About cdo_splunk

cdo_splunk · ‎10-16-2018

To identify which entries need to be re-encrypted, you may do the following: 1) Go to the location where Splunk is installed. By default, this is /opt/splunk on Linux, and c:\Program Files\Splunk on Windows. This command will run on window powershell 2) C:\Program Files\Splunk> Get-ChildItem -Recurse *.conf | Select-String -Pattern '\$1\$.' -List This command will run on linux 3) Run one of the following grep commands find ./etc/ -type f -name "*.conf" -exec grep -iH "\$1\$." {} \; find ./etc/ -type f -name "*.conf" | xargs grep -iH "\$1\$." You should get a list of all files which have a password encrypted using the splunk.secret. Examples of this are: ./etc/system/local/authentication.conf:bindDNpassword = $1$tiw5an/3CRc1dmTN7pdI ./etc/system/local/server.conf:#sslPassword = $1$0X18KG2mW3RH ./etc/system/local/server.conf:sslPassword = $1$1Xl8LyvJ ./etc/system/local/server.conf:pass4SymmKey = $1$hjEodCjgECZH ./etc/system/local/server.conf:pass4SymmKey = $1$hD0kcyHJ ./etc/apps/testapp/default/outputs.conf:pass4SymmKey = $1$liw5fz32GCB0U32Mvdd3MZ4HxFE= ./etc/apps/testapp/default/server.conf:pass4SymmKey = $1$hD0kcyHJ 4) Go to each of the files listed in step #2 or #3, and change the password to the clear text version used in your deployment. Example: In server.conf, there are at least three locations where pass4SymmKey may be entered. You will need to locate each one, and enter the correct value in clear text. If the password is mySecretPassword, edit the identified file, and make the following change. Pass4SymmKey = $1$1Xl8LyvJ í Pass4SymmKey = mySecretPassword 5) After all the appropriate changes have been made, stop and restart the Splunk services. All your passwords should be re-encrypted using the new splunk.secret.

cdo_splunk · ‎04-13-2018

The splunk.secret file is located in the $SPLUNK_HOME/etc/auth directory. It is used to encrypt and decrypt the passwords in the Splunk configuration files. If the splunk.secret file is removed, a new one is automatically generated. When this occurs, the decryption of passwords in the configuration files will no longer yield the correct value, and communication will stop. You will need to enter the clear text (unencrypted value) for all passwords in the configuration files, and then restart Splunk. This will encrypt these values again using the new splunk.secret. To identify which entries need to be re-encrypted, refer to the answer below.

cdo_splunk · ‎06-13-2017

This search does not return the correct disk space for a server | rest splunk_server= /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = capacity - free | eval pct_usage = floor(usage / capacity * 100) | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)" do you know any search that return the correct partition disk space?

cdo_splunk · ‎05-30-2017

To resolve the issue, try the step listed below: [install] allows_disable=true Please do the same for all the apps that listed with the aboved errors and re-tried the upgrade Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/SA-IdentityManagement/enable: ('The read operation timed out',)",) To fix this one, try the following step: vi /opt/splunk/etc/apps/SA-IdentityManagement/local/app.conf [install] allows_disable = true state = enabled <----deleted this line Splunkd daemon is not responding: (u"Error connecting to /services/apps/local/DA-ESS-ThreatIntelligence/disable: ('The read operation timed out',)",) To fix this one, try the following step: vi /opt/splunk/etc/apps/SA-ThreatIntelligence/local/app.conf [install] allows_disable = true state = disabled <-----------removed this line saved & restarted splunk ran setup again

cdo_splunk · ‎05-30-2017

upgraded Splunk Enterprise Security (ES) from v4.5.2 and after restarting Splunk and navigating to the ES app, we receive the error: "Install cannot continue because some apps are configured to deny disablement: SA-IdentityManagement,SAThreatIntelligence,Splunk_TA_windows,Splunk_TA_sourcefire,DA-ESS-ThreatIntelligence,DA-ESS-NetworkProtection,SA-EndpointProtection,DA-ESS-IdentityManagement,DA-ESS-EndpointProtection,DA-ESS-AccessProtection,Splunk_SA_CIM,SA-AccessProtection,Splunk_SA_ExtremeSearch,SA-UEBA,SA-Utils,TA-nmap,Splunk_TA_oracle,Splunk_TA_nix,SA-AuditAndDataProtection,Splunk_TA_ossec,SA-NetworkProtection"

cdo_splunk · ‎01-18-2017

How to search the Splunk system to find the current number of concurrent searches vs the max number of concurrent searches?

cdo_splunk · ‎12-15-2016

So far: - The proposed query worked well in reports - The proposed query worked well in dashboards without explicit time picker (just putting doubled symbol $) When I add an Explicit Time Picker to the dashboard and associate it without each panel, the proposed query shows an error: Error in 'map': Did not find value for required attribute 'searchquery'. Remembering that when “searchquery string variable” assumes value between one $ symbol in the dashboard, It returns to the undesirable message “Search is waiting for input” With double $$ applied to “searchquery string variable”, the query in dashboard works well without associated time picker, and starts presenting error when associate it to an explicit time picker

cdo_splunk · ‎12-13-2016

The search below works only in reports, not in dashboards sourcetype=ped_venda_e_remessa_via_arq Tipo_Linha=WS |fields Num_Remessa |dedup Num_Remessa | mvcombine delim="," Num_Remessa |nomv Num_Remessa |eval searchquery="SELECT VBELN, COUNT(VBELN) AS CONTAGEM FROM SAPSR3.LIPS WHERE VBELN IN (".Num_Remessa.") GROUP BY VBELN ORDER BY VBELN" | map search="|dbxquery connection="SAP_PRD_DR" query=$searchquery$ shortnames=true" | join VBELN [search sourcetype=ped_venda_e_remessa_via_arq Tipo_Linha=WS | fields Num_Remessa | stats count by Num_Remessa | rename Num_Remessa AS VBELN] My interpretation of the error: The statement query=$searchquery$ works well in reports, because is correctly interpreted as a string variable. The same statement in dashboards does not work, probably because is interpreted as an "input token"., so the dashboard gets frozen, awaiting for an data input before showing the results. If I adapt my query to the proposed solution by Splunk (putting an input token by time), and inserting it in the dashboard as a "Search Report" my problem will persist in the dashboard: The statement query=$searchquery$ will continue "awaiting for a data input" that does not exist If I adapt my query to the proposed solution by Splunk (putting an input token by time), and inserting it in the dashboard as a "Report", The statement query=$searchquery$ will works well, but the statement with the "input token by time" will not be interpreted well, because the dashboard code will just calls the query name (not the statement in full), and the "input token by time" will not receive a proper value. We need at least one of the two below - A way to “Search Report” specific query works well in the dashboard; OR - A way to “Report” specific query allows filtering by date/time in the dashboard

cdo_splunk · ‎11-28-2016

Any one know of a search that will look for Splunk apps that have not been used by any user for a week, etc?

cdo_splunk · ‎09-29-2016

1) download file mysql-connector-java-5.1.39.tar.gz from the official MySQL downloads 2) unpack the file using tar xzf mysql-connector-java-5.1.39.tar.gz 3) change into unpacked directory - cd mysql-connector-java-5.1.39 4) locate the jar file mysql-connector-java-5.1.39-bin.jar 5) copy this jar file into directory /opt/splunk/etc/apps/splunk_app_db_connect/bin/lib on the index server 6) make sure to set ownership and permissions - chown splunk:splunk /opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/mysql-connector-java-5.1.39-bin.jar - chmod 755 /opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/mysql-connector-java-5.1.39-bin.jar 7) add in CLASSPATH into splunk user .bash_profile which is located in /opt/splunk/.bash_profile CLASSPATH="/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/mysql-connector-java-5.1.39-bin.jar" export CLASSPATH 8) restart the splunk daemon

cdo_splunk · ‎09-29-2016

issue with using mysql-connector-java-5.0.8-bin.jar for dbconnect 2.30 restarted the splunk daemon but it still says "com.mysql.jdbc.Driver is not installed" for the MySQL drivers as shown in db connect - settings - drivers section

cdo_splunk · ‎08-10-2016

1/using the latest JTDS drvier 1.3.1 2/Identity -> enter servername with the username in the credential as example dbusername@servername instead of just the username portion 3/Connection--select MS SQL server using JTDS driver

cdo_splunk · ‎08-10-2016

How to connect to Azure SQL data with JTDS driver for dbconnect version 2.x ?

cdo_splunk · ‎03-09-2016

When the ePO server is in a domain and an Agent Handler is installed in the DMZ, the Agent Handler cannot connect to the database because it cannot use domain credentials. Solution Configure the Agent Handler to use the SQL sa account. Enable the sa account or create a new SQL account 1. Open SQL Management Studio. 2. Expand Security, Logins and double-click the sa account. 3. Type and confirm a password in the General tab under the Login name section. 4. Set Login to Enabled in the Status tab and click OK. 5. Right-click the database instance name and click Properties. 6. Select SQL Server and Windows Authentication mode in the Security tab to enable the sa account. Change the account to use for connecting to the database 1. Open a web browser and go to https://localhost:8443/core/config-auth (where 8443 is the port for the console communication). 2. Log on with ePO credentials. 3. Delete the entry in the User Domain field. 4. Type sa in the User name field. 5. Type the password for the sa account into the User password and Confirm password fields. 6. Click Test Connection. 7. Click Apply only if the test is successful.

cdo_splunk · ‎03-09-2016

How to change sql server window authentication for EPO db to sql server authentication for dbconnect version 2.x DBconnect version 2.1.3 support sql server domain authentication with splunk server for linux using JTDS driver version . Currently JTDS driver 1.3.1 for dbconnect version 2 using java 1.8 does not support connection through ssl. If user needs to use ssl connection then user needs to use the sql server JDBC driver and that only work for sql server authentication

cdo_splunk · ‎01-22-2016

1/Install dbconnect version 2.1.1. 2/modify the jdbc url jdbc:sqlserver://;databaseName=;selectMethod=cursor 3/Set the host to [Server][Instance] leaving the port blank. JDBC article showing the proper URL string: http://www.codejava.net/java-se/jdbc/connect-to-microsoft-sql-server-via-jdbc

cdo_splunk · ‎01-22-2016

How to configure dbconnect version 2 with sql server using sql server instance without port?

cdo_splunk · ‎09-18-2015

this one worked | rest /services/search/jobs | table author eai:acl.owner sid label eventSearch splunk_server searchProvider | where sid like "%%" and splunk_server like "%"

cdo_splunk · ‎09-03-2015

I tried the query and get the error Unknown search command 'dmc'.

cdo_splunk · ‎09-01-2015

I ran the search that returned no results. index=_internal source="metrics.log" splunk_server="" group= "per_index_thruput" | eval MB=kb/1024 | chart sum(MB) by series | sort - sum(MB) I can see there is raw data, but as soon as I added group=per_index_thruput, no results found. Somehow, it does not recognize the field “group” despite the field shows up in the left menu. I can workaround it by surrounding it with double quotes "group=per_index_thruput" which forces splunk to search on the entire string — or just use per_index_thruput.

cdo_splunk · ‎09-01-2015

How to crossreference the search ID to the search owner and search name? Example if another person created a search and I ran it and I want to know base on the search id , who create it and what is the search name?

cdo_splunk · ‎08-21-2015

Which one is better use for performance for comment ? Eval comment or rename comment?

cdo_splunk · ‎08-20-2015

Version 6, Django page is using port 8000 but still being prompt for login for SSO.

cdo_splunk · ‎06-30-2015

thanks Martin, It worked now :<). You are the best

cdo_splunk · ‎06-30-2015

Thanks! Your worked partially. It showed all the role but not all indexes. It does not showed index like _fishbucket, _audit , _blocksignature , _introspection and user created indexes

Posts	50
Solutions	9
Karma Given	15
Karma Received	72
Member Since	‎10-20-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

What is the splunk.secret file, and is it possible...

How to edit my search to find server disk space?

Splunk Enterprise Security: After upgrading, why d...

How to search the Splunk system to find the curren...

How to edit my search to allow filtering by date a...

How to generate a search that will look for Splunk...

issue with using mysql-connector-java-5.0.8-bin.ja...

how to connect to Azure SQL data with JTDS driver ...

How to change sql server window authentication for...

How to configure dbconnect version 2 with sql serv...

Re: What is the splunk.secret file, and is it poss...

What is the splunk.secret file, and is it possible...

How to edit my search to find server disk space?

Re: Splunk Enterprise Security: After upgrading, w...

Splunk Enterprise Security: After upgrading, why d...

How to search the Splunk system to find the curren...

Re: How to edit my search to allow filtering by da...

How to edit my search to allow filtering by date a...

How to generate a search that will look for Splunk...

Re: issue with using mysql-connector-java-5.0.8-bi...

issue with using mysql-connector-java-5.0.8-bin.ja...

Re: how to connect to Azure SQL data with JTDS dri...

how to connect to Azure SQL data with JTDS driver ...

Re: How to change sql server window authentication...

How to change sql server window authentication for...

Re: How to configure dbconnect version 2 with sql ...

How to configure dbconnect version 2 with sql serv...

Re: How to crossreference the search ID to the sea...

Re: How to crossreference the search ID to the sea...

Search using field value yields no results

How to crossreference the search ID to the search ...

Re: Add a comment to a search?

Re: framework and splunk both run?

Re: How can I search a list of users with all the ...

Re: How can I search a list of users with all the ...