About paulbannister

s2233 · ‎01-05-2022

@Mark_D61 can you clarify what you did to get the add-on to appear again? It seems to disappear whenever I attempt to modify syndication.py and restart Splunk.

dowj · ‎06-03-2021

Having the same issue. Anyone able to get this to work?

guarisma · ‎05-20-2021

Any updates? Where can I get this beta version 2.0.8?

paulbannister · ‎01-18-2021

Just as an FYI for anyone with the same issue, the latest version of the TA has been released and contains the fix for the issue.

pschildein · ‎11-29-2020

No, we changed our input to use HEC directly.

paulbannister · ‎11-25-2020

Hi @thambisetty I've had it installed on our IDM already and Splunk Support have stated there is no reason it shouldn't work so we have been looking to configure with no luck so far However I've got a feeling that the issue may lie on our Teams admin side trying to configure the credentials, tokens and certs correctly for "public" access, just trying to ascertain if anyone had any success so far with this setup and what pitfalls were encountered

paulbannister · ‎11-17-2020

Hi There, \/(?P<locale>[^\/]+)\/klarna Or within the Splunk search itself: |rex field= ##INSERT RELEVANT FIELDNAME## "\/(?P<locale>[^\/]+)\/klarna"

Labenskyd · ‎07-18-2020

martin_mueller · ‎02-07-2020

I believe you're looking for this. https://answers.splunk.com/answers/558071/how-to-subtract-date-for-a-timechart-panel-from-th.html#answer-558579

omuelle1 · ‎02-07-2020

Thank you, guys. The mail idea brought me on the right track. The email apparently sometimes gets quarantined because of its attachment and then released automatically an hour later.

paulbannister · ‎02-07-2020

Ok, then yes you'll need to login with the admin account and it should prompt you to change the license type, if not then head to Settings > Licensing and you'll be able to change the details from there

paulbannister · ‎09-13-2019

Hi There, What version of DB Connect and Splunk were the original inputs created under, also why is there a requirement to create said inputs under a separate app? But as quick fix, as I've experienced a db migration issue before, just re-create the db input as a new input and all should work fine

paulbannister · ‎07-19-2019

UPDATE Currently we are exploring the fact that in might be a limit issue on the size of messages that HEC can handle, to resolve this we've updated our HF to 7.0.6 so that we are able to set the maxEventSize in the inputs.conf for [HTTP] So far all feeds concerned seem stable and are continuing to ingest data, but we have had periods of stability like this before so we're going to let it sit for a week or so to confirm FIXED So doing the above seemed to have fixed the issue, updating to 7.0.6 which allowed us to use the maxEventSize config setting, an obscure issue but hopefully this will prove helpful to someone down the line. Under $SPLUNK_HOME$/etc/apps/splunk_httpinput/local/inputs.conf we merely added the stansa: [http] maxEventSize=15728640

rajeshpakalapat · ‎07-03-2019

Thanks for the answer. I found that the file logs are not being captured by the event viewer. So first I will need to get the logs to the event viewer then send to the platform. Any idea on getting this done? Thanks

paulbannister · ‎07-03-2019

No problem, its always the little things that trip us up!

sandeepmakkena · ‎07-02-2019

Please paste your xml code so that people here can help you better.

paulbannister · ‎06-20-2019

Hi There, There is a deprecated input method called "fschange" that monitors for file system changes which may provide what you are looking for, as I said it is being deprecated but still currently works for us, example inputs below: [fschange:\YOUR_FILE_PATH] fullEvent=true pollPeriod=3600 recurse=true sendEventMaxSize=100000 signedaudit=false disabled=0

kamlesh_vaghela · ‎10-05-2018

@Mohsin123 Can you please replace your value in my sample search and execute? |makeresults | eval Response_time=<<REPLACE_YOU_VALUE>> | eval Response_time=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC") OR Can you please share the sample output of your search? So I can work on it. YOUR_SEARCH | table Response_time | head 5

mgalos · ‎09-21-2018

Thanks for the response! Adding the index= directly to the universal forwarder instead of only on the indexer worked for me.

Sukisen1981 · ‎06-27-2018

Hi, Perhaps I am not getting your use case or I am not able to explain. At any rate I have written a query on the default _audit index , so that you can run the query as it is (select last 24 hours) index="_audit" | eval current = strftime(_time,"%m-%d-%Y") | eval A = if(action="search","search","no search") | eval {current} = A |table 06-27-2018 Now, the 06-27-2018 needs to be replaced by current day -1, so if you run this on 30th June you would write something like - index="_audit" | eval current = strftime(_time,"%m-%d-%Y") | eval A = if(action="search","search","no search") | eval {current} = A |table 06-29-2018 Is this something like what you need?

bshega · ‎06-05-2018

Oops, error on my part, I had an invalid serial number

tiagofbmm · ‎03-21-2018

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

Skins · ‎04-25-2018

gratzi - accelerated the report and it gave me exactly what i was looking for.

DalJeanis · ‎03-07-2018

SInce there are so many presidents and watches in the index, you'd want to be in the habit of checking identity of the president first, rather than wasting all those mips counting up the other couple of hundred records. Also, since typists may get confused between the various George Bush presidents, and because the name can appear in various forms, you might be better off testing for something like... | search (first_name="George" AND last_name="Bush") OR president_number = 43

martin_mueller · ‎02-01-2018

Here's the response I got from Qualys support: In order to update the changes successfully into the Qualys TA for Splunk, please follow the below steps: 1)From Settings> Data Inputs disable the TA Inputs 2)Delete passwords.conf file. 3)Reboot the splunk instance. 4)Go to TA config in Splunk UI and give the credentials again. 5)Check if the passwords.conf file created 6)Enable TA inputs from data Inputs Perpetual workaround, it seems 😞

Posts	76
Solutions	8
Karma Given	22
Karma Received	16
Member Since	‎09-30-2016

Online Status	Offline
Date Last Visited	‎03-30-2021 01:11 PM

Syndication Input (RSS/ATOM/RDF) Add-On

Microsoft Teams Add-on for Splunk on a Cloud IDM

Dropped events with Splunk Add-on for ServiceNow

DB Connect 3.1.4 Data Duplication & Rising Col Iss...

How to make Splunk recognize a timestamp that is l...

Re: Syndication Input (RSS/ATOM/RDF) Add-On

Re: Configuring Splunk TA for microsoft teams

Re: Crowdstrike Stream Stops Woking

Re: Dropped events with Splunk Add-on for ServiceN...

Re: Large JSONs are truncated at 4KB

Re: Microsoft Teams Add-on for Splunk on a Cloud I...

Re: Hi team, i need to extract the locale field in...

Re: Splunk DB connect : Error "Cannot communicate ...

Re: Subtract time from time picker token response

Re: Scheduled Searches delayed by one hour

Re: I just created this account to study for the C...

Re: Can we create DB Connect inputs in separate ap...

Re: DB Connect 3.1.4 Data Duplication & Rising Col...

Re: Monitoring private shared drive on a remote se...

Re: sql query not working after upgrading db conne...

Re: how to make sparkline and barchart in 1 dashbo...

Re: Can we track changes to a file

Re: Could you help me with the syntax for an "IF/T...

Re: From a Heavy Forwarder to an Indexer, how can ...

Re: change column name with specified new column v...

Re: How to search in the subquery for join?

Re: How to use an index for a lookup

Re: how to initially setup a summary index ?

Re: search to find Bush's stolen watch

Re: Cannot update Qualys API credentials