Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About darlas
darlas
Communicator
Member since:
04-08-2014
06-05-2020
Community Statistics
| Posts | 47 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 7 |
| Member Since | 04-08-2014 |
Activity Feed
- Got Karma for Re: Splunk Add-on for Bit9 Carbon Black: Why are syslog events not parsing into expected fields?. 03-12-2023 06:18 PM
- Got Karma for Re: Does Splunk take into consideration Timezone Daylight Saving ?. 04-23-2021 01:14 PM
- Got Karma for Since upgrading to 6.0 I see error "The lookup table 'minemeldfeeds_lookup' does not exist. It is referenced by configuration 'pan:threat'." for all my indexers. 06-05-2020 12:49 AM
- Got Karma for custom dashboard missing. 06-05-2020 12:47 AM
- Got Karma for Re: Does Splunk take into consideration Timezone Daylight Saving ?. 06-05-2020 12:47 AM
- Got Karma for Splunk Add-on for Bit9 Carbon Black: Why are syslog events not parsing into expected fields?. 06-05-2020 12:47 AM
- Got Karma for Re: Add Credential error. 06-05-2020 12:46 AM
- Posted Re: How to configure for ISO 8601 date and time display? on Getting Data In. 03-15-2018 01:15 PM
- Posted Re: Can you extract JSON syslog automatically? on Getting Data In. 02-23-2018 01:01 PM
- Posted Re: Since upgrading to 6.0 I see error "The lookup table 'minemeldfeeds_lookup' does not exist. It is referenced by configuration 'pan:threat'." for all my indexers on All Apps and Add-ons. 11-30-2017 02:14 PM
- Posted Re: Since upgrading to 6.0 I see error "The lookup table 'minemeldfeeds_lookup' does not exist. It is referenced by configuration 'pan:threat'." for all my indexers on All Apps and Add-ons. 11-27-2017 09:56 AM
- Posted Since upgrading to 6.0 I see error "The lookup table 'minemeldfeeds_lookup' does not exist. It is referenced by configuration 'pan:threat'." for all my indexers on All Apps and Add-ons. 11-27-2017 09:43 AM
- Posted Re: Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer on Splunk Search. 11-27-2017 08:50 AM
- Posted Re: Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer on Splunk Search. 11-22-2017 10:52 AM
- Posted Re: Can I install the Splunk Add-on for Box on just my search head, and not use a Forwarder? on Getting Data In. 08-17-2017 01:50 PM
- Posted Re: Can I install the Splunk Add-on for Box on just my search head, and not use a Forwarder? on Getting Data In. 08-17-2017 01:46 PM
- Posted Can I install the Splunk Add-on for Box on just my search head, and not use a Forwarder? on Getting Data In. 08-17-2017 01:17 PM
- Tagged Can I install the Splunk Add-on for Box on just my search head, and not use a Forwarder? on Getting Data In. 08-17-2017 01:17 PM
- Posted Re: Set-up Page in Carbon Black Defense App just spins - what is wrong? on All Apps and Add-ons. 05-23-2017 03:11 PM
- Posted Set-up Page in Carbon Black Defense App just spins - what is wrong? on All Apps and Add-ons. 05-23-2017 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
03-15-2018
01:15 PM
I also am trying to parse or reformat an ISO 8601 date into something more human friendly. Hope someone can help.
... View more
02-23-2018
01:01 PM
Hi.
I'm facing the same issue.
I've added the following to my props.conf but still not working.
SEDCMD-StripHeader = s/^[^{]+//g
KV_MODE=json
Does the associated TA need to be pushed to indexers as well as search heads?
Does there need to be a reference later in props.conf to the SEDCMD-StripHeader line?
Thanks!
... View more
11-30-2017
02:14 PM
Thanks! I will upgrade to 6.0.1 and see if the issue goes away!
... View more
11-27-2017
09:56 AM
correction. I now see this same error in dashboard panels in Palo Alto app
... View more
11-27-2017
09:43 AM
1 Karma
Hi.
Since upgrading the Palo Alto App to 6.0 I see error "The lookup table 'minemeldfeeds_lookup' does not exist. It is referenced by configuration 'pan:threat'." for all my indexers.
I find these references in:
SplunkforPaloAltoNetworks/default/data/ui/views/incident_feed.xml
Oddly, I only see this in dashboards for OTHER apps, not when I am in the Splunk App. I did change app permissions to be Global but it did not help.
Any ideas what the issue is?
Thanks!
... View more
11-27-2017
08:50 AM
Hi Daniel.
Thanks for the quick response. We have multiple indexers but do not believe they are in a cluster. There is no "master" indexer. we do have a Deployment Server that manages all indexers, search heads, etc... But I don't think that is what you mean.
Thanks.
... View more
11-22-2017
10:52 AM
Hi Daniel.
I have this same problem and want to be clear on your solution.
I deploy this add-on from a deployment server. It gets pushed to my search heads and indexers.
Are you saying to remove the listed files on the deployment server then push out or remove on just the indexers? If just the indexers, how do you do this while still having those files pushed to your search heads?
Thanks a bunch!
... View more
08-17-2017
01:50 PM
Thanks!! I'm running splunk on linux. and I've gotten events before. just had some issues and needed to reinstall.
... View more
08-17-2017
01:46 PM
Thanks to kmorris and rpille. So it sounds like I can install on ONLY a search head if I want and that is a supported configuration. Since I do not have a heavy forwarder right now it is best for me to just do it on a search head.
I appreciate the speedy responses.
... View more
08-17-2017
01:17 PM
Hi.
I'm trying to re-install the Box Add-on, which has somehow stopped working. I do not have a universal forwarder, that has a GUI to set up the Box API information, so I just installed on my Search Head. I am able to successfully grant Splunk access to my Box account and pull events.
But I cannot add the Data Inputs, as specified in the configuration instructions. In fact, when I try to "Add Data" the web page just spins at "loading" and I never even get a chance to add the inputs.
Splunk support says this is because I don't have the Add-on installed on a forwarder so they will no longer assist me.
Hopefully someone out there can help me.
-Darla
... View more
05-23-2017
03:11 PM
Thanks. I feel like I'm not even ready for that yet. I first have to enter an API key in the "Setup" page I can't seem to get loaded.
... View more
05-23-2017
02:06 PM
Hi.
We just installed the Carbon Black Defense Add-on and are trying to configure it. The instructions say to go to Configuration->Set-up to enter some parameters. When I go to this page I just see the word "loading" and it keeps spinning and never loads.
Does anyone have any idea what is going on?
Thanks,
Darla
... View more
04-19-2017
01:44 PM
I wish I had same luck as BrendanCO 😞 I deleted both app.conf and passwords.conf in ./local then restarted splunk. I still get the error. Oddly, the passwords.conf file gets created but only stores the user/password, NOT the Wildfire API key.
So I'm halfway there.
Any thoughts?
... View more
04-10-2017
09:19 AM
sorry no solution. just living with the orphaned searches for now. sorry to not be of any help to you.
... View more
03-17-2017
08:52 AM
Hi.
I actually figured it out. Here is my transforms.conf.
[citrix_netscaler_syslog]
REGEX = ^(\w){3}\s(\d){2}\s(\d){2}:(\d){2}:(\d){2}\s(\w)(\s)\d{2}\/\d{2}\/\d{4}(:\d{2}){3}(\s)*(?P\S+)\s+(?P\S+)\s+:\s+(?P\w+)\s+(?P\w+)\s+(?P\w+)\s+(?P\d+)\s+0\s+:\s+(?P.+)
This likely is not the most elegant regex but it works 🙂
Thanks for offering your help though!
-Darla
... View more
03-15-2017
12:24 PM
Hi.
I'm having this same issue. I tried adding the line in my splunkhome/etc/apps/Splunk_TA_netscaler/local/props.conf file and restarted splunk but nothing changed.
Any ideas what I am missing?
Thanks!
... View more
02-08-2017
03:58 PM
Can you specify what the name of the App is? The documentation for this Add-on says "After the Splunk platform indexes the events, you can consume the data using the prebuilt panels included with the add-on", which makes it sounds like the visualization is contained in this Add-on. Appreciate any clarification on this.
Thanks.
... View more
01-26-2017
12:20 PM
Hi.
Thanks for this idea. I get "connection failed with Read timeout" when I run this.
I'm on 6.5.1 so maybe this no longer works in latest version?
... View more
01-26-2017
11:30 AM
I tried all 3 commands and none seemed to identify orphaned searches. maybe I am not sure how to interpret the output.
... View more
02-19-2016
10:01 AM
I have resolved my own issue. These additional columns came after I initially implemented the asset lookup table. I needed to reload apps from my deployment server to the search heads to get the latest data.
... View more
02-19-2016
09:37 AM
Hi.
I have added a few additional columns to my asset lookup CSV, meaning in addition to the required columns. When I validate the content of the lookup, I see only the required columns and not my additional columns.
I validate with: |inputlookup assets
If I look at the CSV file at command line, it has All the columns (required plus additional).
If I look in GUI under lookup definitions, it only shows the required fields listed.
How can I get Splunk to acknowledge my additional columns?
Thanks,
Darla
... View more
12-16-2015
09:01 AM
You are my HERO !
... View more
12-15-2015
04:27 PM
After upgrading Active Directory Add-on to pull ldap data, the date fields are coming in a strange format which I cannot figure out how to convert.
The format is %Y%m%d%H%M%S.0Z
For example: 20140402220534.0Z
I assume the .0Z part is a timezone reference.
Anyhow, I'm trying to convert/display it in a human readable way, but cannot figure it out.
Any ideas?
... View more
12-15-2015
03:09 PM
Thanks for the quick and successful solution!
... View more
12-15-2015
02:01 PM
I am trying to write a search where I pull data from a lookup table where one field in the lookup matches the value entered by user in a text field.
For example, user enters a user name in a text field on dashboard then clicks submit button.
I want to display data (row) from a lookup table where the user name entered by the user matches a field (column) in the lookup. In my case the lookup contains data pulled from ldap.
I have tried the following but it does not return any data. But I know there is a row in my lookup that matches what I am entering in the text box.
| lookup ldap_data.csv identity as $username$ OUTPUTNEW first last email bunit startDate
Any ideas?
Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
