Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nkpiquette
nkpiquette
Path Finder
Member since:
08-28-2013
02-23-2024
Community Statistics
| Posts | 18 |
| Solutions | 2 |
| Karma Given | 10 |
| Karma Received | 6 |
| Member Since | 08-28-2013 |
Activity Feed
- Got Karma for Re: For Symantec Web Security Service App for Splunk and TA - Events are getting indexed in "main" index only. 06-05-2020 12:50 AM
- Karma Splunk DB Connect 3 authentication on MySQL adding local Splunk server name in username for mabramov. 06-05-2020 12:49 AM
- Karma Re: Splunk DB Connect 3 authentication on MySQL adding local Splunk server name in username for brian_rampley. 06-05-2020 12:49 AM
- Karma Splunk ES Glass Tables Error for andrewdore. 06-05-2020 12:49 AM
- Karma Why does the forwarder stops sending data to all configured TCP connections when one connection is not available? for dami_rel. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk ES Glass Tables Error. 06-05-2020 12:49 AM
- Karma Re: Table Module "per row"checbox for sideview. 06-05-2020 12:48 AM
- Karma How do I ingest the details tab in Windows Forwarded Events? for devinmclean. 06-05-2020 12:48 AM
- Got Karma for Table Module "per row"checbox. 06-05-2020 12:48 AM
- Got Karma for Error with dbInputs on Operations page on fresh DB Connect Install. 06-05-2020 12:48 AM
- Karma Re: If I plan to install heavy forwarders on Windows servers, do I need to install Splunk App for Windows Infrastructure? for jbernt_splunk. 06-05-2020 12:47 AM
- Karma Re: Where has the TA for alert manager gone? for my2ndhead. 06-05-2020 12:47 AM
- Karma Re: Where do I place indexes.conf in an indexer clustering environment? for rphillips_splk. 06-05-2020 12:47 AM
- Karma Problem replicating config (bundle) to search peer for willprince. 06-05-2020 12:47 AM
- Got Karma for Re: How do I display a panel in a dashboard only if it contains data?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect: How to collect data in EPO Database version 4.6.6 with Add-on for McAfee?. 06-05-2020 12:47 AM
- Posted Re: For Symantec Web Security Service App for Splunk and TA - Events are getting indexed in "main" index only on All Apps and Add-ons. 10-28-2019 12:34 PM
- Posted Cannot Complete App Setup on All Apps and Add-ons. 07-17-2018 05:15 AM
- Tagged Cannot Complete App Setup on All Apps and Add-ons. 07-17-2018 05:15 AM
- Posted Re: Why does the forwarder stops sending data to all configured TCP connections when one connection is not available? on Getting Data In. 06-20-2018 04:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 1 |
10-28-2019
12:34 PM
1 Karma
@scottprigge posted this answer in his linked thread, but I wanted to post the text here for those coming in from Google:
Thank you for this post! I didn't even give those batch inputs a second thought when I first saw them. We struggled with this same issue and once I read your post, I immediately understood what the issue was and how to fix it.
For anyone else who might read this, the TA works in two steps:
1) The 'scwss-poll' modular input of inputs.conf pulls down an access log from the internet-based web service and drops it on the Splunk filesystem in the '/opt/splunk/var/spool/splunk/' directory.
2) The batch inputs of inputs.conf index the files.
So if you want to change the index name, you need to add the custom 'index = ' parameter to the batch input, since that is the input that indexes the events.
Thanks again!
... View more
07-17-2018
05:15 AM
I have just installed the app and modified the Lookups to point to our MISP instance. On the app setup page I am getting the following error when trying to set the misp key: ERROR: Delete user failed, cannot find the credential information with id : credential:MISP:admin:
Looking forward to being able to try this out!
... View more
06-20-2018
04:47 AM
Even with Load Balancing configured though if B refuses/cant receive the data it does not send the data to A even if A has load balancing configured.
... View more
04-20-2018
08:57 AM
That did it for me thank you!
... View more
04-19-2018
12:45 PM
Running into this issue with latest DB Connect App too.
... View more
02-28-2018
04:09 AM
1 Karma
The answer is to upgrade to ES 4.7.4 that was released on October 30, 2017.
Date resolved Issue number Description
2017-10-30 SOLNESS-12532 ess_gt_lister.xml does not exist.
... View more
10-03-2017
06:40 AM
I would recommend combining this with sideview utilities to embed a button into a table. The button's search should contain the sendalert command. See https://answers.splunk.com/answers/390073/table-module-per-rowchecbox.html to get more information about embedding a button into the table.
... View more
02-13-2017
05:27 AM
So I was working with Splunk support and we found the following resolution:
I found a case where others had this same issue. The cause was related to the entire /etc/system/default/web.conf file being copied to the /etc/system/local folder. I see that this is the case as well in your diag file. Doing a comparison of the default and local web.conf all I see that has been added or changed is enableSplunkWebSSL = 1. Please backup /local/web.conf and replace it with a new file called web.conf that has only the following line:
enableSplunkWebSSL = true
Then restart Splunk. Please let me know if this resolves this issue.
Making the change and restarting Splunk did fix the issue.
... View more
02-08-2017
07:05 AM
The only operation I can do on the page is a DB Lookup, both inputs and outputs just produce the Error with dbInputs or Error with dbOutputs
I have restarted splunk several times since installing it, and have tried one version down of DB Connect with the same issue.
... View more
02-08-2017
06:25 AM
I have with no luck
... View more
02-08-2017
05:07 AM
1 Karma
Hello all,
I just installed Splunk DB Connect, and got an identity and connection to work. I wanted to convert this to an input, but when I go to Operations it just shows the loading animation with the text Error with dbInputs. I looked in all the internal logs and did not see any error being thrown. Any help would be appreciated to troubleshoot this.
... View more
04-06-2016
09:41 AM
Thank you! For some reason when I was playing with this in the editor earlier I could not get it to work properly. By taking the time to hand code using the documentation as my guide I was able to get it all work properly.
... View more
04-06-2016
07:48 AM
1 Karma
Hello everyone,
I have reached the point where I keep hitting dead ends and I turn to the community for help! I am using sideview utils 3.3.11 and advanced xml to try and put a check-box in each table line so that the user can click the checkbox, and the onValue gets stored for later use. I am modeling my dashboard after the example: https://answers.splunk.com/answers/168267/table-module-per-row-checkbox-module-downstreams.html Titled: Table Module "per row" checkbox module downstreams (posting the title since I do not have enough Karama for links).
Here is what the code looks like so far:
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>test</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="maxSize">1</param>
<param name="clearOnJobDispatch">False</param>
</module>
<module name="DashboardTitleBar" layoutPanel="viewHeader" />
<module name="Message" layoutPanel="navigationHeader">
<param name="filter">splunk.search.job</param>
<param name="maxSize">1</param>
<param name="clearOnJobDispatch">True</param>
<param name="level">warn</param>
</module>
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
<param name="latest">now</param>
<param name="earliest">-24h@h</param>
<param name="search"><![CDATA[
index=_internal | head 1000 | top sourcetype | eval tablevalue=sourcetype+" "+count]]></param>
<module name="Pager">
<module name="Table">
<module name="Checkbox">
<param name="name">row_selection</param>
<param name="name">row_selection</param>
<param name="onValue">$row.field.sourcetype$</param>
</module>
</module>
</module>
</module>
</view>
Any help or nudges in the right direction would be appreciated!
... View more
08-24-2015
10:43 AM
1 Karma
ppablo is correct. By setting a depends attribute you can hide the panel until that criteria is met. I am currently using that method in our tabbed interface to hide dynamic drill down panels.
... View more
06-18-2015
04:55 AM
I haven't seen the TA on splunk base but looking at the project's github I see it in alert_manager/appserver/src, and double checking the version hosted on Splunk I see the TA located there too.
The one thing to keep in mind with the version hosted on Splunk is that it contains folders and files that start with ._ These files have caused issues for me in the past on linux installs. The github version does not contain these folders.
The project github can be found here: https://github.com/simcen/alert_manager
Hope this helps!
... View more
01-07-2015
10:40 AM
Digging up an old threat, but this just came in handy. The sed I had to use in 6.2 was as follows:
rex field=search mode=sed "s/+/ /g"
... View more
09-09-2014
08:25 AM
It really depends on your needs honestly. Out of the box there are a few different data sources it can acquire data from that you may find useful. Make sure you look into the inputs.conf and see what data it is polling and decide if that will be useful for you or not.
This can be helpful to get more Windows event log data in: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Monitorwindowsdata
One thing I recently learned is that you can use the whitelist attribute under the input stanza to specify what event logs you truly care about. This is referenced in the above link.
Hopefully this helps!
... View more
09-05-2014
09:27 AM
1 Karma
It appears that the Antispyware object is what is throwing off the 4.X input. To solve this I used the 5.x query and was able to get it to accept the input. Give this a shot and let us know if it worked please.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-23-2024
11:37 AM
|
Karma given to
