About danielbb

danielbb

We have a universal forwarder and the customer has a csv file on this machine that he would like to ingest. The customer would like to ingest it as a lookup so I wonder whether we should ingest the csv via the UF or potentially, send it via the REST api to be uploaded as a lookup. Does the latter option make sense?

danielbb

We would like to dynamically populate the severity field, is it possible?

danielbb

Is there a way to avoid sending an empty report? I'm thinking about converting the report to an alert but the customer would like to keep it as a report.

danielbb

Thank you @gcusello, this makes perfect sense, I'll go ahead and create a distinct app that would be deployed only on one of the HFs, much appreciated.

danielbb

We have a Splunk app that includes multiple scripted inputs. The app is deployed to 15 heavy forwarders, but we want one of the scripts to run on only one of them. I first tried adding host = <hostname> inside the scripted‑input stanza, but I now realize that this isn't the solution. Is there a way to restrict a scripted input so it executes on only a single server, without having to split the app?

danielbb

I came across an identical thread at Re: How does Splunk calculate linecount? - Splunk Community

danielbb

@isoutamo I'm running the following - index = <my_index> linecount=2 | table _raw and everything shows up as one line, I don't see any sign of \n, what do I miss? I also checked with an encoding tool and it doesn't show either the 13 ascii code or the 10 one within these lines. My biggest confusion is the fact that for this sourcetype I have - SHOULD_LINEMERGE=FALSE And therefore, how come, sometimes the events have multiple lines?

danielbb

Thank you, @livehybrid, @richgalloway, I'll get screenshots but, a related question, how do I access the second line of _raw?

danielbb

For multiple sourcetypes, linecount is 2, while clearly, it should be 1. Has anybody encountered this case?

danielbb

Thank you @PickleRick, it was a confusion about the app where the collection and the definition exist.

danielbb

I wonder if I need to install the app on the distinct components in order to view the btool results across the implementation, I assume I have to install it on each components and I just want to verify.

danielbb

I created a KV Store lookup using the "Splunk App for Lookup File Editing" app, however when I look at Settings>Lookups, the lookup definition doesn't show up. In addition, when running | inputlookup <name> I get the error "The lookup table '<name>' requires a .csv or KV store lookup definition" What do I miss?

danielbb · ‎03-18-2025

Great @livehybrid, "If you are using config files to create your HEC tokens", what are my options on-prem to configure the HEC token?

danielbb · ‎03-18-2025

Very interesting @livehybrid, how do I check whether indexer acknowledgment is in place?

danielbb · ‎03-18-2025

We are transitioning from getting the HEC data through HFs to getting it directly to the indexers and we are wondering if upon introducing a new data source are we forced to do an indexer rolling restart.

danielbb · ‎03-18-2025

We are in a transition from sending the data through HFs to sending the data directly to the indexers and we wonder how to configure the load balancer to handle this HTTP data. My understanding is that HTTP is based on TCP and TCP is connection based and therefore we can lock the sender to a particular indexer which would lead to an uneven distribution of the load, any suggestions?

danielbb · ‎03-18-2025

For our indexers, we see the following under 'Storage I/O Saturation (Mount Point)' - 0.90% (/opt/splunk) 6.56% (/indexing/splunk_cold) We have 14 indexers with roughly the same saturation levels and I wonder if it's healthy. We would like to direct the HEC data straight to the indexers (instead of going through the HFs) and therefore I wonder if at the I/O level we are ready.

danielbb · ‎02-26-2025

We were told the following - Confluent Vendor has provided the Telemetry URL to configure in the Splunk's Open Telemetry collector to push the metrics from Confluent to Splunk. Is this the right Integration between Confluent and Splunk, meaning via the Open Telemetry Collector (OTEL)?

danielbb · ‎02-25-2025

I was told that there is an app that can run the btool command on cloud instances. Does anybody know the name of this app?

danielbb · ‎02-17-2025

Thank you @isoutamo, when trying to put the HF as a search peer in the SH and it gives this error - Encountered the following error while trying to save: Status 401 while sending public key to search peer https://<ip>:8089: Unauthorized

danielbb · ‎02-14-2025

I'm running the following command - | rest /services/server/sysinfo And it shows the indexer and the search head but not the heavy forwarder. What can it be?

danielbb · ‎02-11-2025

Thanks a lot!

danielbb · ‎02-11-2025

Thank you Rick for the information!

danielbb · ‎02-10-2025

Thank you @gcusello. Our Proofpoint account manager said the following - "There is an API but no mail flow API so Splunk wouldn't have anything on the Essentials side. Enterprise side - Remote Syslog gets them all sorts of mail flow details! Having said that, the only way to get an integration with Splunk would be to upgrade from Essentials to our Enterprise email." Is there a way to get the Proofpoint data without an upgrade?

danielbb · ‎02-05-2025

I see multiple Tenable Apps and TAs in Splunkbase, which one should I use to get Tenable data in?

Posts	592
Solutions	3
Karma Given	371
Karma Received	30
Member Since	‎07-24-2019

Online Status	Offline
Date Last Visited	yesterday

How to upload a csv from a host that has a univers...

Is there a way to dynamically control the severity...

How to avoid sending an empty report?

How to run a scripted input on only one of several...

Why is linecount 2 when it's clearly 1?

Do we need to install the "admin's little helper" ...

How do I set up a KV Store lookup?

Do we need to run an indexer rolling restart when ...

How to configure the load balancer to handle HEC d...

Is saturation level fine as a preparation for addi...

How to upload a csv from a host that has a univers...

Is there a way to dynamically control the severity...

How to avoid sending an empty report?

Re: How to run a scripted input on only one of sev...

How to run a scripted input on only one of several...

Re: Why is linecount 2 when it's clearly 1?

Re: Why is linecount 2 when it's clearly 1?

Re: Why is linecount 2 when it's clearly 1?

Why is linecount 2 when it's clearly 1?

Re: How do I set up a KV Store lookup?

Do we need to install the "admin's little helper" ...

How do I set up a KV Store lookup?

Re: Do we need to run an indexer rolling restart w...

Re: How to configure the load balancer to handle H...

Do we need to run an indexer rolling restart when ...

How to configure the load balancer to handle HEC d...

Is saturation level fine as a preparation for addi...

Integration between Confluent and Splunk

What app can execute the btool command on the clou...

Re: Why don't I see my three Splunk servers via th...

Why don't I see my three Splunk servers via the re...

Re: How to I retrieve proofpoint data?

Re: How to I retrieve proofpoint data?

Re: How to I retrieve proofpoint data?

How do I integrate Tenable with Splunk?

Are you a member of the Splunk Community?