Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ekcsoc
ekcsoc
Path Finder
Member since:
09-08-2019
05-04-2021
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 20 |
| Karma Received | 5 |
| Member Since | 09-08-2019 |
Activity Feed
- Posted Re: ServiceNow add-on doesn't index everything on All Apps and Add-ons. 05-04-2021 04:34 AM
- Posted Re: Upgrading Splunk Add-on that was build with Splunk Add-on Builder to Python 3 on All Apps and Add-ons. 04-18-2021 02:21 AM
- Karma Re: Upgrading Splunk Add-on that was build with Splunk Add-on Builder to Python 3 for dtran. 04-18-2021 02:21 AM
- Karma Upgrading Splunk Add-on that was build with Splunk Add-on Builder to Python 3 for rajrsplunk. 04-18-2021 02:21 AM
- Karma FIPS and Splunk Compatibility for plymalebl. 07-12-2020 06:22 AM
- Tagged Re: Universal forwarders no longer sending data - SSL23 unknown protocol on Splunk Search. 07-11-2020 09:21 PM
- Karma FIPS/SSL Incompatibility? for mjdiamore. 07-11-2020 03:48 PM
- Posted Re: Universal forwarders no longer sending data - SSL23 unknown protocol on Splunk Search. 07-11-2020 03:45 PM
- Tagged Re: Universal forwarders no longer sending data - SSL23 unknown protocol on Splunk Search. 07-11-2020 03:45 PM
- Got Karma for parsing mix of json and other type without Splunk query. 06-05-2020 12:51 AM
- Karma Splunk Forwarder Connection Issue with "Error in SSL_read - sock_error = 10054" for caglabaylan. 06-05-2020 12:50 AM
- Karma Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ? for BainM. 06-05-2020 12:50 AM
- Karma Exported addon from Splunk addon builder but unable to see inputs or configuration form for ansif. 06-05-2020 12:50 AM
- Karma Configuration page doesn't work for Splunk Add-on for Office 365 for stevenjluke. 06-05-2020 12:50 AM
- Karma Does DB_Connect work with Snowflake? for sl_quinn. 06-05-2020 12:50 AM
- Karma Is there a way to generate SOAP request programmatically from web sphere logs(data elements logged in) using Splunk API(if any)? for sureshkrovi. 06-05-2020 12:50 AM
- Karma Alert for License Master Communication Error for ips_mandar. 06-05-2020 12:50 AM
- Karma Re: splunk add on for office 365 sudden failure "TypeError: string indices must be integers" for tracieed_nord. 06-05-2020 12:50 AM
- Got Karma for How to configure outputs.conf to forward data in a fail-over method. 06-05-2020 12:50 AM
- Got Karma for Cloud Snowflake DB Connect Integration. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 3 | |||
| 0 |
05-04-2021
04:34 AM
I am facing similar issue with Splunk Add-on for ServiceNow version 6.4.1. Is there any fix available. ?
... View more
04-18-2021
02:21 AM
facing similar issue.
... View more
07-11-2020
03:45 PM
Hi, I am facing similar issue (same error), I have bunch of Universal Forwarder (version 6.5.2, 8.0.3) running in FIPS Mode. So I re-installed the UF on these linux servers. Still I am getting the same error on my heavy forwarder running 7.2.7. Could you please specifically mention, if I need to enable FIPS on Heavy Forwarder also. I also didn't see any document giving complete detail that where all FIPS should be enabled. If you could route me to correct document would be great.
... View more
05-14-2020
01:52 PM
i am facing similar problem I am creating an addon with modular input using python. While testing the app /add-on it was all ok in the addon-builder but after I finish all the things ,and then open the created addon /app , then the input tab is taking forever to show the page. I also noted that whenever I am putting password text box while creating the add-on then only this is happening.
I am using
Splunk Version: 7.2.7
Splunk Build: f817a93effc2
splunk_app_addon-builder version: 2.2.0
... View more
04-27-2020
03:57 AM
I downvoted this post because provided suggestion is not for soap request
... View more
04-13-2020
01:45 AM
1 Karma
if the field is mix of json and some other type. is it possible to parse the field at index time or search time without using spath ?
my data is some what mix of json and other format. how should I parse it without using spath command (i mean parsing at index time or search time), so that I can alias the key value pair in json format and the one in anther format:
Below is my raw logs pattern:
ssoId:023serwerwef32, RBA Request :
key=value&key=value&&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value
,RBA Response :
{"key":value","key":value","key":value","key":value","key":value","key":value","key":value","key":value".........}
Note: Value of the above RBA Response is multiple nested json for varying sizes in different log.
... View more
04-13-2020
01:26 AM
what if the field is mix of json and some other type. is it possible to parse the field at index time or search time without using spath ?
my dates is some what like this:
ssoId:023serwerwef32, RBA Request :
key=value&key=value&&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value&key=value
,RBA Response :
{"key":value","key":value","key":value","key":value","key":value","key":value","key":value","key":value".........}
... View more
10-27-2019
11:02 PM
1 Karma
We have HF 1 and HF2 that are located in DC1 and DC2 respectively. How can we configure outputs.conf in below method.
All servers in DC 1 should forward data to HF 1 primarily and only send data to HF 2 in case of a fail over (ie HF1 goes down.)
All servers in DC 2 should forward data to HF 2 primarily and only send data to HF 1 in case of a fail over (ie HF2 goes down.)
Please note that we are not looking for a autolb feature and just looking for a failover kind of configuration in outputs.conf
... View more
10-03-2019
12:50 AM
Thanks for the info. I wanted to know exactly in which Dashboard this is being used, since its not schedule to send an email or throw an alert
... View more
10-01-2019
02:45 AM
ES version - 5.3.1
... View more
09-29-2019
10:25 PM
This Report "Audit - Index Readiness" under SA-Utils apps is running for every 30 minutes for last 24 hours time range and getting skipped in Search head. Just wanted to know what is the purpose of this report and can it be disabled ?
... View more
09-18-2019
01:07 AM
Hi,
What you are doing is correct.
Please find the below splunk documentation.
"To find out if a license slave has been unable to reach the license master, look for an event that contains failed to transfer rows in splunkd.log or in the _internal index."
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Aboutlicenseviolations
... View more
09-09-2019
12:59 AM
3 Karma
Hi,
Could you please help here I tried to integrate the Snowflake with db connect.
I am using following version of JRE: /usr/java/jdk1.8.0_131/jre
I have placed snowflake at following location:
/opt/splunk/etc/apps/splunk_app_db_connect/drivers/snowflake-jdbc-3.9.1-javadoc.jar
/opt/splunk/etc/apps/splunk_app_db_connect/drivers/snowflake-libs/snowflake-jdbc-3.9.1-javadoc.jar
/opt/splunk/etc/apps/splunk_app_db_connect/jars/snowflake-jdbc-3.9.1-javadoc.jar
I have put below stanza in /opt/splunk/etc/apps/splunk_app_db_connect/local/ db_connection_types.conf
[snowflake]
displayName = Snowflake
serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
jdbcUrlFormat = jdbc:snowflake://:/
jdbcDriverClass = com.snowflake.client.jdbc.SnowflakeDriver
Now when I create a connection and try to save I get following error:
Database connection snowflake is invalid
No suitable driver found for jdbc:snowflake://"":443/
... View more
Labels
- Labels:
-
other
09-08-2019
10:00 PM
What do you mean by limit of your nat device ? Is that the number of connections that can be generated from NAT device ?
And one thing, we are not using deployment server in this model. Universal forwarders will be managed by the IT team with there own tools like SCCM/other tool.
Also we wanted to know the data within the logs is still matched back to the originating log source IP of the server with the Splunk UF/ or the host IP will written as NAT IP ?
... View more
09-08-2019
09:55 PM
We are trying to achieve a multi-tenant architecture by deploying specific HF's to each office location(or each company). And regarding why a single NAT IP for each location, that is how there network architecture is build of and working
... View more
09-08-2019
04:33 AM
We have around 100 Universal Forwarders in a specific Office location A and another 50 Universal Forwarders in Office location B. We are trying to use a single NAT IP (192.168.10.20) for Office location A and a single NAT IP (192.168.10.30) for Office Location B for sending data from these Universal forwarders to a Heavy Forwarder placed in a different Office location C.
Can Splunk distinguish each Universal Forwarder with its own host IP even though its communicating and sending data to HF with a single NAT IP ?
Is this TCP Connection stream handling between the Splunk UF and Splunk HF is capable of managing the multiple TCP client connections on the same NAT IP ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-04-2021
08:41 PM
|
Karma given to
