Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gwalford
gwalford
Path Finder
Member since:
06-03-2014
Thursday
Community Statistics
| Posts | 37 |
| Solutions | 3 |
| Karma Given | 45 |
| Karma Received | 11 |
| Member Since | 06-03-2014 |
Activity Feed
- Posted Re: HTTP Event Collector: How to generate token through Splunk CLI ? on Getting Data In. Thursday
- Karma Re: HTTP Event Collector: How to generate token through Splunk CLI ? for esalesapns2. Thursday
- Got Karma for Re: How to get token value and _time value from a single dropdown in a dashboard?. 05-16-2022 01:07 PM
- Posted Re: How to get token value and _time value from a single dropdown in a dashboard? on Splunk Search. 05-16-2022 11:28 AM
- Posted How to get token value and _time value from a single dropdown in a dashboard? on Splunk Search. 05-16-2022 09:50 AM
- Got Karma for Re: How can we figure out the size of KVStores and Lookups?. 04-16-2021 04:42 AM
- Got Karma for Re: How can we figure out the size of KVStores and Lookups?. 12-16-2020 12:55 PM
- Karma When will be able to migrate to Splunk v8 with Splunk Add-on for NetApp Data ONTAP for MaverickT. 06-05-2020 12:50 AM
- Karma Re: Cyberark Logs - Line Breaking doesn't work for whrg. 06-05-2020 12:50 AM
- Karma Re: Constructing URL to add a splunk user via REST (or via ansible uri mod) for brent_weaver. 06-05-2020 12:50 AM
- Karma Re: Help creating a sourcetype for this data for micahkemp. 06-05-2020 12:49 AM
- Karma Re: Issue with indexing JSON output from application for mattymo. 06-05-2020 12:49 AM
- Karma Re: How to track the bundle size on indexers over time for pradeepkumarg. 06-05-2020 12:49 AM
- Karma Re: How to find if the Splunk events are in future? for gjanders. 06-05-2020 12:49 AM
- Got Karma for Re: put splunk heavy forwarders behind loadbalancer. 06-05-2020 12:49 AM
- Karma Re: How to configure DMC for heavy forwarder monitoring? for mathiask. 06-05-2020 12:48 AM
- Karma How to configure DMC for heavy forwarder monitoring? for koshyk. 06-05-2020 12:48 AM
- Karma Re: How do I find an orphaned search in Splunk 6.4.1? for yahuja_splunk. 06-05-2020 12:48 AM
- Karma Is the iplocation command compatible with the commercial version of MAXMIND mmdb? for lohitkidu. 06-05-2020 12:48 AM
- Karma Where did the RSS feed for Splunk blogs go? for splunkquestions. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-16-2022
11:28 AM
1 Karma
I figured it out - I needed to use the done functionality to make it work from the table: <done> <set token="case_num">$result.case_idz$</set> <set token="earliest_event">$result.earliest_event$</set> <set token="latest_event">$result.latest_event$</set> </done> I also needed to remove the ctime conversion, and leave it in UNIX time. Works now!
... View more
05-16-2022
09:50 AM
How can I pull 3 tokens from a single dropdown search? - I would like our users to select the case_idz, and have the _time value populate from the same dropdown (I know I can append this to the individual searches with the case_idz token, but that seems very brute force and inelegant.) Here is the populating search: | tstats count WHERE index=cases BY source, _time | fields source, _time | rex field=source max_match=0 "^[A-Z]:\\\\([^\\\\]*)\\\\([^\\\\]*)\\\\(?P<case_idz>[^\\\\]*)" | stats count by case_idz, _time | fields case_idz, _time | stats earliest(_time) AS earliest_event, latest(_time) AS latest_event by case_idz | convert ctime(earliest_event) ctime(latest_event) Which gives a table of:
case_idz earliest_event latest_event I would like to turn each of these into a token: $case_idz$ $earliest_event$ $latest_event$ The case_idz is the value that they need to pivot off of, and the earliest_event and latest_event are the second and third tokens that I would like to leverage to set the earliest and latest time values for the searches. Other than taking components of this search and adding it to each and every dashboard, how can I have the three variables trigger in one pass?
... View more
Labels
- Labels:
-
tstats
03-11-2019
01:39 PM
Reassign Knowledge Objects exists in newer versions of Splunk - 7.X and up I believe.
... View more
09-10-2018
02:27 PM
Unfortunately this still breaks in the same fashion. 😞
It is a good thought on the LINE_BREAKER though.
... View more
09-07-2018
06:07 PM
Why is TIME_FORMAT failing for importing data?
I get the error:
Could not use strptime to parse timestamp from "INFO: Manager: list: Lis"
Raw log is repeating sections like:
Sep 06, 2018 12:00:56 AM org.apache.catalina.core.ApplicationContext log
INFO: Manager: list: Listing contexts for virtual host 'localhost'
Sep 06, 2018 12:01:56 AM org.apache.catalina.core.ApplicationContext log
INFO: Manager: list: Listing contexts for virtual host 'localhost'
Sep 06, 2018 12:02:56 AM org.apache.catalina.core.ApplicationContext log
INFO: Manager: list: Listing contexts for virtual host 'localhost'
I am using the following values in props.conf:
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=24
disabled=false
TIME_PREFIX=^
LINE_BREAKER=^\w{3} \d{2}, \d{4} \d{2}:\d{2}:\d{2}
TIME_FORMAT=%b %d, %Y %H:%M:%S %p
Splunk will not accept my timeformat that I have defined above... and I am not sure why.
... View more
03-14-2018
12:12 PM
2 Karma
If you are using Linux, this bash one-liner will give you a list of all the lookups on a search head in a shared bundle:
find /opt/splunk/var/run -maxdepth 1 -name '*.bundle' -print -exec tar -tvf {} \; | grep users | awk '{print $3,$6}' | sort -nr
In the case above, you may want to remove the "grep users" segment, I created it as it is to search for users that were creating files that were abnormally large.
... View more
02-14-2018
04:18 PM
If you got no results from:
|inputlookup MyView
or from:
|inputlookup MyView.csv
Then your lookup file isn't loaded correctly. See if you can find it in:
Settings > Lookups > Lookup Table Files
If you do - also notice what "app" the lookup is in. This is important. If you are in the wrong app when you try the lookup, it will fail.
... View more
12-28-2017
01:00 PM
Are you looking to only index events that have the unique identifier? If that is the case, then you probably want to do something like this:
https://answers.splunk.com/answers/477356/how-to-only-index-events-that-contain-specific-fie.html
If you are looking to index all the JSON files, and then trace events with the same ID, then you probably want to use the TRANSACTION command:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Transaction
Note: If you have a lot of events per ID, you may want to use STATS instead of TRANSACTION.
... View more
12-27-2017
02:32 PM
You probably want the solution found here:
https://answers.splunk.com/answers/145389/routing-data-to-specific-index-based-on-filename.html
... View more
12-27-2017
12:00 PM
1 Karma
Why do you feel you would get a benefit from a load balancer? By default, the forwarders switch indexers every 30 seconds. This happens when the forwarder detects and End of File.
Load Balancing like this is the key to making distributed search or clustering work.
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd
Now, you do want to do this for search heads, and syslog-ng data, but that is a different topic.
... View more
12-27-2017
10:40 AM
When you look at the "schedule" page under the report configuration page (the same one that you select all the emails you want the report to go to) There are some checkboxes down by "include". You can uncheck "Link to Report" and "Link to Results" and just leave "Attach PDF" checked.
... View more
12-27-2017
10:37 AM
It has been over 2 years since I last looked at CEF, and if my memory serves me correctly, I had to download one of the CEF applications off of Splunkbase, then modify the parsing slightly to conform with Arcsight. It did not take too much work to do.
GIven that you are dealing with key=value pairs, I would suggest you use a field extraction to get the details you want.
... View more
12-27-2017
10:34 AM
You always want to install the forwarder directly on the source system that is producing the logs - in this case it should be a Windows system running SCOM - so you will need to install some components of the application directly on the SCOM system itself. The forwarder will pick up the logs from SCOM, then forward them to your Linux environment.
So, in this case, I believe you need to install components of the SCOM application in two locations.
... View more
11-13-2017
09:44 AM
This is the answer we needed!
Surprised it is not linked directly from their main page...
... View more
04-11-2016
02:47 PM
The lookup file is intact, it isn't missing any fields.
If I call it like this:
| inputlookup Network_Hosts_List
It returns the .csv properly with no errors.
If I perform any search inside the customers app (except the above) on any index (even internal indexes) the errors pop up in the search. Even if I make sure to select an index that has no events of sourcetype=network:firewall, these errors still pop up.
... View more
04-11-2016
10:19 AM
1 Karma
One of my users has a lookup table that they have saved appropriately into their app.
It was running just fine. Now, after the weekend, when you search for anything inside the app, Splunk throws errors about the lookup file, even if you are not calling it.
For example, if you just search for:
index=main
You will get a whole host of errors from the indexers prior to the results that look like this:
[Indexer01] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer02] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer03] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer04] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer05] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer06] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer07] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer08] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer09] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer10] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer11] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer12] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer13] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
And so on...........
Why is Splunk throwing errors on a Lookup table that isn't being referenced?
... View more
03-18-2016
02:14 PM
I strongly recommend you open a ticket on this issue as well.
The more customers that open tickets, the higher of a priority this becomes on the DEV side, and the more quickly you will get this issue addressed.
... View more
03-17-2016
03:39 PM
1 Karma
I opened a ticket, it seems that there is a bug in SA-LDAPsearch that is being addressed.
... View more
02-11-2016
10:35 AM
I am dealing with a large domain, and an LDAPsearch takes over 8 hours to complete - but it usually times out.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
Karma from
