Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About francoisternois
francoisternois
Path Finder
Member since:
01-09-2019
10-08-2020
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 01-09-2019 |
Activity Feed
- Karma Adding dimensions to my entities in Splunk App for Infrastructure (SAI) for joesrepsolc. 06-05-2020 12:51 AM
- Karma Re: Splunk app for Infrastructure overview shows "No results found" for CPU, Memory, Disk and Network metrics. for dagarwal_splunk. 06-05-2020 12:50 AM
- Karma mstats - convert spl from perfmon (is it possible) for nathanluke86. 06-05-2020 12:50 AM
- Karma InsecureRequestWarning in splunkd.log for anoopambli. 06-05-2020 12:49 AM
- Karma Why does my Splunk web keep auto-refreshing? for shrikant0013. 06-05-2020 12:49 AM
- Karma Re: How to configure DMC for heavy forwarder monitoring? for mathiask. 06-05-2020 12:48 AM
- Posted Re: Splunk App for Infrastructure : entities still in inactive status on All Apps and Add-ons. 05-07-2020 12:20 AM
- Posted Re: Splunk app for Infrastructure overview shows "No results found" for CPU, Memory, Disk and Network metrics. on All Apps and Add-ons. 05-07-2020 12:14 AM
- Posted Re: Splunk app for Infrastructure overview shows "No results found" for CPU, Memory, Disk and Network metrics. on All Apps and Add-ons. 05-06-2020 02:42 AM
- Posted Re: Splunk App for Infrastructure : entities still in inactive status on All Apps and Add-ons. 05-04-2020 08:33 AM
- Posted Delete old SAML users on SHCluster on Security. 05-04-2020 08:01 AM
- Tagged Delete old SAML users on SHCluster on Security. 05-04-2020 08:01 AM
- Tagged Delete old SAML users on SHCluster on Security. 05-04-2020 08:01 AM
- Posted Re: Splunk App for Infrastructure : entities still in inactive status on All Apps and Add-ons. 04-30-2020 12:58 AM
- Posted Splunk App for Infrastructure : entities still in inactive status on All Apps and Add-ons. 04-28-2020 11:59 PM
- Tagged Splunk App for Infrastructure : entities still in inactive status on All Apps and Add-ons. 04-28-2020 11:59 PM
- Tagged Splunk App for Infrastructure : entities still in inactive status on All Apps and Add-ons. 04-28-2020 11:59 PM
- Posted Re: Splunk App for Infrastructure not displaying entities on All Apps and Add-ons. 04-28-2020 11:48 PM
- Posted Re: SAI - Windows entity does not show up on All Apps and Add-ons. 04-28-2020 03:23 AM
- Posted WinHostMon launched processes with users on Archive2. 01-20-2020 06:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-07-2020
12:20 AM
Thank you.
... View more
05-07-2020
12:14 AM
Awesome ! Thank you so much !
... View more
05-06-2020
02:42 AM
Hi there,
Despite Splunk 8.03 and Splunk App for Infrastructure 2.1.0, I also have this no result panels (whereas the data is ok in analysis panel).
Is it because the requests search for "cpu.*" ? How can I adapt this to windows (and linux) machines ?
... View more
05-04-2020
08:33 AM
Hello,
Thank you again for your help.
No specific error or failed for splunk_app_infrasctructure or sai
The version installed is 1.4.1 (last version compatible with Splunk 7.1.4) on a SHCluster.
... View more
05-04-2020
08:01 AM
Hi there,
I try to delete old SAML users on a SHCluster with Splunk 7.1.4. I followed instructions here https://answers.splunk.com/answers/525555/how-do-i-remove-old-saml-users.html but I still have these users in the access control > users page.
More surprisingly, if I request curl -k -u admin:{password} --request GET https://{searchhead}:8089/services/admin/SAML-user-role-map/{user} I have a positive answer (user found)
But if I request curl -k -u admin{password} --request DELETE https://{searchhead}:8089/services/admin/SAML-user-role-map/{user} It says : In handler 'SAML-user-role-map': Does not exist: /nobody/system/authentication/userToRoleMap_SAML/{user}
These users are not in /etc/users folder nor in authentication.conf file I also tried with authentication/users method. I tried to complete with debug/refresh and restart the SHCluster without the expected result.
Any idea ?
Regards, Francois
... View more
Labels
- Labels:
-
SAML
04-30-2020
12:58 AM
Thanks for your help.
Unfortunately, I set it up to 600s but it didn't work. I still have these inactive entities.
After analysis, it seems that it's not related to delay since last data received since I have inactive status with entities updated less than a minute ago.
Any other ideas ?
Regards,
Francois
... View more
04-28-2020
11:59 PM
Hi guys,
I'm trying to use Splunk App for Infrastructure bu I've an issue : some entities are in inactive status although receiving data (confirmed in "Analysis" view) but sometimes go back to active and so on.
As most of the "sometimes inactive status" entities are receiving data every 5m (not production hosts), I wonder if there is a parameter to tune the detection of pseudo inactivity ?
Thanks for your help
Francois
... View more
04-28-2020
11:48 PM
Hello,
do you install splunk add-on for infrastructure on your indexer(s) ?
do you receive data in your index em_metrics ?
do you setup _meta in your inputs.conf ?
Regards,
Francois
... View more
04-28-2020
03:23 AM
Hello Peter,
Can you share your inputs.conf ?
In my case, I just add _meta = os::Windows
Otherwise, it didn't show up...
... View more
01-20-2020
06:40 AM
Hello guys,
I'm currently using Splunk_TA_Windows (v5.0.1). I'd like to add the user who launched each processes.
Is there a way to add this ? (argument to winhostmon binary ?)
Regards,
Francois
... View more
07-16-2019
12:06 AM
Hi,
First, you have to setup https from end-to-end. From my experience, http won't work (in my case at least).
The setup that work for me in cloudgateway.conf
[proxyConfig]
https_proxy = https://user:password@proxyIP:proxyPort
Another tricky point : you may have to clear your browser cache or use private navigation when configuring the app. It may solve issues...
... View more
07-09-2019
12:58 AM
Problem solved : It was a misconfiguration about the https on the proxy !
... View more
07-08-2019
07:20 AM
Hello Guys,
I try to set up the Splunk Mobile Gateway, but it didn't work for me.
On the configure tab, I've this error ;
Then, on the status Dashboard :
Error found in splnuk_app_cloudgateway.log :
ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/servicesNS/nobody/splunk_app_cloudgateway/storage/passwords/encryption_keys?output_mode=json
The proxy seems to be correctly setup and all gateway inputs are enabled.
Any idea ?
Regards,
Fracois
... View more
01-09-2019
03:55 AM
That's perfect ! Thank you !
... View more
01-09-2019
02:40 AM
Thank again for your quick answer. Here is an example of what I'm facing. And I've no props.conf for this sourcetype. Maybe I should configure one indicating that it's cooked data ?
... View more
01-09-2019
02:20 AM
Thank you ! It works very well ! But...
Now I have multivalue fields 😕
I guess both extracted on HF and indexer. Any ideas ?
... View more
01-09-2019
12:49 AM
Hi,
I'm having trouble extracting timestamps from JSON on a production environment: Timestamp field is not used by Splunk as timestamp (and Splunk used the _indextime as timestamp). I tried to configure props.conf (see below) on both indexers and heavy forwarder (data are pulled from a data store on Azure). I have to say that on a local instance, it works fine.
Here is my raw data :
{"odata.etag": "W/\"datetime'2019-01-09T08%3A29%3A09.2933828Z'\"", "PartitionKey": "201901090829", "levelno": "10", "hostname": "5c6744d1d32c", "levelname": "DEBUG", "version": "v1.2.1-741-g19422ce", "component": "Watcher", "Timestamp": "2019-01-09T08:29:09.2933828Z", "RowKey": "20190109082909284-5c6744d1d32c-22-00", "message": "Watcher running...", "pathname": "/app/ccc/watcher/perimeter.py", "lineno": "61"}
Different props.conf that I tried without any success :
[sourcetype]
CHARSET = AUTO
KV_MODE = JSON
MAX_TIMESTAMP_LOOKAHEAD = 20
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
TIME_PREFIX = Timestamp": "
category = Structured
disabled = false
pulldown_type = true
[sourcetype]
CHARSET = AUTO
INDEXED_EXTRACTIONS = json
KV_MODE = none
MAX_TIMESTAMP_LOOKAHEAD = 20
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = Timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
TIME_PREFIX = Timestamp": "
category = Structured
disabled = false
pulldown_type = true
Any help is very welcome 🙂
Francois
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-08-2020
12:33 PM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
