About afx

afx · ‎11-12-2021

Cool, thank's a lot!

afx · ‎03-11-2021

Brilliant. One gets pointed to the app on splunk ideas by splunk employees that claim this app already fulfills part of the requirements for better audit and state this is step one of what they are working on. Not really confidence inspiring.

afx · ‎03-10-2021

Well, I would think Splunk documents their own apps.

afx · ‎03-10-2021

Hi, So where is the documentation for this app? https://splunkbase.splunk.com/app/5399/ The overview comes up with many empty items, there is no required configuration step, so I wonder how useful/reliable this is. thx afx

afx · ‎03-05-2021

I am seeing this on 8.1.1.

afx · ‎01-25-2021

Splunk definitely did ship OpenJDK in 8.0.4.1, just download the RPM and check. It is gone in 8.1.1. That's why I had those artifacts and the reports from our compliance team.

afx · ‎01-25-2021

Then please explain the OpenJDK artefacts from splunk_archiver under var/run. They make no sense for stuff that is just kept in case it is needed. Our compliance team found the following executable at some time: /splunk/var/run/searchpeers/splunkds-1608544850/apps/splunk_archiver/java-bin/jars/vendors/java/OpenJDK8U-jre_x64_linux_hotspot_8u242b08/bin/java Right now it is gone. Only the directory up to /splunk/var/run/searchpeers/splunkds-1608544850/apps/splunk_archiver/java-bin/jars/ still exists, the bin subdirectory is gone right now.

afx · ‎01-25-2021

Even more puzzling then isn't it? Add the artifacts viewable under var/run it becomes a real mystery. This all popped up because our compliance guys ran scans for java runtimes and found them on my splunk servers but they seem to show up only temporarily. My current assumption is that they are unpacked from some place in Splunk at runtime.

afx · ‎01-22-2021

Got to /splunk/bin and check the jars directory. Then go to /splunk/apps/splunk_archiver and check there. Or grep for jar in the manifest. All shipped with Splunk.

afx · ‎01-22-2021

Hi, Is Splunk Enterprise shipped with a JRE? IT contains a lot of JARs.. Did not find a typical JRE though. If yes do I find the exact version? How often does Splunk update it? If no, why all the JARs? When looking under var/run/searchpeers I see references from the splunk archiver to OpenJDK8U but only directories, no binaries. thx afx

afx · ‎12-05-2020

Hi, I am trying to port an app that needs access to x509 details to python 3. Splunk does not ship OpenSSL for python3, only python2 and the new way seems to be using cryptography. But that is also not shipped with Splunk 8. On the other hand. Looking at the modules shipped with Python 3 in Splunk 8 I see that they do reference cryptography as a dependency (pyopenssl). Looks a bit weird to me. Theoretically I could just dump cryptography in my app directory. But that also would include a shared object file which seems to be counterproductive when wanting to publish the module outside my organization. Any ideas on how to resolve this? thx afx

afx · ‎11-30-2020

Hi, _introspection reports a higher value for existing memory than the real memory of the machine and also the memory used is wrong (and close to the fake max). OS Tools report the real values which are way lower. Any idea why and how to fix this? If I see this correctly, _introspection is fed by splunkd. A reboot fixed this for now, but what should be done to prevent this from re-apperauing? thx afx

afx · ‎11-29-2020

Absolutely yes please. So far I have only been toying with Alert manager. That feature would make it production worthy 😉 thx afx

afx · ‎11-25-2020

Hi, looks like I am missing something. I have a Splunk alert that is a bit spammy. I would like to use the Alert Manager app to give me one alert a day, basically the first time this alert shows up. And be quiet for the rest of the day, just increase the duplicate counter. I can get alerts to be counted as duplicates, but I still get e-mails for all of them. I have not found a way in the suppression rules to hide follow on alerts. thx afx

afx · ‎10-04-2020

Sorry, no idea. To me the posted example feels like it was preprocessed somehow. And from the SAP blog post, it should not matter whether RSAU or SM19 control.

afx · ‎08-13-2020

I recently switched over my Splunk 8 server to Python 3. Definitely not a nice experience as not just Python itself changed but also some libraries got dropped, most notable OpenSSL. I can understand upgrades like switching from urllib2 to urllib3, but dropping OpenSSL completely? That is rather weird. So I wonder what other silly surprises are lurking and what they are thinking dropping pretty essential libraries. For the time being I switched back. But on the long run, that is not a viable strategy. cheers afx

afx · ‎07-31-2020

Thank you, that seems to work out of the Box. Some simple use cases without password ran on the first try. thx afx

afx · ‎07-30-2020

Hi, I just installed the "App for REST Lookup" https://splunkbase.splunk.com/app/4253/ on my Splunk 8 SH. The details talk about a setup screen but I do not see any. But I see loads of error in the log: 07-30-2020 09:47:43.591 +0200 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/DBData/bin/dbdata.py" raise RuntimeError('Failed to parse transport header: {}'.format(header)) 07-30-2020 09:47:43.591 +0200 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/DBData/bin/dbdata.py" File "/opt/splunk/etc/apps/DBData/bin/splunklib/searchcommands/search_command.py", line 866, in _read_chunk 07-30-2020 09:47:43.591 +0200 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/DBData/bin/dbdata.py" metadata, body = self._read_chunk(ifile) 07-30-2020 09:47:43.591 +0200 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/DBData/bin/dbdata.py" File "/opt/splunk/etc/apps/DBData/bin/splunklib/searchcommands/search_command.py", line 658, in _process_protocol_v2 07-30-2020 09:47:43.591 +0200 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/DBData/bin/dbdata.py" Traceback: 07-30-2020 09:47:43.591 +0200 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/DBData/bin/dbdata.py" RuntimeError at "/opt/splunk/etc/apps/DBData/bin/splunklib/searchcommands/search_command.py", line 866 : Failed to parse transport header: U_i7UanLSoQNucQe9p8fvoPRxcC3dy_WKnCtgqt1_gVhrVCwyDW_z2yXBPu7xZbJXJQh6P^q0_gVSO4Ni9MF_nifVBNrTYwDkdk2ND3RqlJQxM4BDyz1^8pFfo0 Has anyone used that App with Splunk 8? thx afx

afx · ‎07-06-2020

Hi, I see error messages from the exec processor on my Splunk DB Connect installs where dbxquery complains about input that suspiciously looks like stuff from Nessus. So it seems that dbxquery is listening on the Ethernet. How can I stop that? Me thinks it should listen only on localhost if it needs to listen at all. thx afx

afx · ‎07-06-2020

Thanks! interesting that this worked in v7. I always thought I had to have a values without field to get any data at all from the model. thx afx

Posts	139
Solutions	7
Karma Given	9
Karma Received	20
Member Since	‎05-02-2019

Online Status	Offline
Date Last Visited	‎11-12-2021 10:49 AM

Documentation for Knowledge Object Overview App fo...

JRE/JDK shipped with Splunk Enterprise?

How to access x509 objects in Splunk 8 / Python 3?

_introspection shows wrong memory usage for the de...

Alert Manager: How to suppress follow on alerts

Missing libraries when switching to Python 3

App for REST Lookup and Splunk 8

How can I block dbxquery from listening on the net...

TsidxStats Error after Splunk v8 Upgrade

Inconsistent PowerShell Script behaviour

Re: How to Splunk the SAP Security Audit Log

Re: Documentation for Knowledge Object Overview Ap...

Re: Documentation for Knowledge Object Overview Ap...

Documentation for Knowledge Object Overview App fo...

Re: CMMaster - Unable to send scheduled jobs

Re: JRE/JDK shipped with Splunk Enterprise?

Re: JRE/JDK shipped with Splunk Enterprise?

Re: JRE/JDK shipped with Splunk Enterprise?

Re: JRE/JDK shipped with Splunk Enterprise?

JRE/JDK shipped with Splunk Enterprise?

How to access x509 objects in Splunk 8 / Python 3?

_introspection shows wrong memory usage for the de...

Re: Alert Manager: How to suppress follow on alert...

Alert Manager: How to suppress follow on alerts

Re: How to Splunk the SAP Security Audit Log

Missing libraries when switching to Python 3

Re: App for REST Lookup and Splunk 8

App for REST Lookup and Splunk 8

How can I block dbxquery from listening on the net...

Re: TsidxStats Error after Splunk v8 Upgrade