About sudosplunk

hrawat · ‎05-01-2024

@sudosplunk the setting is expected to be in inputs.conf ( not in custom inputs.conf). All modinputs honor meta setting starting 6.4 https://community.splunk.com/t5/Getting-Data-In/UF-Route-inputs-to-specific-indexers-based-on-the-data-s-input/m-p/147597

sergiollg · ‎03-09-2023

This is the sourcetype you should use: WinEventLog:System:IAS

harryc42 · ‎09-26-2022

Not quite the same - but my cloned boxes were not coming up in the queries - in the end had to update rev-DNS for them as the host group was defined by hostname .

chrabi · ‎09-20-2022

Maybe for someone will be useful:[ How export to csv only 2 rows from base query] #Workaround Export with Base Search, Post Processing. 1. IN Your dashboard xml <search id="BASE_SEARCH_EXAMPLE"> <query> index=_internal sourcetype=* | fields * </query> 2. Post Procesing query stats base on base search, show only 2 rows. <Base Search> | stats count by source | head 2 <table> <title>Post Processing table with 2 rows for export</title> <search base="BASE_SEARCH_EXAMPLE"> <done> <set token="start_query_inputlookup">| inputlookup FileForExport.csv</set> </done> <query>| stats count by source | head 2 | outputlookup FileForExport.csv</query> </search> <option name="drilldown">none</option> </table> 3. Hide table with query "| inputlookup FileForExport.csv" and job.sid required for export token $job_exportTocsv$. <panel depends="$nevershow$"> <table> <title>Hide table with import query, job.sid required for export.</title> <search> <done> <set token="job_exportTocsv">$job.sid$</set> </done> <query>$start_query_inputlookup$</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <refreshType>delay</refreshType> </search> </table> </panel> 4. Button or link required for download csv file, paste someware in dashboard. <table> </table> <html> <a target="_blank" class="btn" href="/api/search/jobs/$job_exportTocsv$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=FileForExportDetails.csv&outputMode=csv" role="button">Export_Data_csv</a> </html> </panel>

spl10 · ‎08-19-2022

Hello splunkers I am also facing the same issue and no data collection is happening due to this issue. Can anyone please guide?

splunkoptimus · ‎08-11-2022

Check if the user belongs to groups which have permissions to access Splunk.

Parthi · ‎12-03-2021

i wish @splunk has out of the box feature to detect once and check for the recurrence after specified interval before sending the alert similar to how it throttles after the first alert is sent.. @jospina2 thank you for the suggestion

jeremyfer · ‎04-22-2021

Dude you're so unhelpful, I really wish this was stackoverflow so your answer could be voted down. Enforcing your business logic onto others rather than helping them do what they are asking is really annoying, especially for others which have found this post with a similar quandary. I want to do something very similar to what OP was asking, but your perpetual just use git is so unhelpful and adds nothing to the thread.

jaxjohnny2000 · ‎01-20-2021

pushing a bundle does not work for us. making a manual modification to the /opt/splunk/etc/apps/user-prefs/local/user-prefs.conf does work. and yes a user change will override the settings.

rajneeshdba · ‎12-14-2020

2020-11-30T23:59:46.101621+00:00 fdb2.fdb-us-south-002 2020-11-30T23:59:45Z { "Severity": "10", "Time": "1606780785.516014", "Type": "SomewhatSlowRunLoopTop", "ID": "0000000000000000", "Elapsed": "0.0734675", "Machine": "10.185.175.43:4501", "LogGroup": "default" } I want to how Can i extract "severity": "10" in the search from the logs ?

pellegrini · ‎12-01-2020

Edit the JavaScripts are no longer required. If above solution does not solve it, you need to remove user specific config. See solution provided in Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not being respected

lkutch_splunk · ‎11-13-2020

Splunk platform includes, for example: Splunk Enterprise, Splunk Cloud, etc. Splunk apps include, for example: Splunk Enterprise Security, Splunk IT Service Intelligence, etc.

season88481 · ‎09-07-2020

This might be a better command for it: find . -type f -name *.csv -size +10M -exec ls -lh {} \;

mtaher · ‎09-04-2020

I am facing the same issue, can you please explain this in detail: "changing ownership and giving it to app account"

jaxjohnny2000 · ‎07-30-2020

I see this is kind of an old post, but we are running across the same situation. But rather, we need to change from using an IP address to using hostnames, so that we can change subnets. First, I go into the server.conf file and change the mgmt_uri from: mgmt_uri = https://10.16.6.53:8089 to: mgmt_uri = https://servername.domainname.com:8089 Then restart splunk then run: splunk show shcluster-status I get this: Encountered some errors while trying to obtain shcluster status. This node is not part of any cluster configuration, please re-run the command from an active cluster member. Also see "splunk add shcluster-member" to add this member to an existing cluster or see "splunk bootstrap shcluster-captain" to bootstrap a new cluster with this member. If it go through these steps of (set static captain, remove member, rename mgmt_uri, enable cluster using hostnames, add member), the cluster will come back up, but then I get "error resolving hostname" on the SH Deployer

virtuosoo · ‎11-16-2018

You are amazing FrankVl :D...Thank youuuu

bsaujla131984 · ‎11-17-2018

I had tried in angular brackets, however it was giving error as below:- Error in 'rex' command: The regex '_raw' does not extract anything. It should specify at least one named group. Format: (?...).

net1993 · ‎11-09-2018

Exactly this. Thanks !

inventsekar · ‎11-08-2018

I am required to restart Splunk service on deployment clients at mid night everyday /// instead going for complex options, i would simply choose the linux's cronjobs - the simple and best solution for these kind of tasks. just write a short script(someone already given above on comments i think).. configure it to run at midnight, whatever min, hour as per your convenience. on the script you can include ideas like.. whether splunk restart was successfull or not, get that details and send a mail to you/your team.. All set! ... Happy splunking!

qbolbk59 · ‎11-21-2018

Hey @FrankVl , Nope. It's the same dashboard accessed by all users.

damucka · ‎11-06-2018

Hello, The missing DB_ICP is becsuse for the nameserver I need to collect from the directory above and for the indexserver from the DB_ICP, where it is already there in the input path. When I think of that now, I would try the following config, please let me know what you think: [monitor:///usr/sap/ICP/HDB02/ls5979/trace/.../*] index=mlbso disabled=false interval=15 sourcetype=ICP_statements whitelist = statements My intention here is to collect all files with the "statement" pattern in the filename from the trace directory and below (DB_ICP). Would that make sense? Kind Regards, Kamil

twinspop · ‎10-23-2018

Bueno search. But i've been down that road and there were only 4 listed skipped or delegated_remote_error. Sadly the Big Deal(tm) searches that were skipped are not in the scheduler log, skipped, error, or otherwise.

Vijeta · ‎10-19-2018

May be this link will help https://support.microsoft.com/en-us/help/944884/description-of-the-time-taken-field-in-iis-6-0-and-iis-7-0-http-loggin

lavanyaanne · ‎11-01-2018

From the splunk docs i have observed server.conf ciphersuite is different from inputs.conf and outputs.conf. Check your cipheresuite. https://docs.splunk.com/Documentation/Splunk/7.1.3/Security/Ciphersuites

valiquet · ‎10-28-2018

Throttle on mytime | eval mytime=strftime(_time, "%Y%m%d")

Posts	333
Solutions	33
Karma Given	4
Karma Received	74
Member Since	‎10-16-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk DB Connect App: How to troubleshoot why db ...

_TCP_ROUTING for Heavy Forwarder

Re: _TCP_ROUTING for Heavy Forwarder

Re: How to parse Radius log files into splunk? Wha...

Re: Why is our new cloned server reflecting an old...

Re: How to export to csv the search results which ...

Re: Splunk DB Connect App: How to troubleshoot why...

Re: How to troubleshoot ERROR AuthenticationManage...

Re: Is it possible to delay triggering an alert fo...

Re: How do I monitor changes to config files?

Re: On a Splunk Enterprise deployer, how do I chan...

Re: How do I write a regex that extracts a field b...

Re: How to remove automatic real-time searches tha...

Re: What is the difference between Splunk Enterpri...

Re: How to trouble shoot bundle replication failur...

Re: Error while adding search peer to search head

Re: Help with changing IP address on one of the Se...

Re: Why are Props & transforms not taking effect w...

Re: How do you get the following search to return ...

Re: How can I search for all fields that have a ce...

Re: Is there an option to automate "restart Splunk...

Re: Field name getting reflected in the same field...

Re: Asteriks in monitoring entry

Re: Is a dead SHC member expected to cause a batch...

Re: What represents time_taken?

Re: When updating our certs between universal forw...

Re: How to throttle alert until 23:59:59 of the da...

Join the Conversation