Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Esky73
Esky73
Builder
Member since:
05-16-2016
07-28-2023
Community Statistics
| Posts | 168 |
| Solutions | 6 |
| Karma Given | 58 |
| Karma Received | 22 |
| Member Since | 05-16-2016 |
Activity Feed
- Got Karma for Re: How would I build a table of all metrics and their dimensions in splunk. 08-21-2023 09:40 PM
- Posted PSConsole error running powershell script from TA-Exchange-Mailbox bin directory on All Apps and Add-ons. 07-27-2023 09:31 PM
- Posted Help with Logic when a multivalue field appears: How to utilise lookup? on Splunk Search. 05-18-2022 07:04 AM
- Karma Re: list of adhoc kpis via REST ? for shandr. 04-11-2022 09:58 PM
- Posted Re: Cyberark Logs - Line Breaking doesn't work on All Apps and Add-ons. 05-03-2021 06:12 PM
- Karma Re: How to check if an HEC is up or not before posting any data to it? for spavin. 04-29-2021 06:01 PM
- Posted Re: Is it possible to use wildcards in sourcetype props.conf stanzas on Getting Data In. 04-26-2021 04:45 PM
- Karma Re: Tricky behavior of escaping backslash in regex for FrankVl. 04-15-2021 08:31 PM
- Posted Where can I find a list of adhoc kpis via REST ? on Splunk IT Service Intelligence. 04-06-2021 04:40 AM
- Posted syslog events not sent to Splunk on All Apps and Add-ons. 01-28-2021 05:40 AM
- Posted Re: db_connect : SQL explorer runs query OK - however creating input fails with error on All Apps and Add-ons. 08-03-2020 10:00 PM
- Posted db_connect : SQL explorer runs query OK - however creating input fails with error on All Apps and Add-ons. 08-03-2020 09:05 PM
- Posted Re: Trouble to Create New Input in DB Connect for stored procedure using temp table. MS SQL Server on All Apps and Add-ons. 07-29-2020 06:37 AM
- Karma Re: How to extract integer value in search from string JSON in log event for somesoni2. 06-05-2020 12:51 AM
- Karma Re: Supporting Documentation? for mtroianovskyi. 06-05-2020 12:50 AM
- Karma Re: BREAK_ONLY_BEFORE and BREAK_ONLY_BEFORE_DATE=false in the same props.conf for somesoni2. 06-05-2020 12:50 AM
- Karma Re: UnexpectedHTTPResponse 404 Not Found for titarenko. 06-05-2020 12:50 AM
- Karma Re: If I upgrade to Splunk Enterprise 7.0, can I recieve logs from a Windows 2003 server with a Universal Forwarder on it? for Yorokobi. 06-05-2020 12:50 AM
- Karma Re: V1.0.3 Seeing a Get error when collecting events for jkat54. 06-05-2020 12:50 AM
- Karma Re: what are the requirements on the SAP Side? for mtroianovskyi. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-27-2023
09:31 PM
Seeing the following error when running powershell script both manually and as splunk shown below - anyone got any pointers please? All the scripts in the TA fail in this manner c:\Program Files\SplunkUniversalForwarder\bin>splunk cmd "c:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v15 get-databasestats_2013.ps1
-PSConsoleFile : The term '-PSConsoleFile' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ -PSConsoleFile \bin\exshell.psc1 -command . 'c:\Program Files\SplunkU ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (-PSConsoleFile:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
... View more
- Tags:
- TA-Exchange-Mailbox
Labels
- Labels:
-
administration
05-18-2022
07:04 AM
I have some events coming in that use a lookup to resolve to an action eg :
Block,block,not sent = blocked
tagged, delivered, logged = delivered
Occasionally a multivalue field appears such as :
Tagged
Logged
OR
Tagged
Block
the Logic should be :
Tagged Logged = delivered
Tagged Block = Block
Trying to figure out how to add this logic to utilise the lookup.
Played around with nomv which creates a single value field but adds a \n so the value becomes : Tagged\nLogged
But then i need to do do a sedcmd to remove the \n and then add the result to the lookup to resolve the desired action.
Is there a better approach in this scenario ?
thx
... View more
- Tags:
- logic
- multivalue
Labels
- Labels:
-
field extraction
-
fields
05-03-2021
06:12 PM
did you ever fix this?
... View more
04-26-2021
04:45 PM
This is still working in 8.1x But also please vote for an official method for wildcarding sourcertypes : https://ideas.splunk.com/ideas/E-I-11
... View more
04-06-2021
04:40 AM
i can obtain my base search kpi's via the following rest search :
| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_base_search report_as=text
but is it possible to list any adhoc searches in itsi ?
... View more
Labels
- Labels:
-
using ITSI
01-28-2021
05:40 AM
trying out SC4S - not seeing my syslog come through to Splunk Installed all running docker - no firewalls or selinux syslog hitting server running sc4s : tcpdump -i eth0 dst port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:24:24.962899 IP x.x.x.x.bob.com.38897 > 197-202-166-108-dedicated.multacom.com.syslog: SYSLOG local0.warning, length: 273 docker seems to be running fine - i receive HEC TEST EVENT's and startup events in splunk : sc4s version=v1.47.3 sc4s logs : [root@bob system]# docker logs SC4S
'/etc/syslog-ng/local_config/destinations/README.md' -> '/etc/syslog-ng/conf.d/local/config/destinations/README.md'
'/etc/syslog-ng/local_config/filters/README.md' -> '/etc/syslog-ng/conf.d/local/config/filters/README.md'
'/etc/syslog-ng/local_config/filters/example.conf' -> '/etc/syslog-ng/conf.d/local/config/filters/example.conf'
'/etc/syslog-ng/local_config/log_paths/README.md' -> '/etc/syslog-ng/conf.d/local/config/log_paths/README.md'
'/etc/syslog-ng/local_config/log_paths/lp-example.conf.tmpl' -> '/etc/syslog-ng/conf.d/local/config/log_paths/lp-example.conf.tmpl'
'/etc/syslog-ng/local_config/sources/README.md' -> '/etc/syslog-ng/conf.d/local/config/sources/README.md'
SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful; checking indexes...
SC4S_ENV_CHECK_INDEX: Checking email {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epav {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epintel {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epintelexit {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking fireeye {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking infraops {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking main {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netauth {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netdlp {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netdns {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netfw {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netids {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netipam {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netops {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netproxy {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netwaf {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking osnix {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking oswin {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking oswinsec {"text":"Success","code":0}
syslog-ng checking config
sc4s version=v1.47.3
starting goss
starting syslog-ng
... View more
Labels
- Labels:
-
troubleshooting
08-03-2020
10:00 PM
I'll answer my own question which may help others seeing this error .. Note: Inputs only support SQL queries such as "select...from...where", not DDL such as "create table..."
... View more
08-03-2020
09:05 PM
i have a provided SQL query which runs fine in the data lab and SQL explorer and provides an output i want to use - however when i create the input the steps work up until the last point when to select "finish" the input then gives an error. There was an error processing your request. It has been logged (ID edb0cdb547c4f5d8). Looking at the _internal index the error is: 020-08-04 13:44:44.975 +1000 [dw-59 - POST /api/inputs] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: edb0cdb547c4f5d8
java.lang.RuntimeException: java.lang.NullPointerException
at com.splunk.dbx.server.util.ResultSetMetaDataUtil.isTableHavingSameNameColumns(ResultSetMetaDataUtil.java:117)
at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.create(InputServiceImpl.java:136)
at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.create(InputServiceImpl.java:38)
at com.splunk.dbx.server.api.resource.InputResource.createInput(InputResource.java:97)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161)
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102)
at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267)
at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
at org.glassfish.jersey.internal.Errors.process(Errors.java:267)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317)
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305)
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154)
at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:473)
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:427)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:388)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:341)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:228)
at io.dropwizard.jetty.NonblockingServletHolder.handle(NonblockingServletHolder.java:49)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1650)
at io.dropwizard.servlets.ThreadNameFilter.doFilter(ThreadNameFilter.java:34)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.handle(AllowedMethodsFilter.java:45)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.doFilter(AllowedMethodsFilter.java:39)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at com.splunk.dbx.server.api.filter.ResponseHeaderFilter.doFilter(ResponseHeaderFilter.java:30)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:241)
at io.dropwizard.jetty.RoutingHandler.handle(RoutingHandler.java:52)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:455)
at io.dropwizard.jetty.BiDiGzipHandler.handle(BiDiGzipHandler.java:68)
at org.eclipse.jetty.server.handler.RequestLogHandler.handle(RequestLogHandler.java:56)
at org.eclipse.jetty.server.handler.StatisticsHandler.handle(StatisticsHandler.java:169)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
at org.eclipse.jetty.server.Server.handle(Server.java:561)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:334)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:104)
at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:247)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:140)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:243)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:679)
at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:597)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.NullPointerException: null
at com.splunk.dbx.server.util.ResultSetMetaDataUtil.isTableHavingSameNameColumns(ResultSetMetaDataUtil.java:106)
... 67 common frames omitted
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
07-29-2020
06:37 AM
If the query is successful in SQL explorer - have you tried manually adding the query to the db_connect inputs.conf ? OK from the docs .. Note: Inputs only support SQL queries such as "select...from...where", not DDL such as "create table..." No DDL cmds
... View more
- Tags:
- ve you
03-19-2020
04:16 PM
... and doesn't work on metric indexes
but thx - worked for event idx's
... View more
03-18-2020
07:42 PM
2 Karma
try :
| mcatalog values(_dims) WHERE "index"="*" GROUPBY metric_name index host
| rename values(_dims) AS dimensions
| table metric_name dimensions index host
... View more
03-08-2020
07:20 AM
you timechart should work ok on the timeTaken field ?
| makeresults count=1
| eval data="2020-02-12 17:50:15.228 INFO 1 --- [io-8080-exec-45] c.m.v.c.RequestInterceptor : {\"logType\":\"RESPONS\",\"traceId\":\"03927a51-23d6-4530-a0e6-112b6d4b5539\",\"timestamp\":\"Feb 12, 2020 5:50:15 PM\",\"requestMethod\":\"GET\",\"requestUrl\":\"http://my.url\",\"responseStatus\":500,\"timeTaken\":28}\""
| rex field=data "^([^{]+)(?P<json>.+})\"$"
| spath input=json
... View more
11-24-2019
09:56 PM
I have installed ITSI on a standalone box (4.3.1) - which also installs SAI (+add-on)
I can discover a host and it appears in SAI using the discovery + deploy UF method - but that can't really be used for a deployment plan.
I've deployed a windows TA via the DS and the metrics are sent to the em_metrics index and i can search the metrics from the Metric browser (metric workspace \ Analyser) - but the host does not appear in SAI
Any Ideas ?
ta.
... View more
11-06-2019
10:29 PM
Error Scheduled Successful Failed FieldB FieldC FieldD
10 100 500 5 String String String
Desired output is above :
I would like a table showing a count of the statuses in Field A - as column headers (Errors, Successful, failed etc) inline with fields B > D
How to bring this together ?
i have tried with transpose=header_field=FieldA and also played with xyseries - but unsuccessful so far.
thx
... View more
- Tags:
- splunk-enterprise
10-30-2019
08:38 PM
1 Karma
nice work .. ahem .. .conf19 🙂
... View more
10-22-2019
03:20 PM
Thanks Jason
... View more
10-21-2019
06:22 PM
Does this pull the same metrics from Event hubs as Azure_monitor ?
Activity log, ?
Diagnostic ?
Metrics, ?
thanks.
... View more
07-02-2019
09:19 PM
any idea why we would get these 500 and 401 errors ?
29/06/2019
18:14:40.818
06-29-2019 18:14:40.818 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ms_o365_message_trace.py" HTTP Request error: 500 Server Error: Internal Server Error for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2019-06-27T22:59:36.498398Z'%20and%20EndDate%20eq%20datetime'2019-06-27T23:59:36.498398Z';
host = HOSTNAME source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
28/06/2019
11:58:24.288
06-28-2019 11:58:24.288 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS_O365_Reporting/bin/ms_o365_message_trace.py" HTTP Request error: 401 Client Error: Unauthorized for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2019-06-28T01:00:00Z'%20and%20EndDate%20eq%20datetime'2019-06-28T01:30:00Z';
host = HOSTNAME source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-28-2023
02:48 AM
|
Karma from
