About tpeveler_splunk

tpeveler_splunk · ‎02-06-2019

The capability needed is admin_all_objects.

tpeveler_splunk · ‎02-04-2019

See https://answers.splunk.com/answers/434017/how-to-get-session-key-in-a-search-script-script-s I successfully implemented the approach specified in the Accepted Answer and was able to get the sessionKey when executing a custom search command.

tpeveler_splunk · ‎09-04-2018

mbrunetto - see https://answers.splunk.com/answers/310035/how-to-connect-a-search-head-to-an-indexer-via-pro.html as to why this doesn't work.

tpeveler_splunk · ‎07-24-2018

You'll need to use the public DNS or public IP address for the EC2 Instance when accessing the Splunk Web UI. As I mentioned above, You can get that information on the description tab for the EC2 instance within the AWS console. You don't have to do anything with your existing Splunk installation. For some reason when Splunk starts up it always seems to reference the AWS EC2 instance Private DNS entry.

tpeveler_splunk · ‎07-24-2018

chandana204, The Splunk web interface shown at startup is typically the AWS EC2 instance Private DNS or internal IP address. You will want to use the public DNS or public IP address for the EC2 instance. You can get that information on the description tab for the EC2 instance within the AWS console. Also, check the AWS security group associated with your EC2 instance and make sure that there is an inbound TCP rule for port 8000.

tpeveler_splunk · ‎07-23-2018

One option would be to use the dump command along with the clean command. After which you would re-index the events. You would essentially execute a search that identifies the good events and dump them to local disk in raw format. See Splunk dump command in Search Reference. You would then clean the index of all events via the splunk clean ... CLI command. See Remove data from one or all indexes. Finally, you would re-index the events that were dumped to disk.

tpeveler_splunk · ‎07-23-2018

Manoj_g, Check out Alert Manager on Splunkbase -> Alert Manager

tpeveler_splunk · ‎07-23-2018

Here is an approach that uses an eval statement with a subsearch to get the overall number of hosts to use in the foreach statement that calculates the percentage. I also included limit=0 in the timechart command so that all hosts are included in the results. index=main host=hosts0*p "serviceAvailable=true" | timechart limit=0 partial=false span=15m count by host | eval numhosts= [ search index=main host=hosts0*p "serviceAvailable=true" | stats dc(host) as numhosts | return $numhosts ] | foreach hosts0*p [ eval <<FIELD>> = '<<FIELD>>' * 100 / ( (15 * 60) / (10 / numhosts ) ) ]

tpeveler_splunk · ‎04-11-2018

A Splunk implementation requires a default minimum free disk space of 5000MB for indexing. In your case it looks like the minimum free disk space limit may have been changed to a higher value. Check out the following two options to address the errors and enable your searches to return results: 1) Add space to the file system that houses Splunk (i.e. /opt/...) 2) Decrease the minimum free disk space limit. See http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Setlimitsondiskusage for details on how to set limits on disk usage. I had a customer that was experiencing the same issue as yours and we were able to address it by implementing option 1 (add space).

tpeveler_splunk · ‎04-09-2018

Hello, The most straight forward way to handle this would be to use the top command. A couple of things to note. You'll want to wildcard your sourcetype so that you do indeed pickup the wineventlog sourcetypes (i.e. sourcetype="wineventlog:*"). In addition, you'll want to wrap the OR condition on the Type fields in parenthesis as such (Type="Critique" OR Type="Avertissement") SPL... index="wineventlog" sourcetype="wineventlog:*" SourceName="" (Type="Critique" OR Type="Avertissement") | dedup _time SourceName | top limit=10 SourceName

tpeveler_splunk · ‎01-30-2017

Splunk Stream v7.0 (https://splunkbase.splunk.com/app/1809/) supports vendor extensions to NetFlow and its a documented feature. However, the configuration details are currently not in the Stream documentation. You should be able to work with your Splunk account team to configure the Cisco extensions within Stream.

tpeveler_splunk · ‎01-05-2017

Splunk can route events to a specific index based on the server name. Below is a snippet of props.conf as well as the transforms.conf stanza that will perform the index routing that you described. Check https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Transformsconf for details on the attributes used in the transform.conf stanza. Props.conf (snippet) description = Index is overwritten by the transforms TRANSFORMS-setindex=setindexbyhost Transforms.conf [setindexbyhost] SOURCE_KEY = MetaData:Host REGEX = ^host::(.*)$ DEST_KEY = MetaData:Index FORMAT = idx_$1_perfmon_cpu-load However, having a separate index for each source server is not recommended. This could lead to both management and performance challenges in a large Splunk installation. There are definitely cases where one may want to split out events for a group of source servers due to thing such as access and/or retention requirements. For example, send all development server events to a development index and all production server events to production index.

Posts	12
Solutions	2
Karma Given	0
Karma Received	5
Member Since	‎07-19-2016

Online Status	Offline
Date Last Visited	‎05-25-2023 10:57 PM

Re: What additional permissions are needed for a n...

Re: Why am I not getting sessionKey while using cu...

Re: Connecting a search head to indexer through a ...

Re: Why am I not able to access the Splunk web ser...

Re: Why am I not able to access the Splunk web ser...

Re: How can I really delete an event

Re: Best way 's or Tools to use on call schedule A...

Re: Accessing results from search after timecharti...

Re: Unable to search & getting this error : Unable...

Re: extract top ten values

Re: Does Splunk Stream support Cisco's High Speed ...

Re: How to route to an Index based on SourceType A...