About gwalford

gwalford · ‎09-29-2022

uuidgen is a great way to script this programatically.

gwalford · ‎05-16-2022

I figured it out - I needed to use the done functionality to make it work from the table: <done> <set token="case_num">$result.case_idz$</set> <set token="earliest_event">$result.earliest_event$</set> <set token="latest_event">$result.latest_event$</set> </done> I also needed to remove the ctime conversion, and leave it in UNIX time. Works now!

gwalford · ‎05-16-2022

How can I pull 3 tokens from a single dropdown search? - I would like our users to select the case_idz, and have the _time value populate from the same dropdown (I know I can append this to the individual searches with the case_idz token, but that seems very brute force and inelegant.) Here is the populating search: | tstats count WHERE index=cases BY source, _time | fields source, _time | rex field=source max_match=0 "^[A-Z]:\\\\([^\\\\]*)\\\\([^\\\\]*)\\\\(?P<case_idz>[^\\\\]*)" | stats count by case_idz, _time | fields case_idz, _time | stats earliest(_time) AS earliest_event, latest(_time) AS latest_event by case_idz | convert ctime(earliest_event) ctime(latest_event) Which gives a table of: case_idz earliest_event latest_event I would like to turn each of these into a token: $case_idz$ $earliest_event$ $latest_event$ The case_idz is the value that they need to pivot off of, and the earliest_event and latest_event are the second and third tokens that I would like to leverage to set the earliest and latest time values for the searches. Other than taking components of this search and adding it to each and every dashboard, how can I have the three variables trigger in one pass?

gwalford · ‎03-11-2019

Reassign Knowledge Objects exists in newer versions of Splunk - 7.X and up I believe.

gwalford · ‎09-10-2018

Unfortunately this still breaks in the same fashion. 😞 It is a good thought on the LINE_BREAKER though.

gwalford · ‎09-07-2018

Why is TIME_FORMAT failing for importing data? I get the error: Could not use strptime to parse timestamp from "INFO: Manager: list: Lis" Raw log is repeating sections like: Sep 06, 2018 12:00:56 AM org.apache.catalina.core.ApplicationContext log INFO: Manager: list: Listing contexts for virtual host 'localhost' Sep 06, 2018 12:01:56 AM org.apache.catalina.core.ApplicationContext log INFO: Manager: list: Listing contexts for virtual host 'localhost' Sep 06, 2018 12:02:56 AM org.apache.catalina.core.ApplicationContext log INFO: Manager: list: Listing contexts for virtual host 'localhost' I am using the following values in props.conf: SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=24 disabled=false TIME_PREFIX=^ LINE_BREAKER=^\w{3} \d{2}, \d{4} \d{2}:\d{2}:\d{2} TIME_FORMAT=%b %d, %Y %H:%M:%S %p Splunk will not accept my timeformat that I have defined above... and I am not sure why.

gwalford · ‎03-14-2018

If you are using Linux, this bash one-liner will give you a list of all the lookups on a search head in a shared bundle: find /opt/splunk/var/run -maxdepth 1 -name '*.bundle' -print -exec tar -tvf {} \; | grep users | awk '{print $3,$6}' | sort -nr In the case above, you may want to remove the "grep users" segment, I created it as it is to search for users that were creating files that were abnormally large.

gwalford · ‎02-14-2018

If you got no results from: |inputlookup MyView or from: |inputlookup MyView.csv Then your lookup file isn't loaded correctly. See if you can find it in: Settings > Lookups > Lookup Table Files If you do - also notice what "app" the lookup is in. This is important. If you are in the wrong app when you try the lookup, it will fail.

gwalford · ‎12-28-2017

Are you looking to only index events that have the unique identifier? If that is the case, then you probably want to do something like this: https://answers.splunk.com/answers/477356/how-to-only-index-events-that-contain-specific-fie.html If you are looking to index all the JSON files, and then trace events with the same ID, then you probably want to use the TRANSACTION command: https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Transaction Note: If you have a lot of events per ID, you may want to use STATS instead of TRANSACTION.

gwalford · ‎12-27-2017

You probably want the solution found here: https://answers.splunk.com/answers/145389/routing-data-to-specific-index-based-on-filename.html

gwalford · ‎12-27-2017

Why do you feel you would get a benefit from a load balancer? By default, the forwarders switch indexers every 30 seconds. This happens when the forwarder detects and End of File. Load Balancing like this is the key to making distributed search or clustering work. http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd Now, you do want to do this for search heads, and syslog-ng data, but that is a different topic.

gwalford · ‎12-27-2017

When you look at the "schedule" page under the report configuration page (the same one that you select all the emails you want the report to go to) There are some checkboxes down by "include". You can uncheck "Link to Report" and "Link to Results" and just leave "Attach PDF" checked.

gwalford · ‎12-27-2017

It has been over 2 years since I last looked at CEF, and if my memory serves me correctly, I had to download one of the CEF applications off of Splunkbase, then modify the parsing slightly to conform with Arcsight. It did not take too much work to do. GIven that you are dealing with key=value pairs, I would suggest you use a field extraction to get the details you want.

gwalford · ‎12-27-2017

You always want to install the forwarder directly on the source system that is producing the logs - in this case it should be a Windows system running SCOM - so you will need to install some components of the application directly on the SCOM system itself. The forwarder will pick up the logs from SCOM, then forward them to your Linux environment. So, in this case, I believe you need to install components of the SCOM application in two locations.

gwalford · ‎11-13-2017

This is the answer we needed! Surprised it is not linked directly from their main page...

gwalford · ‎04-11-2016

The lookup file is intact, it isn't missing any fields. If I call it like this: | inputlookup Network_Hosts_List It returns the .csv properly with no errors. If I perform any search inside the customers app (except the above) on any index (even internal indexes) the errors pop up in the search. Even if I make sure to select an index that has no events of sourcetype=network:firewall, these errors still pop up.

gwalford · ‎04-11-2016

One of my users has a lookup table that they have saved appropriately into their app. It was running just fine. Now, after the weekend, when you search for anything inside the app, Splunk throws errors about the lookup file, even if you are not calling it. For example, if you just search for: index=main You will get a whole host of errors from the indexers prior to the results that look like this: [Indexer01] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer02] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer03] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer04] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer05] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer06] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer07] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer08] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer09] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer10] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer11] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer12] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. [Indexer13] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'. And so on........... Why is Splunk throwing errors on a Lookup table that isn't being referenced?

gwalford · ‎03-18-2016

I strongly recommend you open a ticket on this issue as well. The more customers that open tickets, the higher of a priority this becomes on the DEV side, and the more quickly you will get this issue addressed.

gwalford · ‎03-17-2016

I opened a ticket, it seems that there is a bug in SA-LDAPsearch that is being addressed.

gwalford · ‎02-11-2016

I am dealing with a large domain, and an LDAPsearch takes over 8 hours to complete - but it usually times out.

gwalford · ‎02-11-2016

Actually, I thought that this wasn't bad.

gwalford · ‎02-09-2016

I have a pretty inefficient search that I would like to improve - it has a lot of flaws. For example, I run the three searches below in order, one after the other. What I should be doing is pulling out a time value in the first search, and running them all concurrently, but the below is the closest I have been able to get to work. The intent behind this search is to find people running bittorrent at the proxy, compare the natted IP with the DHCP logs to find the MAC address, then check with the authentication servers logs to see who had that IP during that time range. Step 1) index=proxy application=Bittorrent | top limit=20 srcip | table srcip | outputlookup bittorrent_list.csv Step 2) index=dhcp [|inputlookup bittorrent_list.csv | rename srcip as src_ip] | top limit=20 src_mac | table src_mac | outputlookup bittorrent_mac_from_dhcp_list.csv Step 3) index=authentication [|inputlookup bittorrent_mac_from_dhcp_list.csv ]| top limit=20 User_Name

gwalford · ‎02-03-2016

There is a lot of useful detail in the index=wineventlog . I would like to be able to allow my front tier service desk access to dashboards that show things such as "user accounts locked out" or "print job failed". However, I don't want them to have any access to the wineventlog index itself. Is there a way of generating a report off of one index say, and moving the results to a separate index so that they don't gain access to the remainder of the information in the index?

gwalford · ‎02-02-2016

In Powershell "Get-ADUser -Filter *" begins returning results almost instantly - I don't know how long they would take to complete, but I can tell you the domain is insanely large - I don't even know what the sum total of the users would be. The Splunk search | ldapsearch domain="default" search="(&(objectclass=user)(!(objectclass=computer))) Stalls with 0.0% of the time range scanned - this is where I need to extend the job to have it complete. My best guess is that the full user lookup takes hours to stream back from LDAP, but I don't really know (Will verify with my AD admins).

gwalford · ‎02-01-2016

Splunk Support for Active Directory (SA-ldapsearch) is installed and configured on my search heads. When running the test on any system that has it installed, the test function completes. When trying to run nearly any ldap search, it will take hours to return results. For example, this search for the App Search Activity: ldapsearch domain=`SA-LDAPSearch-Domain` search="(&(objectclass=user)(!(objectclass=computer)))"| fields description title cn dn sn name displayName givenName whenChanged sAMAccountName mail manager c l o st telephoneNumber department company directReports physicalDeliveryOfficeName | makemv directReports tokenizer="(?i)(CN=.*?dc=\S*)"| eval NumDirectReports = if(isnull(directReports),0,mvcount(directReports)) | fields - directReports _raw _time Takes about 7 hours to return results. We do have an insanely large domain here. I am sure that this is part of the reason. Unfortunately, the Splunk App for Windows Infrastructure isn't populating a lot of drop-downs, and I suspect it is all related to the SA-ldapsearch search time returns.

Posts	37
Solutions	3
Karma Given	46
Karma Received	11
Member Since	‎06-03-2014

Online Status	Offline
Date Last Visited	‎11-19-2025 10:50 AM

How to get token value and _time value from a sing...

TIME_FORMAT AUTO works, but strptime defined does ...

Why is a Splunk search throwing errors on a lookup...

How do I improve the performance of my three searc...

How to allow users to view some search results fro...

Splunk Support for Active Directory: Why does ldap...

How to omit Scanners as a "Threat" from the Splunk...

Re: HTTP Event Collector: How to generate token th...

Re: How to get token value and _time value from a ...

How to get token value and _time value from a sing...

Re: How to remove the orphan scheduled search from...

Re: TIME_FORMAT AUTO works, but strptime defined d...

TIME_FORMAT AUTO works, but strptime defined does ...

Re: How can we figure out the size of KVStores and...

Re: How to search using ONLY lookup

Re: Need help with complicated Json format

Re: Extract index from filename in inputs.conf

Re: put splunk heavy forwarders behind loadbalance...

Re: Is there a way to disable "view this dashboard...

Re: CEF logs parsing for Enterprise Security

Re: Install SCOM Add on with Splunk Enterprise on ...

Re: Where did the RSS feed for Splunk blogs go?

Re: Why is a Splunk search throwing errors on a lo...

Why is a Splunk search throwing errors on a lookup...

Re: How do I improve ldapsearch performance

Re: How do I improve ldapsearch performance

Re: How do I improve ldapsearch performance

Re: How do I improve the performance of my three s...

How do I improve the performance of my three searc...

How to allow users to view some search results fro...

Re: Splunk Support for Active Directory: Why does ...

Splunk Support for Active Directory: Why does ldap...

Join the Conversation