Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About droth333
droth333
Explorer
Member since:
06-22-2011
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 06-22-2011 |
Activity Feed
- Got Karma for Splunk 6.2 Deployment Monitor repeatedly sends "forwarder missing" alert emails. 06-05-2020 12:47 AM
- Got Karma for Computing latency between event time, arrival, and indexing. 06-05-2020 12:46 AM
- Got Karma for Computing latency between event time, arrival, and indexing. 06-05-2020 12:46 AM
- Got Karma for Computing latency between event time, arrival, and indexing. 06-05-2020 12:46 AM
- Got Karma for Event Options Menu lacks "show source" item if search has "fields" command in it.. 06-05-2020 12:46 AM
- Posted splunk validate cluster-bundle fails with "no spec file" but spec exists on Deployment Architecture. 04-07-2017 03:16 PM
- Tagged splunk validate cluster-bundle fails with "no spec file" but spec exists on Deployment Architecture. 04-07-2017 03:16 PM
- Tagged splunk validate cluster-bundle fails with "no spec file" but spec exists on Deployment Architecture. 04-07-2017 03:16 PM
- Tagged splunk validate cluster-bundle fails with "no spec file" but spec exists on Deployment Architecture. 04-07-2017 03:16 PM
- Posted Re: Azure Aplication Gateway Webapplication Firewall on All Apps and Add-ons. 02-23-2017 09:32 AM
- Posted Re: Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? on Splunk Enterprise Security. 12-16-2016 12:26 PM
- Posted Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? on Splunk Enterprise Security. 12-16-2016 10:49 AM
- Tagged Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? on Splunk Enterprise Security. 12-16-2016 10:49 AM
- Tagged Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? on Splunk Enterprise Security. 12-16-2016 10:49 AM
- Tagged Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? on Splunk Enterprise Security. 12-16-2016 10:49 AM
- Tagged Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? on Splunk Enterprise Security. 12-16-2016 10:49 AM
- Posted Re: alert scripts: where do stdout and stderr go on Alerting. 02-19-2015 12:58 PM
- Posted Splunk 6.2 Deployment Monitor repeatedly sends "forwarder missing" alert emails on Monitoring Splunk. 02-05-2015 12:34 PM
- Tagged Splunk 6.2 Deployment Monitor repeatedly sends "forwarder missing" alert emails on Monitoring Splunk. 02-05-2015 12:34 PM
- Tagged Splunk 6.2 Deployment Monitor repeatedly sends "forwarder missing" alert emails on Monitoring Splunk. 02-05-2015 12:34 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 3 |
04-07-2017
03:16 PM
Hi!
Why on splunk validate cluster-bundle do I get these errors:
No spec file for: /opt/splunk/etc/master-apps/SA-ldapsearch/local/ldap.conf
No spec file for: /opt/splunk/etc/master-apps/SA-ldapsearch/default/ldap.conf
No spec file for: /opt/splunk/etc/master-apps/SA-ldapsearch/default/logging.conf
No spec file for: /opt/splunk/etc/master-apps/SA-ldapsearch/default/ssl.conf
But the corresponding apps README has:
[splunk@scsplunkdeploy1 README]$ ls -l
total 16
-rwxrwxr-x 1 splunk splunk 3971 Nov 4 11:58 ldap.conf.spec
-rwxrwxr-x 1 splunk splunk 5616 Nov 4 11:58 logging.conf.spec
-rwxrwxr-x 1 splunk splunk 1588 Nov 4 11:58 ssl.conf.spec
How do I fix this?
Thanks,
Dave
... View more
02-23-2017
09:32 AM
Run it thru xpath! Works great.
... View more
12-16-2016
12:26 PM
Thanks smoir! Much much more clear now! Also for thanks for quick response.
... View more
12-16-2016
10:49 AM
In Splunk Enterprise Security (ES), we cannot save a correlation search as a user with ess_admin. This works if user is admin.
The navigation is: ES/Configure/Content Management/Create new Content/Correlation Search//Save
The full error is displayed in error bar in the UI:
Search could not be updated: [HTTP 500] Splunkd internal error; [{'type': 'ERROR', 'code': None, 'text': 'Unexpected error "" from python handler: "[HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/nobody/SA-ThreatIntelligence/storage/collections/data/correlationsearches/batch_save". See splunkd.log for more details.'}]
There is not much more in splunkd.log
Is "configuration" change actually a literal "admin" function?
We want to make all "users" of ES to be at most ess_admin.
Thanks,
Dave
... View more
02-19-2015
12:58 PM
Appears Splunk will find a triggered alert script in $SPLUNK_HOME/bin/scripts.
But if the script contains >> directs to a file (like for debugging), that file is written to $SPLUNK_HOME/etc/apps/search/bin (assuming the alert was written in search app).
Does that sound right, or expected?
... View more
02-05-2015
12:34 PM
1 Karma
Immediately after upgrading from 6.0 to 6.2 Indexer, we get "missing forwarder" alerts from Deployment Monitor with
subject: [SPLUNK]: DM missing forwarders.
These repeat every two hours and include every existing forwarder (which are confirmed to all be running, tailing logs, sending log data, and indexing logged data on the Indexer). One clue is that instead of listing the symbolic hostname in the "Forwarder" column (as it always has in the past), it lists the IP address.
In other words, it appears that all the existing forwarders got "duplicated" in metrics logs with their IP addresses instead of their
symbolic hostnames (like webserver.mycompany.com).
And that the Deployment Monitor thinks these are now all "missing" (maybe because all forwarders send with host=symbolic_name).
I am NOT running the Deployment Mgr itself.
Thanks!
... View more
05-17-2013
10:03 AM
Can we get a splunker to comment on this? "Error condition likely",
as in, can you name a few?
This has happened to me too, it can't be that uncommon,
though this issue has low readership.
thanks!
... View more
11-26-2012
12:08 PM
Thanks lguinn, I submitted a bug.
In general, |fields command seems perhaps buggy in 5.0.
Sorry to be so fuzzy, we just upgraded, so I'm just now looking at it.
lguinn or anybody else agree?
... View more
11-26-2012
11:35 AM
1 Karma
If you say "*" as search, you see "show source" in the Event Options Menu by every
event. If you say "* | fields site" the "show source" option disappears from this menu.
This appears to be a regression from 4.2 (at least) to 5.0.
... View more
- Tags:
- bug
- event
- showsource
12-01-2011
01:48 PM
3 Karma
I know I can get lag between the timestamp of the event, and its
index time on the indexer by using
|eval lag = _indextime - _index
Is there a value that says when it arrived on the indexer?
That would help me to know whether my indexing latency problem is
at the forwarder, at the indexer, or somewhere else.
I know these magic _* fields aren't documented, but is there such
a field as the above? Like _arrivaltime value...
Thanks.
... View more
12-01-2011
01:20 PM
This is fascinating stuff, but there's a datum missing that would
help me know everything for an indexing latency problem I have:
_time is timestamp on the event
_indextime is time it was indexed at the indexer.
need _arrivaltime, the time it arrive at the indexer.
Is there such a value?
In general where can I find these hidden groovy _* variables listed?
Thanks,
Dave
... View more
