Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About BP9906
BP9906
Builder
Member since:
07-25-2011
06-05-2020
Community Statistics
| Posts | 160 |
| Solutions | 14 |
| Karma Given | 8 |
| Karma Received | 74 |
| Member Since | 07-25-2011 |
Activity Feed
- Got Karma for Re: Why is cluster master reporting "Cannot fix search count as the bucket hasn't rolled yet.", preventing me from meeting my Search Factor?. 01-13-2026 12:45 AM
- Got Karma for Re: How to troubleshoot why startup.handoff in the Search Job Inspector always seems to take a long time?. 10-19-2020 08:44 AM
- Got Karma for Splunk TA-Windows-Exchange-IIS vs sourcetype=IIS. 08-10-2020 03:03 PM
- Karma Re: After applying a shcluster bundle, why am I getting splunkd startup parsing errors for Splunk_App_DB_Connect? for johnmvang. 06-05-2020 12:48 AM
- Got Karma for Re: DB Connect 2.2.0 not working in SHC. 06-05-2020 12:48 AM
- Got Karma for Re: DB Connect 2.2.0 not working in SHC. 06-05-2020 12:48 AM
- Got Karma for How to resolve Server Abort error - Nginx Reverse Proxy (load balancing). 06-05-2020 12:48 AM
- Karma Re: Splunk 6.2 mongod does not seem to shut down when initiating a restart for ChrisG. 06-05-2020 12:47 AM
- Karma Re: Splunk 6.2 mongod does not seem to shut down when initiating a restart for rbal_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect 2: How to run same the same SQL query on multiple databases? for jcoates_splunk. 06-05-2020 12:47 AM
- Karma Re: Move Splunk's VAR folder ($SPLUNK_HOME/var or /opt/splunk/var) for woodcock. 06-05-2020 12:47 AM
- Karma Re: What are the differences between append, appendpipe, and appendcols search commands? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Sideview Utils: Creating a dashboard with Switcher and multiple Button modules, how do I prevent the first button from running all subsearches? for sideview. 06-05-2020 12:47 AM
- Karma Re: Coalesce and CIM Compliant Fields for woodcock. 06-05-2020 12:47 AM
- Got Karma for Splunk v6.0.x - LineBreakingProcessor - remote_searches.log. 06-05-2020 12:47 AM
- Got Karma for Search Head Cluster - default.old directories. 06-05-2020 12:47 AM
- Got Karma for Search Head Cluster - default.old directories. 06-05-2020 12:47 AM
- Got Karma for Search Head Cluster - default.old directories. 06-05-2020 12:47 AM
- Got Karma for Search Head Clustering: Why am I getting a duplicate alert for one scheduled job?. 06-05-2020 12:47 AM
- Got Karma for Search Head Clustering: Why am I getting a duplicate alert for one scheduled job?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-24-2014
02:15 PM
Found that running it manually reports back:
Exception: Could not get snow credentials from splunk. Error: [HTTP 401] Client is not authenticated
I tried clearing local/app.conf and restarting Splunk, and then going Manage App > Setup and re-entering the credentials, but still fails.
... View more
07-24-2014
11:44 AM
Just followed the word doc instructions with Service Now App and enabled the user group fetch as as test and it fails. So does the user fetch too. Same error.
Any idea whats going on here?
ServiceNow instance is Dublin.
07-24-2014 11:40:37.874 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list" Traceback (most recent call last):
07-24-2014 11:40:37.874 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list" File "/opt/splunk/etc/apps/snow/bin/scripts/snow.py", line 249, in
07-24-2014 11:40:37.874 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list" sn.run()
07-24-2014 11:40:37.874 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list" File "/opt/splunk/etc/apps/snow/bin/scripts/snow.py", line 244, in run
07-24-2014 11:40:37.874 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list" self.retrieve()
07-24-2014 11:40:37.874 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list" File "/opt/splunk/etc/apps/snow/bin/scripts/snow.py", line 146, in retrieve
07-24-2014 11:40:37.874 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list" if child.tag not in self.snow_keys:
07-24-2014 11:40:37.874 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list" TypeError: argument of type 'NoneType' is not iterable
Running manually gets same results:
./bin/splunk cmd python /opt/splunk/etc/apps/snow/bin/scripts/snow.py sys_user_group_list
SNOW: Object=sys_user_group_list state=initiated offset=2000-01-01 00:00:00
Traceback (most recent call last):
File "/opt/splunk/etc/apps/snow/bin/scripts/snow.py", line 249, in
sn.run()
File "/opt/splunk/etc/apps/snow/bin/scripts/snow.py", line 243, in run
self.connect()
File "/opt/splunk/etc/apps/snow/bin/scripts/snow.py", line 103, in connect
user, password = authSession.getCredentials(sessionKey)
File "/opt/splunk/etc/apps/snow/bin/scripts/authSession.py", line 13, in getCredentials
% (myapp, str(e)))
Exception: Could not get snow credentials from splunk. Error: [HTTP 401] Client is not authenticated
... View more
07-23-2014
07:02 AM
Ditto:
07-23-2014 06:57:46.654 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" host=XXXX, jmxServiceURL=service:jmx:remoting-jmx://XXXX:YYYY, jmxport=YYYY, jvmDescription=description, processID=0,stanza=jmx://test1,systemErrorMessage="Unsupported protocol: remoting-jmx"
I copied jmx-client.jar to jmx_ta/bin/lib/ and restarted Splunk and received the above error.
Is the jmx:remoting-jmx service URL supposed to be like this (ie port 1099 and/or different service URI?):
https://community.jboss.org/wiki/JMXRemotingserviceconfiguration
... View more
07-16-2014
12:07 PM
I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.
... View more
07-16-2014
12:06 PM
I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.
... View more
07-16-2014
10:50 AM
2 Karma
07-16-2014 10:45:21.533 -0700 WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 11179 - data_source="/opt/splunk/var/log/splunk/remote_searches.log", data_host="XXXXXXXXX", data_sourcetype="splunkd_remote_searches"
Why does Splunk v6.0.x keep logging this on the indexers?
... View more
07-01-2014
06:46 AM
I'm having the same issue. I reported it here:
http://answers.splunk.com/answers/114566/dbquery-command-with-map-command
... View more
06-25-2014
07:50 AM
I resolved this issue.
I uncommented the lines in the top of: /opt/splunk/etc/apps/bigfix/lib/bigfix/soap/bfconnector.py
Which then gives all data via std out in a shell so you can see everything and where it errors. This helped me locate my issue and resolve it.
I wish the debugging info was present in the docs! 🙂
... View more
06-20-2014
02:17 PM
Why doesnt the above answer not match the docs? The above works, the docs do not for Splunk v6. 🙂
http://docs.splunk.com/Documentation/Splunk/6.0.4/AdvancedDev/ShareYourWork
... View more
06-20-2014
02:10 PM
I dont appear to have it, and I see it present in my system/local/times.conf and system/default/times.conf. The first column of "relative" under Presets is the same as the picture in v6.0.4 documentation: http://docs.splunk.com/Documentation/Splunk/6.0.4/SearchTutorial/Aboutthetimerangepicker
... View more
06-20-2014
01:47 PM
Hello,
Ever since our upgrade to v6 from v5, the "Yesterday" timepicker preset is missing. I see its not a default option yet it exists in times.conf. Can someone clarify why its missing?
I see this known bug which is perhaps related:
The times.conf spec file still refers to adding submenus in order to customize time range presets; this feature does not exist in Splunk Enterprise 6.x (SPL-76798)
... View more
06-18-2014
07:16 PM
I installed Bigfix App for Splunk and all was working with Splunk v5.x, now after upgrading to Splunk v6.0.4, the client.py script fails to execute. When I run manually I see the same error as SOS reports. Why is this causing an issue?
/opt/splunk/bin/splunk cmd python ./bin/clients.py
ERROR:root:Encountered Exception in GetRelevanceResult:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/bigfix/bin/../lib/bigfix/soap/bfconnector.py", line 44, in run
self.results = self.client.service.GetRelevanceResult(expr.format(url=self.url, user=self.user), self.user, self.passwd)
File "/opt/splunk/etc/apps/bigfix/bin/../lib/suds/client.py", line 542, in call
return client.invoke(args, kwargs)
File "/opt/splunk/etc/apps/bigfix/bin/../lib/suds/client.py", line 602, in invoke
result = self.send(soapenv)
File "/opt/splunk/etc/apps/bigfix/bin/../lib/suds/client.py", line 643, in send
result = self.succeeded(binding, reply.message)
File "/opt/splunk/etc/apps/bigfix/bin/../lib/suds/client.py", line 678, in succeeded
reply, result = binding.get_reply(self.method, reply)
File "/opt/splunk/etc/apps/bigfix/bin/../lib/suds/bindings/binding.py", line 151, in get_reply
self.detect_fault(soapbody)
File "/opt/splunk/etc/apps/bigfix/bin/../lib/suds/bindings/binding.py", line 182, in detect_fault
raise WebFault(p, fault)
WebFault: Server raised fault: 'Singular expression refers to nonexistent object.'
... View more
- Tags:
- Splunk for BigFix
06-18-2014
09:01 AM
How can I see what timezone the forwarder is using in my v6 to v6 splunk setup?
I'm just curious to verify it's set properly, that's all. Seeing the timezone might help me find a machine with an incorrect timezone too.
Thanks,
Brian
http://docs.splunk.com/Documentation/Splunk/6.0.1/data/Applytimezoneoffsetstotimestamps
... View more
06-16-2014
10:26 AM
1 Karma
1) Copied service-names-port-numbers.csv to ./SA-cisco-asa/lookups/
2) mkdir SA-cisco-asa/local
3) vi ./SA-cisco-asa/local/transforms.conf
4) add:
[networkservice]
filename = service-names-port-numbers.csv
max_matches = 1
... View more
06-16-2014
10:15 AM
Came across an issue where SA-cisco-asa references service-names-port-numbers.csv but that file is from Cisco Security Suite (which only certain users have access to), thus since SA-cisco-asa is export=system, then it generates an error for all users.
Can this be fixed?
Simply move the csv and transform to the sa-cisco-asa and all good.
Thanks,
Brian
... View more
06-03-2014
07:15 AM
Just upgraded to the Splunk TA for Cisco ASA (previous Cisco Firewall) and noticed that event_desc is missing because event_codes.csv doesnt exist and was never carried over. Any reason why this is the case?
Also the error_code field extraction is missing too.
Doesnt make any sense and I dont see it in the new Cisco Security Suite 3.0 either.
... View more
05-30-2014
10:49 AM
This was my exact issue, I had rsyslog feeding 1 log from many servers. I changed rsyslog.conf to be:
$template DynaFile,"/var/log/file-%programname%.log"
local3.* -?DynaFile
I was then able to create source type stanzas to use TZ= for timezone and host field renaming via transforms.
Thank you!
... View more
05-22-2014
02:17 PM
Why is the SA-nix app hidden, yet all its saved searches are made global to Splunk? Now all my apps on my search head/indexer show all these searches.
I dont want to break the Splunk App for Unix/Linux but I cant have the searches visible to all users.
... View more
05-19-2014
11:35 AM
It appears all the documentation here is related to Tomcat and JMX.
Has anyone had any luck using it with JBoss?
Today I use twiddle.sh to get my information but would be useful to do it using this app.
When I implement it with using port 4447 and dump all in domain "jboss" it comes back with:
processID=0,stanza=jmx://test3,systemErrorMessage="Failed to retrieve RMIServer stub: javax.naming.CommunicationException [Root exception is java.rmi.NoSuchObjectException: no such object in table]"
Any idea what is going on?
... View more
05-13-2014
07:34 AM
Close but not quite: http://answers.splunk.com/answers/4528/finding-your-local-timezone-with-eval
... View more
05-13-2014
07:33 AM
Thank you both for feedback. I also found another Splunk search that will convert the offset value (ie -0400) to relative time and then change it. This is almost what I'm looking for. The problem is that I have all our customer's timezones and I would like to create the alert based on their local business hours. So if the time is between these local business hours, send the alert. The timezone codes are all the standardized notation that Splunk (python) supports but it seems like trying to convert the timezone code to epoch time doesnt work.
... View more
05-12-2014
03:50 PM
I'm familiar with strftime and starptime command and timezones, but cant seem to manipulate now() and convert to a known timezone. As an example now() returns in PDT timezone and I would like to convert now() to CST6CDT. I tried using eval to do a diff but it doesnt return the field. Any idea why?
| eval time_diff=strptime("CST6CDT", "%Z")
... View more
05-06-2014
01:55 PM
Any way to support multiple bigfix servers? We have 2 separate domains.
Thanks
... View more
- Tags:
- Splunk for BigFix
04-22-2014
09:21 AM
Thought I'd add that I have a scripted input to collect Linux timezone:
TimeZone=$(grep -i "zone=" /etc/sysconfig/clock | awk -F= '{print $2}' | sed 's/"//g');
Then I have a splunk search to let me dump the info and format it like props.conf
[host:: ]
TZ =
... ...
Its a pain, but I can easily update the list and recycle the indexers regularly.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
