Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dsofoulis
dsofoulis
Path Finder
Member since:
10-28-2016
05-14-2024
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 4 |
| Karma Received | 4 |
| Member Since | 10-28-2016 |
Activity Feed
- Posted Re: Add Notable Event to an ES Investigation using the API on Splunk Enterprise Security. 05-13-2024 11:37 PM
- Posted Add Notable Event to an ES Investigation using the API on Splunk Enterprise Security. 05-13-2024 10:16 PM
- Posted Re: ERROR: Failed to migrate to storage engine wiredTiger, reason=[blank] on Installation. 12-29-2021 11:00 PM
- Karma Re: SEP 14.2 RU1 log format change for jtwind_2. 06-05-2020 12:50 AM
- Karma Re: DBConnect: OSError: [Errno 2] No such file or directory validate java command: /usr/java/latest/bin/java. for teunlaan. 06-05-2020 12:50 AM
- Got Karma for Splunk ES Duplicate of Notable Events displaying in Incident Review Dashboard. 06-05-2020 12:50 AM
- Karma BucketMover error for pil321. 06-05-2020 12:49 AM
- Got Karma for API Modular input Response Handle JSON. 06-05-2020 12:49 AM
- Got Karma for How to edit my search to track the amount of data being ingested to a specific index, measured in MB/per minute?. 06-05-2020 12:48 AM
- Got Karma for How to edit my search to track the amount of data being ingested to a specific index, measured in MB/per minute?. 06-05-2020 12:48 AM
- Karma Re: Add Picture to Dashboard for Michael. 06-05-2020 12:46 AM
- Posted Re: SEP 14.2 RU1 log format change on All Apps and Add-ons. 08-27-2019 10:49 PM
- Posted Re: Log Event Alert Action not visible when creating alert on Security. 08-15-2019 03:10 AM
- Posted Log Event Alert Action not visible when creating alert on Security. 08-15-2019 01:53 AM
- Tagged Log Event Alert Action not visible when creating alert on Security. 08-15-2019 01:53 AM
- Posted Splunk ES Duplicate of Notable Events displaying in Incident Review Dashboard on Splunk Enterprise Security. 02-03-2019 04:58 AM
- Tagged Splunk ES Duplicate of Notable Events displaying in Incident Review Dashboard on Splunk Enterprise Security. 02-03-2019 04:58 AM
- Posted Re: Datamodel Acceleration questions on Knowledge Management. 01-16-2019 10:53 PM
- Posted Datamodel Acceleration questions on Knowledge Management. 01-16-2019 03:46 AM
- Posted API Modular input Response Handle JSON on All Apps and Add-ons. 01-31-2018 03:00 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-14-2024
10:03 AM
I have not personally tried this API, but based on API Doc, you can try and then ask follow up question based on errors it is generating. Or you can even create Splunk Support ticket if something is not working as described in the Doc.
... View more
03-02-2023
11:17 PM
8 Karma
Had this issue in a pretty large cluster (over 40 Splunk servers). KVStore Upgrade would not work on ANY host. After lots of fiddling and trying to find a cause and solution, we had to give up. At least we found a reliable and easy enough workaround. Sharing it here in case someone else stumbles on this. This workaround is tested with v8.1.9, so should definitely work with versions above as well. splunk backup kvstore ls /opt/splunk/var/lib/kvstorebackup (tgz-Namen notieren) Edit /opt/splunk/etc/system/local/server.conf, add: [kvstore] storageEngine=wiredTiger systemctl shutdown Splunkd rm -r /opt/splunk/var/lib/kvstore systemctl start Splunkd splunk restore kvstore -archiveName <tgz-Name> Hope it helps some of you.
... View more
08-15-2019
03:10 AM
I've found the solution.
To fix this I edited default.metadata
[]
import = app1, app2, alert_logevent
... View more
09-24-2019
05:41 AM
1 Karma
The below is from Ovie in the Splunk community Slack channel #enterprise-security: Not sure if it is your issue but it is supposed to be related to duplicates like that. So it might apply to some of you.
This can happen because of phased_execution_mode
https://docs.splunk.com/Documentation/ES/5.2.0/RN/KnownIssues
2019-04-08 SOLNESS-18603 Incident Review: eventCount does not match resultCount causing display issues (such as events being displayed twice)
Workaround:
Set phased_execution_mode to singlethreaded
For: limits.conf
[search]
phased_execution_mode = singlethreaded
https://docs.splunk.com/Documentation/ES/5.1.0/Install/DeploymentPlanning#Splunk_Enterprise_system_requirements
Splunk Enterprise Security 5.1 is compatible with Splunk Enterprise 7.1.0 and 7.1.1 only by setting phased_execution_mode=singlethreaded in the [search] stanza of the $SPLUNK_HOME/etc/system/local/limits.conf file to avoid an issue that is fixed in Splunk Enterprise 7.1.2. However, if you apply this workaround for 7.1.0 and 7.1.1 and then upgrade Splunk Enterprise but remain on ES 5.1, then you need to set it back to phased_execution_mode=multithreaded.
Splunk Enterprise Security 5.2.x is compatible with Splunk Enterprise 7.1.0 and 7.1.1 only by setting phased_execution_mode=singlethreaded in the [search] stanza of the $SPLUNK_HOME/etc/system/local/limits.conf file to avoid an issue that is fixed in Splunk Enterprise 7.1.2.
Bottom line is this setting has caused some serious grief.
... View more
01-16-2019
10:53 PM
It's not the answer I was hoping for, but thank you for clarifying this.
... View more
01-31-2018
03:00 PM
1 Karma
Hi Everyone,
I am using the API modular input to collect data from an API. Problem is the getting the data in, correctly. Without using a response handle I can get everything in one event and I'm not able to break them into individual events. Using a response handle I'm not able to get the complete data.
SAMPLE Data looks like this:
{
"Meta Data": {
"1. Information": "Intraday Prices and Volumes for Digital Currency",
"2. Digital Currency Code": "BTC",
"3. Digital Currency Name": "Bitcoin",
"4. Market Code": "AUD",
"5. Market Name": "Australian Dollar",
"6. Interval": "5min",
"7. Last Refreshed": "2018-01-31 22:20:00",
"8. Time Zone": "UTC"
},
"Time Series (Digital Currency Intraday)": {
"2018-01-31 22:20:00": {
"1a. price (AUD)": "12474.57250163",
"1b. price (USD)": "10049.09321579",
"2. volume": "1947.32278014",
"3. market cap (USD)": "19568828.13886100"
},
"2018-01-31 22:15:00": {
"1a. price (AUD)": "12477.02432481",
"1b. price (USD)": "10051.06832152",
"2. volume": "1946.46090562",
"3. market cap (USD)": "19564011.54755900"
},
"2018-01-31 22:10:00": {
"1a. price (AUD)": "12482.11267077",
"1b. price (USD)": "10055.16732073",
"2. volume": "1947.86047516",
"3. market cap (USD)": "19586062.99517900"
},
"2018-01-31 22:05:00": {
"1a. price (AUD)": "12469.69385098",
"1b. price (USD)": "10045.16314001",
"2. volume": "1957.84301556",
"3. market cap (USD)": "19666852.49383900"
},
"2018-01-31 22:00:00": {
"1a. price (AUD)": "12465.88588954",
"1b. price (USD)": "10045.88292284",
"2. volume": "1967.23063556",
"3. market cap (USD)": "19762568.64706900"
},
"2018-01-31 21:55:00": {
"1a. price (AUD)": "12449.19799086",
"1b. price (USD)": "10032.43464665",
"2. volume": "2016.41002232",
"3. market cap (USD)": "20229501.76977700"
},
"2018-01-31 21:50:00": {
"1a. price (AUD)": "12459.09475997",
"1b. price (USD)": "10040.41015555",
"2. volume": "2016.23520360",
"3. market cap (USD)": "20243828.41419600"
},
};
I am also using a customer response handler, see below:
class BitcoinHandle:
def __init__(self,**args):
pass
def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
if response_type == "json":
output = json.loads(raw_response_output)
for price in output["Meta Data"]:
print_xml_stream(json.dumps(price))
else:
print_xml_stream(raw_response_output)
The issue that I'm having is that it's not looping through the nested JSON data, I am only getting the following data, not I'm not even getting the key value pairs, just the heading. I have no idea what I'm doing wrong. I would like to have all the data coming in and breaking correctly. Please help!
... View more
01-30-2018
09:50 PM
Hi Damien,
using the config which you given me I was able to get Splunk to index the following. (this is part of "Meta Data" heading and also it is the first part only, not key value pairs. I would like to index "Time Series (Digital Currency Daily)")
"4. Market Code"
"2. Digital Currency Code"
"1. Information"
"7. Last Refreshed"
"6. Interval"
"3. Digital Currency Name"
"5. Market Name"
"8. Time Zone"
"2. Digital Currency Code"
Been trying lots of different stuff including replace metadata with "Time Series (Digital Currency Daily)" and it stopped working completely.
Any idea what I'm missing?
... View more
07-17-2018
02:15 AM
this solution did help me for AoB v 2.2 with a similar error:
HTTPError reason=HTTP Error [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:676)
... View more
08-29-2017
12:18 PM
You would probably be best to strip the null error completely out of the raw event with this on your Indexers:
SEDCMD_remove_empty_error_KVP = "s/\s+error=\"\"//"
... View more
05-11-2017
02:56 AM
You might explore creating a field alias for those fields under settings > fields > field alias
Splunk references field aliases as a first step under "Make your fields CIM-compliant" in the Common Information Model Add-on Manual. There are step by step instructions for various tasks: http://docs.splunk.com/Documentation/CIM/4.8.0/User/UsetheCIMtonormalizedataatsearchtime
Also, search time field extractions are recommended over index time:
https://answers.splunk.com/answers/5817/search-time-versus-index-time-field-extractions.html
https://answers.splunk.com/answers/2535/search-time-vs-index-time-field-extraction.html
... View more
05-30-2018
11:38 PM
If I want to create a report with action, protocol, source ip and destination ip. What should I add in the transforms.conf?
... View more
11-14-2016
03:12 AM
Hi
if you do this, your old data will not be migrated to your new index.
I'm planing to do this in 3 steps:
- create the new index on the DS and deploy the conf (don't forget restarting all your indexers to apply)
- start indexing on the new index (or stop indexing on the old old) and then move the files from the old index location to the new one
- remove old index config from the DS and deploy it.
check this other answer
... View more
10-29-2016
09:37 AM
3 Karma
That metric will give you the total indexing thruput, not the per-index thruput. You'll want something like this:
index=_internal sourcetype=splunkd source=*metrics.log* group=per_index_thruput series=_internal
| timechart per_minute(kb) as kbpm | eval mbpm = kbpm/1024 | fields - kbpm
That gives you the MB/min thruput for the _internal index, swap the series value as you wish.
... View more
