About mux

mux · ‎09-11-2026

Does SMTP auth needs to be enabled at the organization level in order for Splunk to be able to use OAuth to send mail or does enabling at the mailbox level work ? We are migrating to Oauth2 for email and running into some issues getting the tokens back to Splunk.

mux · ‎04-10-2017

That was for the connection itself, We did resolve that by changing a websphere setting but have not been able to pass credentials.

mux · ‎04-05-2017

We believe it is realted to ADDON-8208, do you know if there is a timeframe when that will be fixed?

mux · ‎04-03-2017

We have the Splunk_TA_jmx 3.1.1 as well as Splunk_TA_ibm-was 3.1.0 . We are running Splunk 6.4.1 connecting to Websphere 8.5.5. At the time of the meeting we were able to make the connection work, but now it looks like we still can’t access any of the more advanced JMX data due to a security restriction in WAS. It looks like the user that Splunk is connecting with does not have the sufficient role to access the data. We are currently connecting with an ID that is cindigured as an administrator, so it should have all the access it needs. Based on the messages, I’m not sure if the user ID is getting passed since the error seem to think the user is “UNAUTHENTICATED”. I have put the username and password of the Admin ID into the configuration task, but that doesn’t seem to work. Is there somewhere else this needs to be configured? We can connect with the userid via the JCOSNOLE 16:54:07.606 com.ibm.rmi.corba.ClientDelegate invoke:754 pool-1-thread-3 ORBRas[default] javax.management.JMRuntimeException: ADMN0022E: Access is denied fo r the getName operation on J2CManagedConnectionFactory MBean because of insufficient or empty credentials.

mux · ‎09-19-2016

Error in 'script': Getinfo probe failed for external search command 'base64' I saw this link, but I don't know much about Python. https://answers.splunk.com/answers/243498/getinfo-probe-failed-for-external-search-command-a.html and I did update the libraries in /base64/bin/splunklib to the latest I found on this Splunk instance, but the command still will not execute. Any ideas?

mux · ‎09-01-2016

I need to update ownership of searches after converting to a search head cluster environmen,t and from my understanding, we cannot edit the files anymore for replication to work, so I am doing it via the CLI commands using curl, but that does get syslogged which contains the Splunk creds. Is there a way to get it to prompt for a userid/password ?

mux · ‎07-13-2016

We are running Splunk stream 6.5.1 on Splunk Enterprise 6.4.1 but most of our forwarders are still running on 5.0.5. I am planning to upgrade them later this year but I wanted to find out if Splunk stream can run on a forwarder of that version or not, I couldn't find anything on the web about the forwarder versions for the app. Thanks, Mark.

mux · ‎07-07-2016

I do see this error in the web log as well with a 404 error trying to access the correlation searches "GET /en-US/custom/SA-ThreatIntelligence/correlation_searches/get_searches?output_mode=json&count=-1&namespace=Splunk_DA-ESS_PCICompliance&_=1467911199246 HTTP/1.1" 404 1376 "https://splwwwsec01.llbean.com:8000/en-US/app/Splunk_DA-ESS_PCICompliance/ess_content_management" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)" - 577e8c207d7f258c2db8d0 8ms

mux · ‎07-06-2016

mux · ‎07-05-2016

We recently upgraded our Splunk installation from 6.1.6 to 6.4.1 As part of the follow up work around this we needed to upgrade our PCI App from 2.1.1. to 3.0.1 to 3.1.0, now that everything is upgraded the Notable Events pages in the PCI app does not render in the web browser, or generate events currently. We have tried several different browsers but nothings shows up for Configure -> Incident Management -> New Notable Event, just a title and a blank white test bar in the middle of the page so we cannot even see the notable events except thru the settings menu. Seeing if anyone else has seen this?

mux · ‎10-23-2015

What I am trying to do is create a dashboard for an application team that lists all the windows logs files so they can select the one they want to look at easier. What happens is if you do the search via the search bar, and then click one of the sources listed on the side under sources, Splunk automatically adds in the extra \ to the windows log path so that the source can be found. Within the dashboard running the same command and selecting the source Splunk does not add in the extra \ character to the windows logs files so when it searches for source file it cannot find as it sees the \ as the escape character instead of the source path.

mux · ‎10-23-2015

We are currently running 6.1.6

mux · ‎10-23-2015

When doing this via the search bar index=xxxx | chart count by source, when you select a source in search it automatically adds in the extra escape character \ in front of the file locations \ , when doing it from a dashboard it does not add the extra slashes so it cannot find the source files. On search the search will look like this \\file\\location\\here when clicking on a source file that says \file\location\here , from the dashboard it keeps the original format \file\location\here and it cannot find the source because Splunk interprets the \ character.

mux · ‎01-30-2014

Thank you I believe this will do the trick, I will double check in the AM after the batch jobs have run tonight.

mux · ‎01-30-2014

Currently we are monitoring a directory with batch jobs logs in it and it is not breaking correctly. [monitor:///home/prod/department/interface/joblogs/*] sourcetype = joblogs index = finance disabled = false And I am trying to break the files up here. [joblogs] BREAK_ONLY_BEFORE = (E r r o r\s+L o g|J o b\s+L o g) NO_BINARY_CHECK=1 SHOULD_LINEMERGE = True We are setting the source to the log file name so each different file has a unique source name. I do not want to change the sourcetype name or split the sourcetypes by file. Ideally I am looking to break each file into one event based on the source so that each different file would be 1 event within the index. It is currently breaking the logs into several events.

mux · ‎01-30-2014

You can also use tags on the sourcetypes. tag=yourtagname yousearchhere and it will search all the sourcetypes with that tag name.

mux · ‎01-24-2014

It sounds like sendmail is not configured correctly. Try sending a mail from the server itself. For linux mail -v -s "subject line" [email protected] < sample.test.file to see if the smtp process sends the email. If it does not send the mail then you need to get the Unix Admin to take a look at the sendmail configuration.

mux · ‎01-24-2014

I have a script running from an alert and it shows in the python logs everytime a specific Webspere JVM is activated or deactived. Sorry this did not help.

mux · ‎01-23-2014

If you look in the python log (not splunkd) it should have details on the scripts being called, you can search for runshellscript

mux · ‎01-23-2014

You could move the script out of the /bin/scripts folder. It will not prevent it from being called but would prevent the execution and may generate an error in the splunkd.log to help pinpoint what is calling it.

mux · ‎01-17-2014

There is a new app that can be used with Symantec 12, it is called Splunk for Symantec and has sourcetypes for both SEP11 and SEP12.

Posts	21
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎04-21-2012

Online Status	Offline
Date Last Visited	‎09-11-2026 10:23 AM

SMTP for exchange

JMX Authentication to Websphere 8.5.5

Why am I getting "Error in 'script': Getinfo probe...

Can you hide the credentials in the curl command f...

Splunk stream forwarder versions?

Splunk PCI App Notable Events no longer being gene...

When creating a dashboard to create a list of wind...

How to set up props.conf so that each source is a ...

SMTP for exchange

Re: JMX Authentication to Websphere 8.5.5

Re: JMX Authentication to Websphere 8.5.5

JMX Authentication to Websphere 8.5.5

Why am I getting "Error in 'script': Getinfo probe...

Can you hide the credentials in the curl command f...

Splunk stream forwarder versions?

Re: Splunk PCI App Notable Events no longer being ...

Re: Splunk PCI App Notable Events no longer being ...

Splunk PCI App Notable Events no longer being gene...

Re: When creating a dashboard to create a list of ...

Re: When creating a dashboard to create a list of ...

When creating a dashboard to create a list of wind...

Re: How to set up props.conf so that each source i...

How to set up props.conf so that each source is a ...

Re: Multiple sourcetypes in a search?

Re: EMail and LDAP

Re: Script being executed every minute - not sched...

Re: Script being executed every minute - not sched...

Re: Script being executed every minute - not sched...

Re: Symantec Endpoint Protection 12 App

Join the Conversation