- " class="nav-category">Splunk Administration
This widget could not be displayed.
This widget could not be displayed.
- " class="nav-category">Splunk Development
This widget could not be displayed.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About HansK
HansK
Path Finder
Member since:
08-24-2011
08-21-2020
Community Statistics
| Posts | 39 |
| Solutions | 6 |
| Karma Given | 4 |
| Karma Received | 12 |
| Member Since | 08-24-2011 |
Activity Feed
- Karma Where did the download links for wget go on splunk.com?! for awurster. 06-05-2020 12:47 AM
- Got Karma for Re: Why site doesn't load trying to access Splunk via proxy with Splunk 6.2 SSO using Windows 2012R2 IIS Server?. 06-05-2020 12:47 AM
- Got Karma for Re: Why site doesn't load trying to access Splunk via proxy with Splunk 6.2 SSO using Windows 2012R2 IIS Server?. 06-05-2020 12:47 AM
- Got Karma for Re: Why site doesn't load trying to access Splunk via proxy with Splunk 6.2 SSO using Windows 2012R2 IIS Server?. 06-05-2020 12:47 AM
- Got Karma for Re: Why site doesn't load trying to access Splunk via proxy with Splunk 6.2 SSO using Windows 2012R2 IIS Server?. 06-05-2020 12:47 AM
- Got Karma for Re: Why site doesn't load trying to access Splunk via proxy with Splunk 6.2 SSO using Windows 2012R2 IIS Server?. 06-05-2020 12:47 AM
- Got Karma for Re: Why site doesn't load trying to access Splunk via proxy with Splunk 6.2 SSO using Windows 2012R2 IIS Server?. 06-05-2020 12:47 AM
- Got Karma for Re: Why site doesn't load trying to access Splunk via proxy with Splunk 6.2 SSO using Windows 2012R2 IIS Server?. 06-05-2020 12:47 AM
- Karma Re: timechart and sum seperate events for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: line graph multiple field values for Ayn. 06-05-2020 12:46 AM
- Karma SPL-58112 -> Metadata results from this peer are incomplete for lpolo. 06-05-2020 12:46 AM
- Got Karma for Re: Unable to start splunk forwarder service. 06-05-2020 12:46 AM
- Got Karma for many small files. 06-05-2020 12:46 AM
- Got Karma for Re: many small files. 06-05-2020 12:46 AM
- Got Karma for Re: many small files. 06-05-2020 12:46 AM
- Posted Re: SNMP Splunk MA App for Netcool is not sending traps on All Apps and Add-ons. 01-31-2019 12:22 AM
- Posted Re: SNMP Splunk MA App for Netcool is not sending traps on All Apps and Add-ons. 01-31-2019 12:04 AM
- Posted Re: SNMP Splunk MA App for Netcool is not sending traps on All Apps and Add-ons. 01-29-2019 11:38 PM
- Posted SNMP Splunk MA App for Netcool is not sending traps on All Apps and Add-ons. 01-29-2019 11:36 PM
- Tagged SNMP Splunk MA App for Netcool is not sending traps on All Apps and Add-ons. 01-29-2019 11:36 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-31-2019
12:22 AM
Well found the answer:
In the alert it says "Specify Your Unique Enterprise OID. Example: 1.2.3.4.5.6.7.8"
When using this sample OID nothing gets sent out, when you change it to a valid OID like 1.3.6.1.2.1.43.18.2.0.1 it starts working.
... View more
01-31-2019
12:04 AM
There are no firewalls.
But the problem is there is nothing leaving the machine:
If i send a snptrap on the cli (snmptrap -c public -v 2c 172.22.171.164 "" 1.3.6.1.2.1.43.18.2.0.1) it gets caught by : tcpdump -i any -s 0 host 172.22.171.164 and port 162
None of the alerts using the netcool app send anything , although logs do appear in /opt/splunk/var/log/splunk/netcool_custom_modular_alert.log, tcpdump locally sees nothing going out.
... View more
01-29-2019
11:38 PM
OS Centos7
Splunk version 7.2.3
... View more
01-29-2019
11:36 PM
We have installed "SNMP Splunk MA App for Netcool" on a new search head and linked the search head to the indexers.
An alert with the trigger action "Netcool Custom Modular Alert"has been created and all fieds have been filled.
We see a log entry in /opt/splunk/var/log/splunk/netcool_custom_modular_alert.log:
2019-01-28 07:59:02,230 INFO START
2019-01-28 07:59:02,230 INFO splunkapp:search, splunksearch:test_xxxxxx, snmp_serverip:172.22.171.164, snmp_port:162, snmp_community:xxxxx, snmp_hostname:, snmp_alertmessage:More than 1 release cause 5XX in last 30 minutes for customer xxxx xxxxx, snmp_severity:5, splunk_escalation:xxxxxxxx, splunk_payload:{u'configuration': {u'hostname': u'', u'enterpriseSNMPSpecificObjectID': u'9', u'customtext': u'', u'AlertKey': u'123456789', u'community': u'public', u'alertmessage': u'More than 1 release cause 5XX in last 30 minutes for customer xxxxxxxxxt', u'enterpriseSNMPObjectID': u'1.2.3.4.5.6.7.8', u'enterpriseSNMPSpecificTrapID': u'10', u'serverip': u'172.22.171.164:162', u'escalation': u'xxxxxxxxx', u'severity': u'5'}, u'results_link': u'http://xxxxxxxxx:8000/app/search/search?q=%7Cloadjob%20scheduler__admin__search__RMD510cd368a33d67d83_at_1548658740_9899%20%7C%20head%201%20%7C%20tail%201&earliest=0&latest=now', u'server_uri': u'https://127.0.0.1:8089', u'results_file': u'/opt/splunk/var/run/splunk/dispatch/scheduler_adminsearchRMD510cd368a33d67d83_at_1548658740_9899/per_result_alert/tmp_0.csv.gz', u'result': {u'count(Q21_sip_dest_respcode)': u'2'}, u'sid': u'scheduleradminsearch_RMD510cd368a33d67d83_at_1548658740_9899', u'search_name': u'test_xxxxxxxl', u'server_host': u'xxxxxxxxxxxxx', u'search_uri': u'/servicesNS/nobody/search/saved/searches/test_xxxxxxx', u'session_key': u'd0X5lh5dXc7S9uTW^82E4eQ1l9z6jQpVjKhTm3xczVgILSEZjkVRvHf6z2QXOvv9MR197IjzD5_50uJ0anuIwvZwuYFGTcSmBuuI^L9QsYNPmwZKFplYgJPy8VbVPC^i1W82Gfvt8FY', u'app': u'search', u'owner': u'admin'}, splunk_customtext:
2019-01-28 07:59:02,272 INFO STOP
We receive nothing at the dest ip 172.22.171.164:162
Also nothing is seen on the wire with tcpdump (other snmp sending procs on this server do work and are seen on the wire):
tcpdump -i any -s 0 host 172.22.171.164 and port 162
... View more
01-22-2015
01:32 AM
1 Karma
// Added for new splunk version to work.
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/splunk-cookie-'. session_id());
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/splunk-cookie-'. session_id());
//
Full code
... View more
01-22-2015
01:32 AM
1 Karma
Our problem has been fixed after receiving some tips from splunk support, we use a php script in combination with mod_rewrite to proxy.
It seems cookie handling has changed between 6.1 & 6.2
... View more
01-14-2015
12:11 AM
2 Karma
http://docs.splunk.com/Documentation/Splunk/6.2.1/ReleaseNotes/6.2.1
2014-10-28 PL-92730 Splunk 6.2 appears to break reverse proxy., SPL-92730
I have ticket open (199508), but no fix yet.
... View more
11-04-2014
10:36 AM
3 Karma
We had issues with a apache proxy setup, trying to use SSO on 6.2, which worked perfectly on 6.1
"fix" was to run in legacy mode by adding appServerPorts = 0 to web.conf
... View more
09-19-2014
05:15 AM
This will do the trick:
[\n\r].*--\s*(?<INCATOT>[0-9]*)\s*(?<PRERTEAB>[0-9]*)\s*(?<INFAIL>[0-9]*)\s*(?<NATTMPT>[0-9]*)\s*(?<NOVFLATB>[0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)
... View more
09-19-2014
05:13 AM
For future refence, this is the regex to solve the extraction:
[\n\r].*--\s*(?<INCATOT>[0-9]*)\s*(?<PRERTEAB>[0-9]*)\s*(?<INFAIL>[0-9]*)\s*(?<NATTMPT>[0-9]*)\s*(?<NOVFLATB>[0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)
... View more
09-12-2014
02:37 AM
Hi, I'm trying to get the data from below image into a usable format, I would like to end up with key-value pairs like:
INCATOT=26258
TRU=86167
ACCCONG=0
PRERTEAB=20
etc ...
I do not know how to describe the datastructure we are receiving as it is a table but with muliple headers in a column.
... View more
12-16-2013
11:51 PM
The user does not have the power role, he does have the schedule_search capability though.
... View more
12-13-2013
07:04 AM
What capabilities are needed for a user to delete alerts created by himself?
At the moment it is not possible on our system, no error is given to the user when he selects delete but nothing happens.
... View more
08-01-2013
07:03 AM
looks like I found it :
index="titan" | eval count=1 | timechart per_second(count) as transactions_per_second by SwitchID
it's slow though, can I speed it up in any way?
... View more
08-01-2013
06:38 AM
Hi,
I have records like:
epoch_millisecond|field2|field3|field4|field5|switchID|field7|field8|field9|field10|field11|field12
1375354799977|SIGNALING|dyn-edge-1|860|INAP|3120220016|3110340945|104514444|653444474|INAP|6040|D061108 1375354799963|SIGNALING|dan-edge-1|409|INAP|3120220013|3110340945|492444444|610844440|INAP|3002|D061108
I need to create a report which will tell me how many records per second per switchID.
I tried: index="titan" | timechart per_second(switchID)
But that's not giving the results i need.
... View more
03-14-2013
06:55 AM
Like so?:
host="forward*" count
| timechart max(coin_ENEC_count_DN_800), max(ASICM_count_DN_800), max(DF2_count_DN_800), max(DF2_count_TT_800)
|eval platform_800_count = ASICM_count_DN_800 + DF2_count_DN_800 + DF2_count_TT_800
How would I go about presenting the new field in the timechart?
... View more
03-14-2013
06:19 AM
data is like this:
2013-03-14 14:10:14 DF2_count_DN_800=669
2013-03-14 14:10:14 ASICM_count_DN_800=723
2013-03-14 14:10:14 DF2_count_TT_800=1155
... View more
03-14-2013
06:05 AM
Yes, all numbers and they all show up on the timechart.
If I only eval one field like "eval platform_800_count = ASICM_count_DN_800|" it does not show either.
... View more
03-14-2013
05:50 AM
1 Karma
seems there is allready another service listening on 8089, eiter change the splunk port or the other software's port.
try this:
netstat --tcp --udp --listening --program
... View more
03-14-2013
05:47 AM
Im running this query:
host="forward*" count
| eval platform_800_count = ASICM_count_DN_800 + DF2_count_DN_800 + DF2_count_TT_800
| timechart max(coin_ENEC_count_DN_800), max(ASICM_count_DN_800), max(DF2_count_DN_800), max(DF2_count_TT_800), max(platform_800_count)
I expect eval to sum the fields into platform_800_count and as a last step to timechart this field but it does not present a value on the chart for platform_800_count.
Other fields are presented.
As Martin points out below I cannot eval seperate events, is there another method to do this?
... View more
11-29-2012
07:39 AM
Hi,
I have field which contains telephonenumbers and would like to create a report on area codes, so I need to only use the first 3 digits of the field.
How is this done?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-21-2020
02:39 AM
|
Karma from
