Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About jbrocks
jbrocks
Communicator
Member since:
07-16-2018
08-07-2025
Community Statistics
| Posts | 76 |
| Solutions | 2 |
| Karma Given | 22 |
| Karma Received | 12 |
| Member Since | 07-16-2018 |
Activity Feed
- Got Karma for Re: How to Splunk the SAP Security Audit Log. 01-14-2025 01:58 AM
- Posted Re: Custom Python script executes twice? on Splunk Dev. 10-18-2022 05:59 AM
- Posted Re: Invoking Custom Endpoint from Javascript on Splunk Dev. 06-02-2022 07:10 AM
- Posted Re: Login to Splunk via Python SDK using cookies on Getting Data In. 06-02-2022 02:44 AM
- Posted How do I pass session from Js SDK to custom Rest Python script? on Splunk Dev. 06-02-2022 01:16 AM
- Posted Python SDK not getting existing secret, while JS SKD does, why? on Splunk Dev. 05-30-2022 11:58 PM
- Got Karma for Re: [windows10]"Error connecting to /services/apps/local: The read operation timed out" is returned when uploading the Funnel Visualization from "Install App from file". 04-15-2022 03:16 AM
- Posted Re: Lookup definition in transforms.conf not returning results on Splunk Search. 03-31-2022 04:02 AM
- Posted Re: How to modify Splunk search only for logon_name users that are inside CSV? on Splunk Search. 03-31-2022 03:36 AM
- Posted Re: problems with splunk app for netscaler appflow on All Apps and Add-ons. 03-31-2022 03:26 AM
- Karma Re: problems with splunk app for netscaler appflow for danielwalford. 03-31-2022 03:24 AM
- Posted Re: problems with splunk app for netscaler appflow on All Apps and Add-ons. 03-30-2022 12:26 AM
- Posted Re: splunk Tour is not getting launched or prompted on Installation. 02-24-2022 04:24 AM
- Posted Re: Dashboard Studio hide panel based on token on Dashboards & Visualizations. 02-21-2022 05:41 AM
- Got Karma for How to hide panel based on token in Dashboard Studio. 12-06-2021 10:20 AM
- Got Karma for How to hide panel based on token in Dashboard Studio. 11-24-2021 09:56 AM
- Posted Re: How to Splunk the SAP Security Audit Log on Getting Data In. 11-12-2021 05:11 AM
- Posted How to hide panel based on token in Dashboard Studio on Dashboards & Visualizations. 11-03-2021 01:08 AM
- Posted Field missing after lookup but existing before on Splunk Cloud Platform. 12-10-2020 03:09 AM
- Got Karma for Re: [windows10]"Error connecting to /services/apps/local: The read operation timed out" is returned when uploading the Funnel Visualization from "Install App from file". 11-18-2020 08:08 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
06-02-2022
01:16 AM
Hi all,
I have a Splunk App with React and JS SDK, that calls a custom REST endpoint, that calls a Python script, which uses Splunk Python SDK. Is there a way to pass the session from the logged in User using the Dashboard from JS/REST to the Python script, so that I do not need to write the authentication details for the Python SDK connection in a file?
Best regards!
... View more
05-30-2022
11:58 PM
Hi all, i am using React and the Splunk JS SDK to create an manage secrets, which works fine - as long as you stay in JS. The secret is correctly written in passwords.conf. Now I am trying to list the secrets using Python SDK and I can not find the secrets, that got created by the JS SDK. Am I missing anything out? I thought, JS SDK is pretty staight forward when using the builtin StogarePasswords functions and there are not many options to pass parameters to t (realm, username, secret). Can anyone help?
... View more
03-31-2022
04:02 AM
On which instance did you place the lookup file and how are you checking? If your lookup only exists on search head, then depending on your search, you might need to tell the lookup command so search local like: ...|lookup local=t mylookup ...
... View more
03-31-2022
03:36 AM
Hi, you can use inputlookup command for that. If you have your lookup, you can try something like: index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time
| search [|inputlookup mylookup.csv |rename user as login_name |fields login_name]
... View more
03-31-2022
03:26 AM
Oh okay, what information were you looking for and do you have the edited xml file? 🙂 I am looking for NAT information, but we are also having some problems to configure Netscaler to send especially those data
... View more
03-30-2022
12:26 AM
I am having the same problem - is there any solution to this? I just check the version tag in the citrix.xml which is not matching the newer Splunk versions, I edited it to my version - just to test, but still having the same issues
... View more
02-24-2022
04:24 AM
Did you get this to work? I am having the exact same problem 😕
... View more
02-21-2022
05:41 AM
tbh I swiched back to classic DBs and did not try newer version of DB studio until now
... View more
11-12-2021
05:11 AM
1 Karma
Additional information I found out while parsing SAL version2 logs: The number at beginning of an event (2 or 3) seems to indicate, if the log messages continous in the next event (when the fiel path is too long for the fields limit of 64 signs) - this seems to work for a maximum of three events, that need to be combined. If a path exeeds the limit of 3 events, the rest of it seems to be lost. A "3" seems to indicate that the file path continous in the next message, a "2" indicates that the event ends behind the event starting with "2", so this is where you want to have the line breaker. This leads to the following: LINE_BRAKER = 2[A-Z][A-Z][A-Z0-9]\d{14}00.{180}() After LINE_BREAKING the events have to be set together using SEDCMD for events hat contain a length of two or three events.
... View more
11-03-2021
01:08 AM
2 Karma
Hi all,
in classic Splunk xml dashboards it was very easy to create conditional dashboards that for example hide, when a toke has a specific value. Is there any option to to this in Dashboard Studio?
... View more
Labels
- Labels:
-
Dashboard Studio
12-10-2020
03:09 AM
Im am doing a lookup in a customers Splunk cloud - better to say, I am using Splunk Addon for ASA and there are two lookups for action field. However my problem ist that in this environment something overwrites/cleans the action field after the lookup. The lookup inserts the action field as vendor_action and outputs the action field as Cisco_ASA_action and as action. Cisco_ASA_action field is existing after lookup. Action field is missing after lookup (but surely was existing before). If I output the field as action2, everything is working fine. If I output the filed as action, field is missing. Does anybody have a clue what is happening here? Even if the lookup fails, the action field should be existing. I know that the issue is not with the ASA addon, as the lookup works fine on other Search Heads. Something ist cleaning/overwriting the action field. Any suggestions? As far as I know, lookup is the last thing happening, so I cannot explain, what is going wrong. There are also no other lookups from other apps which might cause this behaviour.
... View more
Labels
- Labels:
-
using Splunk Cloud
11-05-2020
12:44 AM
Hi everyone, I am using the Splunk_TA_nix to collect unix data on my local single Splunk instance. As far as I understand entities get published from splunk_app_for_infrastructure and then appears as entities in ITSI. But somehow the entities will not get transferred. I have one entitie in infrastructure app and zero in ITSI at the moment. I activatet the data input from Infrastructure App for the app server, my entity is getting recognized, but not pushed to ITSI: Can anybody help? I also checked all troubleshooting steps mentioned here: https://docs.splunk.com/Documentation/ITSI/4.6.2/SAIInt/Troubleshooting Thank you!
... View more
- Tags:
- itsi
Labels
- Labels:
-
troubleshooting
02-18-2020
01:36 AM
Hi everybody,
I was on PTS in Europe last year and visited the Trumpet talk over there. However during the talk a website was shown that presented a interactive map on how you could onboard different AWS data sources to Splunk. Does anybody know the linkt to that website?
... View more
- Tags:
- aws
02-04-2020
05:02 AM
3 Karma
Hi,
try to set the time out duration in web.conf:
[settings]
splunkdConnectionTimeout = 300
I had the same issue and this fixed it while uploading the Enterprise Security App which is very large and seems to need more time.
... View more
- Tags:
- King
02-03-2020
06:26 AM
You can use the following regex to extract the 3 fields POOL, Monitor and VDI. You can try this regex in regex101 to check what exactly is happening:
"bigipNotifyObjMsg=Pool\s+.*?(?<POOL>[^\/]+)(?=\s+)\s+.*?(?<Monitor>[^\/]+)(?=\.\s+\[)\.\s+\[\s+(?<VDI>[^;]+);"
... View more
02-03-2020
03:53 AM
1 Karma
For search time field extracteions, TAs normally need to be installed on the Search Heads to. Also the fact that you are using rsyslog might influence the logformat as syslog mostly puts a syslog header in the beginning of each log file, which means you need to modify syslog configuration or props/transforms.conf for this. But I guess first thing would be to install the TA on the Search Head and check if fields get extracted afterwards. Further more you can find info on what to install where over here : https://splunk.paloaltonetworks.com/installation.html
... View more
02-03-2020
03:47 AM
If you have KV_MODE = JSON and your json is valid, you should have a field called "COMPONENTS{}.NAME" in your fields list. Then you can do:
index=yourindex sourcetype=yoursourcetype| stats count by COMPONENTS{}.NAME
... View more
02-01-2020
09:51 AM
Not pretty sure how to understand this, but:
* Both numbered and unnumbered whitelists and blacklists support two formats:
* A comma-separated list of event IDs.
* A list of key=regular expression pairs.
* You cannot combine these formats. You can use either format on a specific
line.
Seems that you might need to transform your whitelist1 one to key=regex format ... but might also mean that you only can not combine list and key=regex format
... View more
02-01-2020
09:41 AM
I think you need to rename the "a", because you define a new by eval and the refer to the old a. Did you try | eval c=split(a, " ")?
... View more
02-01-2020
09:36 AM
As you said that every event begins with a new line, you might only set SHOULD_LINEMERGE = false (and use the default LINE_BREAKER which is per default defined to break an event after every line or if you also have newlines without being a new event, you need to define the LINE_BREAKER for this).
... View more
01-27-2020
02:39 AM
Hi cdec,
I do not have a fully solution to this. Our customer set up multiple Heavy Forwarder for DB Connect. Do manage the inputs and collections for myself, i wrote a Python Script to automate the creation of db_connections.conf and db_inputs.conf from a csv file, but that is just a little help. You can find it here: https://github.com/jbrocks/splunk-db-connect-inputs-and-collections . Further more I am also looking for experience from others. My customer actually tries to onboard as less DBs via DB Connect as possible. Where possible we try to collect the data via syslog, but this is still a long internal discussion.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-07-2025
12:10 AM
|
