About pbrunel_splunk

pbrunel_splunk · ‎03-14-2017

Good idea, but sadly that doesn't work either. On the chart, all points are assigned a value of _time=0. Would post a screenshot, but already exceeded my two img upload limit for this post.

pbrunel_splunk · ‎03-14-2017

I'm looking to create a multi-series scatter plot where time is on the x-axis. An example would be something like this: Attempts to do this in splunk are failing. Given the format requirements: ... | table marker_name_field x-axis_field y-axis_field In the first attempt, using _time, all points are assigned an x-value of 0, like splunk can't understand the timestamp in its native/textual format. (see example below) Using the timestamp in epoch format works in that it will correctly display points along the x-axis, but having a timestamp in that format is not human interpretable, so is not particular useful or viable as an option. (see example below) Short of using D3 to create a custom viz, is there something I'm missing, or are Splunk's native viz capabilities unable to create this kind of chart?

pbrunel_splunk · ‎04-13-2016

1) SAML2.0 is pretty standard. What makes Splunk support only specific Identity Providers rather than all the standard SAML2.0 implementations out there?! Every vendors implement portion of SAML 2.0 and leave out the rest. We need to test / ensure that the IdP works with our code base. This will help us to meet our cloud related SLA to our customers. 2) Does Splunk Cloud support deep link URLs? Yes we do, We track the user’s link(example – a saved search link etc.) using the ‘relayState’ parameter of SAML. When a user logs in using SAML, we sent the user’s link to the IDP as a part of the SAML request in a SP initiated workflow. Once the user is authenticated, we get the relayState back in the SAML response and we redirect the user to the link. 3) Which default SAML binding does Splunk require HTTP POST Or REDIRECT Or ARTIFACT?! Does it support other bindings too? We support POST (6.3/6.4), REDIRECT (6.4.1) 4) How can I get the sp metadata from Splunk Cloud? Log in as a local user. Navigate to splunkweb’s endpoint - ‘https://:/en-us/saml/spmetadata' endpoint. This has Splunk’s SP metadata and you can copy the entire xml out. Note:- If saml is not configured, a template entity id called ‘SplunkentityId’ is generated as a placeholder. This entity id can be changed when SAML is configured. #thankyoueng

pbrunel_splunk · ‎01-15-2016

One way might be to have a periodic dump of Active directory users into a lookup file using the SA for LDAP. The dump would include all relevant information like the domain, username, and first & last names for the users. You could then use a lookup to resolve the field in the logs to what's in AD. Make sense? Can go into more detail if needed.

pbrunel_splunk · ‎11-14-2014

The docs mention installs need to be done as root (but don't really explain why) - http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/RunSplunkasadifferentornon-rootuser Some answers refer to the need to provide, to the user running splunk, access to /dev/urandom, though it isn't clear why that's necessary (encryption?) - http://answers.splunk.com/answers/49153/install-splunk-as-non-root-user.html What aspects of the installation of splunk require root privileges? For the more security conscious sysadmins out there, being able to install splunk without opening the root kimono would be much more preferable. BTW, as a test, I installed splunk as a non-root user (on a host where splunk was already installed), then brought up this new instance as that user, and verified there weren't any errors during startup. I also verified that i could login to the UI and do basic navigation. So at first glance, it looks like the root privileges aren't a requirement. Then again, this was far from a thorough shake-out test, and could've missed something.

pbrunel_splunk · ‎09-30-2014

Are any results returned at all by that search? Or do you only see that error when looking at earlier time buckets in the timeline? And is this a distributed search environment? It could be that you're running up against the remote_timeline_max_size_mb property in limits.conf. This controls how much of the data returned by the search peer will actually get stored in the search's dispatch directory. The default is 100mb, and if the peer returns more than that, splunk will only actually store the latest 100mb worth. For all earlier events, when attempting to look at them by clicking on a bucket in the timeline, you'll get that message.

Posts	6
Solutions	1
Karma Given	9
Karma Received	9
Member Since	‎07-10-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

creating a scatterplot with time on the x-axis

Why does splunk need to be installed as root?

Re: creating a scatterplot with time on the x-axis

creating a scatterplot with time on the x-axis

Re: How to integrate SAML authentication for Splun...

Re: Resolving Windows Domain users in IIS logs

Why does splunk need to be installed as root?

Re: Why am I getting "Error fetching event from se...