Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About MattibergB
MattibergB
Path Finder
Member since:
06-14-2018
05-01-2023
Community Statistics
| Posts | 31 |
| Solutions | 3 |
| Karma Given | 7 |
| Karma Received | 5 |
| Member Since | 06-14-2018 |
Activity Feed
- Karma Re: Is it possible to add a default value for a lookup without match? for s2_splunk. 11-17-2022 10:45 AM
- Karma Re: tstats where index=_internal no results for martin_mueller. 01-11-2022 06:56 AM
- Posted Re: tstats where index=_internal no results on Monitoring Splunk. 01-11-2022 06:51 AM
- Karma Re: Can I delete all data from a KV store at once? for bobnieuwenhuis. 12-01-2021 04:26 AM
- Posted Re: Time range not substitued by earliest/latest on Splunk Search. 01-19-2021 10:48 PM
- Got Karma for Re: Time range not substitued by earliest/latest. 01-19-2021 03:30 PM
- Got Karma for Re: Converting MB to GB. 06-29-2020 07:59 AM
- Posted Re: alert not triggered on expected time and frequency on Alerting. 06-27-2020 11:59 AM
- Posted Re: alert not triggered on expected time and frequency on Alerting. 06-27-2020 10:26 AM
- Tagged Re: alert not triggered on expected time and frequency on Alerting. 06-27-2020 10:26 AM
- Posted Re: Converting MB to GB on Dashboards & Visualizations. 06-25-2020 12:51 PM
- Karma Re: Can you help me create the regex for an Index time field extraction? for somesoni2. 06-05-2020 12:50 AM
- Got Karma for Re: Qualys-TA ignores index setting in inputs.conf. 06-05-2020 12:50 AM
- Got Karma for Re: DBConnect pod block corrupted. 06-05-2020 12:50 AM
- Got Karma for Re: Time range not substitued by earliest/latest. 06-05-2020 12:50 AM
- Karma Re: How many pipelines should I use on a forwarder? for davidpaper. 06-05-2020 12:49 AM
- Karma Re: List difference between two csv files for tfletcher_splun. 06-05-2020 12:46 AM
- Karma Re: sedcmd not being applied for gkanapathy. 06-05-2020 12:45 AM
- Posted Datamodel Child object not accelerated on Splunk Enterprise Security. 09-30-2019 11:46 PM
- Tagged Datamodel Child object not accelerated on Splunk Enterprise Security. 09-30-2019 11:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-11-2022
06:51 AM
Thanks for the tip, i cannot find this in knows issues though. Are there any docs that state this bug?
... View more
01-19-2021
10:48 PM
@lim2 Hi, we were using splunk 7.0.3 at the time with a on prem enviroment. We had 2 search head cluster and only 1 search head cluster with this issue. I am not sure if this could still be a issue. You could check your automatic lookups and see if they use specific fields as a output.
... View more
06-27-2020
11:59 AM
But in the first case you are only looking at data that comes by in minute 50 to 59:59. So if the event that you want to trigger happens at 08:43 your search will not pick it up since it only looks at 08:50 to 08:59. You changed dispatch.earliest_time to -10m but you did not change the frequency of the search. In the second case you are looking at data from the entire previous hour so you would never miss any data.
... View more
06-27-2020
10:26 AM
I think you should check you cron schedule, it now only checks at minute 0 every hour for the last -10m so from minute 50 to 00. You could use */10 * * * * Check https://crontab.guru/#*/10_*_*_*_* for more information.
... View more
- Tags:
- I th
06-25-2020
12:51 PM
1 Karma
You could try to use the following before your timechart: | eval GB_Free=(Free_Megabytes/1024). Then change your timechart to the following: | timechart span=24h avg(GB_Free) as GB_Free
... View more
09-30-2019
11:46 PM
We created a child object within the authentication datamodel.
The authentication datamodel is accelerated, when searching the data using summariesonly=t we get data from the root and other childs but not from the child that we created. If we do not use summariesonly=t then we do see data.
As a test i cloned the entire authentication datamodel and accelerated it and then i am able to use summariesonly=t.
What we have tried:
- Rebuild the original authentication datamodel
- Clone the datamodel (works)
- Remove the child object and add it again.
The search we are using:
| tstats summariesonly=t count from datamodel=Authentication_test where nodename=Authentication.Login_Interactive
The only difference i can find is that the original datamodel is in Splunk_SA_CIM and the cloned datamodel is in SplunkEnterpriseSecuritySuite. If anyone has an idea how to get the child element accelerated in the original authentication model i would be a happy splunker.
... View more
09-30-2019
10:47 PM
Hi,
Did you ever find out why this happend?
We have a similiar issue and when i create a clone of the datamodel i am able to use tstats..
Thanks!
... View more
05-21-2019
01:09 AM
After changing the SEDCMD to the following it works, thank you for the multiline tip!
s/(?m)\/password.*$/\/password:XXXXX/g
... View more
05-16-2019
10:15 PM
To answer your questions:
1. We have restarted after each change and waited for new data to come in
2. It is a multiline event, we tested the command via CLI and that worked but it might not work in Splunk.
3. We are running splunk 7.0.3 i though a eval only worked from 7.1 or 7.2 and up? But i like the idea so i will try to find a way to add something to see if the sourcetype is correct.
Thank you for you comment!
... View more
05-16-2019
06:54 AM
Hi,
You could use something like the following:
index=_internal earliest=-2d@d latest=-0d@d
source=/opt/splunk/var/log/splunk/license_usage.log*
| eval gb=round(b/1024/1024/1024,2)
|bin span=1d _time
| stats sum(gb) as gb by idx _time
| sort by idx
it will show the gb per index per day, you can change the earliest to find older data.
You could add splunk_server to stats sum(gb) as gb by idx _time splunk_server
Then you can see the difference between your servers.
... View more
05-16-2019
06:25 AM
We are trying to mask some data from winhostmon using SEDCMD.
The sample data sourcetype=WinHostMon source=process :
Type=Process
Name="wfcrun32.exe"
ProcessId=1
CommandLine="C:\PROGRAM FILES (X86)\Test\test.EXE" /h0 "C:\Program Files (x86)\Test2\test2.test" /username:"Test" /domain:AD /password:"test"
StartTime="20170516135737.278912+120"
Host="test-test2-test3"
Path="C:\PROGRAM FILES (X86)\Test\test.EXE"
Props:
[WinHostMon]
SEDCMD-anonymize=s/\/password.*$/\/password:XXXXX/g
The issue is that it is not masking the data, i have tried sourcetype,source and host on the indexer but still its not masking.
If i upload a test file with data using the add data option i am able to mask the data using the SEDCMD, same goes for a file with a static sourcetype.
My guess is that the source/sourcetype is not correct because of the way Splunk identifies the data at indexing/parsing.
Does anyone have an idea how i can mask the data at indexing time?
The data is being send from a universal forwarder to our indexers so it is not passing through a heavy forwarder.
... View more
05-06-2019
05:18 AM
2 Karma
After looking into the affected files rules.csv and rule_classifications.csv from the Splunk_TA_sourcefire add-on i saw that one of the column's was named _time.
After changing this to time and changing the searches that fill the csv files the time range does get substitued.
So never use _time as a column in a lookup file.
we double checked the lookups and we were using outputnew without specifying the output fields.
After changing outputnew to output and specifying the output fields we no longer have this issue.
... View more
04-25-2019
11:53 AM
We have narrowed the issue down to the Splunk Add-on for Cisco FireSIGHT. Maybe this could help others if they have te same issue.
If we disable 2 of the lookups/csv files used in that app we are able to use earliest/latest in any query.
We are not exactly sure why this is happening and if we can fix the csv files, if we are able to do so i will update this post.
... View more
04-23-2019
04:30 AM
On our search head cluster we are running into the following issue.
When searching using the time picker everything works as expected, when searching using earliest/latest in the search we are running into issues.
If the time range picker is set to last 60 minutes and earliest in the search is earliest=-15m it works.
If i set earliest=-1d@d it only shows data from the last 60 minutes.
If i try the same thing on a fresh install or a non search head cluster member i am getting the notification:
Your timerange was substituted based on your search string. And i am getting the correct timeframe/data.
Does anyone have an idea what kind of setting/conf i should be looking at? We are running splunk 7.0.3
... View more
04-23-2019
04:24 AM
Hi,
Is HEC running on the heavy forwarder and did you make a token for dbconnect?
You could try Debug HTTP Event Collector port issues in the troubleshooting page:
https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Troubleshooting
... View more
04-12-2019
02:45 AM
First you should check the _internal logging for that host at the time when the logs switches
index=_internal host=yourhost sourcetype=splunkd WatchedFile
You might find a file to small too check message there, if so the link below could help you.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled
... View more
04-05-2019
04:37 AM
Hi,
No we did not get it to play nice with a proxy, we changed our firewall rules so it can collect the data.
... View more
04-01-2019
04:56 AM
Lesegod
Could you copy the inputs file? And the search that's does show results?
... View more
03-22-2019
10:10 AM
If you see es as a admin but not as a user then it is a permission issue. The user needs more then es user, inheret normal user and slowly add permissions till it works.
... View more
03-20-2019
08:33 AM
if there are a few people getting this error than it is likely they do not have any ES permission and thats why they are getting the error.
Check out the user's and roles.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-01-2023
07:27 AM
|
Karma given to
