Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ben_leung
ben_leung
Builder
Member since:
05-13-2014
04-20-2021
Community Statistics
| Posts | 202 |
| Solutions | 11 |
| Karma Given | 44 |
| Karma Received | 88 |
| Member Since | 05-13-2014 |
Activity Feed
- Got Karma for Re: Waiting for web server at https:// (Web Services takes a long time to load). 01-16-2023 05:15 AM
- Got Karma for Re: Why is my search using "mcollect" command causing the following error: "Error in 'mcollect' command: Must specify a valid metric index"?. 12-15-2020 12:26 AM
- Karma Splunk App for Microsoft Exchange: Could not load lookup=LOOKUP-exc_host for jmillford. 06-05-2020 12:50 AM
- Karma Does a user always to have to authenticate every 30 days with a refresh token? for steve23063. 06-05-2020 12:50 AM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 06-05-2020 12:50 AM
- Karma Re: What are some solutions for high cardinality field reporting? for somesoni2. 06-05-2020 12:49 AM
- Karma REST API Modular Input: After creating a custom search command as a Python script, why am I getting the following "parse transport header" error message? for kiril123. 06-05-2020 12:49 AM
- Karma Sudden excessive WinEventLog:Security events involving splunkd.exe for nk-1. 06-05-2020 12:49 AM
- Karma Possible Bug in the Jenkins Apps for skycree_rh. 06-05-2020 12:49 AM
- Karma Re: How to search what values are missing in my lookup table? for niketn. 06-05-2020 12:49 AM
- Karma Re: Is it okay to run a universal forwarder without an inputs.conf? for ddrillic. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my search using "mcollect" command causing the following error: "Error in 'mcollect' command: Must specify a valid metric index"?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my search using "mcollect" command causing the following error: "Error in 'mcollect' command: Must specify a valid metric index"?. 06-05-2020 12:49 AM
- Got Karma for Re: How can I direct a role to a specific dashboard at login?. 06-05-2020 12:49 AM
- Karma Re: How to get a single value display to show a value of zero instead of no results? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: What are the minimum set of capabilities to log in to Splunk and search an index? for the_wolverine. 06-05-2020 12:48 AM
- Got Karma for Re: Can you regex or wildcard props Sourcetype stanzas?. 06-05-2020 12:48 AM
- Got Karma for Re: Can you regex or wildcard props Sourcetype stanzas?. 06-05-2020 12:48 AM
- Got Karma for How should I set the con_replication_max_pull_count value for search head cluster members to pull configuration changes from the captain?. 06-05-2020 12:48 AM
- Got Karma for Re: Can you regex or wildcard props Sourcetype stanzas?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
12-05-2018
05:28 PM
You can actually do this now, while etc/system/local/web.conf contains x_frame_options_sameorigin = false under the [settings] stanza, add
replyHeader.Content-Security-Policy = frame-ancestors self
... View more
12-05-2018
11:52 AM
Splunk uses x frame options header sameorigin. I also want to use allow-from but that is not supported on browsers like chrome and safari.
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet#X-Frame-Options_Header_Types
If Splunk decided to use the header from Content-Security-Policy frame-ancestors, then you could state domains allowed.
... View more
Hi wolverine,
Yea, so for example if you have an admin role user create a saved search with index=_internal and have it run as owner, while sharing it to all roles, a regular user will be able to see the data.
Yea, so if the owners is in the admin role, the admin role's quota will be consumed.
... View more
09-21-2018
03:17 AM
Right, just couldn't find a doc for version 7.1.2 about that.
... View more
09-19-2018
11:36 PM
3 Karma
Okay so to resolve the issue, setup the metrics index on the search head cluster.
Missing the indexes.conf on our search head cluster. Overlooked this because we have indexes defined on our indexers.
Also because the previous method of using outputcsv and a monitoring stanza did not require any index definition on search heads.
... View more
09-12-2018
12:36 PM
I feel that the output of the results may not be right since the method is different.
| table _time, value, a_dimension, metric_name | mcollect index=test_metric
_time value a_dimension metric_name
2018-09-12 12:16:01.100 1.45 view_point view.point.metrics
2018-09-12 12:19:01.100 0.9 view_point view.point.metrics
2018-09-12 12:21:01.100 3.41 view_point view.point.metrics
Field value is a double. If I try to rename value to _value, still does not work.
... View more
09-11-2018
06:23 PM
This is a distributed search environment with search head clustering.
... View more
09-11-2018
03:38 PM
In my query before, I was using the outputcsv search command, and then I had a monitoring input stanza to upload it to my metrics index.
I then took out the outputcsv command and started using mcollect .
Not sure why, but the metrics index is not valid when it recieved metrics from a different method.
.... | mcollect index=metrics-index
And on my indexes.conf, the settings is configured to be metrics:
[metrics-index]
datatype = metric
... View more
09-07-2017
05:03 PM
Have you tried adding "reload" to the endpoint url?
/services/deployment/server/serverclasses//reload
... View more
08-22-2017
03:43 PM
I would suggest that you change the logging format. Your application already writes in JSON format, you just need to clobber the first line not in brackets into the rest of the content. This way, it should extract automatically without using search time parsing SPATH.
I like to tell teams to follow the index=_introspection logging format if you want auto extracted JSON fields.
... View more
08-22-2017
03:12 PM
I think I just repeated what was said here: https://answers.splunk.com/answers/79581/set-default-app-by-role.html
... View more
08-22-2017
03:10 PM
You need to add this to the role stanza in $SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf
example, if you want all users with admin role to go to the search app.
[role_admin]
default_namespace = search
Do this as well as @vasanthmss answer.
I don't know if user contains multiple roles what the outcome will be. Thinking that it will follow alphabetical order in preference.
... View more
08-22-2017
03:07 PM
1 Karma
This would only affect users that are going to the app (e.g. search or sos or es).
... View more
05-23-2017
10:45 PM
1 Karma
You need something like this in your local.meta in the search app:
[props]
access = read : [ admin ], write : [ admin ]
export = none
Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.
... View more
02-28-2017
02:40 PM
Is it just parsing queue thats blocked?
... View more
01-25-2017
03:38 PM
4 Karma
Maybe not use eval?
makemv delim=“ " mv
create some data
index=_internal | head 10 | table _time | eval mv="value1 value2" | table _time, mv | collect index=summary
see how its multivalue?
index=summary | head 20 | table _time, mv
now break them
index=summary | head 20 | table _time, mv | makemv delim=“ " mv
... View more
12-07-2016
04:12 PM
Does not look like you can. If you go into the app's search view, run a query e.g. index=_internal | head 1
Errors from indexers as shown:
12-07-2016 23:42:45.412 +0000 ERROR StreamedSearch - sid=remote_sh-abc-2.my.domain.com_1481154165.41768_6510209A-0131-4200-8B9D-63C774CA33FF, Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
... View more
12-06-2016
05:18 PM
In a distributed search environment, can we blacklist the app in distsearch.conf and prevent it from being part of the bundle replication to search peers?
I have a search head cluster with the Machine Learning Toolkit and Python for Scientific Computing (for Linux 64-bit). I added the following to the blacklist stanza under distsearch.conf in the search heads - Will things still function if app is not replicated to search peers?
[replicationBlacklist]
ml_tool_kit = apps/Splunk_ML_Toolkit/...
scientific_python = apps/Splunk_SA_Scientific_Python_linux_x86_64/...
... View more
11-02-2016
01:51 PM
Another follow question would be, does the credentials for the eAPI have to be the same on the instances of splunk that receive data from the switch (not just forwarder)?
... View more
11-02-2016
11:33 AM
Events coming from the Arista network device all contain the content "ERROR: unable to connect to eAPI".
I notice that the source and source types are scattered, so it seems the data is not generated correctly at the device before sending to Splunk.
Splunk internal logs from the device output :
ERROR ExecProcessor - message from "/usr/bin/eosfacts -r splunk.inventory -c /persist/sys/splunkforwarder/etc/arista.conf -index arista-splunk" No handlers could be found for logger "pyeapi.eapilib"
Working with someone that manages the Arista device, as I am unable to access the device itself to see what is configured.
They are suggesting that the credentials are setup wrong. I am not sure what user and password need to be input on the forwarder instance.
Any help would be appreciated!
... View more
09-13-2016
02:22 PM
We have a version 6.3.4 search head cluster and indexers, in a distributed search environment. Noticing that the searchpeers directory has the bundle along with the deltas. Can we set a time to live for these directories? Similar to setting a ttl for dispatch artifacts from scheduled runs.
Not sure if there is a configuration in distsearch or limits that would be able to do this.
... View more
08-09-2016
04:48 PM
I have some users that complain about the same issue. I had advised them to clear their cache, tried different web browsers, nothing works for them. Similar to the screenshot in the post, there is data in the timeline and the fields column display, but the events in the table do not show anything.
Trying to debug from the access logs and what I could find in Splunk internal logs, there is nothing out of the ordinary. HELP
... View more
07-25-2016
03:56 PM
So should we expect in the scheduler log that there will be a status completed for the specified scheduled time?
... View more
07-19-2016
03:24 PM
Can anyone second that this is the endpoint for the command?
/services/deployment/client/config/reload -X POST
... View more
07-14-2016
12:12 PM
Is this issue still in version 6.3+ ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-20-2021
01:05 PM
|
Karma given to
