Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gwalford
gwalford
Path Finder
Member since:
06-03-2014
11-23-2020
Community Statistics
| Posts | 34 |
| Solutions | 2 |
| Karma Given | 44 |
| Karma Received | 10 |
| Member Since | 06-03-2014 |
Activity Feed
- Got Karma for Re: How can we figure out the size of KVStores and Lookups?. 04-16-2021 04:42 AM
- Got Karma for Re: How can we figure out the size of KVStores and Lookups?. 12-16-2020 12:55 PM
- Karma When will be able to migrate to Splunk v8 with Splunk Add-on for NetApp Data ONTAP for MaverickT. 06-05-2020 12:50 AM
- Karma Re: Cyberark Logs - Line Breaking doesn't work for whrg. 06-05-2020 12:50 AM
- Karma Re: Constructing URL to add a splunk user via REST (or via ansible uri mod) for brent_weaver. 06-05-2020 12:50 AM
- Karma Re: Help creating a sourcetype for this data for micahkemp. 06-05-2020 12:49 AM
- Karma Re: Issue with indexing JSON output from application for mattymo. 06-05-2020 12:49 AM
- Karma Re: How to track the bundle size on indexers over time for pradeepkumarg. 06-05-2020 12:49 AM
- Karma Re: How to find if the Splunk events are in future? for gjanders. 06-05-2020 12:49 AM
- Got Karma for Re: put splunk heavy forwarders behind loadbalancer. 06-05-2020 12:49 AM
- Karma Is the iplocation command compatible with the commercial version of MAXMIND mmdb? for lohitkidu. 06-05-2020 12:48 AM
- Karma Re: How do I find an orphaned search in Splunk 6.4.1? for yahuja_splunk. 06-05-2020 12:48 AM
- Karma How to configure DMC for heavy forwarder monitoring? for koshyk. 06-05-2020 12:48 AM
- Karma Re: How to configure DMC for heavy forwarder monitoring? for mathiask. 06-05-2020 12:48 AM
- Karma Where did the RSS feed for Splunk blogs go? for splunkquestions. 06-05-2020 12:48 AM
- Karma Re: Where did the RSS feed for Splunk blogs go? for acesaro. 06-05-2020 12:48 AM
- Karma Re: Populating Multiple Dashboard Panels, From One Search for woodcock. 06-05-2020 12:48 AM
- Got Karma for Why is a Splunk search throwing errors on a lookup that isn't being called?. 06-05-2020 12:48 AM
- Karma Re: Not getting any data from Google Apps for Splunk for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: How do I improve the performance of my three searches? for somesoni2. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-11-2019
01:39 PM
Reassign Knowledge Objects exists in newer versions of Splunk - 7.X and up I believe.
... View more
09-10-2018
02:27 PM
Unfortunately this still breaks in the same fashion. 😞
It is a good thought on the LINE_BREAKER though.
... View more
09-07-2018
06:07 PM
Why is TIME_FORMAT failing for importing data?
I get the error:
Could not use strptime to parse timestamp from "INFO: Manager: list: Lis"
Raw log is repeating sections like:
Sep 06, 2018 12:00:56 AM org.apache.catalina.core.ApplicationContext log
INFO: Manager: list: Listing contexts for virtual host 'localhost'
Sep 06, 2018 12:01:56 AM org.apache.catalina.core.ApplicationContext log
INFO: Manager: list: Listing contexts for virtual host 'localhost'
Sep 06, 2018 12:02:56 AM org.apache.catalina.core.ApplicationContext log
INFO: Manager: list: Listing contexts for virtual host 'localhost'
I am using the following values in props.conf:
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=24
disabled=false
TIME_PREFIX=^
LINE_BREAKER=^\w{3} \d{2}, \d{4} \d{2}:\d{2}:\d{2}
TIME_FORMAT=%b %d, %Y %H:%M:%S %p
Splunk will not accept my timeformat that I have defined above... and I am not sure why.
... View more
03-14-2018
12:12 PM
2 Karma
If you are using Linux, this bash one-liner will give you a list of all the lookups on a search head in a shared bundle:
find /opt/splunk/var/run -maxdepth 1 -name '*.bundle' -print -exec tar -tvf {} \; | grep users | awk '{print $3,$6}' | sort -nr
In the case above, you may want to remove the "grep users" segment, I created it as it is to search for users that were creating files that were abnormally large.
... View more
02-14-2018
04:18 PM
If you got no results from:
|inputlookup MyView
or from:
|inputlookup MyView.csv
Then your lookup file isn't loaded correctly. See if you can find it in:
Settings > Lookups > Lookup Table Files
If you do - also notice what "app" the lookup is in. This is important. If you are in the wrong app when you try the lookup, it will fail.
... View more
12-28-2017
01:00 PM
Are you looking to only index events that have the unique identifier? If that is the case, then you probably want to do something like this:
https://answers.splunk.com/answers/477356/how-to-only-index-events-that-contain-specific-fie.html
If you are looking to index all the JSON files, and then trace events with the same ID, then you probably want to use the TRANSACTION command:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Transaction
Note: If you have a lot of events per ID, you may want to use STATS instead of TRANSACTION.
... View more
12-27-2017
02:32 PM
You probably want the solution found here:
https://answers.splunk.com/answers/145389/routing-data-to-specific-index-based-on-filename.html
... View more
Why do you feel you would get a benefit from a load balancer? By default, the forwarders switch indexers every 30 seconds. This happens when the forwarder detects and End of File.
Load Balancing like this is the key to making distributed search or clustering work.
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd
Now, you do want to do this for search heads, and syslog-ng data, but that is a different topic.
... View more
12-27-2017
10:40 AM
When you look at the "schedule" page under the report configuration page (the same one that you select all the emails you want the report to go to) There are some checkboxes down by "include". You can uncheck "Link to Report" and "Link to Results" and just leave "Attach PDF" checked.
... View more
12-27-2017
10:37 AM
It has been over 2 years since I last looked at CEF, and if my memory serves me correctly, I had to download one of the CEF applications off of Splunkbase, then modify the parsing slightly to conform with Arcsight. It did not take too much work to do.
GIven that you are dealing with key=value pairs, I would suggest you use a field extraction to get the details you want.
... View more
12-27-2017
10:34 AM
You always want to install the forwarder directly on the source system that is producing the logs - in this case it should be a Windows system running SCOM - so you will need to install some components of the application directly on the SCOM system itself. The forwarder will pick up the logs from SCOM, then forward them to your Linux environment.
So, in this case, I believe you need to install components of the SCOM application in two locations.
... View more
11-13-2017
09:44 AM
This is the answer we needed!
Surprised it is not linked directly from their main page...
... View more
04-11-2016
02:47 PM
The lookup file is intact, it isn't missing any fields.
If I call it like this:
| inputlookup Network_Hosts_List
It returns the .csv properly with no errors.
If I perform any search inside the customers app (except the above) on any index (even internal indexes) the errors pop up in the search. Even if I make sure to select an index that has no events of sourcetype=network:firewall, these errors still pop up.
... View more
04-11-2016
10:19 AM
1 Karma
One of my users has a lookup table that they have saved appropriately into their app.
It was running just fine. Now, after the weekend, when you search for anything inside the app, Splunk throws errors about the lookup file, even if you are not calling it.
For example, if you just search for:
index=main
You will get a whole host of errors from the indexers prior to the results that look like this:
[Indexer01] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer02] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer03] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer04] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer05] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer06] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer07] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer08] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer09] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer10] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer11] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer12] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
[Indexer13] Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'network:firewall' and lookup table 'Network_Hosts_List'.
And so on...........
Why is Splunk throwing errors on a Lookup table that isn't being referenced?
... View more
03-18-2016
02:14 PM
I strongly recommend you open a ticket on this issue as well.
The more customers that open tickets, the higher of a priority this becomes on the DEV side, and the more quickly you will get this issue addressed.
... View more
03-17-2016
03:39 PM
1 Karma
I opened a ticket, it seems that there is a bug in SA-LDAPsearch that is being addressed.
... View more
02-11-2016
10:35 AM
I am dealing with a large domain, and an LDAPsearch takes over 8 hours to complete - but it usually times out.
... View more
02-11-2016
09:55 AM
Actually, I thought that this wasn't bad.
... View more
02-09-2016
12:54 PM
I have a pretty inefficient search that I would like to improve - it has a lot of flaws. For example, I run the three searches below in order, one after the other. What I should be doing is pulling out a time value in the first search, and running them all concurrently, but the below is the closest I have been able to get to work.
The intent behind this search is to find people running bittorrent at the proxy, compare the natted IP with the DHCP logs to find the MAC address, then check with the authentication servers logs to see who had that IP during that time range.
Step 1)
index=proxy application=Bittorrent | top limit=20 srcip | table srcip | outputlookup bittorrent_list.csv
Step 2)
index=dhcp [|inputlookup bittorrent_list.csv | rename srcip as src_ip] | top limit=20 src_mac | table src_mac | outputlookup bittorrent_mac_from_dhcp_list.csv
Step 3)
index=authentication [|inputlookup bittorrent_mac_from_dhcp_list.csv ]| top limit=20 User_Name
... View more
02-03-2016
12:22 PM
There is a lot of useful detail in the index=wineventlog . I would like to be able to allow my front tier service desk access to dashboards that show things such as "user accounts locked out" or "print job failed".
However, I don't want them to have any access to the wineventlog index itself.
Is there a way of generating a report off of one index say, and moving the results to a separate index so that they don't gain access to the remainder of the information in the index?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-23-2020
02:50 PM
|
