Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kozanic_mg
kozanic_mg
Explorer
Member since:
10-31-2019
07-27-2021
Community Statistics
| Posts | 10 |
| Solutions | 2 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 10-31-2019 |
Activity Feed
- Posted Is there a way to be able to view users without having Edit User access? on Splunk Enterprise. 04-26-2021 06:38 PM
- Posted Re: Configuring SAML via .conf files only - can it be done? on Splunk Enterprise. 04-25-2021 10:09 PM
- Posted Re: Configuring SAML via .conf files only - can it be done? on Splunk Enterprise. 04-25-2021 07:02 PM
- Posted Configuring SAML via .conf files only - can it be done? on Splunk Enterprise. 04-22-2021 11:13 PM
- Karma Re: how can i find a directory where i installed splunk in centos? for bandit. 12-10-2020 03:50 PM
- Posted Re: Users with multiple roles - effective settings for search Disk Usage on Splunk Enterprise. 10-29-2020 10:17 PM
- Posted Re: Is there a way to increase the maxQueueSize for Syslog output? on Getting Data In. 10-29-2020 10:04 PM
- Posted Users with multiple roles - effective settings for search Disk Usage on Splunk Enterprise. 10-21-2020 10:56 PM
- Posted Re: Does putting indexer into manual detention roll active hot buckets? on Splunk Enterprise. 07-23-2020 03:32 PM
- Karma Re: Does putting indexer into manual detention roll active hot buckets? for isoutamo. 07-23-2020 03:32 PM
- Posted Re: Does putting indexer into manual detention roll active hot buckets? on Splunk Enterprise. 07-23-2020 03:29 PM
- Karma Re: Does putting indexer into manual detention roll active hot buckets? for richgalloway. 07-23-2020 03:29 PM
- Posted Does putting indexer into manual detention roll active hot buckets? on Splunk Enterprise. 07-22-2020 05:27 PM
- Karma SHC - failed on handle async replicate request for ahartge. 06-05-2020 12:50 AM
- Karma How to configure a Splunk 6.2.3 search head cluster behind an AWS Elastic Load Balancer (ELB) to terminate SSL? for jnicholsenernoc. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-26-2021
06:38 PM
We have a situation where we need to have General day to day admin Role and an Elevated admin role. Day to Day will allow for most things, but should not allow for creation / deletion of local accounts. Setting this up is easy, only issues is, even though I have admin all objects, I'm not able to see any other users details - i.e. I can't see any other users when I try to re-assign objects, I can't see any other users details when running rest calls - to see how they are set-up etc. Just wondering if anyone else has run into anything like this and managed to figure out a way to work around it?
... View more
Labels
04-25-2021
10:09 PM
So... worked out that I was missing IDP cert change within my new build, once added everything just started working and all SAML settings available within GUI as well.
... View more
04-25-2021
07:02 PM
After a weekend to clear the brain - I have found this which indicates that config can be done via .conf files: https://docs.splunk.com/Documentation/Splunk/8.1.3/Security/ConfigureSAMLSSO Now I just have to figure out why it's not working in my environment and why the settings I have configured via files are not showing in the GUI
... View more
04-22-2021
11:13 PM
We are deploying SHC into AWS via pipeline code and attempting to configure SAML integration as part of the build but having some issues. When I check using btool, all the saml details are correct, but if I check details via the GUI - nothing is populated and when I attempt to use SAML to login - I get errors about blank content being passed. If I update the GUI as well - then things seem to work - but this is not something we want to do every time we do a new build. Just wondering if anyone else out there has come across this and worked something out?
... View more
Labels
- Labels:
-
configuration
-
using Splunk Enterprise
10-29-2020
10:17 PM
Have managed to work out this report which give me what I need: | rest /services/authentication/users splunk_server=local | fields title roles | rename title as username | mvexpand roles | search roles IN (<Add role list here if you have limited number that provide functional access - or remove this like if you need to search all roles>) | join type=left roles [| rest /services/authorization/roles splunk_server=*search* | rename title as roles | table roles srchDiskQuota] | sort username -srchDiskQuota | eval CaptureDate = now() | table username, srchDiskQuota, roles, CaptureDate | inputlookup append=true ops_usersDiskQuota.csv | dedup username | outputlookup override_if_empty=false ops_usersDiskQuota.csv
... View more
10-29-2020
10:04 PM
Hi All, Just wondering if anyone has been able to come up with a fix / work-around for this issue. It's 5 yrs since it was originally asked and still it appears that the config options are very limited for this.
... View more
10-21-2020
10:56 PM
Hi All, We are trying to organise some monitoring / Alerting for users and search disk usage and I know SplunkAdmins app has some stuff, but we need something a little different. What I need atm is a way to determine a users effective settings as most users have at least 2 or more roles and I haven't found any clear way to determine what a given users allowance is to be able to configure an alert against. Not sure if I have just missed something simple? Hoping someone out there might have some suggestions. Thanks in advance!
... View more
Labels
07-23-2020
03:32 PM
thanks @isoutamo , Do you know whether we can use a wildcard option with is command? IE: splunk _internal call /data/indexes/*/roll-hot-buckets I have been advised that this should work, but we are currently having issues with our non prod environment and so haven't been able to test to confirm.
... View more
07-23-2020
03:29 PM
Thanks Rich - exactly the answer I was after. Agreed on the autoheal, unfortunately for our situation we don't have any choice so will need to look into how best we can manage the process.
... View more
07-22-2020
05:27 PM
Hi All,
We are trying to work out the best method for rolling our Indexer stack in AWS.
We have recently migrated to Smartstore and 1 week after migration had a number of indexers autoheal which resulted in corrupted buckets all over the place.
Our current thought is to put indexers into manual detention mode prior to the stack roll, but not sure if this forces a bucket roll and replication to S3 or if there is another step required to force this action.
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-27-2021
02:24 PM
|
Karma given to
