About Spranta

Spranta · ‎05-06-2022

Awesome!

Spranta · ‎04-20-2022

I'm getting the same error Error saving stream: Invalid Stream definition for stream with id netflow -- Validation Error None is not of type 'string', Invalid Stream definition for stream with id netflow -- Validation Error None is not of type 'string', Invalid Stream definition for stream with id netflow -- Validation Error None is not of type 'string' No idea which of the 277 entries in the vocabularies is causing the problems. Really annoying...

Spranta · ‎08-13-2021

Great solution, just noticed that my solution has the issues that I'm dedupping the same results so this will lead to an incorrect total value

Spranta · ‎08-13-2021

yes, try | dedup TimeStamp,Total

Spranta · ‎08-13-2021

You run the search every 42 past the full hour but your search is looking back 24 hours, am i right? So i when the scheduler is running the search at 0:42 you will find all events from the past 24 hours, if the search will run the next time at 1:42 it will also send you all the events from the past 24 hours, also the events which have been sent in the previous run at 0:42 with the exeption that the events between 0:42 and 1:42 are not included.. - you know that i mean? but you have overlaping timeranges, so events will be send multiple times. Change the time range to -1h or the cron only to run the search only once daily: for example 00 1 * * *

Spranta · ‎08-13-2021

Hi, have you tried to expand the Multiple Value field with | mvexand TimeStamp?

Spranta · ‎03-01-2021

The new TA is only and supports ontap 9.7

Spranta · ‎10-11-2020

I also opened a request on Splunk Ideas - https://ideas.splunk.com/ideas/APPSID-I-143 there you can follow the progress.

Spranta · ‎10-11-2020

Hi @nathanluke86 , yes meanwhile i've got answer from Splunk. The plan to upgrade the TA until December, but the app itselve will not be further developed. Alex

Spranta · ‎09-29-2020

Great Job!

Spranta · ‎07-30-2020

Hi, we want to use the Cisco WebEX Addon for Splunk but getting the following error: 2020-07-30 15:59:20,439 DEBUG pid=13947 tid=MainThread file=base_modinput.py:log_debug:288 | [-] WebEx Response: 'Incorrect user or password' 2020-07-30 16:00:18,794 INFO pid=14063 tid=MainThread file=setup_util.py:log_info:117 | Customized key can not be found The User we are using is working and we can connect to Webex in the Webbrowser. We believe it's our SSO Integration into ADFS which is causing the issue, because a pop up of our ADFS appears if we want to open the webex website and we have to enter the password there again. Is it possible that the addon doesn't work in a SSO environment? Thanks Ale

Spranta · ‎07-15-2020

No i don't think that fping is available.

Spranta · ‎07-15-2020

You can, for example, create a script that pings a whole subnet and write the output into a csv so you can use this to create the inputs.conf automatically, or you might have a cmdb that can create such a csv?

Spranta · ‎07-15-2020

Hi, we our using the TA_Nix for all our Linux Systems without any Problems. Can you post your inputs.conf? Which Linux Systems do you want to monitor? Thanks Alex

Spranta · ‎07-15-2020

Hi, have you installed the Python for Scientific Computing addon? It's a must if you want to run the Machine Learning Toolkit. https://splunkbase.splunk.com/app/2890/#/details Alex

Spranta · ‎07-15-2020

Hi Ricky, as far as i know the network toolkit doesn't have any autodiscovery features. We are creating are our input for the network toolkit from a csv file, so if you have any tool that is able to create a csv or whatever you can for example use a python script to feed the inputs.conf Alex

Spranta · ‎07-15-2020

Hi, we upgraded our Netapp Systems to ontap 9.7 and know we have got the same problems. The Splunk_TA_ontap is too old for the new ontap versions and isn't working anymore. Splunk hasn't updated the TA since more then a year 😞 I asked splunk if they have any information about future releases and will update the post afterwards.

Spranta · ‎07-09-2020

We just found out it's not the lookup editor itself. We change our authentication methode from ldap to saml. Using SAML the lookup editor is behaving really strange, switching back to ldap everythings fine. Seems to be a permission issue - we are still investigating.

Spranta · ‎07-09-2020

Hi, we have got the same problems editing kvstores. Copy a line will be added 8 times, change values isn't working every time. We are using this tool nearly everyday. But now it's really hard to get the right changes... Downgrading doesn't help, even if we install a very old version we get the latest mask... 😞 Our Splunk Version is the 7.3.4

Spranta · ‎05-24-2020

Depens on which role your instance is acting. We sepperate the workload, some Server are Searchheads and some are responsible only for Indexing the Data. You can have a Search- and Indexinginstance on one Hardware, but it's not recommanded. https://docs.splunk.com/Documentation/Splunk/8.0.4/Overview/AboutSplunkEnterprisedeployments

Posts	48
Solutions	3
Karma Given	4
Karma Received	3
Member Since	‎04-26-2016

Online Status	Offline
Date Last Visited	‎05-02-2023 10:02 AM

Splunk Cisco WebEX Addon / Single Sign On

Powershell failed with exception=An item with the ...

Why is the processing missing data in Splunk_TA_NI...

How to configure File/Directory Information Input ...

splunk_app_db_connect

Splunk App for Microsoft SharePoint: Why is the Lo...

Re: Why am I experiencing these problems with splu...

Re: problems with splunk app for netscaler appflow

Re: turn a columns with multiple entries into a ch...

Re: turn a columns with multiple entries into a ch...

Re: How to stop splunk sending multiple emails for...

Re: turn a columns with multiple entries into a ch...

Re: Unable to see data on from ONTAP 9.5P7 or newe...

Re: Unable to see data on from ONTAP 9.5P7 or newe...

Re: Unable to see data on from ONTAP 9.5P7 or newe...

Re: Why is Splunk not starting after upgrade to 8?

Splunk Cisco WebEX Addon / Single Sign On

Re: Network Toolkit - Question

Re: Network Toolkit - Question

Re: Monitoring *nix : CPU, iostat, vmstat, etc. On...

Re: Splunk Machine Learning Tool Kit Missing "comm...

Re: Network Toolkit - Question

Re: Unable to see data on from ONTAP 9.5P7 or newe...

Re: Lookup Editor edit issue

Re: Lookup Editor edit issue

Re: Why is the processing missing data in Splunk_T...