Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About leonphelps_s
leonphelps_s
Path Finder
Member since:
07-27-2016
10-01-2024
Community Statistics
| Posts | 22 |
| Solutions | 4 |
| Karma Given | 0 |
| Karma Received | 15 |
| Member Since | 07-27-2016 |
Activity Feed
- Got Karma for Re: Capabilities needed for a service account to enable Maintenance Mode and issue offline command. 06-05-2020 12:49 AM
- Got Karma for Re: Capabilities needed for a service account to enable Maintenance Mode and issue offline command. 06-05-2020 12:49 AM
- Got Karma for Need help with what should be a simple precedence issue regarding props.conf and aliases.. 06-05-2020 12:48 AM
- Got Karma for Need help with what should be a simple precedence issue regarding props.conf and aliases.. 06-05-2020 12:48 AM
- Got Karma for Need help with what should be a simple precedence issue regarding props.conf and aliases.. 06-05-2020 12:48 AM
- Got Karma for Need help with what should be a simple precedence issue regarding props.conf and aliases.. 06-05-2020 12:48 AM
- Got Karma for Re: Need help with what should be a simple precedence issue regarding props.conf and aliases.. 06-05-2020 12:48 AM
- Got Karma for Re: Need help with what should be a simple precedence issue regarding props.conf and aliases.. 06-05-2020 12:48 AM
- Got Karma for Re: Need help with what should be a simple precedence issue regarding props.conf and aliases.. 06-05-2020 12:48 AM
- Got Karma for Add-on for JIRA: Is there a character limit in jirarest jqlsearch?. 06-05-2020 12:48 AM
- Got Karma for Re: Add-on for JIRA: Is there a character limit in jirarest jqlsearch?. 06-05-2020 12:48 AM
- Got Karma for Re: Add-on for JIRA: Is there a character limit in jirarest jqlsearch?. 06-05-2020 12:48 AM
- Got Karma for Re: SA-ldapsearch in Search Activity App. 06-05-2020 12:48 AM
- Got Karma for Re: SA-ldapsearch in Search Activity App. 06-05-2020 12:48 AM
- Got Karma for Re: SA-ldapsearch in Search Activity App. 06-05-2020 12:48 AM
- Posted Re: Report scheduling/acceleration question... on Reporting. 02-26-2018 08:40 AM
- Posted Re: Capabilities needed for a service account to enable Maintenance Mode and issue offline command on Security. 11-14-2017 10:10 AM
- Posted Re: SA-ldapsearch in Search Activity App on All Apps and Add-ons. 06-22-2017 12:03 PM
- Posted Re: Splunk Enterprise Security: How can I change the sort order of the incident review page? on Splunk Enterprise Security. 04-20-2017 12:08 PM
- Posted Re: Splunk Enterprise Security: How can I change the sort order of the incident review page? on Splunk Enterprise Security. 02-20-2017 07:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 4 | |||
| 0 | |||
| 1 |
11-14-2017
10:10 AM
2 Karma
For "splunk offline" you'll need to give the account a role with the capability "edit_indexer_cluster". It may work for some of those others.
... View more
06-22-2017
12:03 PM
3 Karma
Hello.
That error is actually caused by the Search Activity apps default.meta and local.meta settings.
I noticed that they have import values set.
default.meta:import = search,search_activity
local.meta:import = search, search_activity
It has been my experience that when you expliciltly import knowledge objects from apps.. anything NOT imported is not avaialble for use.
I've commented out the two import lines and then the search command completes correctly. You could probably just add the sa-ldapsearch app to the import line that would also fix it.
... View more
04-20-2017
12:08 PM
Martin was helpful in general as always but did not answer my question. I was able to do this by editing the incident_review.js which is obviously an unsupported modification.
... View more
02-20-2017
07:57 AM
Thanks Martin, you were part of the group that was discussing this with me in Slack. I'll have to do some testing but when I first checked it didn't seem to support sorting.. and then sub sorting.. because I want it to be reverse time sorted after being sorted by severity.
... View more
02-20-2017
07:45 AM
Thanks Anthony. I've used that link before to show unassigned or change the default time window, but it does not support the level of sort/grouping I'm asking for. Thanks again.
... View more
02-17-2017
07:08 AM
How can I change the sort order of the incident review page within Splunk Enterprise Security? The default appears to be _time, but we'd like to do something urgency and then time or custom field and then time.
... View more
01-30-2017
01:49 PM
Somehow ZZ_ does work but U_ which should also work does not
... View more
01-30-2017
01:24 PM
1 Karma
I tried this with TA-splunk app vs U_TA-splunk app and btool shows the TA-splunk winning out .. and still in the UI the TA-splunk app aliases are shown but not the other app.
... View more
01-30-2017
01:23 PM
Yes, tried debug/refresh/ and a full restart.
both global, an exact copy of the first one
[props]
export = system
access = read : [*], write : [ admin ]
the search is in the "search" app
... View more
01-30-2017
01:22 PM
1 Karma
If what you are saying is true (which I understand why it would) then both aliases should appear via btool.. but do not.
Further, when I run btool it ONLY shows the app with the high asciii order based on path. Try it.. two apps same aliases .. btool grep for the aliases.. only one set will show via btool.
I'm gathering that btool shows whatever it wants.. not necessarily what splunk actually runs with.
I need an apple to apply answer of the scenario I am describing not something different. I am positive I am doing something wrong or just don't understand something but I'm not seeing it.
... View more
01-30-2017
11:08 AM
1 Karma
Ok.. so now it is 'A_app_a' instead of 25_x_x
~/bin/splunk btool props list --debug |grep severity|grep nitro
/opt/splunk/etc/apps/A_app_a/default/props.conf FIELDALIAS-cim_for_sev = severity AS severity_OVERRIDE
ASCII ordering supports #'s so that should have been fine, but here I tested it with a capital "A' which is higher in order than 'a'. No change. btool still recognizes the correct precedence but splunk seemingly refuses to enforce it at the UI level. This includes a full splunk restart.
One item of note.. in both scenarios.. in the "Fields -> Field Aliases" shows both apps and the conflicting aliases.
... View more
01-30-2017
09:45 AM
4 Karma
Simple scenario
app_a/default/props.conf
25_app_a/default/props.conf
The 25_app_a is an exact copy aside from the change noted below.
both contain field aliases for the same sourcetype. the fields/classes are the same aside from a simple "as" clause. app_a says severity as severity_id and 25_app_a you can see below. Due to ASCII ordering of apps 25_ should override, and from a btool perspective it does.
However in the UI the base app is still winning.
~/bin/splunk btool props list --debug |grep severity
/opt/splunk/etc/apps/25_app_a/default/props.conf FIELDALIAS-cim_for_sev = severity AS severity_OVERRIDE
Please don' t offer solutions such as "use app_a and /local/" there is a reason I'm doing it this way and I want emphasis to be on understanding precedence and btool.
... View more
11-03-2016
11:07 AM
My issue ended up being a command ordering issue. Inadvertently had the eval command before the mv
... View more
11-03-2016
09:38 AM
Did you ever figure this out? "No values" when there are multiple values in the field.
... View more
10-08-2016
09:18 AM
This appears to be a result of a bug .."(SPL-95114) where instability in an indexing cluster can lead to distributed search groups losing the internal reference to their members. When this happens, the default target group "dmc_group_indexer" acts as if it had no members even though those are listed in distsearch.conf, and as a result your searches will not be dispatched to any remote peers unless you specify a splunk_server=* or splunk_server_group=* clause."
https://answers.splunk.com/answers/221468/search-returns-zero-results-searchlog-reports-dist.html
Cleaning up distsearch.conf with splunk restart resolved this issue
... View more
10-08-2016
09:16 AM
Looks like the stuff was "crazy" lol will answer my original question with the fix.
... View more
10-06-2016
05:37 PM
servers = localhost:localhost
[distributedSearch:dmc_group_search_head]
servers = localhost:localhost
[distributedSearch:dmc_group_cluster_master]
[distributedSearch:dmc_group_deployment_server]
[distributedSearch:dmc_group_kv_store]
[distributedSearch:dmc_group_indexer]
default = true
servers = localhost:localhost
[distributedSearch:dmc_group_shc_deployer]
[distributedSearch]
servers = https://name_removed.com:8089
so basically nothing but the peer info
... View more
10-06-2016
05:07 PM
Seems like a relatively simple issue but I'm stumped.
I've got peers setup on on a search head.. and if I do a search referencing an index ONLY available on the remote peer.. it will only work if I do it as follows.
index=INDEX_NAME splunk_server=*
if I don't invoke splunk_server= no results are returned.
Further, when in access control none of the indexes are shown from the peer.
By default only the main index is searched. I did try setting default searched indexes to all non_internal but that didn't work either unless i invoked splunk_server.
What am I missing?
... View more
- Tags:
- splunk-enterprise
07-28-2016
10:28 AM
1 Karma
attempting it without the quotes does not work, presumably because of the additional information you just added. The quotes forces the issue I suppose and looks for the exact string.
... View more
07-28-2016
05:57 AM
1 Karma
So I realized that I needed to escape the inner quotes as follows.
| jirarest jqlsearch "text ~ \"20160721163457215194133559\""
This returns the appropriate results, however, it is still unclear to me why the 19 character version without escaping the quotes worked.
... View more
07-27-2016
06:22 PM
1 Karma
This is the search I am trying to execute from within Splunk:
| jirarest jqlsearch "text ~ "20160721163457215194133559""
I just want to find that # in JIRA..
The result from that command is HTTP Error 400: Bad Request (Jira Exception)
If I shorten that request to (19 characters, no more)
| jirarest jqlsearch "text ~ "2016072116345721519""
It returns "No results" presumably because there aren't any. For the sake of testing.. I added the 19 character # to a jira case and re-ran the query.
It returned the appropriate single row.. the full details of the jira case with both the original and long version of the #.
Ideas?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-01-2024
12:53 PM
|
