Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About erwan_raulet
erwan_raulet
Explorer
Member since:
03-14-2013
06-05-2020
Community Statistics
| Posts | 32 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 03-14-2013 |
Activity Feed
- Got Karma for What is the process to run the TA-prtg Add-on?. 06-05-2020 12:48 AM
- Got Karma for How to display SplunkIcons Glyphs library and where can I find them?. 06-05-2020 12:48 AM
- Got Karma for How to display SplunkIcons Glyphs library and where can I find them?. 06-05-2020 12:48 AM
- Posted Re: Cisco ACI Add-on for Splunk Enterprise: "Error connecting to /servicesNS/nobody/TA_cisco-ACI/apps/local/TA_cisco-ACI/setup: ('The read operation timed out',)" on All Apps and Add-ons. 04-16-2020 11:38 PM
- Posted Cisco ACI Add-on for Splunk Enterprise: "Error connecting to /servicesNS/nobody/TA_cisco-ACI/apps/local/TA_cisco-ACI/setup: ('The read operation timed out',)" on All Apps and Add-ons. 04-16-2020 06:15 AM
- Tagged Cisco ACI Add-on for Splunk Enterprise: "Error connecting to /servicesNS/nobody/TA_cisco-ACI/apps/local/TA_cisco-ACI/setup: ('The read operation timed out',)" on All Apps and Add-ons. 04-16-2020 06:15 AM
- Posted How to configure request payload in a POST HTTP Method with REST API Modular Input? on All Apps and Add-ons. 03-26-2019 09:54 AM
- Tagged How to configure request payload in a POST HTTP Method with REST API Modular Input? on All Apps and Add-ons. 03-26-2019 09:54 AM
- Posted Re: What is the process to run the TA-prtg Add-on? on All Apps and Add-ons. 02-16-2018 02:22 AM
- Posted Re: How to resolve when data getting duplicated twice in indexers? on Getting Data In. 06-21-2017 08:37 AM
- Posted Re: How to correlate multiple transactions as a single event? on Splunk Search. 03-29-2017 04:53 AM
- Posted How to correlate multiple transactions as a single event? on Splunk Search. 03-29-2017 03:09 AM
- Tagged How to correlate multiple transactions as a single event? on Splunk Search. 03-29-2017 03:09 AM
- Tagged How to correlate multiple transactions as a single event? on Splunk Search. 03-29-2017 03:09 AM
- Tagged How to correlate multiple transactions as a single event? on Splunk Search. 03-29-2017 03:09 AM
- Tagged How to correlate multiple transactions as a single event? on Splunk Search. 03-29-2017 03:09 AM
- Posted Re: How to display SplunkIcons Glyphs library and where can I find them? on Splunk Search. 02-22-2017 08:30 AM
- Posted Re: How to display SplunkIcons Glyphs library and where can I find them? on Splunk Search. 02-22-2017 08:27 AM
- Posted Re: How to display SplunkIcons Glyphs library and where can I find them? on Splunk Search. 02-22-2017 08:13 AM
- Posted How to display SplunkIcons Glyphs library and where can I find them? on Splunk Search. 02-22-2017 07:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
04-16-2020
11:38 PM
Yes the credentials are correct. With Wireshark, I see any packet from the Splunk server to the Apic.
... View more
04-16-2020
06:15 AM
Hello,
I tried to install Cisco ACI Add-on for Splunk Enterprise on a splunk server in version 7.2.3.
After completing the form with the APIC IP address, local username and password, I get the following error message:
"Error connecting to /servicesNS/nobody/TA_cisco-ACI/apps/local/TA_cisco-ACI/setup: ('The read operation timed out',)"
Can you help me understand the meaning of this message? Is this a Splunk App or Server problem?
FYI, I launched a Wireshark to check if the Splunk server initiated a connection with the Apic. No packet has left the server. The problem is therefore local to the Splunk server.
Thanks in advance
... View more
03-26-2019
09:54 AM
I want to use REST API Modular Input to count alarms from my Spectrum monitoring tool.
Here's the query I'm using with Postman to query my Spectrum server:
POST /spectrum/restful/alarms/count HTTP/1.1
Host: MyServer:8080
Content-Type: application/xml,application/json
Authorization: Basic YmNpdC1waWwdcnBpbG90ZTE=
cache-control: no-cache
<?xml version="1.0" encoding="UTF-8"?>
<rs:alarms-count-request xmlns:rs="http://www.ca.com/spectrum/restful/schema/request"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.ca.com/spectrum/restful/schema/request
../../../xsd/Request.xsd ">
<rs:alarm-filter name="def"/>
</rs:alarms-count-request>
And the response:
<?xml version="1.0" encoding="UTF-8"
standalone="yes"?>
<alarmcount-response
xmlns="http://www.ca.com/spectrum/restful/schema/response">
<critical>3</critical>
<major>2</major>
<minor>4</minor> </alarmcount-response>
Now its configuration in the module REST_ta of Splunk.
I get an HTTP 500 error in splunkd.log
I think this comes from the Request Payload field but I do not see my error. Can someone help me?
... View more
02-16-2018
02:22 AM
Hello Dominique,
I come back to the subject after a long absence but I encounter a problem with the script "prtghistoricdata" that does not work with my configuration.
When I try to run the following command in a new search, I get no results:
| prtghistoricdata id = 22371 count = 1 | fields - _raw, _time, * (RAW), source, sourcetype, host | transpose | rename column AS Key | rename" row 1 "AS Value
Do you have any idea of the problem I'm having? The language in my version of PRTG is French.
Thank you for your help.
Regards,
... View more
06-21-2017
08:37 AM
I have the same problem and my version is Splunk Enterprise 6.5.3. Do you have an issue?
... View more
03-29-2017
04:53 AM
Here is my search to determine transactions:
host="10.xxx.yyy.*" ospf eventtype="ospf_down*" OR eventtype="ospf_full" Base
| eval start_Time=if(eventtype="ospf_down" OR eventtype="ospf_down_if",_time,null())
| eval end_Time=if(eventtype="ospf_full",_time,null())
| transaction host VoisinIP Interface startswith=eval(eventtype="ospf_down" OR eventtype="ospf_down_if") endswith=eval(eventtype="ospf_full")
| convert timeformat="%d/%m/%Y %H:%M:%S" ctime(start_Time) as Debut
| convert timeformat="%d/%m/%Y %H:%M:%S" ctime(end_Time) as Fin
| eval "Duree Perte"=tostring(duration,"duration")
And the result is:
Mar 9 07:27:39 10.xxx.yyy.61 Mar 9 07:27:39 10.xxx.yyy.61 TH2PE1: 525776 Base OSPF-WARNING-tmnxOspfNgNbrStateChange-2042 [VR: 1 OSPFv2 (0) ]: LCL_RTR_ID 10.xxx.yyy.61: Neighbor 10.aaa.bbb.1 on if-MTP1-1 router state changed to down (event BFD_DOWN)
Mar 9 07:33:05 10.xxx.yyy.61 Mar 9 07:33:05 10.xxx.yyy.61 TH2PE1: 525790 Base OSPF-WARNING-tmnxOspfNgNbrStateChange-2042 [VR: 1 OSPFv2 (0) ]: LCL_RTR_ID 10.xxx.yyy.61: Neighbor 10.aaa.bbb.1 on if-MTP1-1 router state changed to full (event EXC_DONE)
Mar 9 07:27:38 10.xxx.yyy.61 Mar 9 07:27:38 10.xxx.yyy.61 TH2PE1: 525744 Base OSPF-WARNING-tmnxOspfNgNbrStateChange-2042 [VR: 1 OSPFv2 (0) ]: LCL_RTR_ID 10.xxx.yyy.61: Neighbor 10.aaa.bbb.2 on if-MTP1-2 router state changed to down (event BFD_DOWN)
Mar 9 07:33:04 10.xxx.yyy.61 Mar 9 07:33:04 10.xxx.yyy.61 TH2PE1: 525788 Base OSPF-WARNING-tmnxOspfNgNbrStateChange-2042 [VR: 1 OSPFv2 (0) ]: LCL_RTR_ID 10.xxx.yyy.61: Neighbor 10.aaa.bbb.2 on if-MTP1-2 router state changed to full (event EXC_DONE)
I hope this will help you better understand my problem
... View more
03-29-2017
03:09 AM
I have defined transactions to determine the cut-off times for our telecom links. We have two telecom operators per site and I want to differentiate between links of cuts and the loss of a site in case of power failure for example. I use the start time to count the number of transactions per site. When the number is 1, it is a loss of link and when the number is 2, it is a loss of site. Only a few times the start time is not exactly the same with 1 second deviation therefore result 2 transactions. How do I correlate both transactions as the same event?
Thank you for your help.
... View more
02-22-2017
08:30 AM
These links do not inform me about the SplunkIcons Glyphs.
... View more
02-22-2017
08:27 AM
My version is Splunk Enterprise 6.5.2 on Windows 2008 R2 Standard.
... View more
02-22-2017
08:13 AM
This page is not found on my server.
... View more
02-22-2017
07:52 AM
2 Karma
I use SplunkIcons glyphs to display some states with search command "rangemap". I would like to see the icons are available in this library but I do not find it and I do not know how to visualize it.
Thank you for your help.
... View more
10-20-2016
08:11 AM
Yes, that is right and without inserting into table. I had already tried this but I think I had to make a syntax error. Thank you for your help and I accept your answer.
... View more
10-20-2016
07:43 AM
I tried your proposal by inserting the search in a table but the result is still not conclusive.
... View more
10-20-2016
06:08 AM
My Splunk version is 6.3.1 and I replaced done with finalized but the result does not change. I have no more idea.
... View more
10-20-2016
05:30 AM
To see if the tokens "showtab1" and showtab2 "are calculated with condition match = "" , I check the display of the value of the tokens" range2 "and" showtab1 "just after the display of the icon state. it appears that the token "showtab" does not display "true" and the table requested when $range2$ = high2.
Here is my code:
<done>
<condition match="'range2' == high2">
<set token="showtab1">true</set>
<unset token="show_tab1"></unset>
</condition>
<condition match="'range2' == severe">
<set token="showtab2">true</set>
<unset token="show_tab2"></unset>
</condition>
</done>
</search>
<html>
<div class="custom-result-value icon-only $range2$"></div>
<li>$showtab1$</li>
<li>$range2$</li>
</html>
<table depends="$showtab1$">
<search>
<query>my tab query</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
</table>
I'm more clear in my explanation?
... View more
10-20-2016
12:14 AM
Sorry rjthibod, finally it was not good. I forgot to change the name of the token in my table. The two tokens are not evaluated with condition match = "" . I do not understand why.
... View more
10-19-2016
05:35 AM
Thank you very much. It works correctly.
I do not know the <done> . What is its function and where can I find documentation?
... View more
10-19-2016
01:43 AM
I try to use condition match=" " to check the value of the "range" field in my search and display a table according to icon status.
<panel>
<html>
<h2>Title</h2>
</html>
<search>
<query>myquery | rangemap field=Status low=0-1 high2=2-3 severe=4-5 default=low</query>
<earliest>-24h</earliest>
<latest>now</latest>
<preview>
<set token="range2">$result.range$</set>
</preview>
<condition match="'result.range' == high2">
<set token="show_tab1">true</set>
<unset token="show_tab1"></unset>
</condition>
<condition match="'result.range' == severe">
<set token="show_tab2">true</set>
<unset token="show_tab2"></unset>
</condition>
</search>
<html>
<div class="custom-result-value icon-only $range2$"></div>
</html>
<table depends="$show_tab1$">
<search>
<query>mytable1query</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
</table>
<table depends="$show_tab2$">
<search>
<query>mytable2query</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
</table>
</panel>
Can someone help me to understand why I can not get the value of the two tokens created by condition match=" " ?
... View more
10-18-2016
02:54 AM
Hello, this latest version of the TA-PRTG application works much better. Splunk can communicate with PRTG now but some problems remain. I do not use the Inventory module. Nothing appears whatever the filters applied. Only the alarms module would displays alerts and the Sensordetails module displays sensor informations.
Do you meet the same difficulties?
... View more
10-18-2016
02:48 AM
I just did the first tests and I see some modules do not work properly. This is the case for the Inventory module that picks me any results whatever the applied filter. Only the module "Sensordetails" gives information when I select a sensor in the list of Down sensors.
Do you have an idea of the problem?
... View more
10-18-2016
12:27 AM
Hello, this latest version of the TA-PRTG application works much better. Splunk can communicate with PRTG now. I'll work on it now. Thank you for your help.
... View more
09-26-2016
12:42 AM
Hello, yes, my prtg.conf is in a local directory and my prtg version is 16.3.25.5767+ and installed on a different server than Splunk server. The access with api URLs are ok from Splunk serveur in a browser but the search in the dashboard is in error with the same message:
Error in 'prtglivedata' command: Error encountered while setting up custom search command, see search.log.
... View more
09-22-2016
06:53 AM
In the module view, I have this error messsage :
"Error in 'prtglivedata' command: Error encountered while setting up custom search command, see search.log"
In the search log file, I find these lines:
09-22-2016 15:44:24.568 INFO ChunkedExternProcessor - Running process: D:\splunk\bin\PYTHON.EXE D:\splunk\etc\apps\TA-prtg\bin\prtglivedata.py
09-22-2016 15:44:24.927 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
09-22-2016 15:44:24.927 ERROR ChunkedExternProcessor - EOF while attempting to read transport header
09-22-2016 15:44:24.927 ERROR ChunkedExternProcessor - stderr: File "D:\splunk\etc\apps\TA-prtg\bin\prtglivedata.py", line 32, in
09-22-2016 15:44:24.927 ERROR ChunkedExternProcessor - Failure reading getinfo chunk
09-22-2016 15:44:24.927 ERROR ChunkedExternProcessor - stderr: from splunklib.searchcommands import dispatch, GeneratingCommand, Configuration, Option, validators
09-22-2016 15:44:24.927 ERROR ChunkedExternProcessor - Error in 'prtglivedata' command: Error encountered while setting up custom search command, see search.log.
It seems to be a python error.
... View more
09-22-2016
01:31 AM
Someone can help me about my problem. Thank
... View more
09-16-2016
02:52 AM
Hello,
I added the port 443 at the end of the line "Server" in the prtg.conf file and restart Splunk process.
My file is like this:
[default]
server=my server.dom:443
user=user1
password=mypassword
When i try an API with a browser from my Splunk server. It is ok and I see the requests in my firewall log.
The same action in Splunk, nothing happens and no trace in my firewall.
Is it necessary to create a data input in Splunk for PRTG? If so what kind of input is needed?
Thank for your help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
