Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About isrjo
isrjo
Explorer
Member since:
11-21-2010
06-05-2020
Community Statistics
| Posts | 4 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-21-2010 |
Activity Feed
- Got Karma for redirect loop. 06-05-2020 12:46 AM
- Posted Re: redirect loop on Security. 09-05-2011 05:25 AM
- Posted redirect loop on Security. 08-30-2011 05:32 AM
- Tagged redirect loop on Security. 08-30-2011 05:32 AM
- Posted Re: Two questions one answer on Splunk Search. 11-21-2010 07:31 PM
- Posted Two questions one answer on Splunk Search. 11-21-2010 01:07 PM
- Tagged Two questions one answer on Splunk Search. 11-21-2010 01:07 PM
- Tagged Two questions one answer on Splunk Search. 11-21-2010 01:07 PM
- Tagged Two questions one answer on Splunk Search. 11-21-2010 01:07 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 |
09-05-2011
05:25 AM
Let me first clarify that we use the free license therefor having no login. The clean installation I just tried briefly to make some sort of reference, and since that did not work either I uninstalled it. There where however no errors part from 'invalid credentials'
I have enabled debug on the webservice, here is the output:
2011-08-30 18:15:47,724 INFO [4e5d0cb3b819c0a50] decorators:301 - require_login - no splunkd sessionKey variable set; cherrypy_session=84e231950db4515fc085e65e4fb1cc7d9786e4d0 request_path=/en-GB/
2011-08-30 18:15:47,724 INFO [4e5d0cb3b819c0a50] decorators:308 - require_login - redirecting to login
2011-08-30 18:15:47,735 DEBUG [4e5d0cb3bb19b7a50] init:366 - simpleRequest > GET https://217.75.116.40:8089/services/server/info [] sessionSource=cherrypy
2011-08-30 18:15:47,740 DEBUG [4e5d0cb3bb19b7a50] init:380 - simpleRequest < server responded status=200 responseTime=0.0052s
2011-08-30 18:15:47,742 DEBUG [4e5d0cb3bb19b7a50] init:366 - simpleRequest > POST https://217.75.116.40:8089/services/auth/login [[REDACTED]] sessionSource=cherrypy
2011-08-30 18:15:47,746 DEBUG [4e5d0cb3bb19b7a50] init:380 - simpleRequest < server responded status=401 responseTime=0.0038s
2011-08-30 18:15:47,746 DEBUG [4e5d0cb3bb19b7a50] init:394 - simpleRequest - Authentication failed; sessionKey=None
2011-08-30 18:15:47,757 DEBUG [4e5d0cb3c119c0dd0] init:366 - simpleRequest > GET https://217.75.116.40:8089/services/server/info [] sessionSource=cherrypy
2011-08-30 18:15:47,763 DEBUG [4e5d0cb3c119c0dd0] init:380 - simpleRequest < server responded status=200 responseTime=0.0051s
2011-08-30 18:15:47,764 DEBUG [4e5d0cb3c119c0dd0] init:366 - simpleRequest > POST https://217.75.116.40:8089/services/auth/login [[REDACTED]] sessionSource=cherrypy
2011-08-30 18:15:47,768 DEBUG [4e5d0cb3c119c0dd0] init:380 - simpleRequest < server responded status=401 responseTime=0.0034s
2011-08-30 18:15:47,768 DEBUG [4e5d0cb3c119c0dd0] init:394 - simpleRequest - Authentication failed; sessionKey=None
2011-08-30 18:15:47,779 DEBUG [4e5d0cb3c619c0fd0] init:366 - simpleRequest > GET https://217.75.116.40:8089/services/server/info [] sessionSource=cherrypy
2011-08-30 18:15:47,783 DEBUG [4e5d0cb3c619c0fd0] init:380 - simpleRequest < server responded status=200 responseTime=0.0039s
Not knowing to much about splunk internals, who's giving the 401 ? Is the web interface talking to the splunk daemon, responsible for the authentication ?
There are no errors found in any log.
... View more
08-30-2011
05:32 AM
1 Karma
Greetings.
We just upgraded our servers from opensuse 11.3 --> 11.4 (X64)
After the upgrade splunk no longer works, or more specificity the web does not. The splunk daemon seem to work as expected.
What happens is when accessing the webinterface a redirect loop occurs and the browser gives up.
Example from log:
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET / HTTP/1.1" 303 108 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e5765758219dad10
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/ HTTP/1.1" 303 127 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e5765758819daa50
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/account/login?return_to=%2Fen-GB%2F HTTP/1.1" 303 148 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e5765758c19dae50
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/account/login?return_to=%2Fen-GB%2Faccount%2Flogin%3Freturn_to%3D%252Fen-GB%252F HTTP/1.1" 303 162 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e5765759219daa50
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/account/login?return_to=%2Fen-GB%2Faccount%2Flogin%3Freturn_to%3D%252Fen-GB%252Faccount%252Flogin%253Freturn_to%253D%25252Fen-GB%25252F HTTP/1.1" 303 171 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e5765759719dae50
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/account/login?return_to=%2Fen-GB%2Faccount%2Flogin%3Freturn_to%3D%252Fen-GB%252Faccount%252Flogin%253Freturn_to%253D%25252Fen-GB%25252Faccount%25252Flogin%25253Freturn_to%25253D%2525252Fen-GB%2525252F HTTP/1.1" 303 184 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e5765759c19e3e90
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/account/login?return_to=%2Fen-GB%2Faccount%2Flogin%3Freturn_to%3D%252Fen-GB%252Faccount%252Flogin%253Freturn_to%253D%25252Fen-GB%25252Faccount%25252Flogin%25253Freturn_to%25253D%2525252Fen-GB%2525252Faccount%2525252Flogin%2525253Freturn_to%2525253D%252525252Fen-GB%252525252F HTTP/1.1" 303 195 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e576575a21a410d0
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/account/login?return_to=%2Fen-GB%2Faccount%2Flogin%3Freturn_to%3D%252Fen-GB%252Faccount%252Flogin%253Freturn_to%253D%25252Fen-GB%25252Faccount%25252Flogin%25253Freturn_to%25253D%2525252Fen-GB%2525252Faccount%2525252Flogin%2525253Freturn_to%2525253D%252525252Fen-GB%252525252Faccount%252525252Flogin%252525253Freturn_to%252525253D%25252525252Fen-GB%25252525252F HTTP/1.1" 303 202 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e576575a919dae50
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/account/login?return_to=%2Fen-GB%2Faccount%2Flogin%3Freturn_to%3D%252Fen-GB%252Faccount%252Flogin%253Freturn_to%253D%25252Fen-GB%25252Faccount%25252Flogin%25253Freturn_to%25253D%2525252Fen-GB%2525252Faccount%2525252Flogin%2525253Freturn_to%2525253D%252525252Fen-GB%252525252Faccount%252525252Flogin%252525253Freturn_to%252525253D%25252525252Fen-GB%25252525252Faccount%25252525252Flogin%25252525253Freturn_to%25252525253D%2525252525252Fen-GB%2525252525252F HTTP/1.1" 303 215 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e576575b019daf90
85.229.239.20 - - [26/Aug/2011:11:20:53] "GET /en-GB/account/login?return_to=%2Fen-GB%2Faccount%2Flogin%3Freturn_to%3D%252Fen-GB%252Faccount%252Flogin%253Freturn_to%253D%25252Fen-GB%25252Faccount%25252Flogin%25253Freturn_to%25253D%2525252Fen-GB%2525252Faccount%2525252Flogin%2525253Freturn_to%2525253D%252525252Fen-GB%252525252Faccount%252525252Flogin%252525253Freturn_to%252525253D%25252525252Fen-GB%25252525252Faccount%25252525252Flogin%25252525253Freturn_to%25252525253D%2525252525252Fen-GB%2525252525252Faccount%2525252525252Flogin%2525252525253Freturn_to%2525252525253D%252525252525252Fen-GB%252525252525252F HTTP/1.1" 303 226 "" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0" - 4e576575b519dae50
To test I downloaded the whole splunk instance to my laptop also running opensuse 11.4 and there it works. The difference between the two are that our servers are installed with just a minimum set of packages.
I fail to find anything in the manual about dependencies to the OS that could explain this.
I also just to try installed a (clean) later version of splunk in parallel to our production splunk, there I can not login. A wild guess is that something with session is broken.
Anyone have a clue what to do ?
... View more
- Tags:
- splunk-web
11-21-2010
07:31 PM
Thanks alot mate, been looking for a "if" - ability, unaware it was underneath the eval command. And yes it worked like a charm..
... View more
11-21-2010
01:07 PM
Greetings, I'm new to splunk and even though I'm extremely impressed with what I have seen/managed to do so far I still have not fully understand the structure of the querys, nor what functions to use where.
I have managed to introduce logs from our e-mail system and defined fields inside splunk accordingly. The problem however is that the meaning of the fields changes depending on the event. So for example my introduced field event_group with value 5 contains sent e-mail events and value 6 received, meaning in a group 5 event the sender is placed in field m_username and recipient in field m_sr_name, and for a group 6 it's the other way around.
The challange i'm facing is to present both events in one table sorted by date. Just to
illustrate, these are the two questions I would like to combine and have the output sent to the same table.
VBEAAAAABcO+PgAAZAABX1MLAb5U event_group="5" | rename m_ptime AS
"Date_time", m_username AS "Sender", m_sr_name AS "Recipient" | table
Date_time , Sender , Recipient
VBEAAAAABcO+PgAAZAABX1MLAb5U event_group="6" | rename m_ptime AS
"Date_time", m_username AS "Recipient", m_sr_name AS "Sender" | table
Date_time , Sender , Recipient
I have played around with various subsearches but as soon as I rename the fields inside the subsearch I am no longer able to extract that field, not even sure if that is the best approach.
... View more
