Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About srichansen
srichansen
Path Finder
Member since:
03-01-2017
10-21-2020
Community Statistics
| Posts | 33 |
| Solutions | 3 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 03-01-2017 |
Activity Feed
- Posted Re: Error - In handler 'savedsearch': Expecting different token on Splunk Search. 10-21-2020 06:18 AM
- Got Karma for Re: subscription_modular_input.py error message in Splunk cloud gateway. 06-05-2020 12:50 AM
- Karma Re: Event breaks in an XML-file on multiple tags for ulrich_track. 06-05-2020 12:47 AM
- Karma Re: How to change bin value ranges using choropleth map? for Reimer1291. 06-05-2020 12:47 AM
- Posted Re: subscription_modular_input.py error message in Splunk cloud gateway on All Apps and Add-ons. 07-08-2019 06:40 AM
- Posted Re: subscription_modular_input.py error message in Splunk cloud gateway on All Apps and Add-ons. 05-27-2019 12:34 AM
- Posted subscription_modular_input.py error message in Splunk cloud gateway on All Apps and Add-ons. 05-24-2019 05:03 AM
- Tagged subscription_modular_input.py error message in Splunk cloud gateway on All Apps and Add-ons. 05-24-2019 05:03 AM
- Posted Re: SSO setup problems on Security. 02-11-2019 03:40 AM
- Posted SSO setup problems on Security. 01-24-2019 08:10 AM
- Tagged SSO setup problems on Security. 01-24-2019 08:10 AM
- Tagged SSO setup problems on Security. 01-24-2019 08:10 AM
- Posted Re: tstats subsearch on Splunk Search. 07-05-2018 01:00 AM
- Posted Re: tstats subsearch on Splunk Search. 07-04-2018 12:41 AM
- Posted Re: tstats subsearch on Splunk Search. 07-03-2018 04:53 AM
- Posted Re: tstats subsearch on Splunk Search. 07-03-2018 04:35 AM
- Posted Re: tstats subsearch on Splunk Search. 07-03-2018 03:21 AM
- Posted Re: Geo Heatmap not showing data points on the map. on All Apps and Add-ons. 07-03-2018 02:54 AM
- Posted Re: tstats subsearch on Splunk Search. 07-03-2018 02:44 AM
- Posted Re: tstats subsearch on Splunk Search. 07-02-2018 05:30 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-21-2020
06:18 AM
Hi, Did you manage to get this fixed? I am also getting the same error and cant find a fix. regards Simon
... View more
07-08-2019
06:40 AM
1 Karma
I have worked out what the issue is with the cloud gateway.
If you install any other apps that use the google proto-buffer protocol, cloud gateway will stop working.
Removal of that app will get it working again.
Thanks for help all.
Kind regards,
Simon
... View more
05-27-2019
12:34 AM
Hi,
There were no changes in the system to do with cloud gateway. The only changes were within an app and should not affect the system files.
I should have added that i have tried re-installing, cleaning the app off the system and installing it again and
over installing Splunk again (update) to refresh the python2.7 files.
Somehow it seems that whatever has changed is not being undone by the updates or resets above.
regards,
Simon
... View more
05-24-2019
05:03 AM
Hi all,
I am suddenly getting the following error in my Splunk cloud gateway app and can't see to correct it.
Unable to initialize modular input "subscription_modular_input" defined inside the app "splunk_app_cloudgateway": Introspecting scheme=subscription_modular_input: script running failed (exited with code 1).
Running the failed script above via Splunk cmd gives the following error. Looking for the missing libraries shows them all in their correct place.
/opt/splunk/bin/splunk cmd python /opt/splunk/etc/apps/splunk_app_cloudgateway/bin/subscription_modular_input.py Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/subscription_modular_input.py", line 24, in <module>
from spacebridgeapp.sodium_client import SodiumClient File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/sodium_client/__init__.py", line 1, in <module>
from sodium_client import SodiumClient File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/sodium_client/sodium_client.py", line 10, in <module>
from sodium import sodium_server_pb2 as sodium File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/sodium_client/sodium/sodium_server_pb2.py", line 6, in <module>
from google.protobuf.internal import enum_type_wrapper ImportError: No module named protobuf.internal
Can anyone steer me in the right direction to correct this,
thanks in advance
Simon
... View more
02-11-2019
03:40 AM
Hi,
Thanks for the help.
I am going to close the ticket as i discovered what the problem was. The setup on the AD side was done by the client IT and a few steps were missed whereby the profiles were not linked to accounts.
Splunk was then getting empty user details and hence the errors.
thanks for looking.
regards
Simon
... View more
01-24-2019
08:10 AM
Hi all,
we are trying to get SSO working through the SAML authentication method but are running into errors that we cant diagnose.
the most common error on login is the following in the splunkd logs.
01-24-2019 16:59:00.303 +0100 ERROR UserManagerPro - user="nobody" had no roles
01-24-2019 16:58:47.196 +0100 ERROR UiSAML - IDP failed to authenticate request. Status Code="Responder"
01-24-2019 16:58:47.196 +0100 ERROR UiSAML - IDP failed to authenticate request. Status Message="" Status Code="Responder"
01-24-2019 16:58:47.196 +0100 ERROR Saml - No extra status code found in SamlResponse, Not a valid status. Could not evaluate xpath expression /samlp:Response/samlp:Status/samlp:StatusMessage or no matching nodes foundNo value found in SamlResponse for key=/samlp:Response/samlp:Status/samlp:StatusMessageCould not evaluate xpath expression /samlp:Response/samlp:Status/samlp:StatusDetail/Cause or no matching nodes foundNo value found in SamlResponse for key=/samlp:Response/samlp:Status/samlp:StatusDetail/Cause
From with the domain it seems to work fine, but externally we get the above.
Any tips to steer us in the right direction would be much apprectiated.
Kind regards
Simon
... View more
07-05-2018
01:00 AM
That is strange, there must be something that is causeing it to fail in the syntax
Is it possible to paste the exact search you are running?
... View more
07-04-2018
12:41 AM
That is strange.
The only think i can think of is that the format of the user names is not the same.
I would suggest running
| tstats summariesonly=t count FROM datamodel=Datamodel.Name WHERE earliest=@d latest=now AND datamodel.EventName="LOGIN_FAILED" by datamodel.UserName
| eval SamAccountName=mvindex(split(datamodel.UserName,"\\"),-1)
then copying a name out the SamAccountName field and pasting it in the following to see if you get a result.
index=tfl_ad SamAccountName="*pasteduser*" | stats latest(lastLogon) as lastLogon by SamAccountName
... View more
07-03-2018
04:53 AM
I tried to clean it up a bit and found a type-o in the field names. Does this work?
| tstats summariesonly=t count FROM datamodel=Datamodel.Name WHERE earliest=@d latest=now AND datamodel.EventName="LOGIN_FAILED" by datamodel.UserName
| eval SameAccountName=mvindex(split(datamodel.UserName,"\\"),-1)
| join type=left SameAccountName
[ search index=ad earliest=-1 latest=now
| stats latest(lastLogon) as lastLogon by SameAccountName]
Glad to help, hopefully we can get it working.
... View more
07-03-2018
04:35 AM
it is probably your sub search time period.
when you get a result using
index=ad SamAccountName="JoeBloggs" | table SamAccountName, lastLogon
what is the event time? Is it the within the day periode and does it give the same result as
index=ad SamAccountName="JoeBloggs" earliest=@d latest=now | table SamAccountName, lastLogon
Do you get results if you change it to the following:
| tstats summariesonly=t count FROM datamodel=Datamodel.Name WHERE earliest=@d latest=now
datamodel.EventName="LOGIN_FAILED" by datamodel.EventName, datamodel.UserName
| rename datamodel.* as *
| eval SameAccountName=mvindex(split(UserName,"\\"),-1)
| join type=left SamAccountName
[search index=ad earliest=-1 latest=now | stats latest(lastLogon) as lastLogon by SamAccountName]
... View more
07-03-2018
03:21 AM
Ok, so join works by having two fields with the same field name and values.
If your field with users is the following:
tstats search its "UserNameSplit" and
sub search its "SamAccountName"
you will need to rename one of them to match the other.
in my example I renamed the sub search field with "| rename SamAccountName as UserNameSplit"
the part of the join statement "| join type=left UserNameSplit" tells splunk on which field to link. As long as you have renamed the fields and the values are the same it should return values.
You can check if anything is linking by removing the "type=left" from the join. This will make the join only return matched record as apposed to all tstats records.
If you are still not seeing anything then it might be that your sub search time frame is not right. In you tstats you are searching "earliest=@d latest=now". Is the data in you sub search for the same period?
... View more
07-03-2018
02:54 AM
Hi Andre,
Thanks for the tip.
Unfortunately it does not seem to have any effect.
Using the cluster map or custom cluster map with the same results draws perfectly. Its only if you change it to the geo heatmap that nothing shows. What is strange is that if you zoom in you see the legend change based on the geobin it is using and the event count returned,
Its seems to me that the visualization is not rendering on the tiles. I am going to try clear out my browser and try some others and see if it gives the same problem.
... View more
07-03-2018
02:44 AM
are you trying to filter your search to where field SamAccountName=UserNameSplit or are you trying to rename it? if you want to rename it you will need to add "| rename SamAccountName as UserNameSplit":
further i think you need to have the join field in your table results as below:
| tstats summariesonly=t count FROM datamodel=Datamodel.Name WHERE earliest=@d latest=now
datamodel.EventName="LOGIN_FAILED" by datamodel.EventName, datamodel.UserName
| rename datamodel.* as *
| join type=left UserNameSplit [ search index=ad | rename SamAccountName as UserNameSplit | table UserNameSplit, lastLogon]
hopefully that will give results.
... View more
07-02-2018
05:30 AM
ps. you will need to specify an earliest, latest in the sub search if the join data is in another time frame.
... View more
07-02-2018
05:28 AM
Hi,
there are a few ways to do this.
The first is to use a lookup with helps if you have more than 50k events that you want to link without hitting any limits. In this case you would need to use | outputlookup to create the csv with a search.
otherwise you can use a join as so:
| tstats summariesonly=t count FROM datamodel=Datamodel.Name WHERE earliest=@d latest=now
datamodel.EventName="LOGIN_FAILED" by datamodel.EventName, datamodel.UserName
| join type=left datamodel.UserName
[search index=ad
| rename Name=datamodel.UserName | table datamodel.UserName, (+ fields you want to return) ]
A join might not be the most efficient way to do this if you are linking lots of records. If so it would be better to call up all the events from both indexes in the tstats command. This can be tricky using tstats though.
Hope that helps,
regards
Simon
... View more
07-02-2018
03:06 AM
Hi all,
I am having difficulty with geostats and the Geo heatmap visualization.
No matter what I input into the geostats command nothing is displayed on the map.
The same geostats results show up on all other mapping visualizations and display correctly.
Has anyone else had these issues?
thanks in advance,
Simon
This is a search example:
index="ndov_chb" source="meetboek_2017-07-26.csv" earliest=1 latest=now
| eval y = RD_y, x = RD_x
| where y > 0 AND x > 0
| eval dX = round((('x' - 155000) *
0.00001),5), dY = round((('y' - 463000) * 0.00001),5)
| eval SomN = (3235.65389 * dY) + (-32.58297 * pow(dX,2)) + (-0.2475 * pow(dY,2)) + (-0.84978 * pow(dX,2) * dY) + (-0.0655
* pow(dY,3)) + (-0.01709 * pow(dX,2) * pow(dY,2)) + (-0.00738 * dX) + (0.0053
* pow(dX,4)) + (-0.00039 * pow(dX,2) * pow(dY,3)) + (0.00033 * pow(dX,4) * dY) + (-0.00012 * dX * dY), SomE = (5260.52916 * dX) + (105.94684 * dX * dY) + (2.45656 * dX * pow(dY,2)) + (-0.81885 * pow(dX,3)) + (0.05594 * dX
* pow(dY,3)) + (-0.05607 * pow(dX,3) * dY) + (0.01199 * dY) + (-0.00256 * pow(dX,3) * pow(dY,2)) + (0.00128 * dX
* pow(dY,4)) + (0.00022 * pow(dY,2)) + (-0.00022 * pow(dX,2)) + (0.00026 * pow(dX,5))
| eval latitude = 52.15517 + (SomN / 3600), longitude = 5.387206 + (SomE / 3600)
| where latitude<60 AND longitude < 8 AND latitude>0 AND longitude>0
| eval haltecodes = substr(Quaycode,6,len(Quaycode)-5)
| geostats latfield=latitude longfield=longitude count
here is an example of my geostats results:
geobin latitude longitude count
bin_id_zl_0_y_6_x_4 52.17996 5.42564 46659
bin_id_zl_1_y_12_x_8 52.17996 5.42564 46659
bin_id_zl_2_y_25_x_16 52.17996 5.42564 46659
bin_id_zl_3_y_50_x_32 52.05388 4.82835 26785
bin_id_zl_3_y_50_x_33 52.34348 6.23268 19760
bin_id_zl_3_y_51_x_32 53.44860 5.62062 2
bin_id_zl_3_y_51_x_33 53.45916 5.88079 112
bin_id_zl_4_y_100_x_65 51.72564 4.75573 12924
bin_id_zl_4_y_100_x_66 51.48612 5.91255 6521
... View more
05-16-2018
05:33 AM
Hi all,
Thanks for the reactions.
The error is showing when you change the label in the rangemap and not the ranges in the mapping.
They both have the same range mapped (0-30) but with different labels.
From the eval example above it would be like:
|eval rank=case((latency>160),">160",(latency>120),">120",(latency>80),">80",(latency<=80),"<=80")
gives different results to this:
|eval rank=case((latency>160),"99999 - 160",(latency>120),"180 - 120",(latency>80),"120 - 80",(latency<=80),"0 - 80")
If this is some how linked then it would mean that a label has influence on the ranges that rangemap uses. Maybe it needs to be escaped or something, but never seen that in spl before only in xml or regex.
kind regards.
... View more
11-17-2017
12:57 AM
As update to this issue:
At the moment there is no functionality to work in meters within the mapping apps. I got round this problem by using the following calculation which anyone wanting to convert from meters to decimal degrees in the rijksdriehoekstel (Nederlands/dutch) format can use.
| eval x={your X in meters}, y={your Y in meters}
| where y > 0 AND x > 0
| eval dX = round((('x' - 155000) * 0.00001),5), dY = round((('y' - 463000) * 0.00001),5)
| eval SomN = (3235.65389 * dY) + (-32.58297 * pow(dX,2)) + (-0.2475 * pow(dY,2)) + (-0.84978 * pow(dX,2) * dY) + (-0.0655 * pow(dY,3)) + (-0.01709 * pow(dX,2) * pow(dY,2)) + (-0.00738 * dX) + (0.0053 * pow(dX,4)) + (-0.00039 * pow(dX,2) * pow(dY,3)) + (0.00033 * pow(dX,4) * dY) + (-0.00012 * dX * dY), SomE = (5260.52916 * dX) + (105.94684 * dX * dY) + (2.45656 * dX * pow(dY,2)) + (-0.81885 * pow(dX,3)) + (0.05594 * dX * pow(dY,3)) + (-0.05607 * pow(dX,3) * dY) + (0.01199 * dY) + (-0.00256 * pow(dX,3) * pow(dY,2)) + (0.00128 * dX * pow(dY,4)) + (0.00022 * pow(dY,2)) + (-0.00022 * pow(dX,2)) + (0.00026 * pow(dX,5))
| eval latitude = 52.15517 + (SomN / 3600), longitude = 5.387206 + (SomE / 3600)
The end result is a latitude and longitude field in decimal degrees that can be used in all the mapping apps.
... View more
11-17-2017
12:04 AM
Hi all,
I have a search with a rangemap that groups based on seconds.
The smallest and first grouping is for a range of less then 30 sec. The label is "<30" with the values being from 0 - 30.
This "label" gives a different result than the label "0-30".
Here are the two examples with results:
*| rangemap field=middle
"<30m"=0-30
"30-60m"=30-60
"1-2u"=60-120
"2-4u"=120-240
"range": "<30m",
"totalTransactions": "12568"*
*| rangemap field=middle
"0-30m"=0-30
"30-60m"=30-60
"1-2u"=60-120
"2-4u"=120-240
"range": "0-30m",
"totalTransactions": "12913"*
Has anyone experienced this before or know a solution?
thanks in advanced,
Simon
... View more
04-03-2017
12:48 AM
I mean, is there a way to show geodetic RDS co-ordinates (meters) as opposed to the WGS84 lat, long that the mapping tools are using.
What I would like to do is import transport data directly from a source without having to first convert the x,y to lat long in a GIS.
... View more
03-31-2017
07:23 AM
Hi,
does anyone know if its possible to use geodetic (projected) locations in Splunk.
... View more
03-31-2017
12:42 AM
Thanks for the advice guys. I managed to get it working with streamstats. In the end a transaction was not even needed.
I was making it more complex than it needed to be as I was looking at it from the point of view of sql queries.
This was my search in the end.
search....... | streamstats current=f last(rijtijddep) as last_Depart, last(TimingPointName) as last_halte by ConcessionAreaCode OperationDate LinePlanningNumber TripNumber | eval Brijtijd = rijtijdarr-last_Depart, trajectnaam = last_halte+" - "+TimingPointName | where Brijtijd>0 AND Brijtijd<3600 | stats $HTfunct$(Brijtijd) as gemrijtijd by trajectnaam | eval gemrijtijd = gemrijtijd/60
... View more
03-15-2017
01:23 AM
I think I can use the stopordernumber, the order of stops in a trip and streamstats to get a result.
I will give it a try and let you know.
Thanks for the advice.
... View more
03-15-2017
01:21 AM
I will give it a try and let you know.
thanks!
... View more
03-14-2017
04:05 AM
@niketnilay Thanks for your response.
Will that not give me the total transaction time per event? I have used mvindex(0) and mvindex(1) to get the total ride time.
I used transaction as that allowed me to group the events effectively per trip. The key fields to get the unique trips are ConcessionAreaCode OperationDate LinePlanningNumber TripNumber. Where I am having difficulty is that the ride time between the stops is arrival(row 2) - depart(row 1)
What I am trying to calculate is the time between the sub-events within one transaction event.
So something like mvindex(2) -mvindex(1) but with iteration for all the sub events.
ie. something like mvindex(n) -mvindex(n-1)
I am not sure if I am making this more complex then it is
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-21-2020
10:13 AM
|
