Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jcspigler2010
jcspigler2010
Path Finder
Member since:
05-09-2016
06-05-2020
Community Statistics
| Posts | 33 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 10 |
| Member Since | 05-09-2016 |
Activity Feed
- Got Karma for Re: How to configure Splunk to use a custom CA SSL certificate for all Splunkd traffic?. 10-23-2022 06:36 AM
- Karma Re: How to fill in null or non existent fields in a custom dashboard? for woodcock. 06-05-2020 12:48 AM
- Karma Re: How to query _TCP_ROUTING key value? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to query _TCP_ROUTING key value? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Issues deploying initial shcluster apps from deployer for adonio. 06-05-2020 12:48 AM
- Karma Re: Where does the Master node in an index cluster store bucket replication information? for lguinn2. 06-05-2020 12:48 AM
- Karma Re: How to build a search that will show events that have passed a specific threshhold, create a table, and then provide filtering via a drop-down? for adonio. 06-05-2020 12:48 AM
- Karma Re: How to build a search that will show events that have passed a specific threshhold, create a table, and then provide filtering via a drop-down? for DalJeanis. 06-05-2020 12:48 AM
- Got Karma for How to fill in null or non existent fields in a custom dashboard?. 06-05-2020 12:48 AM
- Got Karma for How to create a choropleth map using state abbreviations?. 06-05-2020 12:48 AM
- Got Karma for How to find out why Splunk is crashing with error "Crashing thread: TcpChannelThread"?. 06-05-2020 12:48 AM
- Got Karma for How to find out why Splunk is crashing with error "Crashing thread: TcpChannelThread"?. 06-05-2020 12:48 AM
- Got Karma for Does anyone know what the "window_period" represents under Settings -> Licenses -> Installed licenses?. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk ISE TA fails when distributed via Cluster Master. 06-05-2020 12:48 AM
- Karma Re: WinEventLog:ForwardedEvents override for mikaelbje. 06-05-2020 12:47 AM
- Karma Re: Splunk and Port Mirroring for Ayn. 06-05-2020 12:46 AM
- Got Karma for Re: Including SSL Certificates in a Splunk App. 06-05-2020 12:46 AM
- Got Karma for Re: Including SSL Certificates in a Splunk App. 06-05-2020 12:46 AM
- Got Karma for Re: Including SSL Certificates in a Splunk App. 06-05-2020 12:46 AM
- Posted Re: Splunk ISE TA fails when distributed via Cluster Master on All Apps and Add-ons. 08-08-2017 12:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
08-08-2017
12:30 PM
1 Karma
Just dealt with this today at a customer site. Luckily I tailed the splunkd.logs on one of the indexers while their syslog w/ UF was firing data at this particular indexer. Saw the error and spiraled down to your same conclusion. I submitted feed back on this TA to have the doc site updated with instructions to modify the DATETIME_CONFIG variable in clustered index environments...
... View more
07-26-2017
06:29 AM
1 Karma
Does anyone know what the "window_period" represents under Settings -> Licenses -> Installed licenses?
... View more
Labels
- Labels:
-
license
07-19-2017
01:53 PM
Thanks somesoni2!
Sorry for the delay in credit. Was onsite with a customer all day. If you would be so kind to humor my next question. I can always start another thread if need be.
But we have an odd requirement at a client site where they index EVERYTHING sent from a heavy forwarder to an indexer and then send 2 or 3 source types off to a remote indexer. Now I know this isn't the conventional or best practice way of doing stuff, but due to political and environment boundaries, they have to forward data from the indexer and not the HF. HF would obviously be the optimal place to do this. So my question is, can we set the _TCP_ROUTING key at the HF level, and use it for routing and forwarding decisions at the indexer level? I guess the question generalized, does the DEST_KEY and FORMAT values persist from splunk instance to splunk instance or is just internal to that instance. I am going to test this out this week but figured someone would already have the answer.
Thanks!
... View more
07-19-2017
06:30 AM
Hello all
Is there a way you can query event's _TCP_ROUTING key value in a search? I would assume you should be able to since its being written in the events meta. We have bit of a complicated data routing and filtering issue and a search like this would be super helpful.
Thanks!
... View more
07-05-2017
12:56 PM
2 Karma
Splunk is crashing, related possibly to DMA (data model acceleration). Having an issue with one of my clustered indexers crashing. The following is the crash log. Any input or places to look would be awesome...
[build aeae3fe0c5af] 2017-07-05 15:49:56
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 8568 running under UID 500.
Crashing thread: TcpChannelThread
Registers:
RIP: [0x00007F2B891B15E5] gsignal + 53 (libc.so.6 + 0x325E5)
RDI: [0x0000000000002178]
RSI: [0x00000000000023A2]
RBP: [0x00007F2B8C5AE7F8]
RSP: [0x00007F2B633FAEF8]
RAX: [0x0000000000000000]
RBX: [0x00007F2B8A722000]
RCX: [0xFFFFFFFFFFFFFFFF]
RDX: [0x0000000000000006]
R8: [0x0000000000000008]
R9: [0xFEFEFEFEFEFEFEFF]
R10: [0x0000000000000008]
R11: [0x0000000000000206]
R12: [0x00007F2B8C5AE848]
R13: [0x00007F2B8C6893A0]
R14: [0x0000000000000001]
R15: [0x0000000058F56601]
EFL: [0x0000000000000206]
TRAPNO: [0x0000000000000000]
ERR: [0x0000000000000000]
CSGSFS: [0x0000000000000033]
OLDMASK: [0x0000000000000000]
OS: Linux
Arch: x86-64
Backtrace (PIC build):
[0x00007F2B891B15E5] gsignal + 53 (libc.so.6 + 0x325E5)
[0x00007F2B891B2DC5] abort + 373 (libc.so.6 + 0x33DC5)
[0x00007F2B891AA70E] ? (libc.so.6 + 0x2B70E)
[0x00007F2B891AA7D0] __assert_perror_fail + 0 (libc.so.6 + 0x2B7D0)
[0x00007F2B8B2A65DA] _ZN14SummaryManager20readSummaries_lockedERKN12cachemanager10BucketTypeERSt3mapINS0_7CacheIdENS_7SummaryESt4lessIS5_ESaISt4pairIKS5_S6_EEE + 1546 (splunkd + 0xB2C5DA)
[0x00007F2B8B2A7C89] _ZN14SummaryManager20handleSummaryChangesERK8JsonNode + 249 (splunkd + 0xB2DC89)
[0x00007F2B8B2A8E5C] _ZN21SummaryManagerHandler12handleCreateER10ConfigInfo + 348 (splunkd + 0xB2EE5C)
[0x00007F2B8B46357C] _ZN14MConfigHandler14executeHandlerER10ConfigInfo + 620 (splunkd + 0xCE957C)
[0x00007F2B8B4739ED] _ZN14MConfigHandler2goER10ConfigInfo + 189 (splunkd + 0xCF99ED)
[0x00007F2B8B4745B4] _ZN29AdminManagerReplyDataProvider2goEv + 804 (splunkd + 0xCFA5B4)
[0x00007F2B8B50CDE8] _ZN33ServicesEndpointReplyDataProvider9rawHandleEv + 88 (splunkd + 0xD92DE8)
[0x00007F2B8B50289F] _ZN18RawRestHttpHandler10getPreBodyEP21HttpServerTransaction + 31 (splunkd + 0xD8889F)
[0x00007F2B8B943D50] _ZN32HttpThreadedCommunicationHandler11communicateER17TcpSyncDataBuffer + 272 (splunkd + 0x11C9D50)
[0x00007F2B8AF82023] _ZN16TcpChannelThread4mainEv + 227 (splunkd + 0x808023)
[0x00007F2B8B9CD130] _ZN6Thread8callMainEPv + 64 (splunkd + 0x1253130)
[0x00007F2B8951AAA1] ? (libpthread.so.0 + 0x7AA1)
[0x00007F2B89267AAD] clone + 109 (libc.so.6 + 0xE8AAD)
Linux / jsspl3.verbosity.net / 2.6.32-642.6.1.el6.x86_64 / #1 SMP Wed Oct 5 00:36:12 UTC 2016 / x86_64
Last few lines of stderr (may contain info on assertion failure, but also could be old):
2017-07-05 15:45:59.290 -0400 splunkd started (build aeae3fe0c5af)
splunkd: /home/build/build-src/kimono/src/pipeline/indexer/search/SummaryManager.cpp:63: void SummaryManager::readSummaries_locked(const cachemanager::BucketType&, SummaryManager::SummaryMap&): Assertion `fields.size() == summary_info_fields_size' failed.
2017-07-05 15:49:34.566 -0400 splunkd started (build aeae3fe0c5af)
splunkd: /home/build/build-src/kimono/src/pipeline/indexer/search/SummaryManager.cpp:63: void SummaryManager::readSummaries_locked(const cachemanager::BucketType&, SummaryManager::SummaryMap&): Assertion `fields.size() == summary_info_fields_size' failed.
/etc/redhat-release: CentOS release 6.8 (Final)
glibc version: 2.12
glibc release: stable
Last errno: 0
Threads running: 74
Runtime: 21.872963s
argv: [splunkd -p 8089 start]
Regex JIT disabled due to SELinux
using CLOCK_MONOTONIC
Thread: "TcpChannelThread", did_join=0, ready_to_run=Y, main_thread=N
First 8 bytes of Thread token @0x7f2b570e6b90:
00000000 00 c7 3f 63 2b 7f 00 00 |..?c+...|
00000008
commandForThread=0, nextIdle=0x7f2b71571540, requestAfterThread=0, _tpfd=0x7f2b59ae5000, writeCorkCount=0, terminateCallback=(nil), ioError=No error, lastError=No error, terminateError=No error
giveCmd @0x7f2b570e6ce8: _queuedOn=(nil), ran=N, wantWake=N, wantFailIfLoopDone=N, cmd=0, ok=Y, chan=0x7f2b5ed7a800
writeDataAvail @0x7f2b570e6d48: _queuedOn=(nil), ran=N, wantWake=N, wantFailIfLoopDone=N, chan=0x7f2b5ed7a800
wbuf: ptr=0x7f2b570e6de8, size=0x8000, rptr=0x0, wptr=0x0
HttpListeningConnection: _transactionActive=Y, _haveHadTransaction=Y, _alreadyLoggedTimeout=N
HttpTcpConnection: peer=127.0.0.1, _desiredCompressionLevel=0
RestHttpServerTransaction: _restPath="admin/summaryman", namespaced=N, context=-/-, session=[user=splunk-system-user, refcnt=2, touched=1499284196, removed=N, id=aacf8b13120ab7d2c0f93e6c1ad67e4f, created=1499284184, createdBy=67C3A1EA-A1BB-4154-AB93-977DBDB331B4, sid="remote_jsspl5.verbosity.net_scheduler__nobody__f5__RMD5ed4f8c799ba150d6_at_1499283900_91172"]
HttpServerTransaction: _state=6, _shouldLog=Y, _startTime=1499284196.291574
REQUEST: POST /services/admin/summaryman HTTP/1.1
User-Agent: Splunk/6.6.1 (Linux 2.6.32-642.6.1.el6.x86_64; arch=x86_64)
TE: trailers, chunked
Host: 127.0.0.1:8089
Content-Length: 631
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Authorization: Splunk {value elided from dump}
_bytesReceived=631, _maximumRequestDataSize=2147483648, _totalBytesExpectedOfRequestData=631
_bytesLeftInRequestDataChunk=0, _requestTransferEncodingIsChunked=N, _receivingRequestDataForever=N
_needToSetupRequestGunzip=N, _owedConsume=0, _wantSavedRequestData=N
_100continue=0, _expectDisconnect=N, _overrideSourceState=0
POST arguments: {["name"] = "report_summaries", ["summary_changes"] = "{"f5-system_stats":{"dma":[{"summary_operation_type":"0","summary_cid":"dma|f5-system_stats~232~620CCE54-6DF9-47E1-B3A3-9BE55F5C66BB|2A18DD68-5133-4DA5-98D6-14813FE663D7_DM_f5_bigip-tmstats-pool_member_stat","summary_path":"/opt/splunk_hw/f5-system_stats/datamodel_summary/232_620CCE54-6DF9-47E1-B3A3-9BE55F5C66BB/2A18DD68-5133-4DA5-98D6-14813FE663D7/DM_f5_bigip-tmstats-pool_member_stat","summary_earliest_time":1499020655,"summary_latest_time":1499278827,"summary_size_on_disk":12288}]}}"}
REPLY: 200
admin_handler="summaryman"
MConfigHandler: name=summaryman, _atomFormat=1, _customAction=
caller args: id="report_summaries": { summary_changes -> { _dataType=string _isMultiValue=Y, _values: ["{"f5-system_stats":{"dma":[{"summary_operation_type":"0","summary_cid":"dma|f5-system_stats~232~620CCE54-6DF9-47E1-B3A3-9BE55F5C66BB|2A18DD68-5133-4DA5-98D6-14813FE663D7_DM_f5_bigip-tmstats-pool_member_stat","summary_path":"/opt/splunk_hw/f5-system_stats/datamodel_summary/232_620CCE54-6DF9-47E1-B3A3-9BE55F5C66BB/2A18DD68-5133-4DA5-98D6-14813FE663D7/DM_f5_bigip-tmstats-pool_member_stat","summary_earliest_time":1499020655,"summary_latest_time":1499278827,"summary_size_on_disk":12288}]}}"] } }
_docShowEntry=Y, _didFilter=N, _didPaginate=N
_maxCount=30, posOffset=0, _requestedAction=1
_shouldFilter=N, _shouldReload=N, _shouldAutoList=N, _sortSpecified=N
_strict_mode=N, _list_new=N, _force_stanza_overwite=N, _force_app_context_on_write=Y
sort keys: ["name"]
sort modes: ["auto"]
supported args: ["name" type=0 (required), "summary_changes" type=0 (required)]
Paginator: offset=0, count=30
_customStatusCode=0, _supportedActions=0x43, hasSession=Y
_forceBoolNormalization=N, _contextMode=0, _didCapCheck=Y
_ranSetup=Y, _restartRequired=N, _listingOne=N
_userName=splunk-system-user, _appName=search
ServicesEndpointReplyDataProvider: _setupState=0, _outputMode=1, _explicitOutputMode=N
GET args: {}
_allowedMethods={GET,POST,PUT,DELETE,HEAD,OPTIONS}, _preconditionState=0
_wantsSeparateThread=N, _alreadyBuiltHeaders=N, _needToSendBody=Y
_bodyBytesWritten=0, _chunkedState=0, _isLastTransaction=N
_varyBy=0x10, _redirectUrl="", _downloadFilename="", _totalScheduledLength=0
_willSendDataLater=N, _toSendState=0, _toSendSafe=Y
_knowCompleteLength=N, _desiredCompressionLevel=0
_replyIsGzipCompressed=N, _cacheControl=0x10, _maxCacheSeconds=4294967295, _dontIncludeFrameOptions=N
In TcpChannel 0x7f2b59ae5000, _tcloop=0x7f2b88c42690, no async write data, _data._shouldKill=N, r/w_timeouts=5.000/300.000, timeout_count=0
SSL: version="TLSv1.2", state="SSL negotiation finished successfully", cipher="ECDHE-RSA-AES256-GCM-SHA384", compression="zlib compression"
rbuf: ptr=0x7f2b59ae50a0, size=0x2000, rptr=0x0, wptr=0x0
TcpChannelAcceptor: , tcloop=0x7f2b88c42690, _disabledReasons=0, _activeCount=16, _inflightSubordinateAccepts=0
HttpListener: ssl=Y, _maxActiveConnections=6826, _wellBelowConnectionLimit=Y, _maxThreads=2658
SplunkdHttpListener: PORT: _allowGzip=Y, bind=https://:8089
conf: _sslopt={rootCAPath="", caCertFile="/opt/splunk/etc/auth/cacert.pem", certFile="/opt/splunk/etc/auth/server.pem", privateKeyFile="/opt/splunk/etc/auth/server.pem", privateKeyPassword_set=Y, commonNameToCheck="", altNameToCheck="", allowSslRenegotiation=Y, sslVersions="TLS1.2", cipherSuite="ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256", ecdhCurves="prime256v1, secp384r1, secp521r1", useCompression=Y, quietShutdown=NdhFile="", shouldVerifyClientCert=N}, _allowSslRenegotiation=Y, _frameOptionsSameOrigin=Y, _strictTransportSecurityHeader=N, _allowBasicAuth=Y, _allowCookieAuth=Y, _cookieAuthHttpOnly=Y, _cookieAuthSecure=Y
conf: _streamInWriteTimeout=5.000, _maxContentLength=2147483648, _maxThreads=2658, _maxSockets=6826, _forceHttp10=0
_thread=0x7f2b570e6b80: commandForThread=0, nextIdle=0x7f2b71571540, requestAfterThread=0, _tpfd=0x7f2b59ae5000, writeCorkCount=0, terminateCallback=(nil), ioError=No error, lastError=No error, terminateError=No error
giveCmd @0x7f2b570e6ce8: _queuedOn=(nil), ran=N, wantWake=N, wantFailIfLoopDone=N, cmd=0, ok=Y, chan=0x7f2b5ed7a800
writeDataAvail @0x7f2b570e6d48: _queuedOn=(nil), ran=N, wantWake=N, wantFailIfLoopDone=N, chan=0x7f2b5ed7a800
wbuf: ptr=0x7f2b570e6de8, size=0x8000, rptr=0x0, wptr=0x0
x86 CPUID registers:
0: 0000000B 756E6547 6C65746E 49656E69
1: 00020651 0C010800 83B82203 0FABFBFF
2: 55035A01 00F0B2FF 00000000 00CA0000
3: 00000000 00000000 00000000 00000000
4: 00000000 00000000 00000000 00000000
5: 00000000 00000000 00000000 00000000
6: 00000007 00000002 00000001 00000000
7: 00000000 00000000 00000000 00000000
8: 00000000 00000000 00000000 00000000
9: 00000000 00000000 00000000 00000000
A: 07300401 0000007F 00000000 00000000
B: 00000000 00000000 000000CD 0000000C
80000000: 80000008 00000000 00000000 00000000
80000001: 00000000 00000000 00000001 28100800
80000002: 65746E49 2952286C 6F655820 2952286E
80000003: 55504320 20202020 20202020 45202020
80000004: 35343635 20402020 30342E32 007A4847
80000005: 00000000 00000000 00000000 00000000
80000006: 00000000 00000000 01006040 00000000
80000007: 00000000 00000000 00000000 00000100
80000008: 0000302A 00000000 00000000 00000000
terminating...
... View more
05-30-2017
06:46 PM
Jeeze....
I was under the impression from docs that it went in the root of /shcluster dir.
Thanks adonio!
... View more
05-27-2017
06:45 AM
I'm having an issue deploying my first bundle of shcluster apps. I have all untarred apps in /opt/splunk/etc/shcluster, permissions are correct, all SH cluster members are configured with my deployers IP.
Everytime I run the "splunk apply shcluster-bundle -target https://172.16.31.36:8089 -auth admin:password
I get the following error
"Error while deploying apps to first member: Found zero deployable apps to send; /opt/splunk/etc/shcluster is likely empty; ensure that the command is being run on the deployer. If intentionally attempting to remove all apps from the search head cluster use the "force" option. WARNING: using this option with an empty shcluster directory will delete all apps previously deployed to the search head cluster; use with extreme caution!"
I haven't been able to find ANYTHING on this error. Any help would be great
... View more
05-12-2017
05:25 AM
Jrodman
Sorry to dig up a 3 year old question but wanted to expand the question a little bit. I understand that the streaming of data from FWDr to IDXr, stream of data from IDXr of origin to N IDXrs and the commit is reflected back to the forwarder. I'm assuming this is the scenario if you have useACK = true. But from a searching perspective, if I am running a real time search on the IDXr of origin, will I only see the data after the commits have happened at all participating N IDXrs or after the streamed data has made its way through the data pipeline? I would assume its the latter of the two, but wanted to make sure. This question came up at one of my customers where were setting up a multi site cluster.
Thanks!
... View more
04-14-2017
12:04 PM
Thanks guys both fantastic answers!
... View more
04-14-2017
08:22 AM
Have a silly yet relevant question. I deal with some very inquisitive customers when architecting, deploying and configuring splunk. One question has come up that I can't quite answer...
FYI, I'm well aware how Splunk Index Clustering works, where the configs are, how to deploy, what happens when a node goes down etc etc...
However I have not been able to answer the question of, where does the Master node store the bucket (primary,copy,raw,etc) status, information for the entire cluster? That goes for both single site and multi site
I know in server.conf you specify the cluster parameters and configs, but where is the actual bucket information. It has to be stored somewhere considering a SH participating in an indexer cluster checks with the master node first WHERE it should replicate its config bundle to for searching.
Thanks!
... View more
03-30-2017
08:19 AM
I think I answered my own question partially...
... View more
03-30-2017
08:11 AM
I know you can edit dashboards, create your own, add reports to dashboard etc etc etc.
But can you create a custom dashboard with the option of allowing a user to hide and display specific panels on that dashboard that he or she may or may not be interested in? Also have that configuration persist every time they log on?
Long story short, I created a custom dashboard for a client but wants the options to hide and show certain panels. Similar to how you can show and hide KSIs within the ES app.
Thanks for any and all help!
... View more
03-27-2017
05:09 AM
Thanks adonio
Had to expand on this a little hit. You can't filter on the state until the search is ran. I did the following
| dbinspect index=* | eval indexSizeGB = sizeOnDiskMB / 1024 | stats sum(indexSizeGB) as "Total Size in GBs" by index,state | search state=cold
Thanks pointing me in the right direction!
... View more
03-27-2017
04:29 AM
I have found ways to calculate total storage for all indexers per index. But how would I focus in on what is only occupying coldPath space? Possibly break this down per index.
thanks!
... View more
- Tags:
- splunk-enterprise
03-20-2017
03:06 AM
Niketnilay,
I think this will work nicely. Thanks!
... View more
03-19-2017
06:05 PM
Is there a way to do a real time search with a static start time? For example...
Select start time of march 19 @ 9:00 am and expand the latest time every 5 seconds? Instead of a sliding window of 5 minutes or 5 hours, it is more of an expanding window. I'm hoping this is relatively simple. I know earliest_time can set a static start time. Maybe this is the direction I want to go.
Thanks
... View more
03-06-2017
07:44 AM
DaJeanis This is EXACTLY what i was looking for.
Thank you so much
... View more
03-03-2017
01:49 PM
Thanks Adonio. I'll try it this weekend. Had to run out of the office this afternoon.
Cheers
... View more
03-03-2017
01:11 PM
Hello Splunkers,
I am trying to compose a search to do the following and create a table based off of the results:
Show only events where count of field host AND eventtype AND message_text AND interface within time period is larger than "X"
Create a table with fields _time,host,eventtype,message_text,interface
After creating the table, I want to be able to filter via dynamically built drop-down in a dashboard.
Essentially the customer wants to eliminate noise. They are only concerned with events that have happened a certain number of times within a specific time period. If a certain thresh hold is met, show me the event in a table. They deal with port flapping constantly but don't want to be alerted every time a port flaps. If a port flaps 2000 times, yes alert me. Build a table based off of this criteria, then provide filtering via drop down.
Hopefully that makes sense. I don't even know where to start with this one.
Thanks!
... View more
03-01-2017
04:24 AM
3 Karma
I know this is an older post so I understand if my question gets batted to the side. But is there a technical reason as to why you can't have certificates located in an app directory? It just seems like a way more intuitive way to deploy SSL related configurations as opposed to using something like ansible or GPOs.
Thanks!
... View more
01-20-2017
09:54 AM
Thanks for the input guys
This was what I ultimately did. It checks if each field has a value in it before filtering. If the field doesn't exist for that event, fill in with N/A
index = network sourcetype=cisco:ios host = "$host$" | eval protocol=if(isnull(protocol),"N/A",protocol),mnemonic=if(isnull(mnemonic),"N/A",mnemonic),reason=if(isnull(reason),"N/A",reason),message_text=if(isnull(message_text),"N/A",message_text),severity=if(isnull(severity),"N/A",severity),src_interface=if(isnull(src_interface),"N/A",src_interface) | search mnemonic="$mnemonic$" protocol = "$protocol$" reason = "$reason$" message_text = "$message_text$" severity = "$severity$" src_interface="$src_interface$" | lookup dnslookup host as host OUTPUT hostname as hostname | table _time,mnemonic,host,hostname,protocol,reason,message_text,severity,src_interface
Fillnull seems like a WAY easier way of doing it.
... View more
01-19-2017
07:25 AM
1 Karma
Bare with me on this one...
Splunkers!!!!
Have a custom dashboard panel question.
I am building a dashboard for a customer who just wants to show their cisco switch and routers in a single table. All of it being the sourcetype of cisco:ios.
Building of the table is relatively straight forward along with creating the drop -own menus that are dynamically generated from Splunk searches. Here's the issue I am running into….
If I filter on a host that doesn’t have a particular field I'm referencing in the table I am populating, no results return at all. The way I have the search constructed is as follows…
index = network sourcetype=cisco:ios mnemonic="$mnemonic$" host="$host$" protocol = "$protocol$" reason="$reason$" message_text="$message_text$" severity="$severity$" src_interface="$src_interface$" | table _time,mnemonic,host,hostname,protocol,reason,message_text,severity,src_interface
My default values for anything referencing a variable is “*”. So back to my issue, if the field doesn’t exist, Splunk doesn’t return results since it is an implicit AND. So for example, if I filter on the host “foo”, my search creating this table would ultimately look like this….
index = network sourcetype=cisco:ios mnemonic="*" host=“foo" protocol = "*" reason="*" message_text="*" severity="*" src_interface="*" | table _time,mnemonic,host,hostname,protocol,reason,message_text,severity,src_interface
which yield no results since host foo, doesn’t have a couple of the specified fields.
I did some research and found the following post about a similar issue, but it only addresses when you are doing a static table and have missing fields. https://answers.splunk.com/answers/60048/how-to-include-completely-missing-fields-in-results.html
You essentially do an eval, and if null, fill in the field with a static text.
I wanted to pick everyone’s brains and see how they would approach this and if my way is really that efficient.
My thinking is this…
filter on the host first because we know we are always going to have a host value.
Then run an eval on each field we need in our table. If the value is null, then fill in with “missing” or whatever. Then, pipe that into a sub search where you apply your variables and since the missing fields now have a value in them, a =* value will work. Finally pipe that all into a table.
So it would look sorta kinda like this…
index = network sourcetype=cisco:ios host=“$host$” | eval mnemonic=if(is null(mnemonic),”missing”,mnemonic) … repeat for each field, then pipe into … | search mnemonic="$mnemonic$” … do this for each field finally pipe into a table … | table _time,mnemonic,host,hostname,protocol,reason,message_text,severity,src_interface
Hopefully my banter makes sense 🙂
Any help is appreciated!!
... View more
12-28-2016
11:48 AM
I downvoted this post because splunk can index compressed files
... View more
12-22-2016
07:20 AM
1 Karma
Thanks for the reply jwelch. This is actually for management traffic over port 8089 so the change is done in the server.conf. But I finally figured out what my problem was. And you are right in your answer, splunk didn't like using a full path name in Windows speak C:\Program Files\SplunkUniversalForwarder\etc\auth\myCerts\universalForwarderCertBundle.pem. With or with quotes. As soon as I replace this with $SPLUNK_HOME/etc/auth/MyCerts/universalForwarderCertBundle.pem everything started working. Does splunk choked on "\" characters in configuration files?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
