About coreyCLI

coreyCLI

I have a KV store collection that is populated. I have a lookup definition pointing to the KV store. If you use the kvstore lookup definition in a search, I get matching results and everything works as expected. index=* source=jello | lookup kvstore_lookup ip as srcip outputnew city as src_city However, if I move that into an automatic lookup it does not work. Before using the kvstore I was using a csv lookup and the automatic lookups where working fine. The csv grew to 122mb so I populated a kvstore with the below. | inputlookup old_csv_lookup | outputlookup kvstore_lookup Permissions on the automatic lookups are global, everyone read, admin write. I can see in the search log that its calling the automatic lookup "Will use Lookup: Lookup-......" but the the fields that are supposed to be added in from the lookup dont populate. Also, I am using matchtype=CIDR for this lookup definition. Any ideas why the automatic lookup is not working now that its using the kvstore?

coreyCLI · ‎02-10-2021

Thanks for the quick reply Jacob. While that didnt work for our specific case I do appreciate the response. In the end, and I am usure why TBH, this is whats currently in place and working for us to blacklist files that start with a dot (.) blacklist = \/dir\/dir\/syslog\/\.\S+

coreyCLI · ‎02-05-2021

sady its not working for me. I have also tried something more specific and still no joy. blacklist = /dir/dir/dir/syslog/.* and blacklist = \/dir\/dir\/dir\/syslog\/\..*

coreyCLI · ‎02-04-2021

I have seen a few regex examples on this and I have used the regex tools online to test my regex to blacklist files that begin with a period (.) yet this example is not working. example of inputs [monitor:///dir/dir/dir/syslog] index = index sourcetype = sourcetype host_regex=syslog\/(?P<host>.*)\.syslog blacklist = ^\.\S example filename = .filename.syslog.2021-01-01

coreyCLI · ‎12-03-2020

I know how to create/edit the navigation menu and create collections however, I would like to create a "Tools" collection then is displayed on every current and any new app created. Is there a way to create this once and have it displayed by default in every App so that I dont have to go to each one and add this collection specifically?

coreyCLI · ‎12-01-2020

I found this to work from our DMC for all instances. I can see retrieve info for all instances that are search peers of the DMC. Without "splunk_server=*" then I only see the indexers. | rest splunk_server=* /services/server/info | table host, startup_time | eval uptime=tostring(now() - startup_time, "duration") hope this helps

coreyCLI · ‎11-16-2020

here is what i did to correct my issue with the same error at restart. I was having the issue on 2 indexers. I went throught the each value for every instance of pass4SymmKey and sslPassword and fed that encrypted value in the /bin/splunk show-decrypted --value 'pastvaluehere' until this command spit out the same error "....AES-GCM Decryption Failed!". If it spits out the decrypted value, move on the the next one. When that command spits out the AES-GCM error you know you have found your password that needs to be update/chagned.

coreyCLI · ‎08-21-2020

I installed Search Activity App 3.0.1 on a 7.3.4 Splunk instance. I do not have LDAP in this environment. I cannot step through the setup process. I cant get passed the Collecting Data page. One thing that I am curious about is that the "Existing Configuration Retrieved" check says "in Progress" however I have never installed Search Activity before. Not sure if this never changing from "in Progress" is the reason the I cannot pass this page. the Next button is greyed out. I want to be able to configure this with the "No LDAP" option.

coreyCLI · ‎08-21-2020

I installed Search Activity App 3.0.1 on a 7.3.4 Splunk instance. I do not have LDAP in this environment. I cannot step through the setup process. I cant get passed the Collecting Data page. One thing that I am curious about is that the "Existing Configuration Retrieved" check says "in Progress" however I have never installed Search Activity before. Not sure if this never changing from "in Progress" is the reason the I cannot pass this page. the Next button is greyed out. I want to be able to configure this with the "No LDAP" option.

Posts	9
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎08-21-2020

Online Status	Offline
Date Last Visited	3 weeks ago

Automated lookup using KVstore lookup

black list regex files starting with a period (.)

Create same "collection" in navigation menu in all...

Search Activity App "no LDAP" option

Search Activity App

Automated lookup using KVstore lookup

Re: black list regex files starting with a period ...

Re: black list regex files starting with a period ...

black list regex files starting with a period (.)

Create same "collection" in navigation menu in all...

Re: Splunk server uptime - missing Splunk server d...

Re: Getting decryption failed errors on indexers

Search Activity App "no LDAP" option

Search Activity App