About michael_kushma

michael_kushma · ‎03-24-2026

I was having a similar issue but none of the dropdowns were showing up. I'm an admin on my server and we have an enterprise license, but I needed to inherit the "mltk_admin" role on the admin role so thank you for pointing me in the right direction.

michael_kushma · ‎09-18-2020

The simple answer to this is you have a dashboard without a title. As soon as I fixed that, all the problems with 500 errors went away.

michael_kushma · ‎02-05-2020

Worked for me as well. Splunk 7.3.2 and DB connect version 3.2.0. Changed that one line: if isinstance(command, str): if isinstance(command, basestring): They need to fix this...

michael_kushma · ‎04-04-2018

The area to change the max file size upload is located below: https://:/en-US/manager/SplunkEnterpriseSecuritySuite/data/inputs/threat_intelligence_manager

michael_kushma · ‎10-12-2016

It doesn't look like there is currently a work around. According to the regex in the error, you can only have digits, letters, ".", "-", "_", and "/". This sound to me like its not using regex to find the log group name.

michael_kushma · ‎10-12-2016

I am also having this issue. I have tried * and .+ regex but it won't work. It is requiring the exact log group name.

michael_kushma · ‎03-28-2016

Did you restart Splunk after making the changes?

michael_kushma · ‎03-24-2016

Can we see the inputs.conf in question?

michael_kushma · ‎03-24-2016

Can you type out your Timestamp format. It's VERY hard to read. My guess is that there line break in that field you're trying to extract from. I also don't see an AM or PM so you shouldn't be using %p at all. Should be: %m/%d/%Y %k:%M

michael_kushma · ‎03-24-2016

Polling should take relatively low resources. You're poling interval will need to be determined based on how long you can wait before gathering data for investigations. If the UF's are polling every hour and you need to be able to start gathering data in 30 seconds, then you need to set the polling interval to 30 seconds.

michael_kushma · ‎03-24-2016

What are you trying to do?

michael_kushma · ‎04-10-2015

I want to know if its possible in props.conf to create one stanza for multiple sourcetypes that doesn't use regex. I want all of my linux logs to check the hostname vs a lookup table that has a plethora of data in it. I need it to check multiple sourcetypes and I don't want to have to copy and paste the stanza over and over. It seems like it should be simple: [sourcetype1|sourcetype2|sourcetype3] LOOKUP-test = lookup_test host OUTPUT ip

Posts	12
Solutions	0
Karma Given	26
Karma Received	2
Member Since	‎03-05-2015

Online Status	Offline
Date Last Visited	yesterday

Pipe delineated sourcetype Stanza

Re: AI Toolkit "Connection Management is not yet c...

Re: 500 Internal Server Error when I click "Manage...

Re: DBConnect: OSError: [Errno 2] No such file or ...

Re: Any file size limit of threat intelligence lis...

Re: In the Splunk Add-on for Amazon Web Services i...

Re: In the Splunk Add-on for Amazon Web Services i...

Re: Polling frequency seems to default to 10m

Re: Invalid key in stanza [Splunk_TA_f5_bigip_main...

Re: Strptime statement not extracting date/time

Re: 1000 Windows Universal Forwarders, all configu...

Re: How do I filter events and extract fields in a...

Pipe delineated sourcetype Stanza

Join the Conversation