Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lcrielaa
lcrielaa
Communicator
Member since:
08-25-2011
06-05-2020
Community Statistics
| Posts | 42 |
| Solutions | 4 |
| Karma Given | 7 |
| Karma Received | 13 |
| Member Since | 08-25-2011 |
Activity Feed
- Got Karma for Re: Known issue. 06-05-2020 12:48 AM
- Karma Re: ServiceNow add-on doesn't index everything for jcoates_splunk. 06-05-2020 12:47 AM
- Got Karma for Re: Conditional Rex Expression. 06-05-2020 12:47 AM
- Got Karma for Re: how to convert seconds to HH:MM format ?. 06-05-2020 12:47 AM
- Got Karma for Re: How to remove Splunk App for Enterprise Security custom threat feeds?. 06-05-2020 12:47 AM
- Got Karma for Re: How to remove Splunk App for Enterprise Security custom threat feeds?. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure Splunk to to run my python script every time Splunk starts or restarts?. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure Splunk to to run my python script every time Splunk starts or restarts?. 06-05-2020 12:47 AM
- Karma Re: not picking up timestamp for sowings. 06-05-2020 12:46 AM
- Karma Re: Does the Splunk for XenApp app need three different Indexes? for rturk. 06-05-2020 12:46 AM
- Karma Re: Can I configure my deployment server to send deployment related logs to another splunk for searching? for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Horizontal scaling using the load balancing with universal forwarder for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: duplicate event for Drainy. 06-05-2020 12:46 AM
- Karma Re: McAfee epo integration with Splunk for MuS. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk User is Created automatically when i done a splunk installation ??. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk User is Created automatically when i done a splunk installation ??. 06-05-2020 12:46 AM
- Got Karma for Re: OpenSSL Heartbleed bug. 06-05-2020 12:46 AM
- Got Karma for Re: OpenSSL Heartbleed bug. 06-05-2020 12:46 AM
- Got Karma for Re: how to take timestamp from this. 06-05-2020 12:46 AM
- Got Karma for Re: how to take timestamp from this. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
04-16-2018
02:00 AM
Splunk ES on SHC's is not supported on Windows but is supported on Linux.
http://docs.splunk.com/Documentation/ES/5.0.0/Install/DeploymentPlanning#Splunk_Enterprise_Security_and_search_head_clustering
... View more
07-18-2016
03:57 AM
Can't you simply disable the KVStore on the indexers via server.conf?
[kvstore]
disabled = true|false
* Set to true to disable the KV Store process on the current server. To
completely disable KV Store in a deployment with search head clustering or
search head pooling, you must also disable KV Store on each individual
server.
* Defaults to false.
... View more
06-10-2016
05:11 AM
It's hard to do without an actual sample and what it would look like but perhaps this would help?
sourcetype="bn22_epsin" earliest=-1h latest=now | dedup Cpk_Num | stats count by Cpk_Num | where count=0
... View more
03-15-2016
05:15 AM
1 Karma
According to the known issues list, this particular known issue relates to event routing to multiple targets. I'd recommend opening a case with Splunk Enterprise Support if you think you're being affected by this issue. If not, just post whatever your problem is and perhaps we can assist.
... View more
11-25-2015
01:57 AM
That did the trick for me.
... View more
11-05-2015
04:56 AM
By installing the Splunk app for *nix, and deploying the *nix TA to your Linux servers, you can have your servers report the output of the "df" command in Splunk. You can then do a search on your collected "df" data to find servers that have 85% or higher disk utilisation.
For this you would need:
A Splunk server (search head / indexer)
A Splunk Deployment server to push out the *nix TA (Doesn't need to be a separate server)
A Splunk universal forwarder installed on your 5000 Linux servers that is connected to your deployment server.
Do you have any of this in place yet? Secondly, are you sure Splunk is the best answer for your problem(s)? You don't have any performance metrics collection in place already?
... View more
10-09-2015
05:09 PM
The only thing I can find that would help in some way is the following from transforms.conf:
batch_index_query = <bool>
* For large file based lookups, this determines whether queries can be grouped to improve
search performance.
* Default is unspecified here, but defaults to true (at global level in limits.conf)
allow_caching = <bool>
* Allow output from lookup scripts to be cached
* Default is true
The first one only works for file-based lookups and since you're using an external script, it won't help you much and the second one doesn't do anything for new requests. You'll either have to implement the logic in the external lookup script itself or change your approach altogether.
How often do people's phone number change? Can you Request the whole list and use that as a file-based lookup in Splunk? Perhaps updating the full list once a day? Even with a million-line CSV file as a file-based lookup, Splunk will still enrich the data charmingly.
... View more
09-10-2015
12:58 AM
Use multikv to separate the data and then use the new values for your chart/timechart.
index=... sourcetype=... | multikv fields PollTime, "Server Name", QueueName, "Display Name", value | timechart avg(value) by "Server Name"
You might have to tweak the above query a bit but that should get you started.
... View more
09-10-2015
12:41 AM
You can't. See here for all the options you can do via the CLI:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/MonitorfilesanddirectoriesusingtheCLI
Adding a blacklist isn't one of them. You could probably do it with some regex/sed-magic. You could search for you particular monitoring stanza and add the blacklist line underneath it and then restart splunk. This should help: http://stackoverflow.com/questions/15559359/insert-line-after-first-match-using-sed
... View more
09-07-2015
04:18 AM
Which exactly what I'm saying.
Either use the Splunk start/restart script in /etc/init.d/ and hook in your python script there. This will run your script when you start/restart Splunk.
Or
Create a scripted input in Splunk and give it an interval of -1 so that it starts every time you start/restart Splunk. I recommend this option. See the documentation link I provided earlier.
... View more
09-07-2015
03:51 AM
not /opt/splunk/etc/init.d/ but /etc/init.d/ of the actual server.
... View more
09-07-2015
03:16 AM
2 Karma
If you're running Splunk on UNIX/Linux, you could edit the startup scripts in /etc/init.d/ to include your script in the start/restart section. Just be careful that if you ever do a "splunk enable boot-start", your changes will get overwritten.
You can also create a scripted input and set the interval to -1 as per the documentation : http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Setupcustominputs
For one-shot data streams, enter -1. Setting interval to -1 will cause the script to run each time the splunk daemon restarts.
... View more
09-03-2015
07:44 AM
2 Karma
It's been moved into the Threat intelligence KVStore. Here's some help on how to clean it : http://answers.splunk.com/answers/237859/can-i-delete-all-data-from-a-kv-store-at-once.html
... View more
09-03-2015
05:22 AM
1 Karma
http://answers.splunk.com/answers/439/how-to-convert-second-to-hh-mm-ss-format-in-the-exported-search-result.html
Bit of googling found that.
... View more
07-26-2015
11:43 PM
Easiest would be
| rex field=_raw ".*duration\s\[(?<duration>.*?)\]"
This will capture everything in between the [] after the word "duration". So in your examples, it would be "1.1s", "999ms", and "814ms". Is that what you're looking for?
... View more
07-15-2015
08:33 AM
| rex "Employers Name=(?<employersname>[^,]*)" | rex "Providers Name=(?<providername>[^,]*)" | eval contactname=coalesce(employersname,providername) | table contactname
This should extract both the Employer's Name (if it exists) and the Provider's Name (if it exists) and fill the field "contactname" with the employers name, unless that's empty, then it'll put the providername in there.
I see from your logging that it's all key/value pairs, did you try using the | extract pairdelim=",", kvdelim="=" keyword to automatically extract these fields? Splunk will extract the Employer's Name and Provider's Name if they exist and that should solve all your problems.
... View more
07-15-2015
06:03 AM
do you have some sample logging that you could post here (just a few lines)?
... View more
07-15-2015
05:17 AM
1 Karma
There's the eval command called "coalesce" which merges two fields together into a new field. Imagine the following; I have 2 fields that contains values, these fields are called "clientip" and "ipaddress", but sometimes "clientip" is empty and then I want to use the value from "ipaddress" instead. What I do is I coalesce these two fields together into a new field called "IpAddr".
| eval IpAddr=coalesce(clientip, ipaddress)
The field "IpAddr" will be filled with the value from "clientip", unless "clientip" is empty, then it'll pick the value from "ipaddress". You can add as many fields to coalesce as you want.
... View more
06-03-2015
01:38 AM
| rex field=_raw .*cs1=(?[^\s]+)\scs1Lable=(?[^"]+)
There's a slightly better version of the regex. This one doesn't capture the closing "-symbol in your label field. As for your second question, have a look at http://answers.splunk.com/answers/78340/is-it-possible-to-set-field-name-and-value-with-rex-similar-to-1-2-in-transforms-conf.html
... View more
06-02-2015
11:38 PM
| rex field=_raw "####<[^>]+>\s<(?[^>]+)>\s<[^>]+>\s<(?[^>]+)>\s<(?[^>]+)>\s(?.*)"
That'll do the extracting you want but like the other said, you'll need to fix your linebreaking and timestamping via your props.conf.
... View more
04-29-2015
05:06 AM
My problem has been solved with 2.6.0. Thanks for the work! 🙂
... View more
04-03-2015
12:41 AM
I have case 229460 open for this problem.
... View more
03-11-2015
01:57 PM
The logging shows that it successfully returned 1059 for my table in one go (since it's supposed to pick 'em up per 5000) and subsequent runs show 0 records returned.
There's 2 python tracebacks in the logging: one that relates to the .old files that are created in the modinputs directory since they don't exist yet on the first run (or after you delete them if you want to force a full reread) and another for complaining about the update credentials subroutine, can't really pinpoint that. Both of them seem unrelated since the data retrieval works correctly (if not for the few missing records).
I'll open a support case for this and provide the support guys with some diags and such.
... View more
03-11-2015
12:44 AM
Hi,
I've installed the ServiceNow add-on v2.5.0 on a Search Head that is part of a distributed setup with 6 Indexers. I've configured the add-on with a service account to let it communicate with our ServiceNow installation and pull in incident, change and CMDB information. Normally, this search head uses a proxy and SSO to connect to Service Now but I've had that disabled to prevent issues from arising due to network complexity. I haven't updated the ServiceNow installation with the provided Dublin/Calgary/Eureka XML file since I'm only looking for pulling data in, not sending incidents/tickets/events back.
One of the database table names that I want to index contains 1059 rows so I've configured this database table name as a modular input. I configured collection at a 60 second interval, set "since when" to 2014-01-01 00:00:00 and I enabled the modular input. I can see in the logging that the URL it retrieves from (https://mycustomer.service-now.com/mytable.do?JSONv2&sysparm_query=sys_updated_on%3E=2014-01-01+00:00:00^ORDERBYsys_updated_on&sysparm_record_count=5000) picks up on 1059, but a seach in Splunk gives me only 1013 events. I've verified that if I manually curl the above URL from the search head that I do indeed get everything.
This is one of the events that were part of the JSON datastream but wasn't picked up by Splunk. (data is partially anonymized)
{"u_config_admin_group":"a738fecc1c56a1003615a9c3415190d0","checked_in":"","po_number":"","correlation_id":"","supported_by":"","u_responsible_vendor":"31ef66841c56a1003615a9c34151904e","u_layer_group":"compute","u_supply_offering_count":"2","first_discovered":"","owned_by":"","gl_account":"","managed_by":"","asset":"","u_standard":"true","maintenance_schedule":"","u_warranty_start":"","u_business_chain_count":"0","category":"","delivery_date":"","install_status":"7","u_status_updated":"2015-02-27 10:14:56","u_row_position":"","dns_domain":"","u_audit_comments":"","u_repair_contract_id":"02c798bc1c5ea1003615a9c341519003","u_cabinet_position":"","change_control":"","checked_out":"","purchase_date":"","order_date":"","u_maintenance_vendor":"31ef66841c56a1003615a9c34151904e","__status":"success","skip_sync":"false","lease_id":"","vendor":"","sys_id":"e94538bc1c9ea1003615a9c3415190a0","u_cabinet":"","u_active":"true","u_function_category":"myserverA","u_originating_vendor":"","sys_created_by":"john.smith","u_row_number":"","subcategory":"","u_support_offering_count":"5","u_audit_executed_datetime":"2012-12-04 16:56:17","start_date":"","comments":"","unverified":"false","location":"","u_cname":"","justification":"","u_rack_position_bottom":"","sys_domain":"global","u_configuration_item_count":"0","sys_mod_count":"3","cost_cc":"USD","u_tech_supported_by":"","u_service_offering_count":"0","monitor":"false","sys_updated_on":"2015-02-27 10:14:56","warranty_expiration":"","invoice_number":"","u_rack_position_top":"","cost":"","fqdn":"","u_system_category":"production","ip_address":"","u_business_service_count":"0","last_discovered":"","model_id":"","manufacturer":"","company":"","due":"","u_audit_ok_datetime":"2012-12-04 16:56:17","asset_tag":"LH200551","discovery_source":"","u_audit_status":"Executed OK","can_print":"false","u_standard_function":"","department":"","support_group":"","u_platform":"linux","sys_created_on":"2014-07-31 09:16:23","u_system_environment":"single-server","cost_center":"","short_description":"","sys_updated_by":"jsmith","name":"serverA","due_in":"","install_date":"2012-12-03 23:00:00","u_replaced_by":"","u_os_version":"rehel6-64 bit","assigned":"","u_os":"","u_audit_status_by":"471677c81c1aa1003615a9c3415190a9","serial_number":"","mac_address":"","assigned_to":"","model_number":"","u_audit_needed_datetime":"","schedule":"","sys_class_name":"u_cmdb_ci_logical_host","u_relation_log":"","attributes":"","fault_count":"0","operational_status":"1"},
Any idea on what's causing this and how to troubleshoot? DEBUG logging doesn't help much here.
... View more
01-09-2015
04:54 AM
Could you give a few examples of log files (pastebin?) and what exactly it is you'd like to have extracted?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
