About isoutamo

isoutamo

This is exactly the same solution what I propose. It’s even better learning experience that you are solving it by yourself;-) Happy splunking!

isoutamo

Here is a link https://regex101.com/r/GVLrA1/1 where you could read what those are meaning. There is also easy to chain it.

isoutamo

Hi ... | rex "^(?:\w+:){3}(?<region>[^:]+)" this should do the extraction. If the ARN is on field, then you should add “field=<field name>” in rex. r. Ismo

isoutamo

Hi you should look kvstore for this amount of data. Of course lookups are option, but it depends which one is better. https://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutKVstore https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/aboutkvstorecollections/ r. Ismo

isoutamo

Hi usual this means that db connection has some inputs/queries etc. which are running from several places like HF and SH regularly and enough often to get that account locked again. Sou you should change the password into the all identities and then probably again in db server and ensure that db account is not locked/revoked state in Oracle side. I cannot recall if it could locked also on OS / AD side too or only on Oracle db side. Maybe one possibility is that when account has reseted/password has changed there are not cleared “user must change password in next login”? r. Ismo

isoutamo

Hi I afraid that there is no that kind of option. On any SHC member you could see under Settings -> Distributed : search head cluster (or something similar) what is status for it and do some operations for SHC. r. Ismo

isoutamo

Hi We have lot of alert where we need to change alert.email.to recipients to new one. Those alerts are in SHC and those are done within years directly with GUI. So I cannot manually edit those files on OS level and I don't want to redistributed those with Deployer unless there haven't been any other option. Basically I can change that, but the issue is that it change hiddenly some other attributes which I cannot set with REST POST method. There seems to be at least own old unanswered questions already somehow touching this issue: https://community.splunk.com/t5/Splunk-Enterprise/Changed-save-searches-alert-cron-schedule-with-rest-api-bash/m-p/559595 What I have done: | rest /servicesNS/-/-/saved/searches | search disabled = 0 AND action.email = 1 AND is_scheduled = 1 | search action.email.to = "*<an old email>*" | search title = "*SPLUNK:Alarm testing Clone*" | rename eai:acl.owner as acl_owner, eai:acl.app as acl_app, eai:acl.sharing as acl_sharing | eval URL1 = replace(replace(title, " ", "%20"),":", "%3A") | eval URL = "curl -ku $PASS -X POST \"https://localhost:8089/servicesNS/" + acl_owner + "/" + acl_app + "/saved/searches/" + URL1 + "\" -d action.email.to=\"<the new email>\"" | fields URL This gives to me a shell command to run it for that individual alert ($PASS contains user:pass pair). When I run that curl -vku $PASS -X POST "https://localhost:8089/servicesNS/<user>/alerts_splunk/saved/searches/SPLUNK%3AAlarm%20testing%20Clone -d action.email.to="f.s@some.domain" It runs as expected, but when I do this query | rest /servicesNS/-/-/saved/searches splunk_server=splunk-shc* | search NOT eai:acl.app IN (splunk_instrumentation splunk_rapid_diag splunk_archiver splunk_monitoring_console splunk_app_db_connect splunk_app_aws Splunk_TA_aws SplunkAdmins Splunk_ML_Toolkit trackme) | rename "alert.track" as alert_track | eval type=case(alert_track=1, "alert", (isnotnull(actions) AND actions!="") AND (isnotnull(alert_threshold) AND alert_threshold!=""), "alert", (isnotnull(alert_comparator) AND alert_comparator!="") AND (isnotnull(alert_type) AND alert_type!="always"), "alert", 1==1, "report") | fields title type eai:acl.app is_scheduled description search disabled triggered_alert_count actions action.script.filename alert.severity cron_schedule disabled splunk_server * | search title = "SPLUNK:alarm testing Clone" | sort eai:acl.app title splunk_server | fields eai:acl.app title splunk_server type * | search splunk_server = "*-b-*" | transpose | where 'row 1' != 'row 2' I got that instead of changed action.email.to I have private Report with that new action.email.to field! It has eai:acl.sharing as private and is_scheduled = 0 instead of 1. Basically that means that now I have a new private report instead of updated alert! Any hints / advised, how to do this with rest will take thankfully! r. Ismo

isoutamo

Hi As @gcusello said that is license violations. Usually you should have only one LM where licenses are. Then you can create one ore more pools to divide those between nodes. If needed you can add secondary LM for test/dev environment if you don't want to share same pass4SymmKey between prod and dev/test. BUT never use the same license file on several LM or directly on nodes. If needed you could ask that Splunk Support splits your license to smaller chunks (separate lic files) and use those to different LM nodes. You could move those freely between LM when needed. One hints rename lic files as some reasonable name like 5gb-xyz-2023-06.lic 5gb-yxx-2023-06.lic. That way it's easier to recognise than looking GUIDs 😞 Usually indexers/SHs recognise if there are same license in use on several nodes and give you a notice. If you don't fix the situation then your searches stopped after 72h, if I recall right what this notice said. r. Ismo

isoutamo

Hi i don’t think that those will explain, why splunkd doesn’t start. What else you have on logs after those? r. Ismo

isoutamo

Have you check internal logs that this input is working? Also check from all indexes from all time with source/sourcetype/host. Time by timestamp parsing or index setting could fail, and those could be on your default index or those could have some weird time even in future.

isoutamo

The easiest way is shutdown node and start update. Another option is check what are running jobs and then cancel those one by on from GUI.

isoutamo

I have heard some rumours that EDU staff have hands full of work after that change. So probably you just need to wait and try to poll when they have time to start solving these normal issues and/or if they could fix it on global level?

isoutamo

Hi could you told what was you SPL search? It seems that you are on splunk cloud, so you could always ask help from Splunk Support. r. Ismo

isoutamo

Hi have you checked this https://splunkbase.splunk.com/app/6848 r. Ismo

isoutamo

Hi my guess is that is somehow still waiting input on command prompt? I usually use user-seed.conf file with crypted password. - name: Set admin access via seed when: splunk_first_run | bool block: - name: "Hash the password" command: "{{ splunk.exec }} hash-passwd {{ splunk.password }}" register: hashed_pwd changed_when: hashed_pwd.rc == 0 become: yes become_user: "{{ splunk.user }}" no_log: "{{ hide_password }}" - name: "Generate user-seed.conf (Linux)" ini_file: owner: "{{ splunk.user }}" group: "{{ splunk.group }}" dest: "{{ splunk.home }}/etc/system/local/user-seed.conf" section: user_info option: "{{ item.opt }}" value: "{{ item.val }}" mode: 0644 with_items: - {opt: 'USERNAME', val: '{{ splunk.admin_user }}'} - {opt: 'HASHED_PASSWORD', val: '{{ hashed_pwd.stdout }}'} loop_control: label: "{{ item.opt }}" when: ansible_system is match("Linux") become: yes become_user: "{{ splunk.user }}" no_log: "{{ hide_password }}" Quite much similarities with splunk-ansible 😉 r. Ismo

isoutamo

Hi one option is do this with two steps like | makeresults | eval _raw = ";; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24094 ;; flags: qr aa rd ra ; QUESTION: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 67816834b9432822c5a508fd59b65054fb5bbab0c5fe14f8 ;; QUESTION SECTION: ;www.test.aa. IN A ;; ANSWER SECTION: www.test.aa. 60 IN CNAME testserver.domain www.test.aa. 60 IN A 192.168.1.20 ;; AUTHORITY SECTION: test.aa. 60 IN NS localhost." | rex max_match=0 ";;\sANSWER\sSECTION:\v(?<line>[^;]+)" | rex max_match=0 field=line "(?<response_query>\S+)\s+(?<response_ttl>\S+)\s+(?<response_class>\S+)\s+(?<reponse_type>\S+)\s+(?<response>\S+)" |fields - _raw _time If you do it on props.conf, you need to ensure that extraction names are correct for getting line extracted firsts. r. Ismo

isoutamo

You should use </> block when you are including code, samples etc. to ensure that your question is correctly formatted! <some_search> | table field1 field2 field3 | outputcsv TestInvioMail_searchOutput.csv | stats values(recipient) AS emailToHeader | mvexpand emailToHeader | map search="|inputcsv TestInvioMail_searchOutput.csv | where recipient=$emailToHeader$ | sendemail sendresults=true sendcsv=true server=<my_email_server_address> from=<sender_server_address> to=$emailToHeader$ subject=\"Some object\" message=\"Some message\"" | append [| inputcsv TestInvioMail_searchOutput.csv] I suppose that above was what you have written? There is couple of questions. You have exported to csv file fields: field1 field2 field3 When you are using it you are searching field named recipient not fieldX! Could you told what are correct field names? Why you have the last append? If you want that ensure that columns are in correct order please try to change ..... | map search="|inputcsv TestInvioMail_searchOutput.csv | where recipient=$emailToHeader$ | table <fields as you want> | sendemail sendresults=true sendcsv=true server=<my_email_server_address> from=<sender_server_address> to=$emailToHeader$ subject=\"Some object\" message=\"Some message\""

isoutamo

You are including those lines on last append. Your previous table didn't work on that level. For that reason you must add it also on that subsearch which is separate process.

isoutamo

If your company is using private CA which are not known by your host you should ask that your server staff will add it as trust CAs on OS level.

isoutamo

Hi here is what splunk said on doc https://docs.splunk.com/Documentation/Splunk/latest/Updating/Calculatedeploymentserverperformance https://docs.splunk.com/Documentation/Splunk/latest/Updating/Planadeployment With VMware or other virtualised platforms I like to start with smaller (e.g. 4vCPU, 4+GB men) and monitoring its resource usage. Before it run out of resources just add more vCPUs, mem, disk etc. When limits of one node will rise then add another node and LB before those node and configure those to support several DSs. There are some answers about it and also conf presentations. To do it easier later, you should use DNS name for your DS server which you can later point to LB instead of individual server. r. Ismo

Posts	3145
Solutions	374
Karma Given	337
Karma Received	922
Member Since	‎14-02-2017

Online Status	Online
Date Last Visited	2m ago

Why can't I change alert with REST- It change perm...

Why does Splunk_TA_aws hang on configure / inputs ...

Don't execute rest of commands if there is no even...

Indexing Ubisecure Ubilogin logs?

Fieldformat didn't work with foreach

Cannot migrate DBConnect 2.4.0 -> 3.2.0 on Splunk ...

How to check splunk multisite cluster status after...

Re: Can the Splunk Add-on for AWS forward to a non...

Re: Help with Regex for AWS ARN to extract region?

Re: Help with Regex for AWS ARN to extract region?

Re: matching records from lookup file (more than 1...

Re: Why is Oracle connection not working-ORA-28000...

Re: how to view the list of Search Head Cluster Me...

Why can't I change alert with REST- It change perm...

Re: Can we use same license on different nodes of ...

Re: Splunkd not running after launching from an AM...

Re: Splunk with GitLab

Re: Search Head in a Search Head Cluster is in man...

Re: No response from support

Re: I am getting below error out of memory while t...

Re: Splunk with GitLab

Re: Deploying Splunk Universal Forwarder with Ansi...

Re: dnstap Field Extraction

Re: csv sent via sendmail has column order changed

Re: csv sent via sendmail has column order changed

Re: From LDAP to LDAPS (LDAP + SSL enabled)

Re: VM Resource Spec for Dedicated Deployment Serv...