Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About landen99
landen99
Motivator
Member since:
02-26-2014
07-02-2024
Community Statistics
| Posts | 475 |
| Solutions | 19 |
| Karma Given | 191 |
| Karma Received | 167 |
| Member Since | 02-26-2014 |
Activity Feed
- Got Karma for Re: renaming fields in search. 01-02-2025 04:35 AM
- Got Karma for Re: Merge two fields into one field. 10-23-2024 09:28 AM
- Got Karma for Re: Merge two fields into one field. 10-23-2024 09:24 AM
- Got Karma for Re: DNS debug log dns.log Format Review. 07-08-2024 10:21 AM
- Got Karma for Re: Merge two fields into one field. 04-25-2024 04:04 AM
- Got Karma for Re: Merge two fields into one field. 03-07-2024 12:35 PM
- Posted Re: Splunk time parse on Splunk Enterprise Security. 01-04-2024 09:38 AM
- Got Karma for Re: Dark theme. 06-12-2023 10:27 AM
- Got Karma for How do I get the dark theme to all of Splunk, regardless of version?. 06-12-2023 10:26 AM
- Got Karma for Re: Show all lines for Windows event-log events. 05-03-2023 09:47 AM
- Posted Re: Dealing with OMG huge events on Getting Data In. 03-08-2023 12:04 PM
- Posted Re: Browser sluggish when browsing through large raw data events. on Security. 03-08-2023 11:10 AM
- Got Karma for Re: inputlookup followed by transaction - No results found. 11-23-2022 07:30 AM
- Got Karma for Re: How can I generate a list of users and assigned roles?. 11-04-2022 06:20 AM
- Karma Re: Splunk web stuck at Loading page.. for att35. 10-12-2022 11:47 AM
- Karma Re: What are your Splunk t-shirt ideas? for nickstone. 10-04-2022 03:13 PM
- Karma Re: What are your Splunk t-shirt ideas? for ccl0utier. 10-04-2022 03:08 PM
- Posted Download Splunk Add-On Builder version 2.2.0 on All Apps and Add-ons. 10-04-2022 02:45 PM
- Posted How to resolve: ServiceNow TA Error "Failed to load current state for selected entity in form!" on Getting Data In. 08-24-2022 07:08 AM
- Got Karma for Re: how can i see all of the searches that are looking for a specific field?. 08-10-2022 08:02 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
01-04-2024
09:38 AM
If ADD_EXTRA_TIME_FIELDS = true then why wouldn't those fields be present in every event? How could we ensure that those fields are present in every event?
... View more
03-08-2023
12:04 PM
Try this at searchtime: | rex mode=sed "s/([\r\n].{1,100}).*/\1/g"
... View more
03-08-2023
11:10 AM
All of the data in those raw events is literally stored in the html that the browser has to load. If this happens with smart mode or fast mode, then your search allows the raw data to be loaded into the Events tab or into a field in the Statistics tab (perhaps an _raw field).
... View more
10-04-2022
02:45 PM
I would like to download Splunk Add-On Builder version 2.2.0 in the hopes that it can import an app create from that version. How can I get ahold of that specific version of the app?
... View more
08-24-2022
07:08 AM
Loading the Configuration page from the Splunk_TA_snow ServiceNow TA yields the following error:
Something went wrong!
Failed to load current state for selected entity in form! Error: Request failed with status code 500
ERR0005
Similarly for the inputs page yields the following error:
Failed to load Inputs Page
This is normal on Splunk search heads as they do not require an Input page. Check your installation or return to the configuration page. Error: Request failed with status code 500
ERR0001
The troubleshooting documentation only mentions something about using the admin account, which we are:
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting#Cannot_access_configuration_page
SNOW internal logs only show this error:
index=_internal sourcetype="ta_snow"
2022-08-24 13:52:12,894 INFO pid=[xxx] tid=MainThread file=snow.py:stream_events:430 | No configured inputs found. To collect data from ServiceNow, configure new input(s) or update existing input(s) either from Inputs page of the Add-on or manually from inputs.conf.
Splunkd errors show:
requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
raise ConnectionError(err, request=request)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/adapters.py", line 501, in send
r = adapter.send(request, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/sessions.py", line 645, in send
resp = self.send(prep, **send_kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/sessions.py", line 529, in request
return session.request(method=method, url=url, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/api.py", line 61, in request
**kwargs,
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/solnlib/splunk_rest_client.py", line 147, in request
response = self.handler(url, message, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 1279, in request
return self.request(url, { 'method': "GET", 'headers': headers })
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 1219, in get
response = self.http.get(path, all_headers, **query)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 685, in get
val = f(*args, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 70, in new_f
return request_fun(self, *args, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/binding.py", line 289, in wrapper
**query)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/client.py", line 795, in get
return super(Collection, self).get(name, owner, app, sharing, **query)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/client.py", line 1702, in get
response = self.get(key)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/splunklib/client.py", line 1740, in __getitem__
conf = self._confs[name]
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/solnlib/conf_manager.py", line 457, in get_conf
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/solnlib/utils.py", line 153, in wrapper
Traceback (most recent call last):
During handling of the above exception, another exception occurred:
urllib3.exceptions.ProtocolError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
return self._sock.recv_into(b)
File "/opt/splunk/lib/python3.7/socket.py", line 589, in readinto
line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/opt/splunk/lib/python3.7/http/client.py", line 280, in _read_status
version, status, reason = self._read_status()
File "/opt/splunk/lib/python3.7/http/client.py", line 319, in begin
response.begin()
File "/opt/splunk/lib/python3.7/http/client.py", line 1373, in getresponse
httplib_response = conn.getresponse()
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/connectionpool.py", line 444, in _make_request
File "<string>", line 3, in raise_from
six.raise_from(e, None)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/connectionpool.py", line 449, in _make_request
chunked=chunked,
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/connectionpool.py", line 710, in urlopen
raise value.with_traceback(tb)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/packages/six.py", line 769, in reraise
raise six.reraise(type(error), error, _stacktrace)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/util/retry.py", line 550, in increment
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/connectionpool.py", line 786, in urlopen
timeout=timeout
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/adapters.py", line 450, in send
Traceback (most recent call last):
During handling of the above exception, another exception occurred:
ConnectionResetError: [Errno 104] Connection reset by peer
return self._sock.recv_into(b)
File "/opt/splunk/lib/python3.7/socket.py", line 589, in readinto
line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/opt/splunk/lib/python3.7/http/client.py", line 280, in _read_status
version, status, reason = self._read_status()
File "/opt/splunk/lib/python3.7/http/client.py", line 319, in begin
response.begin()
File "/opt/splunk/lib/python3.7/http/client.py", line 1373, in getresponse
httplib_response = conn.getresponse()
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/connectionpool.py", line 444, in _make_request
File "<string>", line 3, in raise_from
six.raise_from(e, None)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/connectionpool.py", line 449, in _make_request
chunked=chunked,
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/urllib3/connectionpool.py", line 710, in urlopen
WARNING:root:Run function: get_conf failed: Traceback (most recent call last):
requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
raise ConnectionError(err, request=request)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/adapters.py", line 501, in send
r = adapter.send(request, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/sessions.py", line 645, in send
resp = self.send(prep, **send_kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/sessions.py", line 529, in request
return session.request(method=method, url=url, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/requests/api.py", line 61, in request
**kwargs,
File "/opt/splunk/etc/apps/Splunk_TA_snow/lib/solnlib/splunk_rest_client.py", line 147, in request
Traceback (most recent call last):
During handling of the above exception, another exception occurred:
urllib3.exceptions.ProtocolError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
return self._sock.recv_into(b)
File "/opt/splunk/lib/python3.7/socket.py", line 589, in readinto
line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/opt/splunk/lib/python3.7/http/client.py", line 280, in _read_status
version, status, reason = self._read_status()
File "/opt/splunk/lib/python3.7/http/client.py", line 319, in begin
response.begin()
File "/opt/splunk/lib/python3.7/http/client.py", line 1373, in getresponse
httplib_response = conn.getresponse()
How do we troubleshoot and solve this?
... View more
Labels
- Labels:
-
heavy forwarder
-
Linux
02-09-2022
04:34 PM
The short answer is that you changed the sourcetype before your [instance] transform could operate on it. I get that this question was first asked 6 years ago, but hopefully this answer reveals similar issues that others may be encountering. Transforms are applied in alphabetical order by the props name and in the order set in each transforms call. The order set lists createsource first and instance second: [tomcat-appl]
TRANSFORMS-set = createsource, instance So, [createsource] changes the sourcetype so that the data no longer matches "tomcat-appl" for [instance] to apply to it. Listing the props transforms calls separately follows the props name rule, where props are called in alphabetical order by prop names: [tomcat-appl]
TRANSFORMS-instance_set = instance TRANSFORMS-createsource_set = createsource [createsource] starts with a "c", which is before the "i" of [instance]. So [createsource] applies first and changes the sourcetype so that [instance] cannot apply to the data (different sourcetype now).
... View more
03-30-2021
03:59 PM
index=_internal [ rest /services/authentication/current-context/context local=t | fields + username | rename username as user | search user != "splunk-system-user" ] | dedup user | search user != "splunk-system-user" | table user
... View more
01-27-2021
11:24 AM
The following search presents the real-time searches from the audit index: index=_audit action=search info=granted search=* NOT ("search_id='scheduler" OR "search='|history" OR "user=splunk-system-user" OR "search='typeahead" OR "search='| metadata type=* | search totalCount>0" OR "| metadata type=sourcetypes | search totalCount > 0" ) "search_id='rt_*"
| table _time user host info savedsearch_name search search_id
... View more
01-27-2021
11:23 AM
Enable alerts and reports on real-time searches seen in the internal audit index.
... View more
01-22-2021
09:50 AM
It depends on what you mean by "suppress" and what you mean by csv file. If the file is a lookup file in Splunk, you can add | fields - myField Or send that to outputlookup to another lookup that is shared with those who you don't want to see the last field. If you are talking about indexing the csv, part of the configuration will have a props SED filter overwrite the data in the last column.
... View more
10-06-2020
08:27 AM
index=m1 sourcetype=m1a
| head 999
| fieldsummary
| where count>0
| table field count distinct_count values
... View more
10-06-2020
08:22 AM
| rest splunk_server=local /servicesNS/nobody/search/configs/conf-fields | fields - TOKENIZER eai:acl.can_* eai:acl.mod* eai:acl.owner eai:acl.perms* eai:acl.remov* eai:acl.sharing* acl:appName id published updated | search disabled=0 | outputlookup fields_idx.csv
... View more
09-29-2020
09:33 AM
Your inputs can be there, but it is better in an app for organization/management. Your transform extracts nothing and tries to use a list of matches, which is always bad without a good anchor. I don't understand what you mean about my 3rd option. I was providing guidance not options.
... View more
09-22-2020
07:59 AM
Or index the field and set KVMODE to none.
... View more
09-21-2020
01:21 PM
The other solution is to leave it as an indexed field and add KVMODE=false to the search head.
... View more
08-06-2020
07:03 AM
Better yet: index=_internal [ rest /services/authentication/current-context/context local=t | fields + username | rename username as user | search user != "splunk-system-user" ] | dedup user | search user != "splunk-system-user" | table user
... View more
07-01-2020
11:59 AM
| makeresults | eval weekday=strftime(_time,"%A") | table weekday
... View more
06-02-2020
03:23 PM
It's a bit more complicated than that.
map creates new searches from the results of each row that entirely replace the results of the host search.
foreach allows you to use segments from each column name to construct an eval that adds to or changes the host search results.
... View more
04-20-2020
01:49 PM
The following macro displays the wildcard string matches to a given CIDR:
rex field=cidr "^(?<ip_base>[\d\.]{7,})\/(?<ip_block>\d{1,2})$"
| rex field=ip_base "(?<ip1>\d+)\.(?<ip2>\d+)\.(?<ip3>\d+)"
| eval ip2B=case(ip_block<=8,"*",ip_block=16,ip2,ip_block=15,mvrange(ip2,ip2+2),ip_block=14,mvrange(ip2,ip2+4),ip_block=13,mvrange(ip2,ip2+8),ip_block=12,mvrange(ip2,ip2+16),ip_block=11,mvrange(ip2,ip2+32),ip_block=10,mvrange(ip2,ip2+64),ip_block=9,mvrange(ip2,ip2+128),1=1,ip2)
| eval ip3B=case(ip_block<=16,"*",ip_block=16,ip3,ip_block=23,mvrange(ip3,ip3+2),ip_block=22,mvrange(ip3,ip3+4),ip_block=21,mvrange(ip3,ip3+8),ip_block=20,mvrange(ip3,ip3+16),ip_block=19,mvrange(ip3,ip3+32),ip_block=18,mvrange(ip3,ip3+64),ip_block=17,mvrange(ip3,ip3+128),1=1,ip3)
| mvexpand ip2B
| mvexpand ip3B
| eval ip_wildcard=ip1.".".ip2B.".".ip3B.".*"
| fields - ip1* ip2* ip3* cidr_wildcard
... View more
04-20-2020
01:48 PM
Create a wildcard string for a TERM match to a cidr or list of cidrs.
This way you can search indexes or datamodels like this: index=myindex TERM(192.168.0.*) from the cidr 192.168.0.0/24
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
data model
04-20-2020
01:44 PM
1 Karma
The following macro displays the wildcard string matches to a given CIDR:
rex field=cidr "^(?<ip_base>[\d\.]{7,})\/(?<ip_block>\d{1,2})$"
| rex field=ip_base "(?<ip1>\d+)\.(?<ip2>\d+)\.(?<ip3>\d+)"
| eval ip2B=case(ip_block<=8,"*",ip_block=16,ip2,ip_block=15,mvrange(ip2,ip2+2),ip_block=14,mvrange(ip2,ip2+4),ip_block=13,mvrange(ip2,ip2+8),ip_block=12,mvrange(ip2,ip2+16),ip_block=11,mvrange(ip2,ip2+32),ip_block=10,mvrange(ip2,ip2+64),ip_block=9,mvrange(ip2,ip2+128),1=1,ip2)
| eval ip3B=case(ip_block<=16,"*",ip_block=16,ip3,ip_block=23,mvrange(ip3,ip3+2),ip_block=22,mvrange(ip3,ip 3+4),ip_block=21,mvrange(ip3,ip3+8),ip_block=20,mvrange(ip3,ip3+16),ip_block=19,mvrange(ip3,ip3+32),ip_block=18,mvrange(ip3,ip3+64),ip_block=17,mvrange(ip3,ip3+128),1=1,ip3)
| mvexpand ip2B
| mvexpand ip3B
| eval ip_wildcard=ip1.".".ip2B.".".ip3B.".*"
| fields - ip1* ip2* ip3* cidr_wildcard
... View more
04-16-2020
03:49 PM
Look at the DM constraints. DMs are picky about the format of the constraints. If there is a macro, it may be hiding a problematic constraint. For instance, you cannot include a subsearch to return a filter.
... View more
03-18-2020
04:58 PM
1 Karma
I search the same time period in wineventlogs for host values with tstats (37,558) and with regular search (42,008):
| tstats count where index=wineventlog sourcetype=wineventlog
(TERM(LogName=Microsoft-Windows-PowerShell/Operational) OR TERM(SourceName=Microsoft-Windows-PowerShell))
(TERM(EventCode=4103) OR TERM(EventCode=4104) OR TERM(EventCode=4105) OR TERM(EventCode=4106)) by host
versus:
index=wineventlog sourcetype=wineventlog
(TERM(LogName=Microsoft-Windows-PowerShell/Operational) OR TERM(SourceName=Microsoft-Windows-PowerShell))
(TERM(EventCode=4103) OR TERM(EventCode=4104) OR TERM(EventCode=4105) OR TERM(EventCode=4106))
| stats count by host
The number of ComputerName values for the same time period is 41,656, which may be less simply due to the addition of new logs to the indexers for that time period before my searches above were run. Ironically, it took less time than my search on the indexed field "host" and I don't understand that either: 375s vs 430s, respectively.
... View more
- Tags:
- splunk-enterprise
03-05-2020
09:37 AM
1 Karma
What is the purpose of the first and last parts with "^" and "^." ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-02-2024
08:32 PM
|
Karma from
Karma given to
