Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About louismai
louismai
Path Finder
Member since:
05-22-2019
03-09-2022
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 40 |
| Karma Received | 4 |
| Member Since | 05-22-2019 |
Activity Feed
- Got Karma for Splunk cluster collecting UDP log receiving port. 07-22-2022 12:17 AM
- Karma Re: Add-on for MS Office 365 question for jconger. 03-08-2022 09:02 PM
- Karma Azure AD Add-on for MS Office 365 questions for adamblock2. 03-08-2022 09:02 PM
- Posted Re: DB-Connect 3 - dbxlookup with query does not work on All Apps and Add-ons. 01-15-2022 11:54 PM
- Posted Re: DB-Connect 3 - dbxlookup with query does not work on All Apps and Add-ons. 01-14-2022 04:26 AM
- Karma Re: DB-Connect 3 - dbxlookup with query does not work for drodman29. 01-14-2022 04:25 AM
- Posted Re: DB Connect dbxquery works fine, but not dbxlookup on All Apps and Add-ons. 01-13-2022 01:42 PM
- Posted Re: When will the Rubrik Splunk App & Add-On support Splunk v8.x? on All Apps and Add-ons. 12-13-2021 03:51 PM
- Posted Re: Unable to initialize modular input "mscs_storage_table" defined in the app "Splunk_TA_microsoft-cloud on All Apps and Add-ons. 06-28-2021 06:38 PM
- Karma Re: How to resolve issues with mongod startup such as "Failed to start KV Store process" error? for hunters_splunk. 09-02-2020 06:14 AM
- Got Karma for Re: Splunk App for Unix configuration *.sh not running. 07-04-2020 05:16 PM
- Posted Re: Splunk App for Unix configuration *.sh not running on All Apps and Add-ons. 07-04-2020 04:25 PM
- Karma Re: Help with rex for part of a file path for woodcock. 06-05-2020 12:50 AM
- Karma Re: Splunk cluster collecting UDP log receiving port for gcusello. 06-05-2020 12:50 AM
- Karma Re: Splunk cluster collecting UDP log receiving port for grumpcat. 06-05-2020 12:50 AM
- Karma Re: How to write regex to extract this line in this very long field? for MuS. 06-05-2020 12:50 AM
- Karma Re: How to configure Phantom to use LDAP/Active Directory for authentication? for sam_splunk. 06-05-2020 12:50 AM
- Karma Re: How do I configure email settings on a search head (SH) cluster? for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: How/where to tell a new data input to use this new index in a cluster? for pgerke_cc. 06-05-2020 12:50 AM
- Karma Re: Phantom: "Run Playbook in Phantom" Servers not being listed as Options for jamolson. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
01-15-2022
11:54 PM
Hi @SinghK , I go to DataLab > Lookups > New Lookups, Step 1: Set Reference Search with time range : results as expected Step 2: Set Lookup SQL: results as expected Step 3: Field Mapping: - Search Fields Match Table Columns (case sensitive) - Lookup Fields: Table columns chosen Preview Results: (...) | dbxlookup connection="Pro_DB" query="SELECT TOP(1000) [SID] ,
[LogTime] ,
[DocID]
FROM [Storage].[dbo].[DocStates]
ORDER BY [LogTime] DESC" "SID" AS "SID" OUTPUT "LogTime" AS "Log_Time", "DocID" AS "Doc_ID" Then I clicked on "Open In Search", only the SPL query returns result, but the dbxlookup fields are all blank. Tks Louis
... View more
01-14-2022
04:26 AM
It seems to be the only one solution for now. I have to use your solution because the bug is still there until now.
... View more
01-13-2022
01:42 PM
dbxlookup doesn't seem to work when I tried to run. The query doesn't provide any outputs when I clicked Open in Search in Data Lab/ Edit Lookup page. Both my reference search and Look SQL are working, and provide correct results when running separately.
... View more
12-13-2021
03:51 PM
I am using v1.1.3, and I still have problems to ingest data to Splunk 8.2. Hope it would be compatible soon.
... View more
06-28-2021
06:38 PM
This error is raised in version 4.1.3 too. I have changed the inputs.conf and restmap.conf to python2, but it doesn't work Splunk: 7.7.3 Python: 2.7
... View more
07-04-2020
04:25 PM
1 Karma
The answer is shown in this post: https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-and-Linux-configuration/td-p/366783 You need to installed Splunk_TA_nix on all indexers/forwarders and searchhead. The search head needs Splunk_TA_nix to display data. Tks Louis.
... View more
05-24-2020
07:47 PM
Hi all,
I want to send syslog data directly from a Fortinet Firewall (remote site) to our Splunk Server via Internet. I want to encrypt the data while transferring the data via the Internet.
Is it possible to do this without a syslog collection and a forwarder?
Tks
... View more
Labels
- Labels:
-
syslog
05-19-2020
06:24 PM
index=_internal source=metrics.log group=udpin_connections |timechart avg(udp_kbps) max(udp_kbps) span=5m
UDP is similar. But UDP has _udp_bps=25434.085277542734, _udp_kbps=24.837973903850326, _udp_avg_thruput=15.692977114824794; so we might not need to do calculation.
... View more
03-24-2020
09:20 PM
https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Configurationfilechangesthatrequirerestart
This works for me.
... View more
03-05-2020
02:57 PM
Hi all,
I have a problem when I tried to parse EventID=1 in wineventlog. The message look like this:
03/05/2020 09:01:58 AM
LogName=System
SourceName=Microsoft-Windows-Kernel-General
EventCode=1
EventType=4
Type=Information
ComputerName=H7Y2.nap.net
TaskCategory=5
OpCode=Info
RecordNumber=5763
Keywords=Time
Message=The system time has changed to 2020-03-04T23:01:58.500000000Z from 2020-03-03T00:38:07.829890100Z.
Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).
When I used regex to parse the time from Message field. There is 1 unseen character before and after each number. Hence the command: | eval time_from = strptime(stime_from, "%Y-%m-%dT%H:%M:%S.%N") doesn't work because it doesn't have the unseen characters.
Tks
Linh
... View more
- Tags:
- splunk-enterprise
03-01-2020
02:19 PM
When I run a script in PowerShell on the same user, the PowerShell script returns a non-null value, while the app Active Directory still receives null value. It is very strange.
Tks
Louis
... View more
02-24-2020
09:15 PM
Hi,
I ran a query:
| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="sAMAccountName,distinguishedName,lastLogon,lastLogonTimestamp,division"
I found there are couple accounts witch lastLogon is null. But that field has value when I check that account in Active Directory. It is confusing because only some accounts have that issue.
Tks
Linh
... View more
02-06-2020
03:36 PM
I got a similar issue with 7.3.3 when migrating from single-site to multisite. I found that reducing replication_factor and seach_factor helped the process faster.
... View more
12-08-2019
10:15 PM
2 Karma
We have this issue again when we are upgrading to 7.3.3 to fix timestamp issue:
The percentage of small of buckets created xx over the last hour is very high and exceeded the red thresholds (xx) for index=xxxxx, and possibly more indexes, on this indexer
I wonder if we can search for the source/host the time is not correct, so we can fix it. We have about 1200 forwarders.
TKs
Louis.
... View more
11-21-2019
04:53 PM
Please use '\\' to escape '\'
| rex field=path "^(?:[^\]+\){2}(?[^\]+)"
... View more
11-17-2019
04:18 PM
It cannot be applied to the Enterprise version.
If you are running the Phantom App on Splunk on a Splunk ES server, then additional options are available to you. You can use "Send to Phantom" and "Run Playbook in Phantom" as alert actions, and you can send notable events to Phantom as an Adaptive Response Action.
Note: These alert actions will show up in the interface on regular Splunk (non-ES), but they ONLY work on Splunk ES.
... View more
11-01-2019
04:47 PM
1 Karma
Hi all,
I have a cluster with 2 indexers. I want to collect the UDP logs from Fortinet Firewall. I have setup the syslog forwarding from our FW to 1 indexer, but we haven't received any log data.
My FW: forward UDP connection to 172.25.1.26:9997
My IDX: 172.25.1.26 and 172.25.1.25
Is my setup correct, or I need to forward to both IDX?
Tks
Louis.
... View more
- Tags:
- TCP or UDP Sending
09-26-2019
06:27 PM
I had to place this code within the first panel. I cannot put it in the row element.
<head>
<style type="text/css">
.splunk-header {
min-height: 0px;
}
.dashboard-header{
overflow: hidden;
margin-bottom: 0px;
padding-top: 0px;
min-height: 0px;
}
</style>
</head>
</html>
... View more
09-17-2019
04:17 PM
This works well. I place it in the teardown function:
teardown: function($container, rowData) {
var that = this;
that._tableView=null;
var search_idCell = _(rowData.cells).find(function (cell) {
return cell.field === 'Login Name';
});
mvc.Components.revokeInstance(search_idCell.value);
},
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-09-2022
12:33 AM
|
Karma given to
