Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Esky73
Esky73
Builder
Member since:
05-16-2016
07-08-2025
Community Statistics
| Posts | 183 |
| Solutions | 6 |
| Karma Given | 60 |
| Karma Received | 23 |
| Member Since | 05-16-2016 |
Activity Feed
- Posted Re: Website monitoring : user format for domain users on All Apps and Add-ons. 07-02-2025 06:54 PM
- Posted Website monitoring : user format for domain users on All Apps and Add-ons. 07-02-2025 07:03 AM
- Posted Re: ITSI - exclusion of an entity from a service on Splunk ITSI. 04-10-2025 03:10 PM
- Posted Re: Splunk action to trigger and run a script to do autohealing on Splunk ITSI. 02-02-2025 08:49 PM
- Posted Still developed and supported? on Splunk ITSI. 10-16-2024 09:18 PM
- Got Karma for Re: create multiple sourcetypes from single syslog source. 10-08-2024 09:58 AM
- Posted Re: How to find out overall health status for VMWARE on Splunk ITSI. 09-09-2024 04:53 AM
- Posted Re: Tour of Splunk ITSI product for predictive monitoring on Splunk ITSI. 08-12-2024 06:41 AM
- Karma Re: Splunk instances will not connect to HTTP port for mpavlas. 07-11-2024 05:03 AM
- Karma Re: Splunk instances will not connect to HTTP port for mpavlas. 07-11-2024 05:03 AM
- Posted Re: Edit CSV file sent through sendemail command on Splunk Search. 02-26-2024 07:52 PM
- Posted Re: Why doesn't my Ingest Action work? on Getting Data In. 02-25-2024 03:45 PM
- Posted Re: ingest_eval lookup not working on Getting Data In. 02-13-2024 10:10 PM
- Posted Re: Live data from Appdynamics to splunk on Splunk ITSI. 02-09-2024 10:58 PM
- Posted Creating a line graph with positive and negative values in line graph at right angles (not connecting at angles) on Dashboards & Visualizations. 11-21-2023 08:46 PM
- Tagged Creating a line graph with positive and negative values in line graph at right angles (not connecting at angles) on Dashboards & Visualizations. 11-21-2023 08:46 PM
- Posted Adding input via URL link to ITSI Infrastructure Overview dimension search on Splunk ITSI. 11-01-2023 07:01 PM
- Got Karma for Re: How would I build a table of all metrics and their dimensions in splunk. 08-21-2023 09:40 PM
- Posted PSConsole error running powershell script from TA-Exchange-Mailbox bin directory on All Apps and Add-ons. 07-27-2023 09:31 PM
- Posted Help with Logic when a multivalue field appears: How to utilise lookup? on Splunk Search. 05-18-2022 07:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-02-2025
06:54 PM
Retried with curl and the domain\\username format and got curl to work - but the repsponse is initially a 401 and then retries and is successful - the request goes through a load balancer 1st enroute to the webserver. > curl http://mywebsite/healthcheck.aspx -v --ntlm -u DOMAIN\\username Enter host password for user 'DOMAIN\username': * Trying 1.1.1.1 ... * TCP_NODELAY set * Connected to myhost (1.1.1.1) port 80 (#0) * Server auth using NTLM with user 'DOMAIN\username' > GET /healthcheck.aspx HTTP/1.1 > Host: myhost > Authorization: NTLM XXX > User-Agent: curl/7.61.1 > Accept: */* > < HTTP/1.1 401 Unauthorized < Content-Type: text/html; charset=us-ascii < Server: Microsoft-HTTPAPI/2.0 < WWW-Authenticate: NTLM XXX < Date: Thu, 03 Jul 2025 01:07:05 GMT < Content-Length: 341 < * Ignoring the response-body * Connection #0 to host myhost left intact * Issue another request to this URL: 'http://myhost/healthcheck.aspx' * Found bundle for host myhost: 0x55a8787a6a60 [can pipeline] * Re-using existing connection! (#0) with host myhost * Connected to myhost (1.1.1.1) port 80 (#0) * Server auth using NTLM with user 'DOMAIN\username' > GET /healthcheck.aspx HTTP/1.1 > Host: myhost > Authorization: NTLM XXX > User-Agent: curl/7.61.1 > Accept: */* > < HTTP/1.1 200 OK < Cache-Control: private < Content-Type: text/html; charset=utf-8 < Server: Microsoft-IIS/10.0 < X-AspNet-Version: 4.0.30319 < Persistent-Auth: true < X-Powered-By: ASP.NET < Date: Thu, 03 Jul 2025 01:07:05 GMT < Content-Length: 557 < <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title>Health Check</title> </head>
... View more
07-02-2025
07:03 AM
what is the correct format for domain users please? if i curl from a HF i get get the desired 200 response using : curl -v http://mywebsite.com --ntlm -u username@mydomain.ad.ltd.com.au If i use this format in the TA i see the error message in the logs asking for format in domain\\username I have tried several connotations of mydomain\\username but have not been successful what should be the format for this domain? Or is the issue with --ntlm ? as if we use the --negotiate flag or remove --ntlm we get 401 ? cheers
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
04-10-2025
03:10 PM
Can you add an information field to the entity you don't want in the service and then add an exclusion for that information field in the entity filter?
... View more
02-02-2025
08:49 PM
yep .. we are doing just that - 1st you need to capture a batch job failing - this can be done in a number of ways such as writing the batch status to a log file to capture failures. - Then monitor that log file and create a KPI - Create a custom alert action that runs a batch job restart - in the neap create the logic that when the KPI picks up a failing batch job then trigger the custom alert action - then you need another correlation search to capture the batch job being successful and correlate with the KPI returning to normal to complete the cycle
... View more
10-16-2024
09:18 PM
Is this TA still being developed and supported? https://splunkbase.splunk.com/app/4950/ I followed the 'visit site' link on the splunkbase page and couldn't see the Enterprise version advertised?
... View more
09-09-2024
04:53 AM
Not quite sure what you are looking for? VMware has different components - but you will find a range of pre configured KPI's you can adapt to your requirements for ESX, Virtual Machines, Storage etc in the ITSI Content pack for Vmware
... View more
08-12-2024
06:41 AM
Theres a talk here with some demos : https://community.splunk.com/t5/Splunk-Tech-Talks/Machine-Learning-Assisted-Adaptive-Thresholding/ba-p/676851
... View more
02-26-2024
07:52 PM
Came looking for an answer to this as well - seems there has been an idea for this for some time now .. https://ideas.splunk.com/ideas/EID-I-717
... View more
02-25-2024
03:45 PM
Do you need to deploy to indexers (as well) ? when there is an intermediary HF ? All my config is on a HF
... View more
02-09-2024
10:58 PM
Why specifically in CSV format? You can bring appdynamics data into splunk with the splunk addon for appdynamics. And add the itsi content pack for APM to give you kpis and services Details here: https://docs.splunk.com/Documentation/CPAPM/1.1.0/CP/About
... View more
11-21-2023
08:46 PM
25/10/2023 6000 31/10/2023 0 6/11/2023 2500 6/11/2023 500 12/11/2023 -7800 16/11/2023 500 i have a table and i'm trying to create a line chart that starts at 6000, then has a straight line until it hits the date 6/11/2023 at which point it adds a line 90 degrees and goes up to 8500 and so on .. going up at 90 degrees and down at 90 degrees for the negative values keeping the current total thanks,
... View more
- Tags:
- timeline
11-01-2023
07:01 PM
Hi All .. is there a way to add dimensions to the URL that posts into the "Search Entity Dimensions" search in the ITSI Infrastructure Overview dashboard? eg : "service_name" and "department" Ideally want to link from a dashboard into a Focused by dimensions list of entities for example: https://itsi-blah.splunkcloud.com/en-GB/app/itsi/entity_overview?countPerPage=20&earlie[…]w&page=1&refreshInterval=-1&sortTypeBy=entities_count... & <my dimensions>
... View more
Labels
07-27-2023
09:31 PM
Seeing the following error when running powershell script both manually and as splunk shown below - anyone got any pointers please? All the scripts in the TA fail in this manner c:\Program Files\SplunkUniversalForwarder\bin>splunk cmd "c:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v15 get-databasestats_2013.ps1
-PSConsoleFile : The term '-PSConsoleFile' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ -PSConsoleFile \bin\exshell.psc1 -command . 'c:\Program Files\SplunkU ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (-PSConsoleFile:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
... View more
- Tags:
- TA-Exchange-Mailbox
Labels
- Labels:
-
administration
05-18-2022
07:04 AM
I have some events coming in that use a lookup to resolve to an action eg :
Block,block,not sent = blocked
tagged, delivered, logged = delivered
Occasionally a multivalue field appears such as :
Tagged
Logged
OR
Tagged
Block
the Logic should be :
Tagged Logged = delivered
Tagged Block = Block
Trying to figure out how to add this logic to utilise the lookup.
Played around with nomv which creates a single value field but adds a \n so the value becomes : Tagged\nLogged
But then i need to do do a sedcmd to remove the \n and then add the result to the lookup to resolve the desired action.
Is there a better approach in this scenario ?
thx
... View more
- Tags:
- logic
- multivalue
Labels
- Labels:
-
field extraction
-
fields
05-03-2021
06:12 PM
did you ever fix this?
... View more
04-26-2021
04:45 PM
This is still working in 8.1x But also please vote for an official method for wildcarding sourcertypes : https://ideas.splunk.com/ideas/E-I-11
... View more
04-06-2021
04:40 AM
i can obtain my base search kpi's via the following rest search :
| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_base_search report_as=text
but is it possible to list any adhoc searches in itsi ?
... View more
Labels
- Labels:
-
using ITSI
01-28-2021
05:40 AM
trying out SC4S - not seeing my syslog come through to Splunk Installed all running docker - no firewalls or selinux syslog hitting server running sc4s : tcpdump -i eth0 dst port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:24:24.962899 IP x.x.x.x.bob.com.38897 > 197-202-166-108-dedicated.multacom.com.syslog: SYSLOG local0.warning, length: 273 docker seems to be running fine - i receive HEC TEST EVENT's and startup events in splunk : sc4s version=v1.47.3 sc4s logs : [root@bob system]# docker logs SC4S
'/etc/syslog-ng/local_config/destinations/README.md' -> '/etc/syslog-ng/conf.d/local/config/destinations/README.md'
'/etc/syslog-ng/local_config/filters/README.md' -> '/etc/syslog-ng/conf.d/local/config/filters/README.md'
'/etc/syslog-ng/local_config/filters/example.conf' -> '/etc/syslog-ng/conf.d/local/config/filters/example.conf'
'/etc/syslog-ng/local_config/log_paths/README.md' -> '/etc/syslog-ng/conf.d/local/config/log_paths/README.md'
'/etc/syslog-ng/local_config/log_paths/lp-example.conf.tmpl' -> '/etc/syslog-ng/conf.d/local/config/log_paths/lp-example.conf.tmpl'
'/etc/syslog-ng/local_config/sources/README.md' -> '/etc/syslog-ng/conf.d/local/config/sources/README.md'
SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful; checking indexes...
SC4S_ENV_CHECK_INDEX: Checking email {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epav {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epintel {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epintelexit {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking fireeye {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking infraops {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking main {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netauth {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netdlp {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netdns {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netfw {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netids {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netipam {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netops {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netproxy {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netwaf {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking osnix {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking oswin {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking oswinsec {"text":"Success","code":0}
syslog-ng checking config
sc4s version=v1.47.3
starting goss
starting syslog-ng
... View more
Labels
- Labels:
-
troubleshooting
08-03-2020
10:00 PM
I'll answer my own question which may help others seeing this error .. Note: Inputs only support SQL queries such as "select...from...where", not DDL such as "create table..."
... View more
08-03-2020
09:05 PM
i have a provided SQL query which runs fine in the data lab and SQL explorer and provides an output i want to use - however when i create the input the steps work up until the last point when to select "finish" the input then gives an error. There was an error processing your request. It has been logged (ID edb0cdb547c4f5d8). Looking at the _internal index the error is: 020-08-04 13:44:44.975 +1000 [dw-59 - POST /api/inputs] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: edb0cdb547c4f5d8
java.lang.RuntimeException: java.lang.NullPointerException
at com.splunk.dbx.server.util.ResultSetMetaDataUtil.isTableHavingSameNameColumns(ResultSetMetaDataUtil.java:117)
at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.create(InputServiceImpl.java:136)
at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.create(InputServiceImpl.java:38)
at com.splunk.dbx.server.api.resource.InputResource.createInput(InputResource.java:97)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161)
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102)
at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267)
at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
at org.glassfish.jersey.internal.Errors.process(Errors.java:267)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317)
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305)
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154)
at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:473)
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:427)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:388)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:341)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:228)
at io.dropwizard.jetty.NonblockingServletHolder.handle(NonblockingServletHolder.java:49)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1650)
at io.dropwizard.servlets.ThreadNameFilter.doFilter(ThreadNameFilter.java:34)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.handle(AllowedMethodsFilter.java:45)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.doFilter(AllowedMethodsFilter.java:39)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at com.splunk.dbx.server.api.filter.ResponseHeaderFilter.doFilter(ResponseHeaderFilter.java:30)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:241)
at io.dropwizard.jetty.RoutingHandler.handle(RoutingHandler.java:52)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:455)
at io.dropwizard.jetty.BiDiGzipHandler.handle(BiDiGzipHandler.java:68)
at org.eclipse.jetty.server.handler.RequestLogHandler.handle(RequestLogHandler.java:56)
at org.eclipse.jetty.server.handler.StatisticsHandler.handle(StatisticsHandler.java:169)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
at org.eclipse.jetty.server.Server.handle(Server.java:561)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:334)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:104)
at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:247)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:140)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:243)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:679)
at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:597)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.NullPointerException: null
at com.splunk.dbx.server.util.ResultSetMetaDataUtil.isTableHavingSameNameColumns(ResultSetMetaDataUtil.java:106)
... 67 common frames omitted
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
07-29-2020
06:37 AM
If the query is successful in SQL explorer - have you tried manually adding the query to the db_connect inputs.conf ? OK from the docs .. Note: Inputs only support SQL queries such as "select...from...where", not DDL such as "create table..." No DDL cmds
... View more
- Tags:
- ve you
03-19-2020
04:16 PM
... and doesn't work on metric indexes
but thx - worked for event idx's
... View more
03-18-2020
07:42 PM
2 Karma
try :
| mcatalog values(_dims) WHERE "index"="*" GROUPBY metric_name index host
| rename values(_dims) AS dimensions
| table metric_name dimensions index host
... View more
03-08-2020
07:20 AM
you timechart should work ok on the timeTaken field ?
| makeresults count=1
| eval data="2020-02-12 17:50:15.228 INFO 1 --- [io-8080-exec-45] c.m.v.c.RequestInterceptor : {\"logType\":\"RESPONS\",\"traceId\":\"03927a51-23d6-4530-a0e6-112b6d4b5539\",\"timestamp\":\"Feb 12, 2020 5:50:15 PM\",\"requestMethod\":\"GET\",\"requestUrl\":\"http://my.url\",\"responseStatus\":500,\"timeTaken\":28}\""
| rex field=data "^([^{]+)(?P<json>.+})\"$"
| spath input=json
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-08-2025
09:39 PM
|
Karma from
