Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Ant1D
Ant1D
Motivator
Member since:
08-25-2010
05-17-2021
Community Statistics
| Posts | 319 |
| Solutions | 19 |
| Karma Given | 26 |
| Karma Received | 96 |
| Member Since | 08-25-2010 |
Activity Feed
- Got Karma for Where is the Splunk Forwarder older versions page?. 11-18-2021 11:36 AM
- Got Karma for Users who are logged in right now. 09-29-2020 09:39 AM
- Karma Re: Message "Eventtype 'wineventlog-ds' does not exist or is disabled" appears in splunk app for *nix for tsweet_splunk. 06-05-2020 12:48 AM
- Karma Re: Where is the Splunk Forwarder older versions page? for Richfez. 06-05-2020 12:48 AM
- Got Karma for Re: As a Splunk admin user, why am I unable to access the roles menu ("Access controls")?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Karma Re: Can SSL configuration be applied on Splunk Universal Forwarders? for mmccullough_mer. 06-05-2020 12:47 AM
- Karma Re: How can we find all the searches, Alerts, Dashboard and ... created (saved) by a user? for mparks11. 06-05-2020 12:47 AM
- Karma Unable to add TCP Data Inputs in Splunk Cloud for bobbyavn. 06-05-2020 12:47 AM
- Got Karma for Is it possible to run dashboard panel searches in a staggered sequence instead of all at once?. 06-05-2020 12:47 AM
- Got Karma for Can SSL configuration be applied on Splunk Universal Forwarders?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to enable License Usage logging on a license slave?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to run dashboard panel searches in a staggered sequence instead of all at once?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 9 | |||
| 1 | |||
| 0 | |||
| 4 | |||
| 1 |
11-01-2019
07:55 AM
The issue was with outputs.conf.
There were a number of outputs.conf configuration with similar tcpout stanzas which were causing some config to take precedence over other configuration.
... View more
11-01-2019
07:52 AM
Both of these were setup correctly. I have fixed the issue.
... View more
10-25-2019
09:10 AM
The index=index_names in inputs.conf on the Linux forwarder match the indexes created on the Windows indexer where the data is not being indexed. Yet this Windows indexer is having no issue indexing _internal logs from the Linux forwarder.
It is a manual inputs.conf on the forwarder. Both the _internal and os logs get indexed fine in the separate Linux Splunk instance but the Windows indexer only chooses to index the _internal logs. Both the Windows indexer and the separate Linux Splunk instance have the same indexes created.
This is weird
... View more
10-25-2019
05:46 AM
Hi,
I set up a Linux forwarder to forward os logs to a Windows indexer as a test. The Windows indexer is running Splunk Free (500MB per day license limit).
After setting this up I am only seeing Splunk internal logs (e.g. _internal) when querying data on this indexer. The index (index=myindex) on the indexer which I have configured to receive the os logs is empty. Nothing has been written to this index. The forwarder has been configured to forward data to index=myindex.
Any ideas why my indexer is indexing internal logs from this forwarder but is not indexing os logs?
This forwarder is also forwarding the os logs to a separate Linux Splunk instance and it is working as expected there (i.e. This Linux Splunk instance indexes both os and Splunk internal logs).
Thanks
... View more
07-09-2018
02:58 AM
Hi,
Is it possible to do the following on one Splunk Universal Forwarder:
inputs.conf
`[WinEventLog://Security]
renderXml = true
_TCP_ROUTING = splunk_indexer
To route Security WinEventLog in XML format from Splunk Universal Forwarder to Splunk indexer`
`[WinEventLog://Security]
renderXML = false
_TCP_ROUTING = third_party_tool
To route Security WinEventLog in plain text format from Splunk Universal Forwarder to third party tool`
How can I make it so that the Splunk Forwarder does not merge the attributes together into one?
Why you ask? The third party tool does not want to accept data in XML format and the Splunk indexer is currently accepting this data in XML format and we do not want this to change.
Thanks.
... View more
05-25-2017
07:53 AM
Hi,
I am aware that it can be done at search-time via props.conf:
[sourcetype]
EVAL-_raw = urldecode(_raw)
Is it possible to urldecode(_raw) at index time in Splunk? I want to perform a urldecode on _raw with the result being assigned to the _raw which will then be indexed by Splunk.
Is there a RegEx that can decode any url?
Thanks in advance for your help.
... View more
05-18-2017
08:53 AM
I am not sure if the SimpleXML method would work.
According to the documentation here when it comes to drilldowns, the only attribute available for the tag is field. The match attribute is only available for inputs
... View more
03-03-2017
04:41 AM
Can Splunk please include something in a future version that prevents certain Splunk capabilities from being removed if the removal can result in breaking the admin account?
... View more
Figured it out...
Visited the URL (https://MyServer:8089/servicesNS/admin/system/data/modular-inputs) and got the following message:
`
In handler 'modular-inputs': You (user=admin) do not have permission to perform this operation (requires capability: list_inputs).
`
Made necessary tweak to authorize.conf in $SPLUNK_HOME/etc/system/local/authorize.conf
Then refreshed the necessary endpoint: http(s)://yourserver:8000/en-US/debug/refresh?entity=admin/auth-services
... View more
03-03-2017
04:13 AM
Hi,
In Splunk Web when logged in as admin, I go to Settings > Access controls, and get the following message:
Fail: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/admin/system/data/modular-inputs?count=-1
Details: None
What does this mean and how can I fix it?
The message appears when I click many of the options under the Settings menu
... View more
03-15-2016
02:32 AM
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles
The section titled Handling events with multivalue fields seems to be what I am looking for. The below does what I need.
In transforms.conf:
[mv-check]
REGEX = Check=(?<Check>\d+)[,\s]+
MV_ADD = true
In props.conf:
REPORT-mychecks = mv-check
... View more
03-15-2016
01:03 AM
Hi, thanks for this but it is not what I am looking for. I want the fields "Check" and "Server" to be assigned all of the fields in the event without having to use any additional search commands. Is there Splunk config which will force this to happen?
... View more
03-15-2016
12:59 AM
Splunk extracts the first occurrence only by default. What I am expecting is for the field "Check" to be assigned values 01, 02, 03, 04 and 05
... View more
03-14-2016
09:48 AM
Hey,
I have some data that looks like this:
Jan 01 01:02:03 host123 serial123 Version=1.0, Check=01 , Check=02 , Check=03 , Check=04 , Check=05 , Server=ABC, Server=DEF
Splunk is currently only extracting the first occurrence of field Check (i.e. 01) and field Server (i.e. ABC) by default.
What do I need to add to the Splunk config to force all occurrences of these fields to be extracted?
Thanks
... View more
03-08-2016
04:36 AM
9 Karma
Hi,
Can someone please kindly provide a link to the Splunk Forwarder older versions page?
Thanks
... View more
07-14-2015
01:44 AM
mysearchheadhost was replaced with the name of the search head. This is a Windows instance so I did not use your command. I deleted the "mysearchheadhost" directory then I logged in to splunkweb on the search head and re-entered the admin/password details for the indexer in the distributed search peers view. Note, I did not delete the search peer, I just re-entered to admin/password details and "mysearchheadhost" directory re-appeared on the indexer. What is the name of the key that must be deleted? The only key found in "mysearchheadhost" directory is trusted.pem
... View more
07-13-2015
08:52 AM
I deleted the folder $SPLUNK_HOME/etc/auth/distServerKeys/mysearchheadhost. I did not see a message saying that replication had failed for the indexer. I entered the admin/password and saved but the warning is still there. The warning occurs once a minute on each indexer.
... View more
06-25-2015
01:42 AM
Hi, this is a 6.1 instance. Are there any alternatives other than adding the License Master as a peer?
... View more
06-24-2015
09:29 AM
1 Karma
Hi,
Is it possible to enable license usage logging on a license slave?
We have a splunk instance that is connected to a remote license master. The remote license master also manages licenses for other Splunk instances that we do not own. We want our license_usage logging available locally as we do not look after or manage the license master. This would be helpful for configuring the Splunk Deployment Monitor App that we have installed on our local instance.
The only events I can see in the license_usage.log are:
LicenseUsage - type=Message - License usage logging not available for slave licensing instances, please see license_usage.log on license master
Can we make this logging available locally without adding the remote license master as a search peer?
Thanks
... View more
06-24-2015
02:36 AM
OK I will try this when I have a moment and see if it fixes the issue. Thanks
... View more
06-24-2015
01:19 AM
Hi Lucas, when you say "On the search head readd the indexer via the gui" do you mean add this indexer as a search peer of that search head again?
... View more
06-09-2015
04:28 AM
Hi,
We have a v6.1.6 Windows server 2008 distributed Splunk environment.
On the Indexers the following event is being written to splunkd.log every minute:
WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user
What could be causing this and how can I make this go away?
Thanks in advance for your help
... View more
11-05-2014
09:15 AM
1 Karma
Hi gkanapathy, thanks for your feedback. I understand although this workaround will be cumbersome to manage. I think this is something for Splunk maybe to implement in a future version of Splunk.
... View more
10-31-2014
09:57 AM
4 Karma
Hey,
I have a dashboard with 6 charts. When I open this dashboard in my browser, Splunk attempts to run all 6 searches at the same time to produce these 6 charts. Is there a way to stagger the running of these searches when the dashboard is opened?
Essentially I would like the first chart to load before the second chart starts to load, I would like the second chart to finish loading before the third chart search is executed and so forth.
Post processing is not the answer because the searches are unrelated (the 6 charts are from 6 different unrelated indexes).
Thanks in advance for your help.
... View more
10-22-2014
08:36 AM
Hi Jeremiahc4,
Thanks for your answer. I have looked at the documentation before posting the question and have concluded the same but I was hoping that someone who has implemented this already can confirm.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-17-2021
11:31 AM
|
Karma given to
