About tsheets13

tsheets13 · ‎10-29-2021

I've been working with Splunk for many years and have always made changes via the .conf files. However, I recently added the /var/logs directory by using ./splunk add monitor /var/log -index main -sourcetype linux It's working, but I want to modify it a bit. However, I have been pulling my hair out trying to figure out which inputs.conf file was modified with the command. Any assistance appreciated. Tim

tsheets13 · ‎03-17-2020

So the lookup would contain 2 columns, subnet and state and nothing else correct?

tsheets13 · ‎03-17-2020

Sorry, typo, Ohio should be 10.10.20 and 10.10.21

tsheets13 · ‎03-17-2020

I need to create a search to count the number of events in each geographic are of our network. Each geo area will consist of multiple subnets. Kentucky 10.10.10 10.10.11 10.10.12 Ohio 10.10.10.20 10.10.10.21 Indiana 10.10.30 10.10.31 10.10.32 10.10.10.33. The report should simply output total by state: Kentucky 112 Ohio 87 Indiana 212 All events have a full IP address but I've already used REX to assign the first 3 octets to the field SUBNET. Thanks

tsheets13 · ‎03-05-2020

Perfect! Thank you

tsheets13 · ‎03-05-2020

I have a value in my events called type, which is a single digit integer (1, 2, 3, etc.) I would like to create a new string field in my search based on that value. So, something like this pseudocode... if type = 1 then desc = "pre" if type = 2 then desc = "current" if type = 3 then desc = "post" I realize the splunk doesn't do if/then statements but I thought that was the easiest way to explain. Thanks

tsheets13 · ‎03-05-2020

exactly what I needed, thank you!

tsheets13 · ‎03-04-2020

That's perfect. I am not sure why you singled out indexes with the name of device and syslogs, but after I removed that, I got what I want. Now if you don't mind helping me take it just a step further. I need to alert if the difference between today and sevendaysago are greater than 20% on any given index and report that index and difference. Thanks

tsheets13 · ‎03-04-2020

I have been asked to create an alert that looks at the index sizes (all indexes) for today, and compare them to the sizes as they were one week ago. I know I can get the index sizes for the last 7 days with index=_introspection component=Indexes | eval data.total_size = 'data.total_size' / 1024 | timechart span=1d max("data.total_size") by data.name However, how can I compare the sizes of each index, 1 by 1, between today and 7 days ago. Thanks for the help.

tsheets13 · ‎02-12-2020

That's exactly what I needed. Thanks

tsheets13 · ‎02-12-2020

I would like to define the value of a variable, lets call it 'infile' based on the value of a token selected via radio button. Pseudocode: If rbutton=yes then infile=inputfileA.csv if rbutton=no then infile=inputfileB.csv Any help appreciated.

tsheets13 · ‎01-29-2020

Trying to set up the Qualys Technology Add-on (TA) for Splunk, When I enter my Username and Password I am getting the following error. Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/storage/passwords/ I found a post here from 2017 that suggested deleting /local/qualys.conf /local/app.conf and retrying but still getting the error. Thanks in advance.

tsheets13 · ‎01-24-2020

I have a python script that I have set in my apps inputs.conf being called with the specific path name. Example: [script://$SPLUNK_HOME/etc/apps/myappname/local/bin/myscript] The script doesn't seem to be working. But when I originally had it in .../myappname/bin it worked fine. Is the location invalid even though the path is fully specified in the inputs.conf? If it is valid, what can I look for to see why it's not running?

tsheets13 · ‎01-02-2020

Sure enough, it didn't like the comment in the interval declaration in inputs.conf. Working great now. Thanks

tsheets13 · ‎01-02-2020

I'm trying to so a simple ps for ssh connections from a specific user. I have created a python script ! /usr/bin/python import os os.system("ps -ef|grep 'sshd: myuser'|wc -l") I've configured the script in inputs.conf [script://$SPLUNK_HOME/etc/apps/CheckSSH/bin/chkssh.py] disabled = false index = testing interval = 30 #frequency to run the script, in seconds source = ssh_myuser sourcetype = ssh_myuser However, when I search for "sourcetype=ssh_myuser" I get no results. ideas?

tsheets13 · ‎12-09-2019

Resolved. Error in hosts file.

tsheets13 · ‎12-09-2019

I have validated the client server has collectd configured identical to those that work, and have validated that we have data on port 8088

tsheets13 · ‎12-09-2019

We have collectd set up on many of our servers. They forward that data to the http event collector. I have dozens of servers that are working just fine. However, we have a few clients that we are not getting data in to splunk for. I'm having trouble determining how to troubleshoot the cause. Any ideas?

tsheets13 · ‎12-04-2019

Those two searches are exactly what I was looking for. Thanks

tsheets13 · ‎12-04-2019

The windows and nix TA's are installed. Just not sure how to form the report.

tsheets13 · ‎12-03-2019

I did this a few weeks ago and now I can't seem figure out how I did it. I need a report listing all UFs, with their version of splunk UF as well as specific OS version. Searched all over here and couldn't find it.

tsheets13 · ‎11-07-2019

While configuring a data input in DBConnect, when I get to the part asking what index, it only shows me the list of the local indexes. How do I tell it what indexer it should be looking at and ultimately sending data to. Thanks

tsheets13 · ‎11-06-2019

Found it in MC, thanks somesoni2!!!

tsheets13 · ‎11-06-2019

I would have thought this would be easy but I'm unsure how to do it. I had a very high cpu spike on one of the peers in my searchhead cluster. I would like to know what splunk jobs (scheduled or adhoc searches) were running at a certain time on a certain search head. Can someone help me with the appropriate search query?

tsheets13 · ‎10-29-2019

I misspoke (mistyped). We added 2 indexers.

Posts	50
Solutions	2
Karma Given	1
Karma Received	4
Member Since	‎08-20-2019

Online Status	Offline
Date Last Visited	‎11-01-2021 04:11 PM

Which inputs.conf does "splunk add monitor" modify

Counting events based on IP Subnets

Setting field value based on another field

Comparing index sizes on 2 dates

Defining string for use with inputcsv using dashbo...

Qualys Technology Add on error setting up

Is $SPLUNK_HOME/etc/apps/myappname/local/bin/myscr...

Capture data from scripted input

Troubleshooting collectd/http collector on specifi...

Search to list all UF's and OS including version n...

Which inputs.conf does "splunk add monitor" modify

Re: Counting events based on IP Subnets

Re: Counting events based on IP Subnets

Counting events based on IP Subnets

Re: Setting field value based on another field

Setting field value based on another field

Re: Comparing index sizes on 2 dates

Re: Comparing index sizes on 2 dates

Comparing index sizes on 2 dates

Re: Defining string for use with inputcsv using da...

Defining string for use with inputcsv using dashbo...

Qualys Technology Add on error setting up

Is $SPLUNK_HOME/etc/apps/myappname/local/bin/myscr...

Re: Capture data from scripted input

Capture data from scripted input

Re: Troubleshooting collectd/http collector on spe...

Re: Troubleshooting collectd/http collector on spe...

Troubleshooting collectd/http collector on specifi...

Re: Search to list all UF's and OS including versi...

Re: Search to list all UF's and OS including versi...

Search to list all UF's and OS including version n...

DB Connect: defining indexer

Re: What was running at xx:xx

What was running at xx:xx

Re: Determining if an index needs rebalance

Join the Conversation