Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bhsakarchourasi
bhsakarchourasi
Path Finder
Member since:
09-25-2019
07-08-2024
Community Statistics
| Posts | 39 |
| Solutions | 4 |
| Karma Given | 6 |
| Karma Received | 2 |
| Member Since | 09-25-2019 |
Activity Feed
- Karma Re: indexer internal logs for gcusello. 04-24-2023 01:00 AM
- Karma Re: indexer internal logs for isoutamo. 04-24-2023 12:44 AM
- Posted Re: indexer internal logs on Getting Data In. 04-24-2023 12:18 AM
- Posted Why can't we see indexer internal logs? on Getting Data In. 04-20-2023 10:46 AM
- Posted Re: Notable info could not be obtained: : unidentified in content management adaptive response actions. on Splunk Enterprise Security. 03-23-2023 09:58 PM
- Posted Re: Notable info could not be obtained: : unidentified in content management adaptive response actions. on Splunk Enterprise Security. 03-17-2023 11:11 PM
- Karma Re: Microsoft Azure Event Hub Pulls - Wrong Offset Error for cornemrc. 03-16-2023 10:52 PM
- Posted Notable info could not be obtained: : unidentified in content management adaptive response actions? on Splunk Enterprise Security. 03-16-2023 10:50 PM
- Posted Re: TIME_PREFIX configuration is not working on Getting Data In. 12-23-2022 11:18 PM
- Posted TIME_PREFIX configuration is not working on Getting Data In. 12-23-2022 07:13 PM
- Posted Re: Import Azure NSG LOGs on Splunk Search. 10-21-2022 06:11 AM
- Karma Re: Import Azure NSG LOGs for ejwade. 10-21-2022 06:08 AM
- Posted Why is Splunk add-on for okta identity cloud is not able to pull logs from Okta cloud? on Getting Data In. 10-17-2022 10:43 PM
- Posted Splunk addon for Microsoft Cloud Services event hub input partial log collection issue on All Apps and Add-ons. 09-30-2022 08:23 AM
- Karma Re: Why is a value appearing twice in a table but only occurs once in the event data? for jbillings. 09-14-2022 06:10 AM
- Got Karma for Re: Tag field is not showing in tstats search. 08-24-2022 02:55 AM
- Posted Why am I time zone difference between event time and index time? on Getting Data In. 04-01-2022 04:51 AM
- Tagged Why am I time zone difference between event time and index time? on Getting Data In. 04-01-2022 04:51 AM
- Karma Re: DHCP server log time parsing issue for PickleRick. 03-03-2022 12:37 AM
- Posted Re: DHCP server log time parsing issue on Getting Data In. 03-03-2022 12:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-24-2023
12:18 AM
This is solved but I am still not convinced with resolution, after spending hours on troubleshooting we circled back to the changes performed in last one week, then found a small typo in props.conf of one of the app pushed to indexers and search heads. disabling that app in indexers resolved the issue (later corrected the typo in idx and SHs), not sure how a typo in a app halted internal logs of indexers and some of the UFs. We have asked splunk to help investigate the issue.
... View more
04-20-2023
10:46 AM
Hi All,
we are unable to see the indexers internal logs in _internal index, except mongodb logs. we verified that the input configuration is present in default inputs.conf but while checking in splunkd.log there is no TailReader process logs, the only logs which is related to seekptr (generally seen when there is rollover of the log file). We even tried configuring inputs.conf with different index and sourcetype for splunkd.log but it didn't worked.
Also there are almost half of the UFs stopped reporting to indexers. there are 6 indexers in cluster.
Any idea about the issue will be very helpful.
Thanks,
Bhaskar
... View more
- Tags:
- _internal logs
Labels
- Labels:
-
indexer
03-23-2023
09:58 PM
The issue was related to KV store, while troubleshooting we found that the KV store status of starting hence we checked whether the cluster members are able to communicate to each other on KV port. Enabling the KV store port between all the cluster member resolved the issue.
... View more
03-17-2023
11:11 PM
Upgraded the ES version to 7.1 but still facing same issue, any reference would be very helpful. Thanks.
... View more
03-16-2023
10:50 PM
Hi All,
we have newly installed ES cluster where we cannot see the any action populating in adaptive response. We tried installing ES on stand alone server it works fine. Below is the error we are getting. Splunk version is 8.2 and ES 7.0.2.
Thanks in advance
... View more
12-23-2022
11:18 PM
Hi, Thanks for the reply, that's correct, regex can be changed as per your suggestion, can you also provide a logical explanation for having this configuration on search head. I not able to figure this out as far as I understood time prefix should work if it's present in Indexer and HF. Thanks, Bhaskar
... View more
12-23-2022
07:13 PM
Hi All, We are working in Splunk Cloud environment, I want to deploy custom the TIME_PREFIX configuration for one of the log source, we have tested the configuration in Splunk stand alone box, it works fine, we have deployed the same configuration on Splunk Cloud indexers and IDM node, but it's not working. Below is my props configuration. TIME_PREFIX = "time":\s*" MAX_TIMESTAMP_LOOKAHEAD = 128 sample value: , "time": "2022-12-24T02:36:55.9183013Z", My question is do I need to deploy this configuration on search heads as well. Thanks, Bhaskar
... View more
- Tags:
- time configuration
Labels
- Labels:
-
field extraction
-
index
-
props.conf
-
sourcetype
10-21-2022
06:11 AM
Hi, Thanks for the solution it works for me, although we have another ask from client to extract the rule name, have you ever tried or achieved to extract the rule name from the event. We have tried putting transforms before SEDCMD (looks silly.. 😄 but really that it will work) but it's not working. Looking forward for your reply. Thanks, Bhaskar
... View more
10-17-2022
10:43 PM
Hi All,
We are currently in-progress of onboarding the okta identity cloud logs, we are using Splunk built add-on for okta identity cloud. when we configure input for test instance of okta cloud it works perfectly fine, but we are configuring the input for okta cloud production logs are not coming in.
we have tried below steps.
Disabling and re-enabling the input.
Deleting and re-creating the input.
Creating a new API input in Okta.
Changing the configuration items to high and low values.
Changed the interval to higher values.
Reviewed internal logs for errors.
Testing the API key locally (which was successful).
Configured the API key in different heavy forwarder
While checking on okta side it shows rate limit warning.
Any help would be very appreciated.
Thanks,
Bhaskar Chourasiya
... View more
Labels
- Labels:
-
modular input
09-30-2022
08:23 AM
Hi All, we are facing a issue in Splunk Add-on for Microsoft Cloud Services event hub input, there are multiple inputs we have created and almost all the inputs are collecting partial logs. We are checking the count of event at Azure Log Analytics workspace and at the same time checking events on Splunk there is random difference in event collection. There are no errors in internal logs, although we can see some warning messages, we tried increasing the ingestion pipeline to 4. tried disabling all the inputs but kept only one to check if that's making any issue. Splunk deployment is single instance test environment where 32vCPU and 64 GB memory is assigned, storage is more than 800 IOPS. Not much of the application are installed. Splunk support case is also opened but till now they haven't able to find any root cause. Need suggestions and inputs if someone else has faced such issue. Little back ground on architecture, we have multiple data sources (Azure Activity & AD) sending logs to one event hub and we are segregating the sourcetypes in splunk by transforming data based on category and resourceId. Please help to resolve this issue. Thanks Bhaskar
... View more
Labels
04-01-2022
04:51 AM
Hi All,
I am facing an issue related to time zone interpretation, one server which is configured with CET and sending log splunk cloud (in my best knowledge indexers are placed in GMT timezone). This server sends syslogs to SC4S servers configured with GMT time zone. Event Time value in splunk is being picked as per the raw event time. Since splunk indexers are GMT, SC4S is in GMT, I am getting time difference between event time (server time/ CET time zone) and index time (GMT time zone).
please help, how can I resolve this issue of huge time difference in event time and index time.
Thanks,
Bhaskar
... View more
Labels
- Labels:
-
HTTP Event Collector
-
Linux
-
syslog
03-03-2022
12:36 AM
That's helpful, but still didn't answer for two different index time for different events from same machine Thanks Bhaskar
... View more
03-03-2022
12:17 AM
Thanks for the reply, I don't think this is something related to time zone (maybe correct me if I am wrong) because both logs are from same server. first is interpreted differently where second has different time parsing. What I understand is universal forwarder first gives the preference if raw contains the TZ info, second it consider the device TZ, third would be converting TZ based on indexer timezone settings and at last if configure TZ on UFs itself. Thanks, Bhaskar
... View more
03-02-2022
11:39 PM
Hi All,
we have onboarded windows DHCP servers on splunk cloud by installing UFs on each server. DHCP server writes logs on local log file and universal forwarder sends logs direct to splunk cloud.
The problem is logs are getting ingested to splunk with varied time difference. See the screenshot below, first log generated at 00:38 and indexed at 5:38 exact 5 hours difference where second log generated at 19:58 but indexed at 00:59 which has exact 7 hours of difference in event time (_time) and time in raw event but indexed at 00:59 and _time has been picked 00:58.
Please help to understand what can be the problem.
Thanks,
Bhaskar
... View more
- Tags:
- DhcpSrvLog
Labels
- Labels:
-
time
-
universal forwarder
-
Windows
05-25-2021
03:05 AM
Hi @guarisma - Have you resolved this issue, I ran into it and out of 4 partition only getting logs from 3 partitions and loosing 25 percent of logs. I think @jconger you are correct hence I have removed the input configuration and setup with new name but that didn't resolved my issue. Further, we did the same and configured new event hub with new name in azure than also issue didn't resolved. Thanks, Bhaskar
... View more
05-24-2021
09:36 PM
Hi, You can follow this link to resolve this issue. it might help. Solved: Re: Azure Event hub input error in Microsoft Cloud... - Splunk Community plz mark as answer if this resolve your issue. Thanks, Bhaskar
... View more
04-30-2021
05:39 AM
Hi andygerberkp, It depends if there is certificate base authentication is configured in your case than yes you need to import the certificate otherwise please connect with your azure team configure service principal permissions properly that should resolve the issue. Thanks, Bhaskar
... View more
02-28-2021
09:48 PM
1 Karma
We followed below link and provided built in ‘Azure Event Hubs Data Receiver’ role. https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal#assign-a-role-to-the-application Hope this will help you. Thanks.
... View more
- Tags:
- troubleshooting
02-26-2021
12:41 AM
Hi, Have your find any solution for this, in my case, we are not getting logs from event hub and in internal logs intermittently can see below error messages. I am using current version of Microsoft Cloud Services add on (4.1.1). 2021-02-26 08:14:18,418 level=WARNING pid=31978 tid=Thread-1 logger=uamqp.connection pos=connection.py:work:255 | ConnectionClose('ErrorCodes.UnknownError: Connection in an unexpected error state.') 2021-02-26 08:54:28,165 level=INFO pid=127352 tid=Thread-1 logger=__main__ pos=mscs_azure_event_hub.py:_work_proc:465 | datainput="securitycenter" start_time=1614326067 | message="Start receiving events." max_wait_time=20 max_batch_size=300 2021-02-26 08:54:27,680 level=INFO pid=127352 tid=MainThread logger=splunksdc.collector pos=collector.py:run:246 | | message="Modular input started." [2:06 PM] Bhaskar Chourasiya EXT 2021-02-26 08:54:25,620 level=INFO pid=31978 tid=MainThread logger=splunksdc.collector pos=collector.py:run:249 | | message="Modular input exited." 2021-02-26 08:54:25,605 level=INFO pid=31978 tid=MainThread logger=splunksdc.loop pos=loop.py:is_aborted:38 | datainput="securitycenter" start_time=1614307646 | message="Loop has been aborted." Thanks, Bhaskar
... View more
02-26-2021
12:31 AM
Further to this. Last error has been resolved by providing proper entitlement to service principal. currently getting below messages in event hub input internal logs. 2021-02-26 08:54:25,605 level=INFO pid=31978 tid=MainThread logger=splunksdc.loop pos=loop.py:is_aborted:38 | datainput="securitycenter" start_time=1614307646 | message="Loop has been aborted." 2021-02-26 08:14:18,418 level=WARNING pid=31978 tid=Thread-1 logger=uamqp.connection pos=connection.py:work:255 | ConnectionClose('ErrorCodes.UnknownError: Connection in an unexpected error state.') Thanks, Bhaskar
... View more
- Tags:
- troubleshooting
02-22-2021
09:09 PM
Hi All, This issue is partially resolved by providing root certificate into configuration. path to the certificate is /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/3rdparties/python3/certifi/cacert.pem I would say addon error handling is not clear enough to show correct error message so that may need to be updated in coming versions. Now we are getting below error in event hub inputs configuration. I will be working on it once it resolve I will post the solution, if anyone has faced this issue earlier, comment will be much appreciated. 2021-02-22 13:42:21,663 level=WARNING pid=37627 tid=Thread-1 logger=uamqp.receiver pos=receiver.py:get_state:270 | LinkDetach("ErrorCodes.UnauthorizedAccess: Unauthorized access. 'Listen' claim(s) are required to perform this operation. Resource: 'sb://xyz-namespace.servicebus.windows.net/diagnosticlogs/consumergroups/$default/partitions/0'. TrackingId:d02679b0b93f4cbda26ac45bce14cdf2_G46, SystemTracker:gateway5, Timestamp:2021-02-22T12:42:2 Thanks in advance Bhaskar
... View more
- Tags:
- add on
02-16-2021
10:26 PM
Hi All, We saw there is update released for Microsoft Cloud Services add on splunk base which describe near to same issue that we are facing with this add on so we tried upgrading the add on but still didn't worked for us. Plz help to resolve this issue. Thanks in advance. Bhaskar
... View more
02-16-2021
04:59 AM
Hi All, we are getting below error while adding app account configuration in Microsoft Cloud Services Add On from web UI. REST Error [400]: Bad Request -- Account authentication failed. Please check your credentials and try again So to do this configuration as per documentation we did the same from command line and now it seems to be saved without any error. But after configuring inputs for event hub it's giving below error message in sourcetype=mscs:azure:eventhub:log 2021-02-16 13:36:51,248 level=ERROR pid=50816 tid=MainThread logger=__main__ pos=utils.py:wrapper:72 | datainput="Test" start_time=1613479010 | message="Data input was interrupted by an unhandled exception." Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/utils.py", line 70, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_event_hub.py", line 597, in run credential = self._create_credentials(config, proxy) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_event_hub.py", line 505, in _create_credentials args = parser.parse(content) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 125, in parse stanza[field.key] = field.parse(content) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 156, in parse value = super(IntegerField, self).parse(document) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 139, in parse raise KeyError("%s not exists" % self._key) KeyError: 'account_class_type not exists' First, thing I doubt about is add on making request to azure cloud for authentication because I tried providing other credentials which are working fine with other add on (O365) are also giving same error. Second, if app account configuraiton is saved without any error are working or not working (as I can't see error in splunkd logs, it was coming when trying to configure from web UI). Third, what will be the stanza for 'account_class_type' to put in conf file as it's not mentioned in documentation. Thanks, Bhaskar
... View more
Labels
01-26-2021
10:44 AM
Hi All, I got into a error while setting up Microsoft Azure Add on for Splunk. Everything seems to be correct on configuration stands point but getting below error in internal logs . _Splunk_ error collecting event hub data: Token authentication failed: 'utf-8' codec can't decode byte 0xe4 in position 0: invalid continuation byte Any words are much appreciated. Thanks, Bhaskar
... View more
Labels
- Labels:
-
other
11-25-2020
09:50 PM
Hi Guys, Please help, now the required events are not coming data model at all, where I can see all the events are tagged properly, relevant fields are mapped to data model. Is there something that I am missing currently. Thanks, Bhaskar
... View more
