About michaeljorgense

michaeljorgense · ‎07-20-2020

@rkantamaneni_sp are you talking about this being specifically fixed in Splunk Universal Forwarder version 7.3.0? i.e. would just patching the Windows UFs to use 7.3.0 fix this issue? Or does it need 7.3.0 in the server end too? Also I notice there isn't any reference to SPL-145668 in the Splunk Universal Forwarder release notes yet.

michaeljorgense · ‎06-18-2020

@jlsabaut it looks like the migration to new Splunk Answers might have lost the attachment you provided with tips on setting this up. Would you mind re-sharing please? @richardphung I would also prefer to send this to a syslog server and not direct to Splunk so thanks for asking my question for me. But it sounds like from the answer for the Avaya Call app to work it's not in syslog format. Possibly can have the Avaya system export syslog in another way? Just not on the SMDR screen.

michaeljorgense · ‎05-13-2019

This looks like close something I am experiencing. My understanding is the streamfwd binary needs to phone home to the Splunk App for Stream as described here: https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/DeploymentArchitecture#How_streamfwd_communicates_with_splunk_app_stream This is where you configure streamfwd to talk to the Stream App: https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/ConfigureStreamForwarder#Verify_location_of_splunk_app_stream_in_inputs.conf In your config this is set to: splunk_stream_app_location = http://localhost:8000/en-us/custom/splunk_app_stream/ To me it looks like your logs are showing that streamfwd is getting a connection refused when connecting via http to localhost on tcp port 8000. It's getting a connection refused when attempting that. Are you able to, on that same splunk server, access: http://localhost:8000/en-us/custom/splunk_app_stream/ping If you can't that might indicate your problem, i.e. a local firewall, DNS resolution of "localhost" etc might not be working for you?

michaeljorgense · ‎05-13-2019

In the Splunk App for Stream, i.e. not the TA, access the Configuration->Configure Streams menu item from the navigation bar. Scroll down until you find the stream titled "netflow" and choose "edit". Then, in the resulting config screen, ensure that the Mode is set to "enabled". This will enable the stream as described above by @seg42

michaeljorgense · ‎03-19-2019

Sorry to bump a question well answered a while ago. I stumbled across it while searching for something else. The answer to this question has changed and there is now an ITSI Certificate available. More info can be found here: https://www.splunk.com/en_us/training/certification-track/splunk-itsi-certified-admin.html Thought I should update this question in case someone else stumbles across it and wants to know about ITSI certification.

michaeljorgense · ‎04-26-2018

Thanks @jajung. That was exactly the problem. Once I reconfigured permissions on the app config to "all apps" then the new fields were immediately accessible within Search & Reporting.

michaeljorgense · ‎04-26-2018

It looks like this has all come down to a Splunk permissions issue. I edited the permissions on my app within Splunk & set the permissions for “sharing for config file-only objects” to “all apps” not “this app only (system)” and now Search & Reporting app shows me the fields I've been trying to extract immediately. So possibly any number of previous attempts/syntax options has been working but permissions weren't allowing me to see it.

michaeljorgense · ‎04-26-2018

I tried your suggested host_regex config & can confirm that the host field is still being extracted successfully from the file name, i.e. no change there as it was working before. Unfortunately it hasn't made the props.conf inline extraction work. inputs.conf: [monitor:///path/to/file/*/child_AE_*.log] index=mjtest sourcetype=mjtest host_regex = \/path\/to\/file\/.*?\/child_AE_(\S+).log props.conf: [mjtest] EXTRACT-group_and_site = (?<group>\w{3})(?<site>\w{3})\w+ in host

michaeljorgense · ‎04-26-2018

Thanks for the suggestion. The host field is being extracted properly using the regex I have posted. I will give your suggestion a try regardless of that fact in case it helps the later props/transforms regex extraction & update you soon.

michaeljorgense · ‎04-26-2018

Sorry for any confusion. The only time I used that incorrect stanza name was in my original question, in the REPORT extraction attempt. Once corrected by @FrankVI I changed it & have never posted config since showing me using it incorrectly. I'm not sure why you think I am still using it, but I'm not.

michaeljorgense · ‎04-26-2018

Thanks again for the reply & for confirming that it looks ok to your eyes. This is a specific app just for testing this new input. Nothing else in inputs.conf, props.conf or transforms.conf that could conflict. In fact no other config files in this app but those files in a local/ sub-dir. I've used btool to confirm that the props settings were visible previously & also seen them in the 'Field Extractions' dashboard in the Web GUI. So I know they are loaded into splunk successfully. Permissions are fine (splunk runs as root anyway on this test server) & I have been restarting splunk after every change to props.conf. Trust me when I say that's about 30+ times in the last 2 days before I even logged this question. Again, thanks for taking the time, I guess I'll take it up with support.

michaeljorgense · ‎04-25-2018

Looks like I accidentally "commented" on the wrong response. Thanks for your reply @FrankVI, please find my response to it below @woodcock comment.

michaeljorgense · ‎04-25-2018

Thanks very much for your reply Frank. Unfortunately I tested both suggestions & neither is working, i.e. no 'group' or 'site' field at search time on the data in my index. Not on previously indexed data or fresh data that I add to the file to be ingested. Please find below my config files for each scenario with the fixes you suggested. Inline scenario. inputs.conf: [monitor:///path/to/file/*/child_AE_*.log] index=mjtest sourcetype=mjtest host_regex = /path/to/file/.*/child_AE_(\w+).log props.conf: [mjtest] EXTRACT-group_and_site = (?<group>\w{3})(?<site>\w{3})\w+ in host Report scenario. inputs.conf: [monitor:///path/to/file/*/child_AE_*.log] index=mjtest sourcetype=mjtest host_regex = /path/to/file/.*/child_AE_(\w+).log props.conf: [mjtest] REPORT-fieldextract = group_site_extract transforms.conf: [group_site_extract] REGEX = (?<group>\w{3})(?<site>\w{3})\w+ SOURCE_KEY = host Thanks for your help so far! 🙂

michaeljorgense · ‎04-25-2018

Hi, I would like to extract two new fields from the value of the host field at search time. I'd like the first 3 characters of the host field value to be a new field named 'group', and the next 3 characters of the host field value to be a new field named 'site'. e.g. if host = AAABBBsomestring then group = AAA site = BBB I believe I have the regex to make this work. I've tested it with rex in a Splunk Search & can see the new fields 'group' & 'site' being correctly populated in the events resulting from that rex modified search. Here is my search: index=mjtest | rex field=host "(?<group>\w{3})(?<site>\w{3})\w+" So I then tried to place this as an inline field extraction in props.conf. My environment for testing is a single virtual machine hosting all splunk functions including search head & indexers. Additionally the files being monitored are also on this same test server. All config files named below are in my own app in SPLUNK_HOME/etc/apps/app_name/local. My inputs.conf looks like: [monitor:///path/to/file/*/child_*.log] index=mjtest sourcetype=mjtest host_regex = /path/to/file/.*/child_(\w+).log My props.conf looks like: [mjtest] EXTRACT-group,site = (?<group>\w{3})(?<site>\w{3})\w+ in host However these fields are not extracted at search time, well they don't appear in the event data or the list of interesting fields in a Splunk Search. Any clues on why this might be? Is it because I'm setting the host value via host_regex in inputs.conf? I would have thought that wouldn't matter as that would happen before any props.conf actions took place in the processing pipeline. For what it's worth I also tried doing a REPORT extraction with a props.conf & transforms.conf combo of the below which also didn't work. props.conf: [sourcetype::mjtest] REPORT-fieldextract = group_site_extract transforms.conf: [group_site_extract] REGEX = (?<group>\w{3})(?<site>\w{3})\w+ SOURCE_KEY = host Ultimately I don't mind which way my goal is achieved... but it's driving me crazy why it's not working. Any help would be much appreciated. Michael.

michaeljorgense · ‎11-29-2016

Thanks for the reply Guilhem. It sounds like it is actually possible to monitor nmon files elsewhere in real-time, just not recommended. How would I go about doing so if I wanted to see what the cost of doing so is like? I assume I'd have to modify a local copy of inputs.conf to point at my separate nmon files. Would I have to modify any other config files? Would simply modifying inputs.conf automatically call your parsers and helper scripts when changes were made to my outside TA-nmon nmon files? Would modifying inputs.conf, automatically stop TA-nmon from generating it's own files or would I have to disable that somewhere also? I'm quite keen to keep my nmon files as the source of data & monitor them in real-time. So any pointers on how to achieve that would be greatly appreciated 🙂

Posts	16
Solutions	0
Karma Given	35
Karma Received	4
Member Since	‎24-11-2016

Online Status	Offline
Date Last Visited	‎11-06-2023 07:46 PM

Field extraction from host field value

Re: Splunk sub-processes start/stop every minute (...

Re: Splunk as SMDR Listener

Re: Splunk Stream not showing netflow data

Re: How to configure the Splunk Flow Collector Set...

Re: Splunk ITSI Certification

Re: Field extraction from host field value

Re: Field extraction from host field value

Re: Field extraction from host field value

Re: Field extraction from host field value

Re: Field extraction from host field value

Re: Field extraction from host field value

Re: Field extraction from host field value

Re: Field extraction from host field value

Field extraction from host field value

Re: Do I need to deploy TA-nmon, or can I just pul...