Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About whrg
whrg
Motivator
Member since:
11-29-2018
09-18-2024
Community Statistics
| Posts | 320 |
| Solutions | 73 |
| Karma Given | 96 |
| Karma Received | 110 |
| Member Since | 11-29-2018 |
Activity Feed
- Posted Re: Splunk User of windows SplunkForwarder on Getting Data In. 08-14-2024 09:13 AM
- Karma Re: Splunk User of windows SplunkForwarder for Shahrukh_S. 08-14-2024 09:12 AM
- Karma Re: Splunk User of windows SplunkForwarder for gcusello. 08-14-2024 09:12 AM
- Got Karma for Re: What is crc_Salt = means and in which case its used?. 08-01-2024 09:04 AM
- Posted Re: Cannot change email address of Splunk Community account on Other Usage. 06-23-2024 07:46 AM
- Posted Re: Cannot change email address of Splunk Community account on Other Usage. 06-19-2024 11:48 PM
- Posted Cannot change email address of Splunk Community account on Other Usage. 06-19-2024 10:39 AM
- Got Karma for Re: How can I find out what the deployment errors are?. 06-07-2024 11:14 AM
- Posted Re: How do I change the email address of my splunk.com account? on Other Usage. 05-28-2024 03:35 AM
- Posted Re: How do I change the email address of my splunk.com account? on Other Usage. 05-28-2024 03:23 AM
- Posted How do I change the email address of my splunk.com account? on Other Usage. 05-28-2024 03:07 AM
- Got Karma for How to prevent automatic translation of input labels?. 03-06-2024 12:09 AM
- Posted Re: KVStore is not ready. Token auth system will not work. on Splunk Enterprise. 03-05-2024 04:48 AM
- Posted KVStore is not ready. Token auth system will not work. on Splunk Enterprise. 02-29-2024 04:26 AM
- Got Karma for Re: How can I automate the downloading of universal forwarder?. 01-10-2024 09:12 AM
- Got Karma for Re: How come our Splunk 6.5 REST API calls with curl command are not working?. 01-24-2023 05:45 AM
- Got Karma for Re: Can you help me identify when end time overlaps start time for the following events?. 12-11-2022 04:24 PM
- Posted How to prevent automatic translation of input labels? on Dashboards & Visualizations. 12-07-2022 12:25 AM
- Got Karma for Re: What is crc_Salt = means and in which case its used?. 10-03-2022 03:01 AM
- Got Karma for Re: How can I automate the downloading of universal forwarder?. 08-17-2022 02:14 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 13 | |||
| 1 |
08-14-2024
09:13 AM
Many thanks! I was troubleshooting why Splunk was not reading out the Security event log. After adding "NT Service\SplunkForwarder" to the "Event Log Readers" group, it finally works.
... View more
06-19-2024
11:48 PM
Same for First Name and Last Name (under Personal Information): Any changes made here will be reversed after the next login.
... View more
06-19-2024
10:39 AM
Hello, I am trying to change the email address of my Splunk community account. I went to My settings > Personal > Email and set the new email address. I got the verification email and verified the new email address. Now the new email address was displayed under My settings. However, when I logged out and then logged back in, the old email address is shown again. Is this a known issue?
... View more
05-28-2024
03:35 AM
I don't have an account on the partner portal. I will try support@splunk.com again. I will keep this post updated if I hear anything back.
... View more
05-28-2024
03:23 AM
Hello @gcusello, How exactly did you open this case with Support?
... View more
05-28-2024
03:07 AM
Like the title says, I want to change the email address of my splunk.com account. Logging into splunk.com and navigating to My Dashboard, it is only possible to change the password but not the email address. There are older forum posts which suggest to contact Splunk support. I wrote several emails but received no help. For any other website, changing the email address is a matter of seconds. Why is there no such option for splunk.com?
... View more
03-05-2024
04:48 AM
I found the solution which I came across here: https://community.splunk.com/t5/Security/How-do-I-renew-an-expired-Splunk-Certificate/m-p/389701 Turns out, the Splunk certificate was expired. This is how I checked: $ openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem
notAfter=Feb 27 13:56:21 2024 GMT To get a new certificate, I removed the old certificate and restarted Splunk (a new certificate will be created when Splunk starts): $ mv /opt/splunk/etc/auth/server.pem /opt/splunk/etc/auth/server.pem.backup Now Settings > Tokens is working again.
... View more
02-29-2024
04:26 AM
When I navigate to Settings > Tokens, I get this error message: KVStore is not ready. Token auth system will not work. Splunk logs shows this: ERROR JsonWebToken [233289 TcpChannelThread] - KVStore is not ready. Token auth system will not work.
ERROR KVStoreConfigurationProvider [233052 KVStoreConfigurationThread] - Failed to start mongod on first attempt reason=KVStore service will not start because kvstore process terminated
ERROR KVStoreBulletinBoardManager [233053 MongodLogThread] - KV Store changed status to failed. KVStore process terminated.. How can this be fixed?
... View more
Labels
- Labels:
-
administration
12-07-2022
12:25 AM
1 Karma
Hello,
I noticed that Splunk automatically translates input labels based on the user's locale. Dashboards with English labels are translated to German when the user locale is de-DE.
Here is an example:
<form version="1.1">
<label>Test</label>
<fieldset submitButton="false">
<input type="text" token="From">
<label>From</label>
</input>
<input type="text" token="To">
<label>To</label>
</input>
</fieldset>
</form>
en-US:
de-DE:
Not only is the translation unwanted, the translation is also wrong. (In this context, "to" should be translated to "für" or "an".)
Is it possible to disable this kind of behavior?
I found two other posts. The solutions were 1) change each input field individually (https://community.splunk.com/t5/Dashboards-Visualizations/How-to-prevent-translation-of-labels-and-input-fields-in/m-p/537380) and 2) change the user locale to English (https://community.splunk.com/t5/Dashboards-Visualizations/How-to-avoid-translation-on-input-field-in-a-dashboard/td-p/477152). However, I would prefer a global setting to disable automatic translations.
... View more
Labels
- Labels:
-
dashboard
08-30-2021
01:20 AM
I noticed that the sort order is kept when using streamstats. This "feature" is undocumented though. index=_* earliest=-15m latest=now | streamstats count | table _time,host,index
... View more
04-29-2021
01:12 AM
I created a new request on Splunk Ideas for this issue: https://ideas.splunk.com/ideas/EID-I-958 If anyone else feels bothered by this, please upvote the idea.
... View more
04-29-2021
01:00 AM
Interestingly enough, the sort order is preserved when doing a dashboard table visualisation with the fields command. However, this approach has two drawbacks: 1) I have to use a seconds fields command to remove the _raw field: | fields - _raw 2) A drilldown (clicking on the magnifying glass below the panel) will not show a table
... View more
04-28-2021
02:11 AM
I tried, but I want the events to be displayed in tabular format.
... View more
04-28-2021
01:55 AM
Hello all, I would like to use the table command without changing the order of events. To give an example: When searching for "index=_* earliest=-15m latest=now", the first displayed event has the current time and the last displayed event is 15 minutes in the past. Now when searching for "index=_* earliest=-15m latest=now | table _time,host,index" the events are resorted. _time is no longer descending (or ascending). I tried "index=_* earliest=-15m latest=now | table _time,host,index | sort 0 -_time". But that does not work 100% because some events have the same timestamp. So my question is: Can I use the table command (or some other command to form a table based on a given set of columns) without changing the sort oder?
... View more
Labels
- Labels:
-
table
04-20-2021
01:44 AM
I just had the same error message: 04-20-2021 10:31:06.770 +0200 ERROR ExecProcessor - Couldn't start command ""C:\Program Files\SplunkUniversalForwarder\etc\apps\myapp\bin\myscript.ps1"": FormatMessage was unable to decode error (193), (0xc1) I had a deployment app which consisted of a ps1 file and this inputs.conf: [script://.\bin\myscript.ps1]
index = myindex
schedule = */15 * * * *
crcSalt = <SOURCE> I could not find out why this error message appeared. However, I found this article: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdatawithPowerShellscripts I removed the ps1 file and created this inputs.conf instead: [powershell://MyPSInput01]
index = myindex
script = Get-ADDomainController -Filter * | Select-Object -Property Domain,Name,HostName,IPv4Address,OperatingSystem,Enabled
schedule = */15 * * * *
crcSalt = <SOURCE> This solved my issue. I don't know if this works for more complex scripts than my one-liner. Using the powershell input works surprisingly well: Before that I used "ConvertTo-Csv" as part of the PowerShell command to convert the PowerShell output to CSV before indexing. Using the powershell input, I do not need to specify the sourcetype and Splunk handles the log format automatically.
... View more
01-06-2021
11:52 PM
I encountered the very same error. I was following this guide: https://www.splunk.com/en_us/blog/tips-and-tricks/write-your-own-search-language.html What I noticed was that this guide is from 2008. Newer version of Splunk already have a built-in "shape" command. This one is defined in etc/system/default/searchbnf.conf: [shape-command]
syntax = shape <field> (maxvalues=<int>)? (maxresolution=<int>)?
shortdesc = Produces a symbolic 'shape' attribute describing the shape of a numeric multivalued field. Apparently, the built-in shape command takes precedence over your custom shape command when running a search. So I suggest rename your "shape" command to "shape2" or something else.
... View more
12-08-2020
12:46 AM
I was having the same issue: Moving the "index" field to the selected field list for all users. I was testing various config files and settings. This is the one which solved the issue for me: /opt/splunk/etc/apps/myapp/default/ui-prefs.conf
[default]
display.events.fields = ["host","index","source","sourcetype"] (system/local/ui-prefs.conf should work as well.) Now it is important to note that if a user had already changed his selected fields prior to this change, then the user preferences ( /opt/splunk/etc/users/your_user/search/local/ui-prefs.conf) will override the global setting above and thus the "index" field might not display under selected fields. Regardless, it will work for newly created users and users who haven't changed their selected fields yet.
... View more
05-29-2020
08:17 AM
1 Karma
I believe your best option is to modify the app bar via the XML file under Settings / User interface / Navigation menus.
There you can add links to your dashboards for quick navigation.
Have a look at this article: https://dev.splunk.com/enterprise/docs/developapps/addnavsplunkapp/
... View more
05-29-2020
06:41 AM
2 Karma
To answer my own question, I found that the REST endpoint /services/search/jobs contains a lot of useful information.
Searching for rest /services/search/jobs will list all past Splunk searches (similar to the Activity/Jobs view). I found that a search from a dasboard will have the "provenance" field like this: UI:Dashboard:sample_simple_dashboard. So I can extract the name of a dashboard for all dashboard searches.
One difficulty in determining the runtime of a dashboard is that there is no clear endtime. A user can select various inputs and time windows on a dashboard which will continuously trigger new searches.
Luckely, there is the "published" field which tells when a search was triggered. So I can group together dashboard searches based on the "published" field.
This is the search i created:
| rest /services/search/jobs
| rename dispatchState as Status eai:acl.app as App title as Search author as User runDuration as Runtime published as Published id as ID provenance as Provenance
| rex field=Provenance "UI:Dashboard:(?<Dashboard>.+)" | search Dashboard=*
| rex field=ID "(?<JobId>[^//]*)$"
| table App,Dashboard,User,Published,Runtime,Status
| stats sum(Runtime) as Runtime count as searches values(Status) as Status by App,Dashboard,User,Published
| eval Status=mvjoin(mvsort(mvdedup(split(mvjoin(Status,","),","))),",")
| eval Runtime=round(Runtime,1)
| sort 0 -Published
... View more
05-22-2020
01:48 AM
1 Karma
Hello,
I want to find out which dashboards take a long time to load. So I would like to have a table which shows the runtimes/searchtimes for all dashboards being opened by any user.
It should look something like this:
time dashboard user runtime (in seconds)
2020-05-22 10:02:00 sample_dashboard admin 15
2020-05-22 10:01:00 sample_dashboard admin 20
2020-05-22 10:00:00 sample_dashboard2 user 5
I found two answers from 2016 and 2017 which do not work. (The first one returns empty and the second one lists searches instead of dashboards.) https://answers.splunk.com/answers/425215/how-can-i-measure-the-dashboard-load-time.html https://answers.splunk.com/answers/488539/how-to-write-a-search-to-find-out-the-average-dash.html
Can anybody help?
... View more
Labels
- Labels:
-
Other
03-23-2020
11:20 AM
Do you want to ingest data from a Splunk instance?
Check out the Splunk App for Phantom:
https://splunkbase.splunk.com/app/3411/
Under details, you will find a link to the documentation. It includes the chapter "Event Forwarding".
When you install this app, you will get new Phantom-related trigger actions like "Run Playbook in Phantom". This way, when a Splunk alert gets triggered, it will send the events to Phantom and run a specified playbook.
... View more
03-23-2020
10:52 AM
Try this:
| stats values(user)
You can combine it with the distinct count like this
| stats values(user) as users dc(user) as usercount
Alternatively:
| stats count by user
... View more
01-17-2020
03:21 AM
@romainbouajila I edited my answer. Have a look at the screenshot and the new props.conf.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-18-2024
08:46 AM
|
