Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About paulbannister
paulbannister
Communicator
Member since:
09-30-2016
03-30-2021
Community Statistics
| Posts | 76 |
| Solutions | 8 |
| Karma Given | 22 |
| Karma Received | 15 |
| Member Since | 09-30-2016 |
Activity Feed
- Posted Re: Crowdstrike Stream Stops Woking on Getting Data In. 03-30-2021 09:50 AM
- Posted Re: Syndication Input (RSS/ATOM/RDF) Add-On on All Apps and Add-ons. 03-17-2021 03:32 AM
- Posted Crowdstrike Stream Stops Woking on Getting Data In. 03-17-2021 03:31 AM
- Posted Re: Configuring Splunk TA for microsoft teams on All Apps and Add-ons. 02-10-2021 05:20 AM
- Posted Re: Syndication Input (RSS/ATOM/RDF) Add-On on All Apps and Add-ons. 01-18-2021 07:41 AM
- Posted Re: Dropped events with Splunk Add-on for ServiceNow on Getting Data In. 01-18-2021 03:57 AM
- Posted Syndication Input (RSS/ATOM/RDF) Add-On on All Apps and Add-ons. 01-18-2021 03:54 AM
- Tagged Syndication Input (RSS/ATOM/RDF) Add-On on All Apps and Add-ons. 01-18-2021 03:54 AM
- Tagged Syndication Input (RSS/ATOM/RDF) Add-On on All Apps and Add-ons. 01-18-2021 03:54 AM
- Posted Re: Microsoft Teams Add-on for Splunk on a Cloud IDM on All Apps and Add-ons. 11-25-2020 12:39 AM
- Posted Re: Dropped events with Splunk Add-on for ServiceNow on Getting Data In. 11-24-2020 07:40 AM
- Posted Microsoft Teams Add-on for Splunk on a Cloud IDM on All Apps and Add-ons. 11-24-2020 07:37 AM
- Tagged Microsoft Teams Add-on for Splunk on a Cloud IDM on All Apps and Add-ons. 11-24-2020 07:37 AM
- Tagged Microsoft Teams Add-on for Splunk on a Cloud IDM on All Apps and Add-ons. 11-24-2020 07:37 AM
- Tagged Microsoft Teams Add-on for Splunk on a Cloud IDM on All Apps and Add-ons. 11-24-2020 07:37 AM
- Tagged Microsoft Teams Add-on for Splunk on a Cloud IDM on All Apps and Add-ons. 11-24-2020 07:37 AM
- Posted Re: Hi team, i need to extract the locale field in BOLD , can you help me with it on Splunk Search. 11-17-2020 07:58 AM
- Posted Re: Hi team, i need to extract the locale field in BOLD , can you help me with it on Splunk Search. 11-12-2020 06:10 AM
- Posted Dropped events with Splunk Add-on for ServiceNow on Getting Data In. 11-12-2020 03:12 AM
- Tagged Dropped events with Splunk Add-on for ServiceNow on Getting Data In. 11-12-2020 03:12 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-30-2021
09:50 AM
We did open a case with them and their initial response was for us to check our network\firewalls... but nothing obvious was spotted and we're still waiting on further advise. In the meantime we've seen that the TA is now cloud friendly so we're looking to migrate it from our on-site HF to our Cloud IDM which might fix it for us hopefully... but there's still definitely an issue to be resolved
... View more
03-17-2021
03:32 AM
No official resolution as far as I can see, some of our feeds were happy once they were deleted and recreated fresh but not all got fixed in this way, thankfully those ones weren't crucial feeds
... View more
03-17-2021
03:31 AM
I've noticed this too, every now and then the data feed just stops with no real errors or indication, a quick "disable & re-enable" of the input seems to fix it but would like to know what the issue is and if it
... View more
02-10-2021
05:20 AM
I find myself in the exact same situation at the moment with our setup, we're doing ours for Splunk Cloud via an IDM. I don't suppose you managed to find a resolution to this?
... View more
01-18-2021
07:41 AM
Hi Rich, Latest available version of the App has been installed and is allegedly compatible with 8.1, we've just been through all the readiness and updates for our environment and nothing came up flagged for the app Many Thanks Paul
... View more
01-18-2021
03:57 AM
Just as an FYI for anyone with the same issue, the latest version of the TA has been released and contains the fix for the issue.
... View more
01-18-2021
03:54 AM
Since updating to 8.1.1 on our Heavy Forwarder we've been seeing the below error message within the internal logs of the add-on, has anyone else experienced this and aware of a fix? Traceback ( most recent call last ) : File " /opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py ", line 1095 , in execute self.do_run ( in_stream , log_exception_and_continue=True ) File " /opt/splunk/etc/apps/syndication/bin/modular_input.zip/modular_input/modular_input_base_class.py ", line 976 , in do_run self.run ( stanza , cleaned_params , input_config ) File " /opt/splunk/etc/apps/syndication/bin/syndication.py ", line 383 , in run if last_entry_date_retrieved is not None and last_entry_date_retrieved > last_entry_date: TypeError: '>' not supported between instances of ' time.struct_time ' and ' NoneType' @LukeMurphey
... View more
- Tags:
- rss
- Syndication Input
Labels
11-25-2020
12:39 AM
Hi @thambisetty I've had it installed on our IDM already and Splunk Support have stated there is no reason it shouldn't work so we have been looking to configure with no luck so far However I've got a feeling that the issue may lie on our Teams admin side trying to configure the credentials, tokens and certs correctly for "public" access, just trying to ascertain if anyone had any success so far with this setup and what pitfalls were encountered
... View more
11-24-2020
07:40 AM
Just as an FYI for anyone with the same issue, this has now been logged as a bug and the developers are currently working on a fix\workaround: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Releasenotes 2020-11-03 ADDON-30681 Splunk Add-on for ServiceNow is not ingesting updated records intermittently.
... View more
11-24-2020
07:37 AM
Hi All, We have an IDM in our cloud environment and we would like to ingest data & logs from Teams with the Add-On installed there, has anyone had any success doing this or is the only way to utilise a Heavy Forwarder?
... View more
Labels
- Labels:
-
configuration
11-17-2020
07:58 AM
Hi There, \/(?P<locale>[^\/]+)\/klarna Or within the Splunk search itself: |rex field= ##INSERT RELEVANT FIELDNAME## "\/(?P<locale>[^\/]+)\/klarna"
... View more
11-12-2020
06:10 AM
Hi There, If you mean via REGEX then try the following: \.com\/(?P<locale>[^\/]+)\/ Or within the Splunk search itself: |rex field=_raw "\.com\/(?P<locale>[^\/]+)\/" EDIT: Slightly improved regex to incorporate address such as ".co.uk": ((\.\w{2,3}\.\w{2,3})|\.\w{2,3})\/(?P<locale>[^\/]+)\/ or |rex field=_raw "((\.\w{2,3}\.\w{2,3})|\.\w{2,3})\/(?P<locale>[^\/]+)\/"
... View more
11-12-2020
03:12 AM
Hi All, We have recently updated our "Splunk Add-on for ServiceNow" to the latest available (6.2.0) from a 4.# release on our Cloud IDM and have been experiencing dropped events ever since. Particularly with our high traffic tables (sc_tasks, incident) which are frequently updated, we've noticed that the TA will pick up the initial entry for these when created in SNOW but will miss any subsequent updates (i.e. ticket will get closed in SNOW but this will not get reflected/updated in the data in Splunk), there was no issue before so we may need to downgrade the TA if necessary We currently have cases open with both ServiceNow and Splunk but was wondering if anyone else had experienced similar? Our instance is all cloud (Splunk Cloud, ServiceNow) and as I said was functioning before the update, which was done as part of 8.1 readiness
... View more
- Tags:
- IDM
- servicenow
Labels
- Labels:
-
other
02-07-2020
07:57 AM
HI There
One thing you could try is adding a base search to the dashboard who's sole purpose is to generate these secondary time tokens for you using makeresults, then pull the tokens from this to use in the other search
|makeresults
|eval new_earliest=$token1.earliest$-604800, new_latest=$token1.latest$-604800
A little crude but should do the job
... View more
02-07-2020
07:44 AM
Ok, then yes you'll need to login with the admin account and it should prompt you to change the license type, if not then head to Settings > Licensing and you'll be able to change the details from there
... View more
02-07-2020
07:10 AM
Hi There,
Is this an instance of Splunk you've installed yourself on your own machine?
... View more
02-07-2020
07:01 AM
The exactly one hour part makes me think timezone related for some reason, mainly as we've had to deal with GMT\BST data issues here, possibility at all?
... View more
09-13-2019
06:48 AM
Hi There,
What version of DB Connect and Splunk were the original inputs created under, also why is there a requirement to create said inputs under a separate app?
But as quick fix, as I've experienced a db migration issue before, just re-create the db input as a new input and all should work fine
... View more
07-19-2019
03:37 AM
UPDATE
Currently we are exploring the fact that in might be a limit issue on the size of messages that HEC can handle, to resolve this we've updated our HF to 7.0.6 so that we are able to set the maxEventSize in the inputs.conf for [HTTP]
So far all feeds concerned seem stable and are continuing to ingest data, but we have had periods of stability like this before so we're going to let it sit for a week or so to confirm
FIXED
So doing the above seemed to have fixed the issue, updating to 7.0.6 which allowed us to use the maxEventSize config setting, an obscure issue but hopefully this will prove helpful to someone down the line.
Under $SPLUNK_HOME$/etc/apps/splunk_httpinput/local/inputs.conf we merely added the stansa:
[http]
maxEventSize=15728640
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-30-2021
01:11 PM
|
Karma given to
