Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lloydknight
lloydknight
Builder
Member since:
08-11-2015
3 weeks ago
Community Statistics
| Posts | 138 |
| Solutions | 8 |
| Karma Given | 16 |
| Karma Received | 15 |
| Member Since | 08-11-2015 |
Activity Feed
- Got Karma for Re: Password Universal Forwarder. 06-05-2020 12:51 AM
- Got Karma for Re: How to not sort CSV file fields. 06-05-2020 12:50 AM
- Karma Re: Starting Splunk Light for skoelpin. 06-05-2020 12:49 AM
- Got Karma for Re: How to Identify sourcetypes by logs. 06-05-2020 12:49 AM
- Got Karma for Re: How to Identify sourcetypes by logs. 06-05-2020 12:49 AM
- Got Karma for Re: How does the Splunk internal search functionality work?. 06-05-2020 12:49 AM
- Got Karma for Re: Combining unique field values. 06-05-2020 12:49 AM
- Got Karma for Re: ITSI installation. 06-05-2020 12:49 AM
- Got Karma for Re: How does reindexing data count against the license?. 06-05-2020 12:49 AM
- Got Karma for Re: Starting Splunk Light. 06-05-2020 12:49 AM
- Got Karma for Re: How do you detect WannaCry by Splunk Enterprise Security Content Updates?. 06-05-2020 12:49 AM
- Got Karma for Re: Explain Data Models (Like I'm Four). 06-05-2020 12:49 AM
- Karma Re: How to get my eval statement to output a certain value, even if there is no result for a certain field? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Splunk IT Service Intelligence: How is the Importance Value for KPIs calculated that contribute to the Service Health Score? for appache. 06-05-2020 12:48 AM
- Karma Re: Splunk Machine Learning Toolkit: Added CorrelationMatrix algo but cannot import name BaseAlgo for aljohnson_splun. 06-05-2020 12:48 AM
- Karma Re: Splunk Machine Learning Toolkit: Added CorrelationMatrix algo but cannot import name BaseAlgo for aljohnson_splun. 06-05-2020 12:48 AM
- Karma Re: Conflicting multiple values using eval command for DalJeanis. 06-05-2020 12:48 AM
- Karma Re: Conflicting multiple values using eval command for richgalloway. 06-05-2020 12:48 AM
- Karma Re: How do I handle fields with nothing between a delimiter on a rex field extraction? for Ravan. 06-05-2020 12:48 AM
- Karma Re: Splunk ITSI 2.2.0 integration to Remedy 7.6.04 for hjauch_splunk. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-22-2020
01:24 PM
Apologies as I got confused on the wordings, here it is:
Incorrect path: /Applications/Splunk/etc/apps/my_app/local/bin/run_it.sh
Your script location: /Applications/Splunk/etc/apps/my_app/bin/run_it.sh
Have you tried running the commands below already for checking?
$SPLUNK_HOME/bin/./splunk list monitor
$SPLUNK_HOME/bin/./splunk cmd btool check
$SPLUNK_HOME/bin/./splunk cmd btool check --debug
... View more
05-22-2020
12:59 PM
Hello @eregon
First time encountering the word splunkthiasts. 🙂
My answer would need you to hop on several links btw.
Below link is similar to your query which the main requirement is to anonymize the data but would need to be used as non-anonymized too for different use:
https://answers.splunk.com/answers/824299/anonymize-data-from-json-file.html
As I've suggested to check the link below, common perception for somewhat-replicated data would be a double-hit license usage"
https://answers.splunk.com/answers/690291/one-source-to-two-indexes.html
Similarly, you can actually achieve the "one data (anonymized and non-anonymized) to two indexes solution" without hitting a double license usage:
(check woodcock's answer on the link below)
https://answers.splunk.com/answers/567223/how-to-send-same-data-source-to-two-or-multiple-in-1.html
Hope it helps!
... View more
05-22-2020
12:30 PM
Hello @AnujaJ
Though I haven't tried this yet, I think this can be achieved by forwarding the anonymized event at index-time to the intended customer index and forward a separate non-anonymized event on an admin-only index.
Caveat for this is it would double your license usage.
Please see link below if my answer is what you're aiming for:
https://answers.splunk.com/answers/690291/one-source-to-two-indexes.html
EDIT:
You can actually achieve the "one data source (anonymized and non-anonymized) to two indexes solution" without hitting a double license usage:
(check woodcock's answer on the link below)
https://answers.splunk.com/answers/567223/how-to-send-same-data-source-to-two-or-multiple-in-1.html
Hope it helps!
... View more
05-22-2020
11:41 AM
Hello @jaimelopez
Aside from both A and B's KPI Importance value set to 11, may I know if you've set entities on them and what are the thresholds of A and B KPI?
While the condition on "KPI A" was met while "KPI B" did not, my hunch is that they both have different thresholds set and should you have defined entities for both KPIs, did you split the aggregation of data by entities?
... View more
05-22-2020
11:18 AM
Hi @abhi04
Though I'm not quite sure if there's a best practice on implementing HEC for Distributed deployment, you can apply persistent queues to improve the data input process and potentially prevent data loss.
Please see link below for more information regarding this:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Usepersistentqueues
... View more
05-22-2020
10:42 AM
To add, I'm not sure if there's a significant difference if you'll not use the runtime of the searches itself.
Check this out also:
https://answers.splunk.com/answers/235005/including-search-run-time-in-search-results.html
... View more
05-22-2020
10:33 AM
Hello @SLSorensen
Looks more like a browser issue than Splunk.
Have you tried using a different browser?
or cleared the cache of your current browser?
or checked the browser Developer tools (assuming you're using Chrome) and see if it will show some error before and after the page goes blank?
... View more
05-22-2020
07:37 AM
Hi @brpsingara
| metadata type=hosts index=_internal
| rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update"
| fieldformat Count=tostring(Count, "commas")
| fieldformat "First Event"=strftime('First Event', "%c")
| fieldformat "Last Event"=strftime('Last Event', "%c")
| fieldformat "Last Update"=strftime('Last Update', "%c")
This sample search is basically just taken on the official docs Search Reference.
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Metadata
Hope it helps!
... View more
05-05-2020
03:27 PM
hello @gcusello
I don't like automatic lookups so as not to lose the thread of logic of a search.
About this one worst practice, I understand that this facility has a performance impact but this is always being catered on the intro courses. What alternatives will you recommend should we avoid automatic lookups aside from using | inputlookup ?
Sorry for this question under a comment.
... View more
04-30-2020
02:47 AM
you cannot search anything on the SH (assuming no data on index=apache) but you see traffic logs (assuming the forwarder is already connected to the indexers)
have you tried checking on splunkd.log if there are any errors? are the sources being monitored? (run ./splunk list monitor on the UF)
... View more
04-28-2020
10:20 PM
Hello @wwhite12
Place the bin outside the local directory.
The run_it.sh script should be located inside the $SPLUNK_HOME/etc/apps/my_app/bin/ for Splunk to be able to run it.
If bin is not existing, you just have to create it and place the script inside with atleast a chmod u+x run_it.sh permission.
Hope it helps!
... View more
04-28-2020
06:07 PM
1 Karma
Hello @edgarsilva01
I believe the question is more on user's operating system rights/permission to modify the UF.
As the admin or root user has all the rights to uninstall/delete a UF in most cases, you may need to set a governance should the said user be assigned as admin/root or not.
Linux:
Best practice on UF installation is to not install it as root. Try to set a splunk:splunk (user:group) for this and set permissions for this splunk-specific user:group.
https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser
Windows:
Though I'm not very particular on Windows installations but UF is installed as Admin in most cases. Then from here, user rights can be managed on AD.
Should the UF was installed on a non-admin user, the forwarder installs and runs in "low-privilege" mode.
https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller
Hope it helps!
... View more
03-12-2020
09:23 PM
sorry for bumping up this question/answer.
@amitgg will you kindly share the solution and steps on how did you do this? this will help everyone that's seeking this kind of integration.
Many thanks!
... View more
10-26-2019
12:37 PM
Hello @kiranhar
See this link below:
https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges
You're not supposed to deploy apps directly on a Search Head Cluster using the Deployment Server.
Let me know if this is not the case.
Thanks!
... View more
10-26-2019
12:32 PM
Hello @kiranhar
are you trying to deploy an add-on using Deployment Server on a Search Head Cluster?
... View more
10-25-2019
07:19 AM
1 Karma
Can you try importing your csv file using Lookup File Editor App?
... View more
10-15-2019
11:07 PM
Hello @joshuabiggley,
Do you have steps on getting in NPM data to Splunk?
... View more
03-26-2019
03:14 AM
Hello Splunkers,
So I'm planning to follow the Splunk Blog link below:
https://www.splunk.com/blog/2018/05/17/ingest-netcool-alerts-into-splunk-itsi-event-analytics.html
Already checked the prerequisites.
My questions are:
Has anybody tried the link and encountered any issue?
So kvstore_to_json.py is involved. It says in the blog that:
6.b. Restore the aggregation policy on the ITSI server via the kvstore_to_json.py command line utility. When prompted for the version of the backup, enter 2.6.
I'm just concerned on this part as I have already encountered an issue in upgrading Splunk ITSI before from the earliest version up to 3. Filed a ticket and the ticket was actually not resolved.
How does this restore aggregation policy work? Are there any possible impact or risk on this?
Much appreciated!
-Lloyd
... View more
06-17-2018
04:01 PM
Hello @navd
You may refer to this link to access the field extractor,
Or you can extract fields using regex. See link.
Also, if the provided sample event is in uniform with the succeeding events, try this query:
your base search | rex "\ERROR ERROR - - - - (?<Exception>.*)\:"
Hope it helps!
... View more
06-11-2018
09:36 AM
Hello @hgehrts_splunk,
I would like to use the add-on as much as possible to configure the integration faster. Base on the add-on's details, it's using dummy values for the OIDs as an example which I am confused. I found this link which tells me the Splunk Enterprise OID is 27389. The documentation used "1.3.6.1.4.1.27389.1.1" . Is this constant or configurable or where can I find this if ever?
From what I understand on SNMP, the one who sends the data is the one who provides the OID.
... View more
06-11-2018
07:25 AM
Hello All,
So I've been searching how to send an SNMP to Netcool and I found these information below:
http://docs.splunk.com/Documentation/Splunk/6.3.12/Alert/SendingSNMPtrapstoothersystems
https://splunkbase.splunk.com/app/3596/#/details
We're currently using Splunk 7.0.3 and it seems that the add-on is the only way to get this requirement done.
I'm not very familiar with this kind of integration as I'm used to getting data in to Splunk, not getting data in to external tools using Splunk.
Though the add-on shows the steps in an orderly manner, but I'm still having a hard time following the steps like how my Splunk search should look like in the parameter $result.host$ and $result.splunk_field_name$ ? Where can I get the OIDs stated on the configuration?
If I were to use the SendingSNMPtrapstoothersystems on the official doc, are there any workarounds to use it on 7.0? If there is, is there a clear method of procedure to do it with simple examples?
Thank you very much for your help!
... View more
05-30-2018
08:41 PM
where to install this app by the way?
if this app will send the custom alerts to netcool, should we install this to the indexers? or search head?
... View more
05-30-2018
06:57 PM
Hello @jadengoho
have you tried this one already?
https://answers.splunk.com/answers/205777/how-to-use-inputlookup-with-realtime-search.html
... View more
03-27-2018
02:21 AM
Hello @nuaraujo
try something like this.
... | rex field=message "USER:\s(?<username>.+?)\s(?<operation>\w+\s\w+)\s\-?\s(?<id>\d+)\.?\s(?<message>.*)"
Hope it helps!
... View more
03-26-2018
06:15 AM
Hello @Venkat_16
Housekeeping on Splunk really depends on the activity of what Splunk does on the server.
It could be a splunkd.log that contributes on eating up space on filesystem of a legacy server, a UF that monitors a huge amount of transaction logs as per requirement that contributes to huge spikes/overheads on system resource, changing configurations on limits.conf that exceeds the default/best practice as per documentation which you have to really do it to fulfill the requirement then generates massive internal logs that eats up space and contributes again on the system resource (CPU/Memory) and you create work arounds to correct the performed configuration.
It's really a case to case basis depending on the operation where the you will perform the housekeeping procedures.
Hope it helps!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma from
Karma given to
