Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About MartinMcNutt
MartinMcNutt
Communicator
Member since:
02-07-2013
06-05-2020
Community Statistics
| Posts | 66 |
| Solutions | 7 |
| Karma Given | 24 |
| Karma Received | 36 |
| Member Since | 02-07-2013 |
Activity Feed
- Got Karma for Re: Why does my sourcetype= search return no results, but pairing with index= does?. 02-22-2021 02:59 PM
- Karma Re: Does Splunk install it's own version of MongoDB for rphillips_splk. 06-05-2020 12:48 AM
- Karma Re: Why would I use the HTTP Event Collector when I can use TCP? for gblock_splunk. 06-05-2020 12:48 AM
- Karma Re: Restricting index access from apps for kml_uvce. 06-05-2020 12:47 AM
- Karma Re: Is there any online regex tool to create regular expressions for given sample data ? for dimoobraznii. 06-05-2020 12:47 AM
- Karma Re: Is there any online regex tool to create regular expressions for given sample data ? for lmyrefelt. 06-05-2020 12:47 AM
- Karma Re: Why site doesn't load trying to access Splunk via proxy with Splunk 6.2 SSO using Windows 2012R2 IIS Server? for HansK. 06-05-2020 12:47 AM
- Karma Re: When will Search Head Clustering be enabled for Windows? for rsathish47. 06-05-2020 12:47 AM
- Karma Re: Why does login page show "Your browser could not connect to Splunk.com..." after upgrading server to 6.2 in a closed environment with web.conf configuration? for Ellen. 06-05-2020 12:47 AM
- Karma Re: Unable to search using Sourcetype for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Splunk Support for Active Directory version 2.0.0 not working with multiple LDAP servers in one stanza (getaddrinfo failed) for hlarimer. 06-05-2020 12:47 AM
- Karma Re: Why is the Splunk Web service not running after an upgrade to 6.2? for hexx. 06-05-2020 12:47 AM
- Karma Re: Restricting index access from apps for gfuente. 06-05-2020 12:47 AM
- Karma Re: Has anybody been successful with configuring the Splunk Support for Active Directory app on Splunk 6.1.1? for m4him7. 06-05-2020 12:47 AM
- Karma Re: Zoom and Center Map Visualization for aljohnson_splun. 06-05-2020 12:47 AM
- Got Karma for External search command 'ldapfilter' returned error code 1. Script output = " ERROR The default configuration stanza for ldap.conf is missing. ". 06-05-2020 12:47 AM
- Got Karma for External search command 'ldapfilter' returned error code 1. Script output = " ERROR The default configuration stanza for ldap.conf is missing. ". 06-05-2020 12:47 AM
- Got Karma for External search command 'ldapfilter' returned error code 1. Script output = " ERROR The default configuration stanza for ldap.conf is missing. ". 06-05-2020 12:47 AM
- Got Karma for Re: External search command 'ldapfilter' returned error code 1. Script output = " ERROR The default configuration stanza for ldap.conf is missing. ". 06-05-2020 12:47 AM
- Got Karma for Re: Why does my sourcetype= search return no results, but pairing with index= does?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 2 | |||
| 2 | |||
| 1 | |||
| 0 |
10-20-2016
10:08 AM
Unfortunately unityjdbc cost $$$ which I can't spend right now since this is a POC project.
... View more
10-20-2016
08:44 AM
I need to export some data from a Splunk search into a stand-alone Mongo server. Are there any "Free" options which permits this functionality?
... View more
01-29-2016
01:07 PM
Looking for advice/suggestions to the following. I created a powershell function that makes getting data inside Splunk easy. The only issue I currently have is that the first KV field inside the Body field is always ignored.
Splunk will not perform any extraction at search-time for dnsserver.
2016-01-29T011:19:56:369-05:00 id="614aa2df-c04b-4656-83f5-c708b174c829" app="SMTP_Job_Manager_Test" task="mx record check" operator="MyID" operatordisplay="MYDisplay" type="information" severity="informational" severity_id="1" body=" dnsserver="8.8.4.4" recordtype="MX" ttl="20697" smtp_server="mail.google.com" preference="20" emaildomainname="google.com" "
If i put a fake KV in front of dnsserver it will work and it will extract dnsserver.
body=" fake=field dnsserver="8.8.4.4" recordtype="MX" ttl="20697" smtp_server="mail.google.com" preference="20" emaildomainname="google.com"
I am pretty happy with the way the function work with the exception of this minor issue. Any clue why this is happening?
Thanks
... View more
09-02-2015
08:06 AM
Looking for an ETA for when windows gets Search head clustering.
Splunk does not currently support search head clustering on Windows systems.
... View more
05-11-2015
10:47 AM
For each strategy you have defined you must click map groups and assign the role to the group.
If you have 10 strats and a a group called Splunk-admins. That will be 10 group mappings you must perform for splunk-admins.
... View more
03-13-2015
06:33 AM
1 Karma
I have been complaining to my sales rep about the lack of response for this ticket. After my compliant, I did receive one tidbit of information regarding SA-ldapsearch slow search performance.
They mentioned that this version of SA-ldapsearch does not inherit the username / password from the default stanza. While is seems to pre-fill the username and password in the GUI apparently it doesn't make it in the config file.
I manually typed in the username / password on all stanzas and that helped with performance.
So if this is known by support...WHY wasn't this added to known issues that you must type in username/password.
ldap.conf is missing
I talked to someone yesterday and mentioned that main reason for the ticket being open was still not looked into.
... View more
03-11-2015
10:46 AM
If you following the steps provided by Splunk you should have no issues with your data.
I recently went through an upgrade from Windows 6.03 to 6.21 without any show stopping issues.
The only issue I had was with the web server refusing to run. I had to put it in legacy mode while Splunk looks into the issue.
... View more
03-04-2015
02:19 PM
Afraid I don't have any fix yet or even an update on the ticket.
I opened up the ticket on Feb 20 and a support person replied on 2/23. I got him the files he requested and never heard from him since.
... View more
02-23-2015
02:19 PM
1 Karma
That is awesome.... I do have a ticket open with Splunk to figure out why sa-ldapsearch is doing that.
Just remember if you plan on putting that into a dashboard, you may have to hide the LDAP part in a macro to avoid Splunk thinking it is a dashboard token. That one caught me by surprise. Doing dashboards / reports is not my full time job. 🙂
... View more
02-20-2015
03:24 PM
1 Karma
I am curious if it is the same issue I encountered. Try this...
Put in and eval statement after your user search | eval ID=user
change samaccount to look at the new field.
(samAccountName=$ID$)
I suspect that the token is not getting properly passed to the pipeline because of some data issues.
EDIT
It looks like |eval ID= was a red herring. I worked my search and simple added | table user prior to the | ldapfilter and things work ok.
I am going to open up a ticket now and maybe I can't have it solved before summer gets here.
... View more
02-20-2015
02:40 PM
I found a workaround for my issue and I will have to open a ticket to see why it is occurring.
I have this field called targetid which contains the mailNickname that I was to pass to Ldapfilter. When I simply use $targetid$ in (mailNickname=$targetid$) sa-ldapsearch will spaz out with that message.
The work around was | eval ID=targetid | ...........(mailNickname=$ID$)
I might have some have some issues with the character set when the file was brought into the indexer.
... View more
02-20-2015
09:40 AM
4 Karma
[ServerName] External search command 'ldapfilter' returned error code 1. Script output = " ERROR The default configuration stanza for ldap.conf is missing. "
i am running sa-ldapsearch 2.01 on windows using splunk 6.2.1 and I have it all my domains configured and tested yet I continue to get this message.
The error is coming from one of my indexers and I am not sure where to go to fix this. The defaul stanza is located at the top of ldap.conf and it successfully tested. The documentation says the app only needs to be installed on the search head so why am I getting this error?
Other tidbit of information: I removed the existing sa-ldapsearch and downloaded a brand new 2.01 and configured from a clean install.
... View more
- Tags:
- sa-ldapsearch
01-30-2015
11:46 AM
Install the Splunk Supporting Add-on for Active Directory and issue an ldapsearch to pull in the CN from the account.
Yes you can use REGEX to try and build the CN but go through the exercise of using ldapsearch ldapfetch etc and you will see how easy it is to bring your data to life.
These commands are hidden gems, especially when you are dealing with applications that have been around awhile. I had an issue with event log that only contains legacy exchange DN (So 1999s) but I need to know who it was. Just create an ldap search and splunk will bring in what ever attribute you want.
... View more
01-30-2015
11:36 AM
2 Karma
I believe what you are looking for is hidden under the Paint Brush Icon when you are in edit panel mode of your dashboard.
Zoom into the region you want the map to start.
Edit Panels then select Paint Brush on your Map Panel
Click Map Section
Populate with current map settings
Click Apply
... View more
01-26-2015
06:44 AM
Also note....Windows is not a support Operating system for SH Cluster as of 6.2.1.
... View more
01-07-2015
07:08 AM
Your options are outlined here: Supported_Oses
6.2.1 dropped support for all of the older windows OS. You may change the version on the page to look at older versions of Splunk that may be compatible but finding the bits may be troublesome.
Windows Vista End of Mainstream support ended on April 10 2012. While there is extended support until 2017 this would only be for critical patches and you have to pay a premium for it. Windows Lifecycle Fact Sheet
Not uncommon for a company to drop support for operating systems that are heading to the graveyard.
... View more
01-06-2015
06:48 AM
1 Karma
I would skip splunk right now until you are certain of the field name.
When I need to snoop AD, I use Active Directory Explorer from Microsoft. Can be a bit hard to use if you are not familiar with AD. You may want to try last.
Your other option is to use the Advanced Features of Active directory users & Computers and click on the Attribute Editor tab. This will so all the values on a user account.
Note:This needs to be a Win2008 Domain lvl AND you need to navigate to the OU of user to see that tab. Searching for a user does bring that tab up.
... View more
01-05-2015
02:24 PM
1 Karma
If we are talking about ActiveDirectory and Exchange CustomAttribute1-X. You have to refer to it by the Active Directory field name called extensionAttribute.
If you replace SamaccountName & Domain with your information you can try this search.
... | head 1 | eval SamAccountName="myid" | eval domain="mydomain" | ldapfilter domain=$domain$ search="(&(objectClass=user)(samAccountName=$SamAccountName$))" attrs="cn,displayName,extensionAttribute2" | table samAccountName cn displayName exten*
... View more
01-05-2015
01:52 PM
Been awhile since I touched the command but here is an example from one of my searches that may help:
| ldapfilter domain=$domain$ search="(&(objectClass=user)(samAccountName=$SamAccountName$))" attrs="cn,displayName"
You can use the attrs= to pull in fields you want. In my example, I had to first figure out what domain the user belongs to and tell ldapfilter to pull up the users DisplayName and CN.
... View more
11-17-2014
06:56 AM
Very good start.
Thanks
... View more
11-06-2014
01:16 PM
The very first thing i would do is re-apply default security.
At the top level folder right click and properties.
Select Security Tab
Click Advanced
Change Permissions
Select both check boxes at bottom
Click OK
Now open a dos prompt and issues a Splunk Restart from R:\Splunk\bin
Important note: Use dos to restart the splunk processes as it will display errors or other warnings you might have missed by using service manager.
... View more
11-01-2014
08:49 PM
I dont have anything against Linux...The problem is there are more support silos I have to deal with. I can count about 3-4 teams that have their portion of linux support at my company. OS/Security/E-trust/Etc
Windows...i can bypass all them and support the servers all by myself.
... View more
10-31-2014
10:16 PM
Translation:
Windows is low on our priority list and it might make it into next years .conf release.
If I knew how splunk would treat the windows platform...I would not have picked windows as the OS for my 40+ systems. Unfortunately due to the evil custom security layer on unix, windows was the lesser evil of the two.
... View more
10-31-2014
07:37 PM
You got me really confused now..
READTHISFIRST says near the bottom "No support for search head clustering in Windows
... View more
10-30-2014
12:57 PM
2 Karma
I was really looking forward to getting rid of search head pooling. Been a thorn in my side since implementing splunk.
Is it coming in a 6.2. dot release or 6.3?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
