Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About euroa
euroa
Engager
Member since:
06-01-2016
10-06-2021
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 06-01-2016 |
Activity Feed
- Karma Splunk_TA_ontap throwing error message - Unable to initialize modular input for brdr. 06-05-2020 12:48 AM
- Posted Re: Update to 6.6 resulted in the error "Failed to register with cluster master" reason "Error connecting: Connection refused" on All Apps and Add-ons. 04-09-2018 05:49 AM
- Posted Re: Update to 6.6 resulted in the error "Failed to register with cluster master" reason "Error connecting: Connection refused" on All Apps and Add-ons. 11-10-2017 01:39 PM
- Posted Re: Why am I unable to use the Splunk App and Add-on for Salesforce? on All Apps and Add-ons. 08-10-2017 01:08 PM
- Posted Re: Why am I unable to use the Splunk App and Add-on for Salesforce? on All Apps and Add-ons. 08-10-2017 12:03 PM
- Posted Why am I unable to use the Splunk App and Add-on for Salesforce? on All Apps and Add-ons. 06-27-2017 09:03 AM
- Tagged Why am I unable to use the Splunk App and Add-on for Salesforce? on All Apps and Add-ons. 06-27-2017 09:03 AM
- Tagged Why am I unable to use the Splunk App and Add-on for Salesforce? on All Apps and Add-ons. 06-27-2017 09:03 AM
- Tagged Why am I unable to use the Splunk App and Add-on for Salesforce? on All Apps and Add-ons. 06-27-2017 09:03 AM
- Posted Technology Add-on for Cisco Secure Access Control Server (ACS): Why am I unable to see any data after installing the add-on? on All Apps and Add-ons. 05-26-2017 08:03 AM
- Tagged Technology Add-on for Cisco Secure Access Control Server (ACS): Why am I unable to see any data after installing the add-on? on All Apps and Add-ons. 05-26-2017 08:03 AM
- Tagged Technology Add-on for Cisco Secure Access Control Server (ACS): Why am I unable to see any data after installing the add-on? on All Apps and Add-ons. 05-26-2017 08:03 AM
- Tagged Technology Add-on for Cisco Secure Access Control Server (ACS): Why am I unable to see any data after installing the add-on? on All Apps and Add-ons. 05-26-2017 08:03 AM
- Tagged Technology Add-on for Cisco Secure Access Control Server (ACS): Why am I unable to see any data after installing the add-on? on All Apps and Add-ons. 05-26-2017 08:03 AM
- Posted Re: How to integrate Splunk and Tableau with Okta to SSO between both systems? on Security. 10-12-2016 01:58 PM
- Posted How to integrate Splunk and Tableau with Okta to SSO between both systems? on Security. 10-12-2016 12:46 PM
- Tagged How to integrate Splunk and Tableau with Okta to SSO between both systems? on Security. 10-12-2016 12:46 PM
- Tagged How to integrate Splunk and Tableau with Okta to SSO between both systems? on Security. 10-12-2016 12:46 PM
- Tagged How to integrate Splunk and Tableau with Okta to SSO between both systems? on Security. 10-12-2016 12:46 PM
- Posted Re: How to collect Slack logs on Knowledge Management. 07-26-2016 05:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-09-2018
05:49 AM
I had to open a case with Splunk support, and they had to patch. I suggest contacting Splunk if you have this issue. I suspect this has been fixed with newer versions of Splunk.
... View more
11-10-2017
01:39 PM
I am having the same issue and we are on version 6.6.3.2.
... View more
08-10-2017
01:08 PM
Using Splunk Cloud. The security token gets placed under the section called "Inputs" on the TA itself. Ensure the TA is installed on the locations mentioned on the documentation. Login to your search head and go into the TA and click on Inputs > Action. There should be 6 inputs already there be default. The token goes there in the inputs. Theres a section that asks for security token. The password to the user credentials goes in a different part of the app under "configuration" on the top bar. I would suggestion enabling the loginhistory input first since it populates every minute by default.
... View more
08-10-2017
12:03 PM
I am not sure, but what seemed to fix the issue for me (regarding the Addon for Salesforce) was first making sure that you are able to login to the Salesforce site with your provided credentials and having the Security token. Once you confirm that then fill out the configuration portion of the TA app and then go through each Input and adding the index name and the security token and saving and enabling each one. Ensure that the TA has global permissions as well so the App for Salesforce can read it. Also clear out the older settings on the Splunk App (if this was working before).
... View more
06-27-2017
09:03 AM
We are unable to capture any information on the Splunk App for Salesforce. We installed the Splunk Add-on for Salesforce to capture the data and I provided the Add-on with the required info (credentials, enabled inputs, etc). However no data is present in the App for Salesforce. When I went to go back to the Add-on, it will no longer load. I am seeing the following in errors in the internal logs:
-27-2017 15:48:41.686 +0000 ERROR AdminManagerExternal - Unexpected error "" from python handler: "REST Error [500]: Internal Server Error -- Traceback (most recent call last):\n File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/handler.py", line 113, in wrapper\n for name, data, acl in meth(self, *args, **kwargs):\n File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/handler.py", line 348, in _format_all_response\n self._encrypt_raw_credentials(cont['entry'])\n File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/handler.py", line 382, in _encrypt_raw_credentials\n change_list = rest_credentials.decrypt_all(data)\n File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/credentials.py", line 289, in decrypt_all\n return self._merge_passwords(data, realm_passwords)\n File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/credentials.py", line 304, in _merge_passwords\n password_dict = {pwd['username']: json.loads(pwd['clear_password']) for pwd in passwords}\n File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/credentials.py", line 304, in \n password_dict = {pwd['username']: json.loads(pwd['clear_password']) for pwd in passwords}\n File "/opt/splunk/lib/python2.7/json/__init__.py", line 339, in loads\n return _default_decoder.decode(s)\n File "/opt/splunk/lib/python2.7/json/decoder.py", line 364, in decode\n obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n File "/opt/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode\n raise ValueError("No JSON object could be decoded")\nValueError: No JSON object could be decoded\n". See splunkd.log for more details.
While other errors that resemble:
ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_object.py" raise HTTPError(response)
Any ideas what this could be?
... View more
05-26-2017
08:03 AM
I installed the Technology Add-on for Cisco Secure Access Control Server (ACS) to a heavy forwarder and pointed the Cisco ACS device to send data to the heavy forwarder via udp 9010. I created an inputs.conf file with the following :
[udp://9010]
connection_host = dns
disabled = 0
followTail = 0
sourcetype = cisco:acs
crcSalt =
index = cisco_secure_acs
and ensured that the port is opened however I am still unable to see any data in the index. Anyone have any ideas?
... View more
10-12-2016
01:58 PM
I am definitely concerned with a lot of orphaned searches getting generated due to switching from LDAP to SAML.
... View more
10-12-2016
12:46 PM
Currently we use LDAP to authenticate to our Splunk Cloud environment. We have hundreds of users in our system and we have a few mapped roles. We are wanting to implement SSO because of another system that uses it (Tableau). They would like seamless integration between both systems so Splunk won't ask for credentials when users are logged into Tableau and run a report from that system. I am concerned about user names getting deleted because we would move away from the LDAP integration and go into SAML. The SSO solution we would be using is Otka. Please let me know.
... View more
07-26-2016
05:51 AM
I am collecting syslogs on a heavy forwarder and then forwarding that off to Splunk Cloud indexers.
Inputs.conf
[udp://ip address here:514]
connection_host = dns
sourcetype = slack
index = slack
disabled = false
outputs.conf (is contained on a different app that outputs all )
[tcpout]
defaultGroup = splunkcloud
forwardedindex.2.whitelist = (_audit|_introspection|_internal)
[tcpout:splunkcloud]
server = splunkcloud addresses here :9997
compressed = false
... View more
07-25-2016
01:23 PM
Hi,
I created an app with an inputs.conf file to collect syslog data (udp 514) from a particular host and send it to a sourcetype and index. I see the data coming in when I run a Wireshark but I dont see the data when I run a search query on the index I specified. Any clues?
... View more
06-23-2016
01:07 PM
Thank You for your response. We have other hosts that are going to port 514. I ve put this into inputs.conf
[tcp://hostname:514]
source = \mail_logs\mail.@20130712T172736.s
sourcetype = cisco:esa:textmail
index = ironport
Do you happen to know if this would work to collect logs from a particular host going to 514?
... View more
06-23-2016
12:47 PM
I am not able to add data inputs via splunkweb on the heavy forwarder. I need to do it via inputs.conf and the user needs to be able to send data via tcp 514 and not udp. Unfortunately the instructions only mention the monitor portion but not if the port is different.
... View more
06-23-2016
12:23 PM
For the location of the monitor then would I place it under source? For ex:
[tcp://:514]
source = \mail_logs\mail.@20130712T172736.s
... View more
06-23-2016
11:29 AM
I am attempting to setup the Cisco ESA app and on configuring the inputs.conf file I have [monitor://\mail_logs\mail.@20130712T172736.s] per instructions however, I need to ensure the app is listening to tcp port 514. Where can I set that?
... View more
06-17-2016
09:12 AM
Thanks for the reply. I attempted running it and didnt see any events populate so I ran it manually
"eventtype="netscaler_appflow" appName | stats values(appName) AS "appName" by appID | outputlookup appid_lookup.csv"
and still no events are seen. I also ran it as just "eventtype="netscaler_appflow" appName" and also didnt receive events. Could it be that the Netscaler isnt sending appName data?
... View more
06-16-2016
01:22 PM
We have Splunk Cloud in our environment and we installed the Citrix Netscaler with Appflow app. The app seems to be working ok, but we are seeing errors regarding the following:
+0000 WARN SearchResults - /opt/splunk/etc/apps/SplunkforCitrixNetScaler/lookups/appid_lookup.csv is empty, multi-line header is missing matching quotation, or could not parse CSV header
I do have this file listed under lookups and lookup definitions and currently it has global permissions, however, the error above is shown. The app is present on the search heads and heavy forwarder (forwarder receiving events). I created a lookup folder on the TA app on the heavy forwarder and added the file there from the SplunkforCitrixNetscaler app folder. The issue still persists. Any idea what can be wrong?
... View more
