Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About hlarimer
hlarimer
Communicator
Member since:
10-28-2013
06-05-2020
Community Statistics
| Posts | 63 |
| Solutions | 4 |
| Karma Given | 19 |
| Karma Received | 19 |
| Member Since | 10-28-2013 |
Activity Feed
- Karma Re: Slack Notification Setup Problems for wweiland. 06-05-2020 12:48 AM
- Karma Re: Incorrect Timestamp for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Incorrect Timestamp for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Ansible Tower App for Splunk: Why am I receiving "unable to initialize modular input" error after install? for dsilva. 06-05-2020 12:48 AM
- Got Karma for Ansible Tower App for Splunk: Why am I receiving "unable to initialize modular input" error after install?. 06-05-2020 12:48 AM
- Karma Re: How to overlay two searches on the same chart in Splunk 6.1 or 6.2? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Not getting any data from Google Apps for Splunk for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: Compare search to lookup table and return results unique to search for acharlieh. 06-05-2020 12:47 AM
- Karma Re: Why is the metadata type=hosts command for *nix search heads showing incorrect lastTime and recentTime? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the metadata type=hosts command for *nix search heads showing incorrect lastTime and recentTime? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why timewrap command only shows current results from today (latest_day)? for Richfez. 06-05-2020 12:47 AM
- Karma Re: Stats against timechart for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to send syslog data to a specific index based on a string in the log? for acharlieh. 06-05-2020 12:47 AM
- Karma Re: Why are forwarders not load balancing properly between 2 indexers and how to make configuration changes to fix this? for Lucas_K. 06-05-2020 12:47 AM
- Karma Re: Why are forwarders not load balancing properly between 2 indexers and how to make configuration changes to fix this? for MuS. 06-05-2020 12:47 AM
- Karma Re: How does Splunk handle timestamps from different timezones when it doesn't know the offset? for kml_uvce. 06-05-2020 12:47 AM
- Karma Re: Calculations off of results of two stats searches for MuS. 06-05-2020 12:47 AM
- Karma Re: Splunk App for Windows Infrastructure: Why are User and Group dashboards not populating? for malmoore. 06-05-2020 12:47 AM
- Got Karma for Re: How to overlay two searches on the same chart in Splunk 6.1 or 6.2?. 06-05-2020 12:47 AM
- Got Karma for Not getting any data from Google Apps for Splunk. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
09-27-2016
04:39 PM
Thank you dsilva, app is working great now!
... View more
09-27-2016
08:58 AM
1 Karma
Installed new app Ansible Tower App for Splunk but am seeing error:
Unable to initialize modular input "tower_app" defined inside the app "tower_app": Introspecting scheme=tower_app: script running failed (exited with code 1).
Anyone else seeing "unable to initialize modular input" after install?
... View more
09-24-2016
06:11 AM
We actually alert every day on this very thing...when timestamps are incorrect. What I recommend doing is using a search that tells you when timestamps are off and it will allow you to keep up on this. I find existing or new systems with incorrect timestamps on a regular basis (new sites, system rebuilds, etc) but now that we keep up on them its much easier to manage. Here is the search I use for the alert:
| metadata type=hosts index=* | eval diff=recentTime-lastTime | where diff > 1800 OR diff < -1800 | convert ctime(lastTime) AS last_log_date | table host diff last_log_date
This search looks for the difference between the recentTime and the lastTime which is the difference of when the log came in versus what it was timestamped. There will always be some difference based on lag so I only alert if its off by 1800 seconds or more. The negative 1800 is important too since it captures timestamps that are set in the future.
... View more
03-10-2016
06:03 AM
Thanks Martin, it looks like moving it to indexers took care of it! That was my mistake, I was thinking that timestamp extraction happened earlier.
... View more
03-09-2016
12:33 PM
Maybe I have this set in the incorrect place then, I have it in props.conf on the UF, should it actually be on the SH?
... View more
03-09-2016
05:46 AM
Thanks Martin, I added those changes but I'm still getting the first timestamp instead of the second. I added the changes last night and then restarted the splunk forwarder. Do you think the TIME_PREFIX is correctly?
... View more
03-08-2016
01:44 PM
I have the following log and need splunk to grab the second timestamp instead of the first. I have tried adjusting props.conf as shown below as well.
Task Update Application Available Targeting is due at Wednesday 03/09/2016 00:00:00 $$<SMS_DATABASE_NOTIFICATION_MONITOR><03-08-2016 19:00:26.917+00><thread=6760 (0x1A68)>
Props.conf
[server_log]
TIME_PREFIX = ><
TIME_FORMAT = %m-%d-%y %H:%M:%S.
... View more
- Tags:
- timestamp
01-08-2016
08:36 AM
This regex is working, thanks @acharlieh!
... View more
12-18-2015
11:08 AM
I gotcha, I could set global permissions in local.meta just to be sure.
... View more
12-18-2015
10:59 AM
Shouldn't be, I'm running as admin.
... View more
12-18-2015
06:22 AM
I confirmed that I was running in Verbose mode and still didn't get the extractions. I also changed the regex to match what you have above and still don't see any results. I think I'm going to try a very simple regex to confirm that the REPORT function is working correctly.
... View more
12-18-2015
06:19 AM
I have not tried the Extract option, I haven't ever used that command but it may be an option for testing.
... View more
12-17-2015
06:48 AM
I have a very ugly log file that I need to run a regex against and have it match as many times as possible to map the field name and the value of the field. I have a working regex that I can test through search and its working as expected but when I try to move that regex to a transforms file using REPORT, I'm not seeing any results in my searches. Here are the props.conf and transforms.conf that is running on the SH:
props.conf
[jamfChangeManagement]
REPORT-jamfcm=jamfcm
transforms.conf
[jamfcm]
REGEX=(<_KEY_1>.*?)\W{5,30}(<_VAL_1>\w.*)
Any ideas why its not matching the regex in search?
... View more
10-23-2015
07:29 AM
That works perfectly! Thanks for your quick response!
... View more
10-23-2015
07:06 AM
1 Karma
I have a search that tells me when a system doesn't report into splunk after a threshold of an hour:
|metadata index=vmware type=hosts | eval timenow=now() | eval lastseen=timenow-recentTime | where lastseen > 3600 | eval last_seen=tostring(lastseen, "duration") | table host last_seen
Then I have a lookup csv that is driven by a dashboard that allows users to enter systems that are in maintenance mode or decommissioned. If a system hits the threshold from the first search but is listed in the csv I don't want it to fire the alert. The lookup table is called decom_maint_systems.csv.
I can get the correct hostname by using set diff but the problem is I lose the "last_seen" field which I really want to keep. So how do I compare the two while keeping the fields I want from the initial search?
... View more
09-28-2015
05:46 AM
I worked on this app quite a bit after my posts above and found that the correct index is now wineventlog, which changed from the previous version. When digging through the saved searches that the app uses, it references the index and sourcetypes correctly. There seems to be a bug with a few of the drop downs which I have seen in multiple environments across multiple companies and even after clean installs. I have worked with splunk on these dropdowns but they don't seem to have an answer at this point and I get the feeling that that original devs are no longer working on it.
... View more
09-28-2015
05:38 AM
1 Karma
We have part of the data collection working and are working with the developer to get the last 2 inputs working but from what I see at this point, the data indexed is pretty minimal in our environment of about 800 users. We are currently seeing less than a gb a day and don't expect it to go over 2gb once the other inputs are in.
... View more
09-14-2015
09:28 AM
Thanks again for the help @alacercogitatus
... View more
09-11-2015
06:31 AM
1 Karma
I know this is a broad question with an endless amount of answers, but we are trying to get an estimate of how much data is indexed when using the Google Apps for Splunk. We are mainly concerned with security data from this app, so logins, login attempts, user changes, data movement, etc.
Any high level estimates about how much data per user will be created so we can decide on what licensing we need?
... View more
09-11-2015
06:25 AM
3 Karma
I have set up the Google Apps for Splunk app and successfully went through the configuration steps, but I'm not seeing any data. There are 3 inputs set up that I believe were there by default (this app was already installed when I took over this instance), but I'm wondering if they are correct or if there are other inputs that needed to be added. Any tips on getting data in?
... View more
