About lagnone_splunk

lagnone_splunk · ‎03-11-2020

You need to submit a ticket with the support team, thanks!

lagnone_splunk · ‎09-21-2016

You can use the REST API, HEC, and SDKs if you have a paid subscription to Splunk Cloud. Self-Service Splunk Cloud deployments: Use your Splunk Cloud URL prefixed with input- for REST API and HEC access. Example: https://prd-p-rb4p3d3s4vxb.cloud.splunk.com:8088 To access the REST API, use port 8089. To access HEC, use port 8088. http://docs.splunk.com/Documentation/SplunkCloud/SplunkCloud/FAQs/FAQs?ac=partner_smt

lagnone_splunk · ‎07-20-2016

Never fear, Splunk Cloud customer! If you would like to use a deployment server to manage your on-prem forwarders, you can! Please file a case with Splunk support and request a deployment server key.

lagnone_splunk · ‎07-20-2016

I have many forwarders sending data to Splunk Cloud. I would love to be able to manage them with a deployment server, but that feature is only activated with an enterprise key. What are my options?

lagnone_splunk · ‎07-20-2016

Hybrid search is the use of an on-prem search head to look at data stored in Splunk Cloud. It can be used for a variety of purposes, the most common are: *Using custom scripts that are not approved for Splunk cloud *Using custom inputs not approved for Splunk Cloud. *Using custom authentication options (2factor, unsupported SSO providers) *Using apps that are not approved for Splunk Cloud (DB Connect, Cisco Security Suite, etc) In order to set up hybrid search, you must meet the following requirements You are a Splunk Cloud stackmaker customer. Customer of single instance (rainmaker) do not have this option. *Your on-prem search head is *at least the same version as your Splunk Cloud instance To get started, please open a support ticket. In order to speed up the process, please provide the following information *The public IP address of your on-prem search head(s) *The Splunk version of your on-prem search head(s). In return, Support will provide you with a set of configurations to apply to your search head.

lagnone_splunk · ‎07-20-2016

What is hybrid search? What is it used for? How do I set it up?

lagnone_splunk · ‎07-20-2016

The Splunk REST API is available for use by Splunk Cloud customer upon request. The process of gaining access to the API depends on the type of Cloud deployment you have For self-service (rainmaker deployments), access to the API is gained through the use of this URL https://input-[your-stack-name]:8089 Please note the use of "input-" before your stack ID. A full stack name includes ".cloud.splunk.com" For stackmaker deployments, please open a Support ticket. To speed up the process, please provide the following information when opening a ticket. The public IP address(es) that you wish to gain access to the API from. Access to the API is blocked by default, and is managed through whitelisting. If you have multiple search heads (for premium apps), please designate which one you are talking about Multiple IPs can be whitelisted, as well as ranges

lagnone_splunk · ‎07-20-2016

I have a single-instance (rainmaker) deployment, how do I gain access? I have a large (stackmaker) deployment, how do I gain access?

lagnone_splunk · ‎07-20-2016

The HTTP Event Collector (introduce in Splunk 6.3) is available for use by Splunk Cloud customers upon request. For managed service (stackmaker) deployments, please open a ticket with Support. Attempting to configure the event collector through the GUI will not work. To speed up the process of getting your collector set up, please provide the following information in your support ticket: 1. Name of the data input 2. Name of the target index 3. Source type to be applied to the data 4. Amount of data per day that you expect to receive, and any details about your intended usage that will help Splunk Support estimate the number of HTTP connections per hour In return you will a URL to begin sending data to, along with a token for authentication. Tokens are assigned for each individual HTTP input and you can request multiple inputs. To test functionality, please follow this guide: http://dev.splunk.com/view/event-collector/SP-CAAAE7F

lagnone_splunk · ‎07-20-2016

How do I configure the HEC with the GUI? How do I generate a token? How do I test that it's working?

lagnone_splunk · ‎11-12-2015

You should not need these on Java 8

lagnone_splunk · ‎11-12-2015

Assuming you're using Oracle's JRE/JDK 7, you will find that TLSv1.2 support is not enabled by default. To add TLS functionality, simply add any combination of this flag into the JVM command line options on the DBX setup page: -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2

lagnone_splunk · ‎09-30-2015

This is probably due to having no localhost setup for 127.0.0.1 in hosts file. Cat your /etc/hosts file and check that localhost and localhost.localdomain are next to 127.0.0.1 Example 127.0.0.1 lagnone-splunk.splunk.com lagnone-splunk ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 10.10.10.10 lagnone-splunk.splunk.com lagnone-splunk 127.0.0.1 localhost localhost.localdomain

lagnone_splunk · ‎09-30-2015

This also applies to DBX v2 and the RPC service The GUI tells me "the java bridge server is not running" and also "RPC status: down", but I can use both of the apps and I see the processes running! What is going on?

lagnone_splunk · ‎09-24-2015

Deepthi, Are you sure that your monitor stanza is picking up the new files? Is it only monitoring a folder? Check the splunkd.log for details on what tailing processor is doing. For more details 1) Go to the splunk forwarder installation and edit the $SPLUNK_HOME/etc/log.cfg 2) Find these components and change them to DEBUG TailingProcessor. BatchReader, WatchedFile 3) Restart the forwarder 4) Look for which files are being read You can also hit the REST endpoint at port 8089 and look at file input status

lagnone_splunk · ‎09-23-2015

Hi dmr195, SPL-84276 and the original SPL-81481 do not address the root cause of a | delete search changing, they only provide a means by which to identify why a search is in hung state. The search.log of the search with the delete command will print that the search is blocked because of "xxxxxx-xxxxx.tsidx.lock" file. This can be used by support/the user to identify a stale lock file and delete it. From what I can tell, the potential chance of this issue occurring is not strictly limited to searches with | delete.

lagnone_splunk · ‎07-17-2015

One workaround that has worked for some customers is to manually create a SPLUNK_HOME environmental variable $ export SPLUNK_HOME=/opt/splunk verify $ env If edited in /etc/profiles, this change can persist across logins

lagnone_splunk · ‎07-17-2015

I am seeing this message when trying to use the OPSEC LEA app for Splunk - ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity CMA-008" Could not look up HOME variable. Auth tokens cannot be cached. How might I workaround this?

lagnone_splunk · ‎05-19-2015

I just installed DBX v2 and noticed a new file called rsCache.data is growing in size. 1) What are the normal size ranges for this file? 2) Is there a configure setting to keep this file at a certain file size? 3) Does a continuous growth in this file means I am pulling more DBX v2 data than it can index? 4) And if I need to remove this file, is it safe to: a) stop Splunk b) remove file c) start Splunk

lagnone_splunk · ‎04-23-2015

It's a known issue for DBX 2.0 DBX - 1694: SQL server connection does not work in windows authentication mode Try this as a workaround Note - This only works with the JTDS driver, not the generic MSSQL driver 1. Add the below entries to db_connections.conf(for the particular connection) OR db_connection_types.conf(for the connection type) jdbcUrlFormat = jdbc:jtds:sqlserver://<host>:<port>/<database>;useCursors=true;domain=<domain_name>;useNTLMv2=true domain_name = MSSQLSERVER12 2. Change the Username in the identity to have only the username(bamboo) instead of domain-name\username(MSSQLSERVER12\bamboo) 3. Once the above changes are made, validate all flows and make sure they work.

lagnone_splunk · ‎12-05-2014

My table has a column with JSON-formatted data that looks like this: {"Message" : {"Field1": 1000, "Field2": 1000, "Field3": 1000, "Field4": 500, "Field5": 200, "Field6": 500, "Field7": 300, "Field8": 500}} But in Splunk, my raw event is coming in like this: {\"Message\" : {\"Field1\": 1000, \"Field2\": 1000, \"Field3\": 1000, \"Field4\": 500, \"Field5\": 200, \"Field6\": 500, \"Field7\": 300, \"Field8\": 500}} Why is this happening and what can I do to correct it?

lagnone_splunk · ‎10-30-2014

Also, check for a site-wide Group Policy Object that manages IE. It can be set to turn on compatibility mode for all intranet sites. This will hide the setting from the GUI and make it more difficult to diagnose.

lagnone_splunk · ‎10-27-2014

I'm trying to create a dashboard that utilizes PostProcessing and the SideView add on. What this dashboard is supposed to produce is 6 radialGauge panels in a single row that are receiving data from a single query. When I run the below Source code and then go to view the dashboard, I receive this error message "Unable to load all the panels: a dashboard can have maximum of '50' rows," but I am unsure why when I only have 6 Panels in 1 row. Any suggestions? Source Code: <view autoCancelInterval="90" isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html"> <label>PostProcess - static config</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="appHeader"/> <module name="SideviewUtils" layoutPanel="appHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="maxSize">2</param> <param name="clearOnJobDispatch">False</param> </module> <module name="HTML" layoutPanel="viewHeader"> <param name="html"> <![CDATA[ <h1>Ticketing Parking Capacity Test</h1> ]]> </param> </module>  <module name="Search" layoutPanel="panel_row2_col1" autoRun="True"> <param name="search"> index=* (my search goes here)</param> <param name="earliest">-7d</param> <param name="latest">now</param> <module name="JobProgressIndicator"/> <module name="HTML"> <param name="html"> <![CDATA[ <h3>Lot Blue 1</h3> ]]> </param> </module> <module name="PostProcess"> <param name="search"> search Lot="BLUE 1"|fields "Percentage Full"</param> <module name="HiddenChartFormatter"> <param name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</param> <param name="charting.axisLabelsX.majorLabelStyle.rotation">0</param> <param name="charting.axisTitleX.visibility">visible</param> <param name="charting.axisTitleY.visibility">visible</param> <param name="charting.axisTitleY2.visibility">visible</param> <param name="charting.axisX.scale">linear</param> <param name="charting.axisY.scale">linear</param> <param name="charting.axisY2.enabled">false</param> <param name="charting.axisY2.scale">inherit</param> <param name="charting.chart">radialGauge</param> <param name="charting.chart.nullValueMode">gaps</param> <param name="charting.chart.sliceCollapsingThreshold">0.01</param> <param name="charting.chart.stackMode">default</param> <param name="charting.chart.style">shiny</param> <param name="charting.drilldown">all</param> <param name="charting.layout.splitSeries">0</param> <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param> <param name="charting.legend.placement">right</param> <module name="FlashChart"> </module> </module> </module> <module name="HTML" layoutPanel="panel_row2_col2"> <module name="JobProgressIndicator"/> <module name="HTML"> <param name="html"> <![CDATA[ <h3>Lot Blue 2</h3> ]]> </param> </module> <module name="PostProcess"> <param name="search"> search Lot="BLUE 2"|fields "Percentage Full"</param> <module name="HiddenChartFormatter"> <param name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</param> <param name="charting.axisLabelsX.majorLabelStyle.rotation">0</param> <param name="charting.axisTitleX.visibility">visible</param> <param name="charting.axisTitleY.visibility">visible</param> <param name="charting.axisTitleY2.visibility">visible</param> <param name="charting.axisX.scale">linear</param> <param name="charting.axisY.scale">linear</param> <param name="charting.axisY2.enabled">false</param> <param name="charting.axisY2.scale">inherit</param> <param name="charting.chart">radialGauge</param> <param name="charting.chart.nullValueMode">gaps</param> <param name="charting.chart.sliceCollapsingThreshold">0.01</param> <param name="charting.chart.stackMode">default</param> <param name="charting.chart.style">shiny</param> <param name="charting.drilldown">all</param> <param name="charting.layout.splitSeries">0</param> <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param> <param name="charting.legend.placement">right</param> <module name="FlashChart"> </module> </module> </module> </module> <module name="HTML" layoutPanel="panel_row2_col3"> <module name="JobProgressIndicator"/> <module name="HTML"> <param name="html"> <![CDATA[ <h3>Lot Blue 3</h3> ]]> </param> </module> <module name="PostProcess"> <param name="search"> search Lot="BLUE 3"|fields "Percentage Full"</param> <module name="HiddenChartFormatter"> <param name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</param> <param name="charting.axisLabelsX.majorLabelStyle.rotation">0</param> <param name="charting.axisTitleX.visibility">visible</param> <param name="charting.axisTitleY.visibility">visible</param> <param name="charting.axisTitleY2.visibility">visible</param> <param name="charting.axisX.scale">linear</param> <param name="charting.axisY.scale">linear</param> <param name="charting.axisY2.enabled">false</param> <param name="charting.axisY2.scale">inherit</param> <param name="charting.chart">radialGauge</param> <param name="charting.chart.nullValueMode">gaps</param> <param name="charting.chart.sliceCollapsingThreshold">0.01</param> <param name="charting.chart.stackMode">default</param> <param name="charting.chart.style">shiny</param> <param name="charting.drilldown">all</param> <param name="charting.layout.splitSeries">0</param> <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param> <param name="charting.legend.placement">right</param> <module name="FlashChart"> </module> </module> </module> </module> <module name="HTML" layoutPanel="panel_row2_col4"> <module name="JobProgressIndicator"/> <module name="HTML"> <param name="html"> <![CDATA[ <h3>Lot GREEN 1</h3> ]]> </param> </module> <module name="PostProcess"> <param name="search"> search Lot="GREEN 1"|fields "Percentage Full"</param> <module name="HiddenChartFormatter"> <param name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</param> <param name="charting.axisLabelsX.majorLabelStyle.rotation">0</param> <param name="charting.axisTitleX.visibility">visible</param> <param name="charting.axisTitleY.visibility">visible</param> <param name="charting.axisTitleY2.visibility">visible</param> <param name="charting.axisX.scale">linear</param> <param name="charting.axisY.scale">linear</param> <param name="charting.axisY2.enabled">false</param> <param name="charting.axisY2.scale">inherit</param> <param name="charting.chart">radialGauge</param> <param name="charting.chart.nullValueMode">gaps</param> <param name="charting.chart.sliceCollapsingThreshold">0.01</param> <param name="charting.chart.stackMode">default</param> <param name="charting.chart.style">shiny</param> <param name="charting.drilldown">all</param> <param name="charting.layout.splitSeries">0</param> <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param> <param name="charting.legend.placement">right</param> <module name="FlashChart"> </module> </module> </module> </module> <module name="HTML" layoutPanel="panel_row2_col5"> <module name="JobProgressIndicator"/> <module name="HTML"> <param name="html"> <![CDATA[ <h3>Lot GREEN 2</h3> ]]> </param> </module> <module name="PostProcess"> <param name="search"> search Lot="GREEN 2"|fields "Percentage Full"</param> <module name="HiddenChartFormatter"> <param name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</param> <param name="charting.axisLabelsX.majorLabelStyle.rotation">0</param> <param name="charting.axisTitleX.visibility">visible</param> <param name="charting.axisTitleY.visibility">visible</param> <param name="charting.axisTitleY2.visibility">visible</param> <param name="charting.axisX.scale">linear</param> <param name="charting.axisY.scale">linear</param> <param name="charting.axisY2.enabled">false</param> <param name="charting.axisY2.scale">inherit</param> <param name="charting.chart">radialGauge</param> <param name="charting.chart.nullValueMode">gaps</param> <param name="charting.chart.sliceCollapsingThreshold">0.01</param> <param name="charting.chart.stackMode">default</param> <param name="charting.chart.style">shiny</param> <param name="charting.drilldown">all</param> <param name="charting.layout.splitSeries">0</param> <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param> <param name="charting.legend.placement">right</param> <module name="FlashChart"> </module> </module> </module> </module> <module name="HTML" layoutPanel="panel_row2_col6"> <module name="JobProgressIndicator"/> <module name="HTML"> <param name="html"> <![CDATA[ <h3>Lot GREEN 3</h3> ]]> </param> </module> <module name="PostProcess"> <param name="search"> search Lot="GREEN 3"|fields "Percentage Full"</param> <module name="HiddenChartFormatter"> <param name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</param> <param name="charting.axisLabelsX.majorLabelStyle.rotation">0</param> <param name="charting.axisTitleX.visibility">visible</param> <param name="charting.axisTitleY.visibility">visible</param> <param name="charting.axisTitleY2.visibility">visible</param> <param name="charting.axisX.scale">linear</param> <param name="charting.axisY.scale">linear</param> <param name="charting.axisY2.enabled">false</param> <param name="charting.axisY2.scale">inherit</param> <param name="charting.chart">radialGauge</param> <param name="charting.chart.nullValueMode">gaps</param> <param name="charting.chart.sliceCollapsingThreshold">0.01</param> <param name="charting.chart.stackMode">default</param> <param name="charting.chart.style">shiny</param> <param name="charting.drilldown">all</param> <param name="charting.layout.splitSeries">0</param> <param name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</param> <param name="charting.legend.placement">right</param> <module name="FlashChart"> </module> </module> </module> </module> </module> </view>

lagnone_splunk · ‎10-03-2014

Receiving the follow error when trying to install JMX app We get the following error message in our splunkd.log. What troubleshooting steps should I take to diagnose the problem? 0-03-2014 17:10:44.091 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://jmx : No such attribute: value 10-03-2014 17:10:44.091 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://jmx : No such attribute: value 10-03-2014 17:10:44.092 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://jmx : No such attribute: max 10-03-2014 17:10:44.092 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://jmx : No such attribute: committed 10-03-2014 17:10:44.096 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://jmx : No such attribute: value 10-03-2014 17:10:44.097 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://jmx : No such attribute: init 10-03-2014 17:10:44.100 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://jmx : No such attribute: value 10-03-2014 17:10:44.101 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jmx_ta/bin/jmx.py" Error executing JMX stanza jmx://jmx : No such attribute: committed

lagnone_splunk · ‎09-08-2014

Looking for assistance in crafting a scheduled search that sends a notification when I see a specific syslog message AND the absence of a specific second message in a given time period (say 5 minutes). Example: 2014-05-10 11:30:00 NOTICE System restarted bla bla bla bla (This gets logged) 2014-05-10 11:30:15 INFO This is another log 2014-05-10 11:30:40 INFO This is a another log 2014-05-10 11:31:00 INFO All good dude ( I want to get notified when I don't get this)

Posts	25
Solutions	9
Karma Given	71
Karma Received	64
Member Since	‎06-09-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

I am a Splunk Cloud customer. How can I manage my ...

I am a Splunk Cloud customer. What is hybrid searc...

I am a Splunk Cloud customer. I would like access ...

I am a Splunk Cloud customer. I want to use the HT...

Splunk DB Connect: The GUI says "the java bridge s...

OPSEC LEA - Cannot look up HOME variable

Just installed DBX v2, what is rsCache.data used f...

Why does DBX prepend an escape character to double...

How can I create a dashboard with six radial gauge...

Install help with JMX - Java VMs

Re: I am a Splunk Cloud customer. I would like acc...

Re: Splunk SDK can't connect to Splunk Cloud

Re: I am a Splunk Cloud customer. How can I manage...

I am a Splunk Cloud customer. How can I manage my ...

Re: I am a Splunk Cloud customer. What is hybrid s...

I am a Splunk Cloud customer. What is hybrid searc...

Re: I am a Splunk Cloud customer. I would like acc...

I am a Splunk Cloud customer. I would like access ...

Re: I am a Splunk Cloud customer. I want to use th...

I am a Splunk Cloud customer. I want to use the HT...

Re: How to configure Splunk DB Connect 1 to suppor...

Re: How to configure Splunk DB Connect 1 to suppor...

Re: Splunk DB Connect: The GUI says "the java brid...

Splunk DB Connect: The GUI says "the java bridge s...

Re: Issue with conitnously monitoring a folder

Re: Is it expected that the delete command will oc...

Re: OPSEC LEA - Cannot look up HOME variable

OPSEC LEA - Cannot look up HOME variable

Just installed DBX v2, what is rsCache.data used f...

Re: How to connect Splunk DB Connect 2.x to MS SQL...

Why does DBX prepend an escape character to double...

Re: Browser Unsupported on IE after upgrade to 6.2

How can I create a dashboard with six radial gauge...

Install help with JMX - Java VMs

How to create an alert triggered by the presence o...

Join the Conversation