Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About QuintonS
QuintonS
Path Finder
Member since:
10-19-2018
11-22-2020
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 5 |
| Member Since | 10-19-2018 |
Activity Feed
- Got Karma for Re: Splunk Enterprise Security 6.X - Notables not showing in Incident Management. 02-11-2023 12:06 PM
- Got Karma for Re: Splunk Enterprise Security 6.X - Notables not showing in Incident Management. 06-05-2020 12:51 AM
- Got Karma for After Upgrade from Splunk 7.2.3 to Splunk 8.0.1 we get error TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132. 06-05-2020 12:51 AM
- Got Karma for Re: After Upgrade from Splunk 7.2.3 to Splunk 8.0.1 we get error TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132. 06-05-2020 12:51 AM
- Karma Re: How do you create a line graph which shows 3 values? for renjith_nair. 06-05-2020 12:50 AM
- Got Karma for trying to tail directories on windows machines for log files, problem is there are many subfolders and different file types. .log and .csv.. 06-05-2020 12:50 AM
- Posted Re: No CIM aligned fields for TA-WIndows-Defender on All Apps and Add-ons. 05-13-2020 05:31 AM
- Posted Re: No CIM aligned fields for TA-WIndows-Defender on All Apps and Add-ons. 05-13-2020 02:29 AM
- Posted Re: No CIM aligned fields for TA-WIndows-Defender on All Apps and Add-ons. 05-11-2020 01:27 AM
- Posted Re: Splunk Enterprise Security 6.X - Notables not showing in Incident Management on Splunk Enterprise Security. 04-09-2020 11:56 AM
- Posted Re: Splunk Enterprise Security 6.X - Notables not showing in Incident Management on Splunk Enterprise Security. 03-30-2020 10:49 PM
- Posted Re: Splunk Enterprise Security 6.X - Notables not showing in Incident Management on Splunk Enterprise Security. 03-30-2020 12:34 AM
- Posted Re: Splunk Enterprise Security 6.X - Notables not showing in Incident Management on Splunk Enterprise Security. 03-30-2020 12:27 AM
- Posted Splunk Enterprise Security 6.X - Notables not showing in Incident Management on Splunk Enterprise Security. 03-29-2020 10:44 PM
- Tagged Splunk Enterprise Security 6.X - Notables not showing in Incident Management on Splunk Enterprise Security. 03-29-2020 10:44 PM
- Posted Re: After Upgrade from Splunk 7.2.3 to Splunk 8.0.1 we get error TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132 on Splunk Enterprise. 02-10-2020 10:33 PM
- Posted Re: After Upgrade from Splunk 7.2.3 to Splunk 8.0.1 we get error TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132 on Splunk Enterprise. 02-10-2020 10:27 PM
- Posted Re: After Upgrade from Splunk 7.2.3 to Splunk 8.0.1 we get error TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132 on Splunk Enterprise. 02-10-2020 10:21 PM
- Posted After Upgrade from Splunk 7.2.3 to Splunk 8.0.1 we get error TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132 on Splunk Enterprise. 01-23-2020 06:37 AM
- Tagged After Upgrade from Splunk 7.2.3 to Splunk 8.0.1 we get error TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132 on Splunk Enterprise. 01-23-2020 06:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
05-13-2020
05:31 AM
Yup, the only difference is i specified the index as well in my eventtypes.conf, but that should work as well.
... View more
05-13-2020
02:29 AM
Hi,
Found the issue. the props, eventypes and tags were not working because the sourcetype was being renamed by the "Splunk add-on for Microsoft windows". We modified the app a little by changing the props.conf to use the "source::" and not the sourcetype, and also changed the search for the eventtypes to use the index and the source. This solved the issue and we now have all the extractions working and the tags are firing as expected.
Hope this helps?
... View more
05-11-2020
01:27 AM
Having the same issue, did you manage to find a solution?
... View more
04-09-2020
11:56 AM
2 Karma
Answering my own question here so that everyone is aware.
Problem was related to "Splunk_SA_cim" app. when installing this app on Search Heads (or SH clusters) be sure not to remove the "inputs.conf" as per the documentation. Splunk ES writes notables to disk and the inputs.conf within the CIM app then grabs these and writes to the "Notable" index which in turn allows the Incident management page to display the notables.
... View more
03-30-2020
10:49 PM
manually created the notable from event actions, nothing in Notable index and nothing in Incident Management. We are running Splunk Enterprise 8.0.1 with ES 6.x.
Im stumped on this one! strange thing is that the custom CS's were creating notables and showing in the Incident managment page as well as the Notable Index, and then stopped on the 27th February for some reason.
... View more
03-30-2020
12:34 AM
Yes, we do. I can see a couple of skipped searches, but when looking at the CS's in content management they have 100% success rate and no skipped searches at all.
... View more
03-30-2020
12:27 AM
Hi,
Yes, we have checked this and all the custom CS's have got the notable action enabled.
Thanks
... View more
03-29-2020
10:44 PM
Hi,
I have an issue at a customer where ES is not showing the notables on the incident management page or the security posture page. I have confirmed that the custom correlation searches are enabled, and they are successfully running and creating alerts looking at the "Activity" -> "Alerts" page.
I have found that the "Notables" Index is empty over the past 30 days.
Would really appreciate some assistance on this topic? as i have looked at all the articles on answers and cannot seem to find the issue.
... View more
02-10-2020
10:33 PM
I am asking since the Heavy Forwarders have also been upgraded to 8.0.1 but the UF's are still running 7.2.3 and are in the process of being upgraded.
... View more
02-10-2020
10:27 PM
Thank you for the response, this solved my issue. Just another question is this only for the Heavy Forwarder to indexer or would it also be applicable from UF to Heavy Forwarder?
... View more
02-10-2020
10:21 PM
1 Karma
Thank you for the response, this solved my issue. Just another question is this only for the Heavy Forwarder to indexer or would it also be applicable from UF to Heavy Forwarder?
... View more
01-23-2020
06:37 AM
1 Karma
Hi,
I am dealing with an issue where after upgrading our Splunk environment from 7.2.3 to 8.0.1 we are having endless errrors as stated in the title on the indexers within the cluster.
Error - 01-23-2020 15:58:09.056 +0200 ERROR TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132 for data received from src=1
Data flow is - UF --> Heavy Forwarder --> Indexer
Anyone that can shed some light on this?
... View more
- Tags:
- splunk-enterprise
10-02-2019
05:55 AM
After installing Splunk ITSI within a Search Head Cluster it is showing a Blank Screen on the default service analyser page. Also getting the following error message when inspecting the web page from Browser. Tried accessing with Chrome and Safari.
config:1 [Deprecation] Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help, check https://xhr.spec.whatwg.org/.
(anonymous) @ config:1
common.js:195 Uncaught TypeError: Cannot read property 'entry' of undefined
at i. (common.js:195)
at c (common.js:1531)
at Object.fireWith as resolveWith
at x (common.js:1531)
at XMLHttpRequest. (common.js:1531)
... View more
02-21-2019
11:19 PM
Thanks for replying so quickly, definitely not a premission issue. Tried testing with adding the sub directories directly in the input and it bring the files in. with regards to the wildcard we are planning to add a whitelist for the files in production as this is just a POC. problem is that it brings in the files in the main directory but not the subdirectories?
... View more
02-21-2019
11:03 PM
1 Karma
my input.conf below, need to have a recursive path for subfolders and all files. But the below is not working, am I missing something?
[monitor://M:\MGSLog\...\*]
sourcetype = mgslog
index = mgslog
disabled = false
ignoreOlderThan = 1d
... View more
- Tags:
- inputs.conf
10-23-2018
01:57 AM
You are 100% correct, it turns out the Calendar on my MAC shows the week numbers at the end of the week and thats why i read it incorrectly...my date is perfect! Rookie mistake!! 🙂
... View more
10-22-2018
09:34 PM
I have the following query:
| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%m%d %V")
| stats sum(rh) as RH sum(cmplt_reading_only) as ReadOnly by week
Sample output below:
week, RH, Readonly
08/27 35. 10000. 59
09/03 36 10000. 59
The problem is that the week numbers are not matching to actual week numbers in Calendar, for example Week 35 is starting on Monday 08/27 but should be Monday 08/20. Can someone please help me on how to correct this?
... View more
10-19-2018
08:32 AM
This is very close, need to do some tweeks. seems to be working.
Thanks so much for the help! 🙂
... View more
10-19-2018
07:49 AM
i need to provide average of ratings for the client. so i have daily data with a "overal_rating" field. and i also have data per site. So i need to show average overall rating and average overall rating per site in the same graph. cant share sample data unfortunatley..
... View more
10-19-2018
07:35 AM
Hi Renjith, not looking for the totals.
output i want should look like the following.
Week, Site1, Site2, Overall rating
hope this makes sens?
... View more
10-19-2018
06:22 AM
Rookie Question: I am trying to create a line graph showing 3 values. i have the query which works perfectly to show "ratings" per site for each site per week. But i want to show the overall rating for both sites as well.
here is the query i use..
| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%V")
| chart avg(overall_rating) over week by area
area= field name and contains values for 2 sites. if i remove "by area" then i get the overall rating for both sites and i want to get that showing in the same graph.
please help a newbie!! 🙂
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-22-2020
04:16 AM
|
Karma from
