About coreyCLI

coreyCLI

We built a custom app and deployed it in splunk. It is writing logs in splunk/var/log/appname/appname.log. I would like to find a way handle the logs natively within splunk, possibly using log.cfg to roll the log at a certain size as well as retention. I added a stanza to log.cfg in an attempt to manage this log but splunk doesnt appear to care about the added configs. Anyone use this file in such a way? Is it even possible? Below is a snippet of the config I added to log.cfg for the app. appender.appname=RollingFileAppender appender.appname.fileName=${SPLUNK_HOME}/var/log/appname/appname.log appender.appname.maxFileSize=25000000 # default: 25MB (specified in bytes). appender.appname.maxBackupIndex=5 appender.appname.layout=PatternLayout appender.appname.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n

coreyCLI · ‎04-18-2022

Sounds good, thanks1 4.0.2

coreyCLI · ‎04-18-2022

I have tested on a SH just having the one cert in the ssl.conf file that exists on the search head and it still gives the error........ 'str' object has no attribute 'decode'

coreyCLI · ‎04-18-2022

[SSLConfiguration] certPaths = /opt/splunk/etc/apps/appname/fd_certs/cert.pem, /opt/splunk/etc/slave_apps/appname/fd_certs/cert.pem I don't currently have webtools installed. I didn't see that anywhere as a requirement for the ssl checker app? Splunk Version: 8.2.0 Pythong Version: 3.7.10

coreyCLI · ‎04-18-2022

yes i do. Full path down to the pem file.

coreyCLI · ‎04-15-2022

Tried that. Anything that has ssl.conf in the local directory spits out this error message when ssl_checker2.py runs. ' str ' object has no attribute ' decode'

coreyCLI · ‎04-15-2022

I updated ssl.conf with the path to the pem file instead of just the directory. SH's output this error..... No such file or directory: ' /opt/splunk/etc/apps/ssl_checker/bin/../local/ssl.conf' SH's, obviously, since they are getting the app from the Deployer, do not have a local directory. The ssl.conf file is in default. Indexers output this error still...... ' str ' object has no attribute ' decode' The indexers are getting the app from the CM and do have a local/ssl.conf. Thanks!

coreyCLI · ‎04-15-2022

[SSLConfiguration] certPaths = /opt/splunk/etc/apps/appname/fd_certs/, /opt/splunk/etc/slave_apps/appname/fd_certs/ This is to cover SH's and indexers as this app is being deployed via the Deployer and the CM.

coreyCLI · ‎04-14-2022

[script://./bin/ssl_checker2.py] disabled = 0 interval = */60 * * * * [script://./bin/ssl_checker3.py] disabled = 0 interval = */60 * * * *

coreyCLI · ‎04-13-2022

I am using all 3. Deployer for SHC, Deployment for HF and CM for indexers. The architecture here is sound and being used appropriately. Not sure where this line of questioning is going? The issue seems to stem from the python code in ssl_checker2.py not seeing a configured version of ssl.conf in default and not handling a ssl.conf file in local if one exists there as well? Architecture aside. When I installed the app on a standalone box, configured it, it still was producing the " 'str' object has no attribute 'decode' " error and creating an empty ssl.conf_tmp. This is a Splunk 8.2.0 instance using python 3.7.10

coreyCLI · ‎04-13-2022

That is the approached I used. Installed the app on the Deployment server proper, configured, then copied to the shcluster/apps directory to push out to the SH's. I also moved this configured copy of the app to the DS and CM servers to push to the indexers in the IDX cluster as well the deployment clients respectively. I am using our Deployment Server to manage a single Heavy Forwarder per splunk best practices. Not sure what you mean by "not always the best practice"? There are no UF's in this scenario.

coreyCLI · ‎04-13-2022

I configured the app however it keeps returning to the setup page. Easy fix. Also, I have the ssl_check3.py script work fine and its pulling cert info as expected however the manual (ssl_checker2.py) is failing. I deployed the app via the Deployment server so there is no "local" folder, so no local/ssl.conf either. I looked at the ssl_check2.py and it looks like its also looking for defaul/ssl.conf however when I manually run the script it returns the error " No such file or directory: '/opt/splunk/etc/apps/ssl_checker/bin/../local/ssl.conf' ". I tried, just for testing, to create a local/ssl.conf and it returned this error " 'str' object has no attribute 'decode' ". It also created an empty ssl.conf_tmp in local which I assume is a result of the above error?

coreyCLI · ‎08-03-2021

for anyone interested. I just need to encode the commas separating the values severity=Critical%2CHigh%2CModerate

coreyCLI · ‎08-03-2021

How do you format an array using TA-webtools GET? Trying to filter the get response using an array. severity=Critical, High, Moderate

coreyCLI · ‎07-07-2021

For anyone tracking this. If you migrate to wiredTiger you will loose the metrics for "Accelerations" and "Accelerated Size (MB)". If you want to fix this you can add these regexes to the existing search in the DMC-->"KV Store Instance"-->"Collection Metrics" panel | rex field=data "nindexes\"\:(?<nindexes>\d+)\," | rex field=data "totalIndexeSize\"\:(?<totalIndexSize>\d+)\,"

coreyCLI · ‎06-22-2021

For anyone interested. I found an alias someone create using _time. "FIELDALIAS-ts = ts as _time". Once removed, all was working as it should.

coreyCLI · ‎06-22-2021

We have a SHC at version 8.1.3. When we try to use "earliest" and "latest" in search we get results based on the earliest and latest however, its search events based on the time picker. IE - If I create a search "index=main earliest=-15m latest=now" and the time picker is set to "24hours", the search will search all the events from the past 24 hours yet only display the results for the last 15 minutes. If I test this same search outside of our SHC, on a standalone instance and use the "-15m" in search I get back the last minutes of events however I am ONLY search the last 15 minutes of events. The search does not care about what is selected in the time picker. As well, in the job inspector I see the "Your time range was substituted based on your search string" message as I would expect. In the SHC cluster, I do not see this message. To add to the weirdness. If I include a sourcetype in my search "index=main sourcetype=stuff earliest=-15m latest=now" It works as expected and I see the message about substituting the timerage in the job inspector. However, If I include more then one sourcetype, then it does NOT substitute the timerange.

coreyCLI · ‎05-20-2021

That's interesting. Not sure how I haven't come across that document before. We must have some other issues on this particular instance because replicating the KV store to the indexers did not help. Also, when you look at the kvstore pages in the DMC it doesn't show the accelerated fields status either. Thanks for the info!

coreyCLI · ‎05-18-2021

In a way I am glad to hear someone else is having this issue! lol. Have you found any solutions? Possible bug?

coreyCLI · ‎03-25-2021

I have a KV store collection that is populated. I have a lookup definition pointing to the KV store. If you use the kvstore lookup definition in a search, I get matching results and everything works as expected. index=* source=jello | lookup kvstore_lookup ip as srcip outputnew city as src_city However, if I move that into an automatic lookup it does not work. Before using the kvstore I was using a csv lookup and the automatic lookups where working fine. The csv grew to 122mb so I populated a kvstore with the below. | inputlookup old_csv_lookup | outputlookup kvstore_lookup Permissions on the automatic lookups are global, everyone read, admin write. I can see in the search log that its calling the automatic lookup "Will use Lookup: Lookup-......" but the the fields that are supposed to be added in from the lookup dont populate. Also, I am using matchtype=CIDR for this lookup definition. Any ideas why the automatic lookup is not working now that its using the kvstore?

Posts	28
Solutions	2
Karma Given	1
Karma Received	7
Member Since	‎08-21-2020

Online Status	Offline
Date Last Visited	3 weeks ago

log.cfg to handle custom splunk app logs

SSL Certificate Checker App- How to configure?

TA-webtools

Time range not substituted by search

Automated lookup using KVstore lookup

black list regex files starting with a period (.)

Create same "collection" in navigation menu in all...

Search Activity App "no LDAP" option

Search Activity App

log.cfg to handle custom splunk app logs

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

Re: SSL Certificate Checker App

SSL Certificate Checker App- How to configure?

Re: TA-webtools

TA-webtools

Re: Automated lookup using KVstore lookup

Re: Time range not substituted by search

Time range not substituted by search

Re: Automated lookup using KVstore lookup

Re: Automated lookup using KVstore lookup

Automated lookup using KVstore lookup