- Got Karma for Re: How can I enable both Splunk server and Splunk Universal Forwarder at boot time?. 08-12-2022 03:00 AM
- Got Karma for Re: Why are Javascript files not loading after update to Splunk 6.5.0?. 03-16-2022 10:14 AM
- Got Karma for Re: I am able to extract a field with rex in a search, but why does it not appear in Interesting Fields when I save it as a field extraction?. 10-26-2020 07:20 PM
- Karma Re: Splunkweb referrer missing since 6.5.5 for niketn. 06-05-2020 12:49 AM
- Karma Re: Excel Export is not working for user role for lsw6875. 06-05-2020 12:49 AM
- Karma Re: get session key for included javascript app with logged in user for docwalter. 06-05-2020 12:48 AM
- Karma Request to port 8089 from 8000 for thibault28. 06-05-2020 12:48 AM
- Karma BUG WORKAROUND: can I reset a table to page 1 when populating search is (re)run? for gabriel_vasseur. 06-05-2020 12:48 AM
- Got Karma for Re: system uptime calculation. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk DB Connect V3 - Automated / Programmatic creation of connections and inputs. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk DB Connect V3 - Automated / Programmatic creation of connections and inputs. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk DB Connect V3 - Automated / Programmatic creation of connections and inputs. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk DB Connect V3 - Automated / Programmatic creation of connections and inputs. 06-05-2020 12:48 AM
- Got Karma for Re: Can Splunk IT Service Intelligence (ITSI) send email alerts?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-20-2017
11:41 AM
Assuming your threat ip fields are ip range:
"192.168.1.1-192.168.1.100" means ALL IP addresses between the range: 192.168.1.1,2,3,...100
You can use the following:
index=firewall |table fwsrc
|append [index=threat |table threatip ]
|makemv threatip delim="-" |eval startip=mvindex(threatip,0) |eval endip=mvindex(threatip,1)
|table fwsrc startip endip
|eventstats values(startip) as startip values(endip) as endip
|stats count by fwsrc startip endip
|eval isThreat = if(fwsrc>=startip AND fwsrc<=endip,"T","F")
|stats values(isThreat) as isThreat by fwsrc |eval isThreat=if(isThreat=="T","T","F")
Explanation:
|makemv threatip delim="-" will convert the range to multivalue field with start and end
mvindex will extract them to new fields
eventstats will spread the threat ranges across the entire table
(fwsrc>=startip) can decide if fwsrc is 'bigger' than startip, means all it's 4 parts are above or equal to the other ip.
(fwsrc>=endtip) works the same in the opposite side
|stats values and eval will finally show only the ip that detected as threat in one of the ranges.
Another working approach would be converting all the ranges to a where clause in subsearch:
index=firewall |table fwsrc
|where
[index=threat |table threatip |makemv threatip delim="-" |eval startip=mvindex(threatip,0) |eval endip=mvindex(threatip,1) |table startip endip
|eval where="fwsrc>=\""+startip+"\" AND fwsrc<=\""+endip+"\"" |return 10000 $where]
The subsearch here assembles the table:
threatip
-----------
192.168.1.2-192.168.1.100
10.0.0.1-10.1.0.100
into a single line where clause:
(fwsrc>="192.168.1.2" AND fwsrc<="192.168.1.100") OR (fwsrc>="10.0.0.1" AND fwsrc<="10.0.0.100")
Then, the |where command is using this string to filter the results.
... View more
01-20-2017
10:06 AM
What's the different from your example:
192.168.3.35-192.168.3.47
To my example:
192.168.1.1-192.168.1.2-192.168.1.3-10.0.0.1
... View more
01-20-2017
03:59 AM
Assuming the ip field looks like this:
"192.168.1.1-192.168.1.2-192.168.1.3-10.0.0.1"
You can convert it to multivalue field, and then expand to rows:
|makemv delim="-" ip |mvexpand ip
"192.168.1.1-192.168.1.2-192.168.1.3-10.0.0.1" ->
ip
192.168.1.1
192.168.1.2
192.168.1.3
10.0.0.1
Full example:
| makeresults count=1 |eval ip="192.168.1.1-192.168.1.2-192.168.1.3-10.0.0.1" |table ip
|makemv delim="-" ip |mvexpand ip
... View more
01-20-2017
03:51 AM
You would have to write a python script that will copy the dashboard xml file while changing the desired default values within the xml.
Then you can implement the python script as a splunk custom command, and use that in the first dashboard.
Docs:
https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Writeasearchcommand
Examples (slightly old):
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
http://blogs.splunk.com/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-generating-command/
... View more
11-08-2016
03:15 AM
You do not need to install Universal Forwarder on the Splunk server, but you do need to install it on each Windows client.
... View more
11-07-2016
01:23 PM
Hello
The universal forwarder is acting as an "agnet", it's just collecting local data (events) , and moving them forward to full splunk instance.
You would need 1 splunk full instance and a universal forwarder on each of the desired windows servers (which you want events from)
... View more
11-01-2016
08:55 AM
There is no cost for putting it in splunk base
Also, 99% of the apps are free and do not require cost to download.
You would need however an approval from Splunk app team to upload an app.
http://dev.splunk.com/view/app-cert/SP-CAAAE24
Also check the AppInspect tool that checks your app:
http://dev.splunk.com/view/appinspect/SP-CAAAFAM
... View more
11-01-2016
08:35 AM
Hello
I have a search head cluster with 3 peers.
Now I want to use KV Store within that cluster, with |inputlookup `|lookup` commands.
What is the correct way to do that?
When I created manually KV Store on one of the search heads, it didn't replicate to the other peers, so I cannot run lookup queries from the other search heads.
As I understood from the docs, it shouldn't replicate through SHC, but there should be a way to 'remotely' query the KV Store.
... View more
11-01-2016
08:16 AM
If that button is not related to a specific search, you would need an HTML panel.
See this answer:
https://answers.splunk.com/answers/378289/calling-java-script-from-dashboard.html
Also see in the Dashboard Examples, the example "Token Links"
... View more
11-01-2016
08:09 AM
1 Karma
You cannot and do not need universal forwarder and full instance on the same server.
The full instance can provide full forwarder functionality, so you can use it to collect whatever you need.
Just configure inputs\props or forwarder apps like you would do with universal forwarder.
... View more
11-01-2016
08:05 AM
|rex "\w+\s\[(?<Errortype>[^\]]+)]"
Explanation:
A. Word with one or more letter
B. one or more space
C. starting bracket '['
D. One or more Non-Closing bracket ']' character (will be the field value)
E. Closing bracket ']'
... View more
11-01-2016
08:01 AM
Please post the entire panel code, including the start of it (depends parameter?)
... View more
11-01-2016
07:51 AM
1 Karma
1.. Backup:
Search heads:
If the search heads are in a cluster,
- backup the deployer $SPLUNK_HOME\etc\shcluster
- $SPLUNK_HOME\etc of one the peers
Otherwise:
- backup $SPLUNK_HOME\etc of all the search heads
Indexers:
Backup warm\cold\frozen buckets
Also backup cluster master - master apps.
Deployment (Forwarder deployment?):
Backup $SPLUNK_HOME\etc directory
2..
I wouldn't backup diag file as it contains more than the needed files
3..
Docs about backup:
Indexed data (bcukets) - http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Backupindexeddata
Configuration (etc) - http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Backupconfigurations
... View more
10-08-2016
11:36 PM
Hello
Did you find a solution for this error?
... View more
08-02-2016
12:57 AM
OK another RTFM to the long list:
http://docs.splunk.com/Documentation/DBX/2.2.0/DeployDBX/Troubleshooting#Database_inputs_or_lookups_with_inline_views_don.27t_work_as_expected
To enable or disable query wrapping for all connections:
Add the following [default] stanza to local/db_connections.conf, setting enable_query_wrapping to 0 to disable, or to 1 to enable.
[default]
enable_query_wrapping = 0
... View more
08-02-2016
12:05 AM
Hello
When I try to run query with DB Connect 2 with MSSQL, I cannot run ORDER BY in the function.
This works well:
| dbxquery connection="LDPR.UK" maxrows=10 query="select * from users" output=csv shortnames=true
However on this query I get an error:
| dbxquery connection="LDPR.UK" maxrows=10 query="select * from users order by id" output=csv shortnames=true
External search command 'dbxquery' returned error code 1. Script output = "RuntimeError: Failed to run query: "SELECT * FROM (select * from users order by id) t", caused by: AvroRemoteException(u'java.sql.SQLException: The ORDER BY clause is invalid in views, inline functions, derived tables, subqueries, and common table expressions, unless TOP, OFFSET or FOR XML is also specified.',). "*
It happends because DB connect 2 is wapping the query with "SELECT * FROM ([my query])", which makes any ORDER BY to be invalid.
Is there any way to override this besides using |sort in splunk itself?
... View more
- Tags:
- Splunk DB Connect
06-14-2016
04:20 AM
I found it by seeing in _internal logs that there are unindexed zip files that are getting ignored
Fixed the issue by adding blacklist to the input, containing the zip files
... View more
06-08-2016
03:33 AM
Fixed by uninstalling "DB Connect 1" , apparently it does not go well with Splunk 6.4, and it's stopping other modular inputs from running.
DB Connect 2 might be the fix to this.
... View more
06-02-2016
01:22 AM
Apparently you can do it very easily by:
Reference your token in the target dashboard as any token:
search index=... field=$token$
Use the url to give value to the token
searchhead:8000/en-US/app/search/mytarget?token=value1
searchhead:8000/en-US/app/search/mytarget?token=value2
So you don't have to create input in the dashboard for the token to work.
... View more
05-22-2016
07:11 AM
Ok, it seems those messages came while I was restarting the Splunk service.
So if we stop the splunk service for few minutes, clean the logs, and
Then, starting the splunk we still have the issue but we don't see any jms.py errors in the logs.
... View more
05-22-2016
02:26 AM
First of all, show your query in the dashboard, and explain what is the pattern or names of the undesired values.
Generally you could use "field!=pc1 field!=pc2..."
Like this:
index=.... ... field!=pc1 field!=pc2... |chart ...
... View more
05-22-2016
02:22 AM
1 Karma
Sometimes field extraction doesn't necessary show up after saving it in the GUI (props.conf)
First, to to debug refresh:
http://splunksearchead:8000/debug/refresh
If not, try to restart the splunkd service.
... View more
05-22-2016
01:23 AM
Hello
We have an issue with the JMS Messaging Modular Input 1.5, (Splunk 6.4)
The input worked well for a few days, but suddenly disappeared from "Inputs" list.
Now it's still working well behind the scenes, but we can't see it in the "Inputs" list.
This is the 'jms.py' part from splunkd.log (I have replaced the real name with 'splunkserver.domain'):
05-22-2016 10:31:25.579 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Can't connect to Splunk REST API with the token [Splunk 7edPTpv683LdKyzHTdJdpKe7^3M8HNZOUqOSCcsoq2ENb4m2Wkws_MM^JiopdX__HLusYRfAJueILXCCZvSbvTyfowOP7DIj^rl6n6kVsTgtO5ploGzAuC], either the token is invalid or SplunkD has exited : Connection reset
05-22-2016 10:31:29.459 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Probing socket connection to SplunkD failed.Either SplunkD has exited ,or if not, check that your DNS configuration is resolving your system's hostname (splunkserver.domain) correctly : Connection refused
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/:teva.ETL.TEST.msgTrace : Error connecting : javax.naming.NoInitialContextException: Cannot instantiate class: com.sun.jndi.fscontext.RefFSContextFactory [Root exception is java.lang.ClassNotFoundException: com.sun.jndi.fscontext.RefFSContextFactory]
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:674)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at javax.naming.InitialContext.init(InitialContext.java:242)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at javax.naming.InitialContext.<init>(InitialContext.java:216)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: java.lang.ClassNotFoundException: com.sun.jndi.fscontext.RefFSContextFactory
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.security.AccessController.doPrivileged(Native Method)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.lang.ClassLoader.loadClass(ClassLoader.java:423)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.lang.ClassLoader.loadClass(ClassLoader.java:356)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.lang.Class.forName0(Native Method)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.lang.Class.forName(Class.java:266)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at com.sun.naming.internal.VersionHelper12.loadClass(VersionHelper12.java:63)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:671)
05-22-2016 10:31:29.888 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" ... 5 more
05-22-2016 10:31:40.147 +0300 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/jms_ta/bin/jms.py
05-22-2016 10:31:55.848 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" It has been determined via the REST API that all inputs have been disabled
I believe the problem comes from :
Can't connect to Splunk REST API with the token [Splunk 7edPTpv683LdKyzHTdJdpKe7^3M8HNZOUqOSCcsoq2ENb4m2Wkws_MM^JiopdX__HLusYRfAJueILXCCZvSbvTyfowOP7DIj^rl6n6kVsTgtO5ploGzAuC], either the token is invalid or SplunkD has exited : Connection reset
We have valid connection to 'splunkserver.local:8089', but it still seems to be an issue for it.
Is there any way to reset the modular input state?
... View more
05-01-2016
01:01 AM
Lets assume your field is named "time", you can extract it with rex:
|rex field=time "(?\d+)" |stats sum(mins) as total
... View more
04-27-2016
04:51 AM
Fixed by reinstalling the Splunk, probally was an issue with the install itself.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-14-2022
11:56 AM
|
Karma from
Karma given to
