Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About diavolo
diavolo
Path Finder
Member since:
08-28-2016
06-05-2020
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 4 |
| Member Since | 08-28-2016 |
Activity Feed
- Got Karma for TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder. 06-05-2020 12:49 AM
- Got Karma for Why is my dashboard reporting error "Node search is not allowed here"?. 06-05-2020 12:48 AM
- Got Karma for Why is my dashboard reporting error "Node search is not allowed here"?. 06-05-2020 12:48 AM
- Got Karma for Re: Why is my dashboard reporting error "Node search is not allowed here"?. 06-05-2020 12:48 AM
- Posted Re: TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder on Getting Data In. 03-08-2018 03:13 AM
- Posted TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder on Getting Data In. 03-08-2018 02:21 AM
- Tagged TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder on Getting Data In. 03-08-2018 02:21 AM
- Tagged TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder on Getting Data In. 03-08-2018 02:21 AM
- Posted Cna't Connect to HTTP Event Collector Endpoint with My Certificate on Security. 01-16-2018 07:32 PM
- Tagged Cna't Connect to HTTP Event Collector Endpoint with My Certificate on Security. 01-16-2018 07:32 PM
- Tagged Cna't Connect to HTTP Event Collector Endpoint with My Certificate on Security. 01-16-2018 07:32 PM
- Tagged Cna't Connect to HTTP Event Collector Endpoint with My Certificate on Security. 01-16-2018 07:32 PM
- Posted Re: Why is my field extraction not consistent across all events? on Splunk Search. 02-01-2017 09:12 PM
- Posted Re: Why is my field extraction not consistent across all events? on Splunk Search. 02-01-2017 08:16 PM
- Posted Re: Why is my field extraction not consistent across all events? on Splunk Search. 02-01-2017 07:02 PM
- Posted Re: Why is my field extraction not consistent across all events? on Splunk Search. 02-01-2017 10:10 AM
- Posted Re: Why is my field extraction not consistent across all events? on Splunk Search. 02-01-2017 08:49 AM
- Posted Why is my field extraction not consistent across all events? on Splunk Search. 02-01-2017 08:05 AM
- Tagged Why is my field extraction not consistent across all events? on Splunk Search. 02-01-2017 08:05 AM
- Tagged Why is my field extraction not consistent across all events? on Splunk Search. 02-01-2017 08:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
08-10-2019
04:20 PM
Really Late....
Is this still an issue for you?
It seems to be a networking issue for many others(outside of Splunk included) from researching this issue. It spans multiple different applications and 90% of similar issues seem to relay that it's a networking issue. The fact that you're able to connect and get inconsistent errors like this also indicates that it's likely networking issue.
Other questions would be is this the only UF affected?
... View more
10-18-2018
04:49 AM
I think i have seen this while testing our ssl config for HEC. I think your cert chain is incomplete.
You have to supply your certs and key in the following way:
http://docs.splunk.com/Documentation/Splunk/7.2.0/Security/HowtoprepareyoursignedcertificatesforSplunk
and if your key uses a password you can specify that in the [http] stanza with sslPassword
See also: https://answers.splunk.com/answers/462131/securing-http-event-collector.html#answer-692893
... View more
03-02-2017
11:56 AM
The problem is two-fold: either the event does not have what you think all of them does (non-conforming event data) OR your RegEx is slightly off and does not fully accommodate all variations of the events (insufficient RegEx). In either case, here is what you need to do to figure it out. Deploy the version that works best, let's say that you are using a field name of instance_id . Then run a search like this:
... NOT instance_id="*"
This will show you all events that do not have a field called instance_id . You adjust your RegEx or ignore that type of event (by putting an exclusion for it in your base search) and keep repeating this cycle until you have no events returned from that search.
... View more
01-23-2017
11:18 PM
Thank you! I didn't know concurrency command. Very useful!!
... View more
01-17-2017
11:56 PM
Thank you. It's exactly what I want.
... View more
11-21-2019
05:29 PM
Can you please expand on that? I am also having this issue, but it's not due to a misspelling, that I can see.
The error is on the following line:
<search index="windows" Account_Name="$Locked_Out_Account_Name$" EventCode="4624">
If I change the <search index= to <search ref= than it works fine. However, I want to perform a direct search here because I want to reference the previously created variable $Locked_Out_Account_Name$ . Perhaps there's a way to push the variable in a referenced report and search with it there?
Here's the full code:
<form refresh="60">
<label>Account PC (Test 11.21) Dashboard</label>
<description>Blah.</description>
<fieldset submitButton="false">
<input type="dropdown" token="Locked_Out_Account_Name" searchWhenChanged="true" depends="$justHideMe$">
<label>Locked_Out_Account_Name</label>
<search ref="Account PC (Test 11.21) Report">
<earliest>-1h</earliest>
<latest>now</latest>
</search>
<fieldForLabel>Locked_Out_Account_Name</fieldForLabel>
<fieldForValue>Locked_Out_Account_Name</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
</input>
</fieldset>
<row>
<panel>
<html>
<font size="5">
<body1>Last Refresh Time</body1>
<body2>$time$</body2>
<body3>$Locked_Out_Account_Name$</body3>
</font>
<style>
table thead tr th, td{
font-size:175% !important;
}
</style>
</html>
<table>
<title>Account PC (Test 11.21) Report</title>
<search ref="Account PC (Test 11.21) Report">
<done>
<eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
</done>
<earliest>-1h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
... View more
11-08-2016
07:16 PM
You're right. I created it in custom app with App permission but used the command at search app. Thank you.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
