Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About antlefebvre
antlefebvre
Communicator
Member since:
07-20-2012
09-05-2023
Community Statistics
| Posts | 79 |
| Solutions | 7 |
| Karma Given | 34 |
| Karma Received | 47 |
| Member Since | 07-20-2012 |
Activity Feed
- Got Karma for Re: Why am I getting error "Could not use regex to parse timestamp..." for timestamps before November 2010?. 10-21-2021 08:29 AM
- Got Karma for Re: Why Splunk triggered alert is not working for my script and getting error "'OPENSSL_1.0.0' not found (required by ssh)"?. 07-29-2021 04:45 AM
- Got Karma for Re: Why am I getting error "Could not use regex to parse timestamp..." for timestamps before November 2010?. 04-12-2021 12:21 AM
- Karma Re: How can I monitor VMware Horizon View with Splunk? for canalesjac. 06-05-2020 12:51 AM
- Karma Does the Splunk Community have a COVID-19 Folding at Home (fah) Group? for jkat54. 06-05-2020 12:51 AM
- Karma What are the pain points with deploying your Splunk architecture on Windows OS? for woodcock. 06-05-2020 12:48 AM
- Karma Why am I getting incorrect results from btool during diagnostics for a Splunk 6.3.1 Windows universal forwarder? for wyfwa4. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting error "Could not use regex to parse timestamp..." for timestamps before November 2010?. 06-05-2020 12:48 AM
- Got Karma for Re: How to migrate buckets from a standalone indexer to a new indexer in a multisite cluster?. 06-05-2020 12:48 AM
- Got Karma for How to migrate buckets from a standalone indexer to a new indexer in a multisite cluster?. 06-05-2020 12:48 AM
- Got Karma for How to migrate buckets from a standalone indexer to a new indexer in a multisite cluster?. 06-05-2020 12:48 AM
- Karma Re: Why Splunk triggered alert is not working for my script and getting error "'OPENSSL_1.0.0' not found (required by ssh)"? for woodcock. 06-05-2020 12:47 AM
- Karma Re: Unix shell shock vulnerability: Is Splunk web or mgt port vulnerable to attacks when running on Unix system with shell shock vulnerability? for gkanapathy. 06-05-2020 12:47 AM
- Karma Proper etiquette and timing for voting here on Answers (particularly down-voting)? for woodcock. 06-05-2020 12:47 AM
- Karma Re: Proper etiquette and timing for voting here on Answers (particularly down-voting)? for richgalloway. 06-05-2020 12:47 AM
- Karma Re: Proper etiquette and timing for voting here on Answers (particularly down-voting)? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Forwarding events to an indexer cluster using an AWS ELB for dwaddle. 06-05-2020 12:47 AM
- Karma Re: How to do stats or top for each column in a table? for acharlieh. 06-05-2020 12:47 AM
- Karma Re: Timestamp parsing with separate Date and Time fields for richgalloway. 06-05-2020 12:47 AM
- Karma Re: Why does data stop getting indexed for a monitored file when Splunk is restarted, and how do I fix this? for emiller42. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 5 |
06-26-2019
09:49 AM
Not sure if this will work/apply for you. I did this with success on a ubuntu install (not windows) and entered true rather than 1. Splunk 7.2.5.
To do so, open etc/apps/Splunk_CiscoSecuriySuite/local/app.conf (or create it if it does not exist) and enter the following:
[install]
is_configured = true
You may need to restart Splunk after editing the config file. Splunk won't force you to view the setup screen once it recognizes the app is considered configured.
Original post here: https://answers.splunk.com/answers/12702/splunk-cisco-security-suite.html
... View more
01-03-2019
08:03 AM
3 Karma
I know this is a dated question, but ran into the same issue. The solution for me was to increase MAX_DAYS_AGO in props.conf. Looks like based on your description of it not working for 6 year old data this was your issue as well. Since Splunk by default ignores dates over 5 1/2ish years old.
From the docs site:
Specifies the maximum number of days in the past, from the current date, that an extracted date can be valid.
For example, if MAX_DAYS_AGO = 10, Splunk software ignores dates older than 10 days from the current date and instead either uses the timestamp of the previous event, or uses the current index time of the event if it cannot determine a timestamp in the previous event.
The maximum settable number of days in the past is 10951.
Defaults to 2000 days
Note: If you have data that is more than 2000 days old, increase this setting.
... View more
10-30-2017
07:37 AM
Be sure you have Java 8+ installed on the system. I installed Java 9 (assuming this fulfilled the 8+ requirement) and got the same error you are seeing. When I backed the Java version down to 8 the error went away and I was able to see the Alexa input.
... View more
05-17-2016
09:28 AM
I changed the %D to %d to make this work. Thanks @richgalloway
... View more
05-04-2016
07:57 AM
1 Karma
From Slack usergroup: Thanks guys! @dwaddle @Yorokobi @davidpaper
easy way: copy all buckets into the thawedb directory for each index on one of the indexers in the cluster. and manually roll them off when the data is no longer needed.
if a bucket is named <xxx>_<timestamp>_<timestamp> it's not clustered
<guid>_<xxx>_<timestamp>_<timestamp> is clustered
The replicated buckets are already (by definition) copied to other indexers, there's no need to copy them again.
... View more
05-03-2016
01:44 PM
2 Karma
Trying to understand what the procedure would be to migrate data. Situation:
Indexer was standalone. Has standalone buckets in some of its indexes. Was added to a multisite cluster. So now some buckets are clustered in those indexes.
Hardware for this indexer needs to be retired. What is the best procedure to migrate ALL data. Aging out isn't an option. Keeping the server around is also not an option.
Can I do as the migration guide states
http://docs.splunk.com/Documentation/Splunk/6.4.0/Installation/MigrateaSplunkinstance
and just copy the $SPLUNK_HOME directory and install Splunk over the top? That just seems too easy.
Will the new host join the cluster automagically?
Will I get duplicate data from the clustered buckets?
Do I need to decommission from the indexer cluster, migrate just the standalone buckets and then add the new host to the cluster?
If so, how would I know what buckets are the standalone buckets only?
Any guidance would be greatly appreciated!
... View more
10-20-2015
05:40 AM
Thanks for that info. I think I may be running into the latter. Is there any way to "fix" the tailing processor issue you have described?
... View more
10-19-2015
02:12 PM
I am attempting to monitor a file that is fairly large and on a UNC file share. It appears that the file only indexes up to the point at which I reboot the Splunk indexer that is monitoring the file. I am not using a universal forwarder. I configured the file input directly from a Splunk indexer/search head.
How would I make Splunk continue to monitor the file and add the data from after the Splunk reboot?
The file also grows extremely large. Growing to over 200 meg.
The source is a NetApp CIFS XML formatted log file.
Thanks in advance,
... View more
11-07-2014
11:35 AM
7 Karma
Much googling and trial and error got me to a solution. Hopefully someone hits this answer in the future and doesn't have to go through what I did.
To get the script above to work I had to call it with another script. I called it kickoffresetmcvpn.sh and the contents are:
#!/bin/bash
unset LD_LIBRARY_PATH
/opt/splunk/bin/scripts/resetmcvpn.sh
Make sure you enter the full path to the script you want this script to run. That caused me an hour of problems when I was running this in the same directory from the CLI, but it wasn't working from the triggered alert.
From the CLI I verified but entering /opt/splunk/bin/splunk cmd /opt/splunk/bin/scripts/kickoffresetmcvpn.sh
The end result of script kicking off the other script is that I can set a triggered alert to login to the firewall and reset a tunnel when the ping monitor shows the VPN status as down.
... View more
11-06-2014
12:09 PM
2 Karma
I am able to run my script resetmcvpn.sh with no issues from the ubuntu command line. The code below:
#!/usr/bin/expect -f
spawn ssh admin@10.2.1.59
expect "assword:"
send "thepassword\r"
expect "#"
send "config vdom\r"
expect "#"
send "edit root\r"
expect "#"
send "diagnose vpn tunnel reset 'my tunnel'\r"
expect "#"
send "exit\r"
The splunk triggered alert is not working for this. When I run:
/opt/splunk/bin/splunk cmd /opt/splunk/bin/scripts/resetmcvpn.sh
I get the error:
ssh: /opt/splunk/lib/libcrypto.so.1.0.0: version `OPENSSL_1.0.0' not found (required by ssh)
I have tried the solutions posted in other answers, but they require bash where I believe I am using expect? (I only know linux from what I can get from google)
Any help is MUCH apprectiated.
... View more
09-25-2014
08:34 AM
Splunk may be reading the time stamp as a string. Try this solution from the link theou provided :
For example, when Splunk indexes your data, it looks for a timestamp of the DATETIME datatype. If your timestamp is a string value (such as VARCHAR, NVARCHAR, etc.), you can try to convert the timestamp to the correct datatype using a custom SQL statement with CAST, CONVERT, or TO_TIMESTAMP functions.
... View more
09-25-2014
06:52 AM
You have a space in your time stamp format. Try throwing quotes around the string.
... View more
05-05-2014
12:20 PM
1 Karma
In your props.conf do
[sourcetype]
EXTRACT-prsnl_id = (?i)<prsnl_id>(?P<prsnl_id>[^<]+)
Where prsnl_id is the xml tag you would be trying to create the key value pair.
... View more
04-24-2014
07:48 AM
You can reindex with the new source, but once it is indexed Splunk is going to keep the events indexed as it was received. Which is why best practice would be to set up a test index you can use to verify you data is coming in as expected.
... View more
04-22-2014
12:00 PM
Try logging in as a local admin to the machine. Not a domain account. I have seen this happen when UAC is involved.
... View more
03-31-2014
12:21 PM
Crap... thanks for the explanation.
... View more
03-31-2014
07:06 AM
When piping fields into a table, the table eliminates extra spaces inside the field.
For example:
person_name="Smith MD, John" |table person_name
^^ (Two Spaces)
returns
Smith MD, John
^ (One Space)
This is terrible for forms when going from a broad * search to a single name search as copy/paste returns no results.
How do I get a table to return the field with ALL spaces that were in the raw event?
... View more
- Tags:
- table
03-19-2014
04:27 AM
1 Karma
It isn't a solution, it is THE solution. You will run into that issue if you use an LDAP browser or any other tool that requires LDAP integration. You need to fix it from the LDAP server, not the LDAP client.
Try downloading Softerra LDAP Browser. Query your OUs/groups that have over 1000 members and you will see the issue.
... View more
03-18-2014
05:59 AM
1 Karma
I assume you are using Active Directory. You will want to change MaxPageSize. Default is 1000.
http://support.microsoft.com/kb/315071
... View more
03-14-2014
12:00 PM
Do you have a load balancer in your environment? If so, you just put the same forwarder config on 2 different machines. Point the firewalls at the balancer, balancer at the forwarders, and the forwarders will send the data to the indexers.
... View more
03-14-2014
11:43 AM
hostname from the cli isn't always the same as the hostname of the forwarder. Check your $SPLUNK/etc/system/local/inputs.conf and see what the host= is for that server.
... View more
03-14-2014
11:38 AM
5 Karma
http://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps
Refer to the zoneinfo database for all permissible TZ values: http://en.wikipedia.org/wiki/List_of_zoneinfo_timezones
... View more
03-14-2014
11:28 AM
I would imagine a load balancer would be your best bet. If you have to perform maintenance to your forwarders if you do them one at a time the load balancer would see the device as down and send the traffic to an available forwarder.
... View more
03-11-2014
02:14 PM
I'm guessing your full search is pulling the Account_Name from the security index. Not the randomlogs index. In that case your not actually getting a event matches with the termdate.
... View more
03-11-2014
01:17 PM
Check to make sure your extractions are the same case as what you are trying to list. TermDate is not the same as termdate.
... View more
