Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lim2
lim2
Path Finder
Member since:
03-23-2015
a month ago
Community Statistics
| Posts | 36 |
| Solutions | 0 |
| Karma Given | 47 |
| Karma Received | 3 |
| Member Since | 03-23-2015 |
Activity Feed
- Karma Re: Version 1.1.0 doesn't get message trace for snrnbrem. 02-11-2021 07:02 PM
- Karma Re: Time range not substitued by earliest/latest for MattibergB. 01-19-2021 03:30 PM
- Posted Re: Time range not substitued by earliest/latest on Splunk Search. 01-19-2021 03:29 PM
- Posted Re: inputs.conf `monitor` (re)ingest historic data on Getting Data In. 01-12-2021 09:21 AM
- Karma Re: inputs.conf `monitor` (re)ingest historic data for darrenfuller. 01-12-2021 09:15 AM
- Posted increase value of artifact_offset of a savedsearch on Alerting. 12-07-2020 06:39 PM
- Karma Re: How to only display fields with values in a table for ndoshi. 12-07-2020 06:03 PM
- Karma Re: Alert when "rises by" issue for Genti. 12-07-2020 05:59 PM
- Karma Re: How to only display fields with values in a table for romanwaldecker. 12-07-2020 05:47 PM
- Karma Re: How to hide a column in a table if every value in that column is null? for nabeel652. 12-07-2020 05:45 PM
- Karma How to hide a column in a table if every value in that column is null? for yacht_rock. 12-07-2020 05:45 PM
- Got Karma for Re: How do I delete lookup file (CSV) from a lookup lists using query?. 11-23-2020 05:40 AM
- Karma Re: Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error for gordo32. 11-11-2020 12:57 PM
- Karma Re: Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error for poisar. 11-11-2020 12:57 PM
- Posted Re: Why our hourly report doesn't show up? on Reporting. 08-31-2020 10:37 AM
- Posted limits.conf default_save_ttl = 604800 (7 days) but in /opt/splunk/var/run/splunk/dispatch there are folders older than 7 on All Apps and Add-ons. 08-24-2020 08:55 AM
- Posted mcatalog causing ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported on Splunk Enterprise. 08-13-2020 05:58 AM
- Posted Re: ondemand.netsparker.cloud:443 port is closed on All Apps and Add-ons. 07-17-2020 10:32 AM
- Posted Re: Splunk Connect for Zoom on All Apps and Add-ons. 07-17-2020 07:49 AM
- Posted Re: microsoft office 365 reporting add-on stopped getting data on All Apps and Add-ons. 07-13-2020 06:00 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-19-2021
03:29 PM
@MattibergB Thanks for sharing the information. Could you advise what version of Splunk Enterprise did you experience the issue with earliest/latest not working in Splunk search. We are experiencing similar issue on Splunk enterprise 8.0.5 in a hybrid env (Splunk cloud indexers + onprem Splunk SH cluster).
... View more
01-12-2021
09:21 AM
Splunk UF agent to 'reprocess' a monitor file. Noticed that there are events in the SplunkUF monitored file are indexed. Wondering if ./splunk cmd btprobe -d /opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db --file /var/log/messages --reset would do an incremental reindex of the missed events of the file?
... View more
12-07-2020
06:39 PM
Hi, Would like to use artifact_offset in https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob to troubleshoot why alert-when-rises-by-issue (http://answers.splunk.com/answers/6843/alert-when-rises-by-issue) does not seem to work for a savedsearch alert. The max artifact_offset seems to be only 3 for that alert. Not able to find a way to increase it to a high value. It would be nice to have an Advanced_Edit option for updating the artifact_offset of a savedsearch
... View more
Labels
- Labels:
-
alert condition
08-31-2020
10:37 AM
We experiencing quite a few of status=delegated_remote_error and status=skipped searches on Splunk SHC ver 8.0.2 even with following setting: Total Scheduled searches = (((base_max_searches + cpu_count*max_search_per_cpu) * max_searches_perc) / 100) * num_members Total schedule searches = ((6 + 36*1) * 50/100) * 7 = 21 * 7 = 147 Is there other setting tuning variables? Thanks.
... View more
08-24-2020
08:55 AM
All,
2 Splunk admin questions: 1) We have default_save_ttl = 604800 (7 days), but in /opt/splunk/var/run/splunk/dispatch there are folders older than 7 days according to https://docs.splunk.com/Documentation/Splunk/8.0.5/Search/ManagejobsfromtheOS
the ttl, or length of time that job's artifacts (the output it produces) will remain on disk and available (ttl=)
Should we cleanup the old searches manually via cron, is that safe?
find /opt/splunk/var/run/splunk/dispatch/ -maxdepth 1 -type d -mtime +8 -ls|wc -l 37
Here is outputs of limits.conf:
/opt/splunk/bin/splunk cmd btool limits list --debug|grep ttl /opt/splunk/etc/system/default/limits.conf indexed_csv_ttl = 300 /opt/splunk/etc/system/default/limits.conf search_ttl = 2p /opt/splunk/etc/system/default/limits.conf concurrency_message_throttle_time = 10m /opt/splunk/etc/system/default/limits.conf max_lock_file_ttl = 86400 /opt/splunk/etc/system/default/limits.conf cache_ttl = 300 /opt/splunk/etc/system/default/limits.conf default_save_ttl = 604800 /opt/splunk/etc/system/default/limits.conf failed_job_ttl = 86400 /opt/splunk/etc/system/default/limits.conf remote_ttl = 600 /opt/splunk/etc/system/default/limits.conf replication_file_ttl = 600 /opt/splunk/etc/system/default/limits.conf srtemp_dir_ttl = 86400 /opt/splunk/etc/system/default/limits.conf ttl = 600 /opt/splunk/etc/system/default/limits.conf ttl = 300 /opt/splunk/etc/system/default/limits.conf cache_ttl_sec = 300 /opt/splunk/etc/system/default/limits.conf ttl = 86400
2) Also another question regarding from ps aux |grep 1598277129 root 29785 106 0.3 764344 282356 ? Sl 13:51 (UTC) 114:48 [splunkd pid=1771] search --id=1598277129.14351_B930C604-9D78-4B47-8E19-429E50F02A65 --maxbuckets=300 --ttl=600 --maxout=500000 --maxtime=0 --lookups=1 --reduce_freq=10 --rf=* --user=redacted --pro --roles=redacted the approve Splunk search process started/completed and have a ttl of 600 (10 minutes),
and from search.log can see CANCEL and status=3, why is the search still running if CANCEL was issued? We do see quite a few of those cases and the CPU load is usually high in 8.0.2. Did not have that condition in Splunk 7.2.x. Any inputs?
08-24-2020 15:47:12.345 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=CANCEL 08-24-2020 15:47:12.345 INFO DispatchExecutor - User applied action=CANCEL while status=3 ... 08-24-2020 15:47:14.344 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=CANCEL 08-24-2020 15:47:14.345 INFO DispatchExecutor - User applied action=CANCEL while status=3 Thanks.
... View more
Labels
- Labels:
-
administration
-
configuration
08-13-2020
05:58 AM
Hi,
Getting following errors from failed |mcatalog search against metrics index using a power user role. The |mcatalog search runs ok with admin role. The search was running ok in Splunk 7.3.3 but getting error in Splunk 8.0.2. Power user role has the metric_alerts and list_metrics_catalog capabilities
Search: |mcatalog values(metric_name) where index=os_metrics causing
ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported
ERROR SearchOrchestrator - Term based search is not supported
ERROR SearchStatusEnforcer - sid:1597278941.14635_FE8E9C88-7BFB-466C-BA64-C8544C690C88 Term based search is not supported
ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Term based search is not supported
Any suggestions on the cause of the "Term based search is not supported" and solution would be welcome. Thanks.
... View more
Labels
- Labels:
-
metrics
07-17-2020
10:32 AM
Issue was resolved after applied Netsparker Add-on Version 1.2.0 June 25, 2020
... View more
07-17-2020
07:49 AM
Hi @pastorlibre The zoom admin pointed the "Event Notification Endpoint URL" to Splunk server DNS/Load balancer running "Splunk Connect for Zoom" on tcp 4443 and after granting network access to https://marketplace.zoom.us/docs/api-reference/webhook-reference#ip-addresses, started to see series="zoom:webhook" events in metrics.log and sourcetype=zoom:webhook was searchable. But now from splunkd.log, not seeing the http_500 code or the large +300MB. But seeing lots of: 07-17-2020 14:35:46.095 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_Connect_zoom/bin/zoom_input.py" 3.235.69.93 - - [17/Jul/2020 14:35:45] "POST / HTTP/1.1" 200 - 07-17-2020 14:35:46.095 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_Connect_zoom/bin/zoom_input.py" 3.211.241.118 - - [17/Jul/2020 14:35:45] "POST / HTTP/1.1" 200 - 07-17-2020 14:35:46.095 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_Connect_zoom/bin/zoom_input.py" 3.235.69.92 - - [17/Jul/2020 14:35:46] "POST / HTTP/1.1" 200 - 07-17-2020 14:35:46.095 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_Connect_zoom/bin/zoom_input.py" 3.235.69.93 - - [17/Jul/2020 14:35:46] "POST / HTTP/1.1" 200 - I will open case with Splunk support.
... View more
07-13-2020
06:00 AM
@martinnepolean May need to reset the TA_MS_O365_Reporting_checkpointer 's max_date: To check: curl -k -u admin -H "Content-Type: application/json" -X GET https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/ To set: curl -k -u admin -H "Content-Type: application/json" -X POST https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/batch_save -d '[{ "state": "{\"max_date\": \"2020-07-09 07:22:00\"}", "_user": "nobody", "_key": "your_inputname_checkpoint" } ]
... View more
07-13-2020
05:12 AM
@martinnepolean I've to constanty check on the latest 1.2.1TA (having to disable & enable the input) & running tail -500f /opt/splunk/var/log/splunk/ta_ms_o365_reporting_ms_o365_message_trace.log|egrep "Start date|return|batch_save|max_date" Are you seeing any "Number of messages returned:" and "batch_save" ? 2020-07-13 08:05:38,881 DEBUG pid=28145 tid=MainThread file=base_modinput.py:log_debug:288 | Start date: 2020-07-08 19:52:32.511000, End date: 2020-07-08 20:52:32.511000 2020-07-13 08:06:45,692 DEBUG pid=28145 tid=MainThread file=base_modinput.py:log_debug:288 | Number of messages returned: 63039 2020-07-13 08:07:00,460 DEBUG pid=28145 tid=MainThread file=binding.py:post:750 | POST request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/batch_save (body: {'body': '[{"_key": "Company_MO365_checkpoint", "state": "{\\"max_date\\": \\"2020-07-08 20:52:32.465485\\"}"}]'}) 2020-07-13 08:07:00,489 DEBUG pid=28145 tid=MainThread file=connectionpool.py:_make_request:437 | https://127.0.0.1:8089 "POST /servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/batch_save HTTP/1.1" 200 45 2020-07-13 08:07:08,528 DEBUG pid=28666 tid=MainThread file=base_modinput.py:log_debug:288 | Start date: 2020-07-08 20:52:32.465485, End date: 2020-07-08 21:52:32.465485
... View more
07-12-2020
04:24 PM
Issue is resolved for my case. Was trying to get O365 MessageTrace logs which are older than 10 days (https://docs.microsoft.com/en-us/powershell/module/exchange/get-messagetrace?view=exchange-ps) so was getting the http 400 bad request code . Did a completely new install of the newest TA version 1.2.1 and set the Start date/time to 10 days ago 2020-07-02T19:00:00 . Lesson learnt to have an alert for no O365 MessageTrace log because cannot get logs older than 10 days. Log of the successful run: 2020-07-12 18:53:20,548 DEBUG pid=9848 tid=MainThread file=base_modinput.py:log_debug:288 | Start date: 2020-07-02 19:00:00, End date: 2020-07-02 20:00:00 2020-07-12 18:53:20,548 DEBUG pid=9848 tid=MainThread file=base_modinput.py:log_debug:288 | Endpoint URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate eq datetime'2020-07-02T19:00:00Z' and EndDate eq datetime'2020-07-02T20:00:00Z' 2020-07-12 18:53:20,548 INFO pid=9848 tid=MainThread file=setup_util.py:log_info:117 | Proxy is not enabled! 2020-07-12 18:53:20,549 DEBUG pid=9848 tid=MainThread file=connectionpool.py:_new_conn:959 | Starting new HTTPS connection (1): reports.office365.com:443 2020-07-12 18:53:23,059 DEBUG pid=9848 tid=MainThread file=connectionpool.py:_make_request:437 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-02T19:00:00Z'%20and%20EndDate%20eq%20datetime'2020-07-02T20:00:00Z' HTTP/1.1" 200 None 2020-07-12 18:53:23,171 DEBUG pid=9848 tid=MainThread file=base_modinput.py:log_debug:288 | Next URL is https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-07-02T19%3A00%3A00Z'%20and%20EndDate%20eq%20datetime'2020-07-02T20%3A00%3A00Z'&$skiptoken=1999 .... 2020-07-12 18:54:11,931 DEBUG pid=9848 tid=MainThread file=connectionpool.py:_make_request:437 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$ filter=StartDate%20eq%20datetime'2020-07-02T19%3A00%3A00Z'%20and%20EndDate%20eq%20datetime'2020-07-02T20%3A00%3A00Z'&$skiptoken=51999 HTTP/1.1" 200 37202 2020-07-12 18:54:11,939 DEBUG pid=9848 tid=MainThread file=base_modinput.py:log_debug:288 | Number of messages returned: 52751 2020-07-12 18:54:11,939 DEBUG pid=9848 tid=MainThread file=base_modinput.py:log_debug:288 | Max date before getting message: 2020-07-02 19:00:00 2020-07-12 18:54:20,879 DEBUG pid=9848 tid=MainThread file=base_modinput.py:log_debug:288 | Max date after getting messages: 2020-07-02 19:59:59.850906 2020-07-12 18:54:20,879 DEBUG pid=9848 tid=MainThread file=binding.py:post:750 | POST request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/batch_save (body: {'body': '[{"_key": "Company_O365_Reporting_checkpoint", "state": "{\\"max_date\\": \\"2020-07-02 19:59:59.850906\\"}"}]'}) 2020-07-12 18:54:20,884 DEBUG pid=9848 tid=MainThread file=connectionpool.py:_make_request:437 | https://127.0.0.1:8089 "POST /servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/batch_save HTTP/1.1" 200 45 2020-07-12 18:54:20,885 DEBUG pid=9848 tid=MainThread file=binding.py:new_f:73 | Operation took 0:00:00.005899
... View more
07-10-2020
03:45 PM
Also having this issue on Splunk 8.0.3 with version 1.2.1 July10 (https://splunkbase.splunk.com/app/3720/#/overview). Tried with version 1.2.0 also same issue. Came from version 1.1.0 which was working fine until 6/20/2020 2020-07-10 18:39:27,479 DEBUG pid=25523 tid=MainThread file=base_modinput.py:log_debug:288 | Start date: 2020-06-20 09:04:53, End date: 2020-06-20 09:14:53 2020-07-10 18:39:27,479 DEBUG pid=25523 tid=MainThread file=base_modinput.py:log_debug:288 | Endpoint URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate eq datetime'2020-06-20T09:04:53Z' and EndDate eq datetime'2020-06-20T09:14:53Z' 2020-07-10 18:39:27,479 INFO pid=25523 tid=MainThread file=setup_util.py:log_info:117 | Proxy is not enabled! 2020-07-10 18:39:27,480 DEBUG pid=25523 tid=MainThread file=connectionpool.py:_new_conn:959 | Starting new HTTPS connection (1): reports.office365.com:443 2020-07-10 18:39:27,758 DEBUG pid=25523 tid=MainThread file=connectionpool.py:_make_request:437 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-06-20T09:04:53Z'%20and%20EndDate%20eq%20datetime'2020-06-20T09:14:53Z' HTTP/1.1" 400 102 2020-07-10 18:39:27,760 ERROR pid=25523 tid=MainThread file=base_modinput.py:log_error:309 | HTTP Request error: 400 Client Error: Bad Request for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2020-06-20T09:04:53Z'%20and%20EndDate%20eq%20datetime'2020-06-20T09:14:53Z I could use the browser and get to https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate eq datetime'2020-06-20T09:04:53Z' and EndDate eq datetime'2020-06-20T09:14:53Z' and download the MessageTrace json file ok @SplunkWorks development team, help please. Thanks.
... View more
07-02-2020
07:26 AM
Hi @Vijeta , Could you or someone advise what was the fix? Still seeing Splunk Connect for Zoom Version 1.0.1 April 23, 2020. Anyone has to allow Zoom events traffic from https://marketplace.zoom.us/user/logs to be sent to one's Internal Splunk HF running Splunk connect for Zoom listening on 4443? Thanks
... View more
03-20-2020
05:59 PM
Hi,
Followed the steps in https://www.netsparker.com/support/netsparker-enterprise-addon-splunk/#how-to-configure-input
but getting:
ondemand.netsparker.cloud:443 port is closed
also tried with https://www.netsparkercloud.com but getting:
HTTPError: 503 Server Error: Service Unavailable for url: https://www.netsparkercloud.com/api/1.0/issues/allissues?websiteGroupName=&webSiteName=&page=1
Any support from Netsparker tech team?
Thanks
... View more
03-16-2020
02:17 PM
ddrillic, Iguinn2, I am trying to do the |inputlookup largefile.csv |outputlookup largefile, as per https://dev.splunk.com/enterprise/docs/developapps/kvstore/migrateyourappfromusingcsv/ . The csv file is +200MB with +1.5mil rows, to try reduce the bundle size. is it stable or advisable to do maxresultrows = 5000000 ?
... View more
03-13-2020
11:57 AM
Per DUO support, Splunk DUO connector 1.1.6b and 1.1.6 do not support v2 auth logs; therefore, the connector won't be able to pull those 2FA device IP's in the logs. When will the updated Splunk DUO connector which can support v2 auth logs be available? Thanks.
... View more
01-30-2020
09:34 AM
1 Karma
Thanks for the link @rpille_splunk . But with Splunk 7.3.4 and Splunk TA AWS version 5.0.0 when clicked on "IAM Role" tab only saw "Loading..." & I'm getting following message also:
Unable to initialize modular input "splunk_ta_aws_sqs" defined in the app "Splunk_TA_aws": Introspecting scheme=splunk_ta_aws_sqs: script running failed (exited with code 1)..
... View more
01-09-2020
11:58 AM
Thanks for the information innerdna, that it was the fix for my issue too.
... View more
11-20-2019
07:37 AM
1 Karma
I specified curl -vk -u admin:password --request DELETE https://sh-ip-address:8089/servicesNS///data/lookup-table-files/test.csv
Anyone got the following in a clustered SH env?
<msg type="ERROR">Object id=test.csv cannot be deleted in config=lookups.</msg>
... View more
11-19-2019
05:43 AM
Hi somesoni2,
From your above example, I got following query which is supposed send an email of the result, if result > 0 to predefined user email. The src_email needs to be dynamically set. But it is sending the email even though there is no result. Please advise how to update it to only sendemail when result > 0. Thanks
earliest=-60m@m index=network comment="Comment"
| dedup local_start_time src_name src_number src_email src_site src_location dest_name dst_number
| table local_start_time src_name src_number src_email src_site src_location dest_name dst_number
| eval from=src_email | sendemail
[ search earliest=-60m@m index=network comment="Comment"
| dedup local_start_time src_name src_number src_email src_site src_location dest_name dst_number
| table src_email
| rename src_email as from] to="mike@company.org" format=table subject="Comment" server=mail.company.org sendresults=true inline=true
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a month ago
|
