Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About panguy
panguy
Contributor
Member since:
05-03-2016
10-12-2023
Community Statistics
| Posts | 86 |
| Solutions | 14 |
| Karma Given | 9 |
| Karma Received | 23 |
| Member Since | 05-03-2016 |
Activity Feed
- Got Karma for Re: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied. 10-24-2023 01:54 AM
- Karma Splunk Web on Docker fails to start using an M1 Mac on Monterey for mvanberg. 10-12-2023 09:17 AM
- Karma Re: Splunk Web on Docker fails to start using an M1 Mac on Monterey for isoutamo. 10-12-2023 09:17 AM
- Got Karma for Re: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied. 05-13-2023 06:00 PM
- Posted How do you add an external link in Splunk Monitoring Console Health Check checklist.conf on Splunk Dev. 04-28-2023 02:55 PM
- Tagged How do you add an external link in Splunk Monitoring Console Health Check checklist.conf on Splunk Dev. 04-28-2023 02:55 PM
- Tagged How do you add an external link in Splunk Monitoring Console Health Check checklist.conf on Splunk Dev. 04-28-2023 02:55 PM
- Posted Re: Add-on Builder 4.1.2 Detected an outdated version of the Splunk SDK for Python (1.6.6) on Splunk Dev. 03-09-2023 10:00 AM
- Posted Add-on Builder 4.1.2 Detected an outdated version of the Splunk SDK for Python (1.6.6) on Splunk Dev. 03-09-2023 09:54 AM
- Got Karma for Re: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied. 11-16-2022 06:11 PM
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 09-28-2021 06:50 AM
- Posted Re: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied on Installation. 11-25-2020 01:21 PM
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 11-11-2020 12:49 PM
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 10-05-2020 11:46 AM
- Posted Re: Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-05-2020 08:28 AM
- Karma Re: Why is App Inspect failing in inputs.conf.spec? for thambisetty. 08-05-2020 08:28 AM
- Posted Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Tagged Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Tagged Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Got Karma for Re: Palo Alto Networks global protect only shows one month of data. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
04-28-2023
02:55 PM
I'm trying to figure out how do we add an external link to documentation in checklist.conf. This is for a healthcheck that will be run in the Splunk Monitoring Console. Here is an example from the System Hardware provisioning assessment health check: [system_hardware_provisioning_assessment]
title = System hardware provisioning assessment
category = System and Environment
tags = best_practices, capacity, scalability
description = This evaluates the hardware specifications of Splunk instances tasked with indexing and/or searching data, using reference hardware.
failure_text = One or more hosts has returned CPU or memory specifications that fall below reference hardware recommendations. This might adversely affect indexing or search performance.
suggested_action = If you are experiencing performance issues, consider upgrading hosts to meet or exceed the recommended hardware specs.
doc_link = healthcheck.hardware.reference
doc_title = recommended minimum hardware
applicable_to_groups = dmc_group_search_head,dmc_group_indexer
search = | rest $rest_scope$ /services/server/info \
| eval cpu_core_count = if(isnotnull(numberOfVirtualCores), numberOfVirtualCores, numberOfCores) \
| eval physical_memory_GB = round(physicalMemoryMB / 1024, 0) \
| fields splunk_server cpu_core_count physical_memory_GB \
| eval severity_level = case(cpu_core_count <= 4 OR physical_memory_GB <= 4, 2, cpu_core_count < 12 OR physical_memory_GB < 12, 1, cpu_core_count >= 12 AND physical_memory_GB >= 12, 0, true(), -1) \
| rename splunk_server AS instance cpu_core_count AS "cpu_core_count (current / recommended)" physical_memory_GB AS "physical_memory_GB (current / recommended)" \
| fieldformat cpu_core_count (current / recommended) = 'cpu_core_count (current / recommended)'." / 12" \
| fieldformat physical_memory_GB (current / recommended) = 'physical_memory_GB (current / recommended)'." / 12" the doc_link isn't a URL but it does link to : https://docs.splunk.com/Documentation/Splunk/9.0.4/Capacity/Referencehardware?ref=hk How can I link to an external doc?
... View more
03-09-2023
10:00 AM
My work around: Manually update splunklib to the latest version by downloading the latest version of the Splunk SDK. SDK: https://github.com/splunk/splunk-sdk-python/ Extract and copy the splunklib directory to ../aob_py3/solnlib/packages/splunklib
... View more
03-09-2023
09:54 AM
After updating my add-on to 4.1.2 I am getting this error during certification: check_python_sdk_version Detected an outdated version of the Splunk SDK for Python (1.6.6). Please upgrade to version 1.6.16 or later. File: bin/add-on/aob_py3/solnlib/packages/splunklib/binding.py
... View more
11-25-2020
01:21 PM
3 Karma
I had this same problem when upgrading Splunk. After untaring the TGZ file to my $SPLUNK_HOME. cd $SPLUNK_ROOT_DIR
ls -lah This confirmed the owner of the folder changed to 10777 I went ahead and ran this line to fix permissions chown -R splunk:splunk $SPLUNK_HOME In your case change the user to root. Hope that helps.
... View more
- Tags:
- It helps.
08-05-2020
08:28 AM
Thank you. The App Inspect error is misleading. It makes it seem like we need to add it into inputs.conf.spec file. I removed it from inputs.conf.spec and added it to only inputs.conf and it now passes.
... View more
08-04-2020
09:08 PM
I am currently getting this failure when running my add-on through appinspect:
check_inputs_conf_spec_stanzas_has_python_version_property
My README/inputs.conf.spec
[autofocus_export://<name>]
python.version = python3
label =
interval =
AppInspect Report:
Modular input "autofocus_export" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 1
Current documentation for inputs.conf.spec doesn't mention using python.version. Any help would be appreciate
... View more
Labels
- Labels:
-
add-on
-
modular input
-
python
06-02-2020
03:24 PM
3 Karma
try commenting out line 125, 126 173, 174 from props.conf in Splunk_TA_paloalto. This answer works as of version 6.2.0 of the add-on.
... View more
06-02-2020
03:17 PM
what lines did you comment out? I'm assuming your commenting props.conf
... View more
06-02-2020
03:04 PM
Sorry, I didn't realize there is no option to disable it from the GUI. Commenting it out should work. Did you restart the instances?
... View more
06-02-2020
01:59 PM
Have you tried disabling the automatic lookups from the "Lookups" setting page?
... View more
06-02-2020
01:42 PM
I may need a little more context. Firewall logs are generally forwarded to the Splunk instance. Splunk shouldn't need to authenticate with a Firewall to get logs.
... View more
06-02-2020
09:42 AM
The Palo Alto Networks add-on was built using Splunk's Add-on builder and leverages Splunk's credentials encryption method from the settings page.
... View more
05-13-2020
03:00 PM
Please open Browser Inspector and click on the network tab. Let me know what files are showing up as 404.
... View more
03-11-2020
04:58 PM
Yes, I can confirm this is a breaking update for GlobalProtect.
GlobalProtect now has its own log type. It is no longer apart of the system log type. We will be updating the app and add-on to reflect this change.
Since GlobalProtect has it's own log type, you need to activate log forwarding for GlobalProtect. This can be done at Device -> Log Settings. You will see a new section for GlobalProtect as well as IP-TAG logs. Add a filter to the section to forward logs.
... View more
02-27-2020
03:10 PM
This is a known issue with Cortex that is planned to be fixed. The empty value was in place of a serial number. In the future there will be a value here to signify this is coming from Cortex. Temporary work around is to change the REGEX to ^[^,]+,[^,]+,[^,]?+,THREAT,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-12-2023
02:43 PM
|
Karma given to
