Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ericlarsen
ericlarsen
Path Finder
Member since:
01-26-2015
05-14-2021
Community Statistics
| Posts | 42 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 4 |
| Member Since | 01-26-2015 |
Activity Feed
- Posted Re: Splunk DB Connect - Cannot Delete Data Lab -> inputs on Splunk Enterprise. 05-14-2021 06:50 AM
- Posted Gemini KV Store Tools app file retention not working on Splunk Enterprise. 02-16-2021 08:24 AM
- Posted Do I have to use Splunk Connect for Syslog with the Cisco Networks Add-on for Splunk? on Getting Data In. 01-29-2021 09:59 AM
- Tagged Do I have to use Splunk Connect for Syslog with the Cisco Networks Add-on for Splunk? on Getting Data In. 01-29-2021 09:59 AM
- Karma Re: Why is the field count double the amount of total events? for briancrandall. 11-18-2020 04:45 PM
- Posted Re: Server error below the search bar on Security. 11-03-2020 01:11 PM
- Got Karma for My events have no host value!. 06-05-2020 12:49 AM
- Got Karma for My events have no host value!. 06-05-2020 12:49 AM
- Karma Re: how to resolve Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect": Introspecting scheme=server: script running failed (exited with code -1073740940). for mkocak. 06-05-2020 12:48 AM
- Got Karma for Re: How do I monitor Forwarded Events logs on Windows?. 06-05-2020 12:48 AM
- Got Karma for Why does the Palo Alto Networks App for Splunk make calls out to Palo Alto?. 06-05-2020 12:48 AM
- Karma Re: duplicate values causing conflict for NOUMSSI. 06-05-2020 12:47 AM
- Posted Re: How to ingest Microsoft .xel logs on All Apps and Add-ons. 01-07-2020 03:57 AM
- Posted How to ingest Microsoft .xel logs on All Apps and Add-ons. 01-06-2020 12:26 PM
- Posted Re: My events have no host value! on All Apps and Add-ons. 08-02-2018 03:53 AM
- Posted Re: My events have no host value! on All Apps and Add-ons. 08-01-2018 01:35 PM
- Posted My events have no host value! on All Apps and Add-ons. 08-01-2018 01:28 PM
- Posted Re: Trouble extracting time in JSON on Getting Data In. 07-17-2018 12:06 PM
- Posted Trouble extracting time in JSON on Getting Data In. 07-17-2018 11:50 AM
- Posted Re: Update to 6.6 resulted in the error "Failed to register with cluster master" reason "Error connecting: Connection refused" on All Apps and Add-ons. 12-05-2017 05:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
05-14-2021
06:50 AM
Did you resolve this issue? I'm experiencing the exact same thing.
... View more
02-16-2021
08:24 AM
Anyone using the Gemini KV Store Tools app (https://splunkbase.splunk.com/app/3536/)? If so, have you gotten the backup files retention to work? This app was recommended to me by Splunk Support. According to the documentation, "Retention deletion takes place when running kvstorebackup." But regardless of what value I use in the 'Age-Based Retention (Days)' field in the setup UI page, the backup files are never cleaned up. I'd rather not use a cronjob to clean them up as our Splunk instance is IaC and instances/servers can be terminated/rebuilt at any time (meaning the cron tab would be lost). Thanks!
... View more
- Tags:
- gemini_kvstore_tools
Labels
- Labels:
-
configuration
01-29-2021
09:59 AM
We're running v8.0.7. We ingest syslog data through a cluster of servers running rsyslog and UFs. I'm looking to install v2.6.2 of the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467/). Does anyone know if this TA requires the use of the Splunk Connect for Syslog app or can we use rsyslog (or syslog-ng) to accept syslog traffic? Thanks!
... View more
Labels
- Labels:
-
syslog
11-03-2020
01:11 PM
Did you ever find a resolution for this error? We're running v7.3.2, search head cluster, indexer cluster. It doesn't appear to affect the searches running, but multiple users are getting the "Server Error" message, usually after the job has finalized. Thanks.
... View more
01-07-2020
03:57 AM
Thanks for the response. Since I have a large number of servers, I'm trying to avoid using DB Connect. I was hoping for direct ingestion.
... View more
01-06-2020
12:26 PM
I have a need to ingest certain SQL Server logs, in a proprietary .xel format, into Splunk.
Do I need to somehow first get these logs into a common file type/format before ingesting them? If so, how would I do that?
Thanks.
... View more
08-02-2018
03:53 AM
I did not update $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-sqlserver/default/transforms.conf because this TA lives on a Heavy Forwarder and that path is correct.
I do not see any errors in the logs, either on the HF or Indexers.
... View more
08-01-2018
01:35 PM
Note: I tried to manually set the host value via the app configuration, but events still do not have a host in Splunk.
... View more
08-01-2018
01:28 PM
2 Karma
I'm configuring the DB Connect app (v3.1.1) with the SQL Server TA (v1.3.0) on a Heavy Forwarder (Splunk v6.6.5) in order to pull DMV data from our SQL environment. I'm using the default query templates.
All of the queries return data to the HF. However, 5 of them send their data to the Indexers with no host value (only source and sourcetype). Sample Splunk event:
8/1/18
2:36:48.340 PM
2018-08-01 14:36:48.340, object_name="MSSQL$ABCQ1:Memory Broker Clerks ", counter_name="Pressure evictions (pages/sec) ", instance_name="Column store object pool ", cntr_value="0", cntr_type="272696576", max_connection="32767", DatabaseName="master", ServerName="SRVSQLVQ4\ABCQ1"
source = sys.dm_os_performance_counters sourcetype = mssql:os:dm_os_performance_counters tag = database tag = performance
Has anyone seen this before?
Thanks.
... View more
07-17-2018
12:06 PM
I had run btool on props previously. I confirmed my sourcetype is active.
... View more
07-17-2018
11:50 AM
I have a JSON log file that I'm attempting to ingest (Splunk v6.6.5). The events parse correctly, but the epoch time isn't being used as the event timestamp. Splunk is using the file modified date for the event timestamp.
Here's a sample record and my props config (which lives on the Indexers):
{"time":1531405028,"name":"PSIKD01.BOOT","appl":"@ABCVDIF","server":"SERVER1","user":"LSRVID","HandleCount":792,"KernelModeTime":66875000,"OtherOperationCount":18498,"OtherTransferCount":630163,"PageFaults":320216,"PageFileUsage":1349924,"PrivatePageCount":1382322176,"ReadOperationCount":36716,"ReadTransferCount":38844376,"ThreadCount":34,"UserModeTime":363281250,"VirtualSize":2207380942848,"WorkingSetSize":672907264,"WriteOperationCount":205,"WriteTransferCount":63855}
[apm_json]
KV_MODE = none
INDEXED_EXTRACTIONS = json
TIME_PREFIX = "time":
TIME_FORMAT = %s
SHOULD_LINEMERGE = false
TRUNCATE = 100000
Any help would be appreciated. Thanks!
... View more
12-05-2017
05:51 AM
Any solution to this issue? We upgraded to v6.6.1 over a month ago but the message just started showing up on all Indexers today.
... View more
11-07-2017
05:58 AM
I contacted support and this was their response, which worked for me:
In DA-ESS-ThreatIntelligence/bin/configuration_checks/confcheck_failed_threat_download.py if you could change the line from the first line to the second
job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest=earliest)
job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest_time=earliest)
... View more
10-10-2017
08:37 AM
Is there any remediation besides upgrading to 4.7.2? I'm running ES 4.7.1 and cannot upgrade at this time, but I need to stop the "failed threatlist downloads" messages that appear every 3 hours.
... View more
09-05-2017
09:21 AM
The approach Giuseppe suggested is not one I'm exploring. I'm confident this can be done via a whitelist on the UF, not on the Indexers.
... View more
09-01-2017
06:10 AM
Thanks for the response.
I've verified that index=myIndex | regex "EventCode=3000" works in the search bar.
Are you suggesting using a HF to filter events before they're ingested?
Thanks.
... View more
08-31-2017
10:43 AM
I don't think the quotes are needed (I don't see them in the actual Event Log details).
I've tried all of the following with no luck:
1. whitelist = EventCode=\"3000\"
2. whitelist = EventCode=3000
3. whitelist = EventCode=3000
The documentation is very straightforward as to how this should work. Very frustrating it doesn't function as advertised.
... View more
08-31-2017
08:06 AM
I'm trying to monitor a specific Windows Application EventCode (via a whitelist), yet the events are not being sent to Splunk.
I've found numerous posts on the answers site, most of them with different configs, but I've yet to find one that works. What's stated in the documentation (http://docs.splunk.com/Documentation/Splunk/6.6.1/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27) does not work as specified.
I've tried both of these stanzas with no luck:
[WinEventLog://Application]
disabled = 0
index = os_windows
whitelist = EventCode="^3000$"
[WinEventLog://Application]
disabled = 0
index = os_windows
whitelist = EventCode="3000"
I'm running v6.6.1. Any help would be appreciated.
Thanks.
... View more
05-05-2017
05:50 AM
Ignore the sample file. It's just for illustrative purposes.
I was able to get it work by setting the sourcetype = csv in inputs.conf.
... View more
05-05-2017
04:11 AM
I don't want to have the users to create extracted fields for every single field if the field names are already included in the csv file.
... View more
05-04-2017
10:28 AM
I'm trying to monitor a CSV file (via a UF) with column headings included in the file. I want the column headings to be extracted at search time.
Sample file output:
"Name","DatabaseSize","UsedDatabaseSpace","AvailableNewMailboxSpace","NumMailboxes","TotalItemCount"
"SFG-DB01","306.9 GB (329,503,997,952 bytes)","257.1 GB (276,068,106,240 bytes)","49.77 GB (53,435,891,712 bytes)","223"
"SFG-DB02","350.4 GB (376,212,291,584 bytes)","300.7 GB (322,833,514,496 bytes)","49.71 GB (53,378,777,088 bytes)","362"
"SFG-DB03","308.6 GB (331,383,570,432 bytes)","236.1 GB (253,546,692,608 bytes)","72.49 GB (77,836,877,824 bytes)","151"
inputs.conf:
[monitor://E:\fileName*.csv]
index = test
sourcetype = mySourcetypeLog
ignoreOlderThan = 24h
crcSalt =
props.conf:
[mySourcetypeLog]
SHOULD_LINEMERGE = false
REPORT-getfields = mySourcetypeLog_fields
transforms.conf:
[mySourcetypeLog_fields]
DELIMS=","
FIELDS = "Name","DatabaseSize","UsedDatabaseSpace","AvailableNewMailboxSpace","NumMailboxes","TotalItemCount"
When I run a oneshot, the data is ingested correctly (one event per log record) but the extracted fields are not showing up.
Any help would be appreciated.
Thanks.
... View more
01-05-2017
05:13 AM
Thanks for the quick response. I'm trying to avoid installing a UF on each workstation if possible. I'm hoping someone has come across a feasible alternative.
... View more
01-05-2017
04:32 AM
Is it possible to ingest individual workstation Event Viewer logs to Splunk? Is installing a UF on each workstation the only way to accomplish it?
... View more
- Tags:
- splunk-enterprise
12-07-2016
05:53 AM
Thanks for the response.
How did you come up with the "data model summary = Inbound data amount (GB or MB) * 3.4" statement? Wouldn't it depend on the summary range of the data model?
... View more
12-06-2016
10:58 AM
We just implemented Splunk Enterprise Security about a month ago. We're new to data models, acceleration, and any implications they may have on our Splunk environment.
I noticed the datamodel_summary directory in our firewall logs index ($SPLUNK_HOME/var/lib/splunk/pan_logs/) is growing incredibly large (850GB and growing a couple dozen GB/day).
I need to understand why. We have the Palo Alto app installed as well and the Palo Alto Networks Firewall Logs datamodel (7 days acceleration) is 100 GB.
In ES, the Network Traffic datamodel (30 days acceleration), part of the Splunk_SA_CIM app, is 300+ GB!
There are approx. 350 dirs in the $SPLUNK_HOME/var/lib/splunk/pan_logs/datamodel_summary dir. Are all of these really necessary, or can I institute some kind of cleanup in this directory to recover space?
Any help in understanding how data models are stored/cleaned up would be greatly appreciated.
Thanks.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-14-2021
10:31 AM
|
Karma from
