Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About krugger
krugger
Communicator
Member since:
12-14-2012
06-05-2020
Community Statistics
| Posts | 66 |
| Solutions | 8 |
| Karma Given | 6 |
| Karma Received | 31 |
| Member Since | 12-14-2012 |
Activity Feed
- Got Karma for Re: 503 Service unavailable - Is my splunkd crashed ?. 04-05-2021 07:30 AM
- Karma Re: Forwarding events to different indexes for stefano_guidoba. 06-05-2020 12:46 AM
- Karma Re: How to import Windows Log files? for ChrisG. 06-05-2020 12:46 AM
- Karma Re: Example of Active Directory lookup for treinke. 06-05-2020 12:46 AM
- Karma Re: Splunk 6.0 dashboards ignoring top for ineeman. 06-05-2020 12:46 AM
- Karma Re: Splunk 6.0 dashboards ignoring top for melting. 06-05-2020 12:46 AM
- Karma Re: Data Obfuscation at search time for Ayn. 06-05-2020 12:46 AM
- Got Karma for Re: How do I count by a field and then use that count to sort by in a table?. 06-05-2020 12:46 AM
- Got Karma for Re: Listing forwarders. 06-05-2020 12:46 AM
- Got Karma for Re: JOIN two tables in Splunk. 06-05-2020 12:46 AM
- Got Karma for Re: How do I set up a distributed deployment server without any port number. 06-05-2020 12:46 AM
- Got Karma for Splunk 6.0 dashboards ignoring top. 06-05-2020 12:46 AM
- Got Karma for Re: REGEX expression. 06-05-2020 12:46 AM
- Got Karma for Re: Scripted Input Windows Batch - stdout not in the log. 06-05-2020 12:46 AM
- Got Karma for Re: Changing display from row to pie ? [Used for Google Map Drilldown]. 06-05-2020 12:46 AM
- Got Karma for Re: SA-ldapsearch - NameError: name 'JAVA_HOME' is not defined. 06-05-2020 12:46 AM
- Got Karma for Re: SA-ldapsearch - NameError: name 'JAVA_HOME' is not defined. 06-05-2020 12:46 AM
- Got Karma for Re: [subsearch]: Subsearch produced 12959 results, truncating to maxout 10000.. 06-05-2020 12:46 AM
- Got Karma for Re: Correlate multiple log sources. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk 5.0.1 and Splunk LEA 2.0.1 log grabber. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-09-2013
03:13 AM
ineeman and melting, you are both correct.
Changing to a statistics table makes the result of top show again.
... View more
10-08-2013
09:10 AM
1 Karma
Hi,
I have installed Splunk 6.0 for testing before upgrading my current production environment. Everything is rather new, but I am having trouble getting a simple dashboard to work, because the piping through top doesn't seem to work. It just displays the events as a list and not aggregated in a top 10. However if I run the inline search in Search it will display a properly formatted table.
I have read the Build dashboards in Splunk Web of the new 6.0 manual, but it doesn't seem to have anything special about it.
What am I missing? Can it be related to my data model definitions?
... View more
09-23-2013
09:21 AM
1 Karma
I have had some trouble with DB Connect in the past, so I just use python scripts to query remote database servers, fetch the results and echo them to the terminal, so the a scripted input can place it in Splunk.
... View more
09-23-2013
05:42 AM
Check your var/log/splunk for some error messages. Specially in splunkd.log and web_service.log.
... View more
08-29-2013
07:13 AM
2 Karma
This issue keeps spamming my splunkd.log. Had to start discarding stderr by changing the inputs.conf to:
[script:///opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.my --configentity Firewall03 2>/dev/null]
disabled = 0
interval = 600
passAuth = admin
sourcetype = opsec
index = checkpoint
... View more
08-08-2013
07:56 AM
In inputs.conf using connection_host = dns doesn't work for you?
This should set the host to the reverse DNS of the computer sending you data.
... View more
07-23-2013
06:07 AM
Splunk is complaining about the inexistence of splunk-system-user.
Do you have such a user in Splunk? Usually admin is used.
In inputs.conf you should have a entry like this:
[script:///opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.my --configentity Fire01]
disabled = 0
interval = 600
passAuth = admin
sourcetype = opsec
index = checkpointfw
... View more
07-05-2013
06:23 AM
1 Karma
Have a working Google Maps overlay working in the bluecoat app. You need MAXMIND geoip and google maps app installed. Hope it helps:
Google Map
index=bluecoat | geoip dest_host resolve_hostnames=true
rt-5m
rt
roadmap,terrain,satellite
roadmap
true
clusters
m
0.75
0, 100, 500, 1000, 10000
true
500px
on
true
flashtimeline
... View more
07-05-2013
06:06 AM
1 Karma
The solution in the comments is valid, but you can also try:
sourcetype="splunk_page_request" NOT [| inputlookup nmc_crawlers | dedup ip_address |fields ip_address]
This will try to deduplicate the entries with the same IP in the nmc_crawlers lookup, hence reducing the number of returned address.
... View more
07-05-2013
05:58 AM
My main concern with that many connections is the SSL overhead. I would advise that you stress test the server with thousand of SSL connections to see how it performs.
SIEGE tool:
http://www.joedog.org/siege-home/
... View more
07-05-2013
05:35 AM
Can anyone provide me an exemple of what the DomainList.csv and DomainSelector.csv lookups look like in the Splunk for Active Directory app?
I am only collecting the event log, so these lookups are not being generated, so I will have to create them manually to make the app work as expected.
... View more
07-05-2013
05:28 AM
You memory usage patterns seem weird to me because you are processing virtually no data. I have over 50Gb coming in each day and only have 8Gb memory and it doesn't run out of memory.
Unless you are doing some massive complex processing on the inbound information it isn't normal to run out of memory with only 50Mb per day. I would say there is some sort of loop behaviour going on in your splunk infra-structure, but without knowing how things are setup and what you are doing with the data, it is quite hard to give you good guidance.
... View more
07-05-2013
05:18 AM
Seems that in software the features we need at any given time will always be implemented in a future release. 🙂
... View more
07-05-2013
05:10 AM
1 Karma
Give us an example of what your data looks like and what you want to extract from it.
... View more
07-05-2013
04:54 AM
Splunk requires the batch file to be in the $SPLUNK_HOME/bin/scripts directory.
Had forgotten about that.
... View more
07-05-2013
04:12 AM
2 Karma
In SA-ldapsearch the commands that are being called are in the bin directory. They seem to be trying to read the following registry keys:
HKEY_LOCAL_MACHINE\Software\JavaSoft\Java Runtime Environment\CurrentVersion
HKEY_LOCAL_MACHINE\Software\JavaSoft\Java Runtime Environment\($CurrentVersion)\JavaHome
It then tries to call java from the path at JavaHome plus \bin\java. If that fails it will try to read the JAVA_HOME environment variable. If you have something in the registry at those locations your JAVA_HOME will be ignored as it isn't the preferred method to define where Java is.
... View more
07-05-2013
03:38 AM
1 Karma
I would suggest you change you batch file to:
@ECHO OFF
wget.exe -O status.txt http://192.168.178.XXX/SSI/supply_status_info.htm
"C:\Program Files (x86)\GnuWin32\bin\grep.exe" -A 1 %1 status.txt
I removed echo of commands to the command line and fixed you grep which isn't working as intended, because you are grepping for Black instead of your string.
... View more
06-28-2013
09:12 AM
Is that the text comming in from the log file? Or is that a multiline event?
The regex is correct and if each line is an event it should return all the lines starting with a number.
... View more
06-11-2013
02:37 PM
There is such an option in the 5.0.3 manual. Added a link to it.
... View more
06-11-2013
07:50 AM
2 Karma
This should fix it:
[SSL]
supportSSLV3Only = true
cipherSuite = TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH
Also have a look at http://www.splunk.com/view/SP-CAAAHXG. The 5.0.3 release is a security fix which includes a OpenSSL fix.
It should follow the same syntax as:
openssl ciphers -v 'TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH'
There is a SSL section in inputs.conf:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Inputsconf
... View more
06-11-2013
03:33 AM
1 Karma
Using a DATE field as a rising column doesn't seem to work. I think only autoincrementing integer fields would work correctly
I am currently using a query to dump the data daily, because I couldn't get the tail to work correcty for me:
SELECT to_char(LOG_DATE,'YYYY-MM-DD HH24:MI:SS') AS LOGDATE, ... FROM ... WHERE ... AND LOG_DATE > CURRENT_DATE - 1
I must warn you that you have to add
output.timestamp.parse.format = yyyy-MM-dd HH:mm:ss
to you inputs.conf, because the GUI seems to add a
output.timestamp.format = yyyy-MM-dd HH:mm:ss
which isn't in the specs...
... View more
05-30-2013
08:29 AM
1 Karma
Sure, splunk can be used for statisticas analysis. The big question is if splunk is the right tool for you. It all depends on what you are trying to analyze and what you want to extract from the data.
... View more
05-30-2013
08:22 AM
This happens because of the shell thinks the 
