Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About coreyCLI
coreyCLI
Path Finder
Member since:
08-21-2020
2 weeks ago
Community Statistics
| Posts | 42 |
| Solutions | 4 |
| Karma Given | 2 |
| Karma Received | 9 |
| Member Since | 08-21-2020 |
Activity Feed
- Posted Re: How to upgrade Mongo in Splunk 9.0.0? on Installation. 07-18-2023 08:37 AM
- Posted Re: Use drilldown token in URL on Dashboards & Visualizations. 04-19-2023 06:40 AM
- Posted Use drilldown token in URL on Dashboards & Visualizations. 04-19-2023 05:05 AM
- Got Karma for Re: How to remove weak ciphers?. 03-21-2023 08:53 PM
- Got Karma for Re: How to remove weak ciphers?. 03-21-2023 08:32 AM
- Posted Re: How to remove weak ciphers? on Splunk Search. 03-21-2023 06:24 AM
- Posted Re: Is it possible to migrate indexed buckets to a different index on a new machine? on Installation. 03-17-2023 08:46 AM
- Posted Re: How to remove weak ciphers? on Splunk Search. 02-27-2023 05:50 AM
- Posted How to remove weak ciphers? on Splunk Search. 02-24-2023 08:24 AM
- Posted Re: Why are we getting this error after upgrading Splunk DB Connect? on Splunk Enterprise. 12-29-2022 06:23 AM
- Posted Re: Field value specific drilldown on Dashboards & Visualizations. 12-28-2022 10:51 AM
- Posted Field value specific drilldown on Dashboards & Visualizations. 12-28-2022 06:22 AM
- Posted Index migration event count becomes 3x more on Splunk Search. 11-14-2022 05:46 AM
- Posted Can I use macro but complete search if macro is broken or missing? on Splunk Search. 09-28-2022 07:04 AM
- Tagged Can I use macro but complete search if macro is broken or missing? on Splunk Search. 09-28-2022 07:04 AM
- Karma Re: Indexer replication factor from REST for richgalloway. 09-28-2022 06:59 AM
- Posted Is there an API available or some other SPL searchable way to find the Index Cluster replication factor? on Monitoring Splunk. 08-26-2022 06:11 AM
- Tagged Is there an API available or some other SPL searchable way to find the Index Cluster replication factor? on Monitoring Splunk. 08-26-2022 06:11 AM
- Tagged Is there an API available or some other SPL searchable way to find the Index Cluster replication factor? on Monitoring Splunk. 08-26-2022 06:11 AM
- Tagged Is there an API available or some other SPL searchable way to find the Index Cluster replication factor? on Monitoring Splunk. 08-26-2022 06:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
11-09-2023
04:58 AM
Hi ! I am facing a very similar issue : after adding a new field to my KV store automatic lookup doesn't work and never returns my new field in my events but I can manually retrieve it with this query : | inputlookup my_kvstore but that one : index=my_index | lookup my_kvstore... throws an error : [comma separated of my indexers list] phase_0 - Streamed search execute failed because: Error in 'lookup' command: Cannot find the destination field 'my_new_field' in the lookup table 'my_kvstore'.. still, with this query : index=my_index | lookup local=true my_kvstore... I can retrieve my new field... Regards,
... View more
04-19-2023
06:40 AM
I have no "unset" configured for that token so I don't believe so.
... View more
03-23-2023
11:28 AM
I don't know if you noticed but this thread is already 12 years old and the post you're asking about is 4 years old. You have better chance of getting a response by writing a new question (maybe pointing to this old thread for reference) instead of digging up such ancient history 😉
... View more
03-21-2023
06:24 AM
2 Karma
For anyone interested. My particular issue required me to call out the ecdhCurves specifically. [replication_port-ssl://8999]
cipherSuite = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384
ecdhCurves = prime256v1, secp384r1, secp521r1 Everything worked once adding the ecdhCurves.
... View more
12-29-2022
06:23 AM
Did you ever find a solution for this issue?
... View more
12-28-2022
10:51 AM
For anyone that might be interested this is the solution I am using so far. <condition match="$row.ip$ != "N/A"">
<link target="_blank">/app/appname/dashboard_name?form.search_token=$click.value2$</link>
</condition>
<condition field="Tasked"></condition>
... View more
12-02-2022
10:18 AM
How did you fix this? I am currently experiencing the same error after adding a new search head to our cluster.
... View more
11-14-2022
05:46 AM
I recently migrated a clustered index. We wanted to rename the index. I created the new index as your normally would via the CM. Put the cluster in maintenance mode. Stop any ingest into the "old" index and merely copied all the contents of the "old" index into the "new" index on all 6 of our indexers. Took the cluster out of maintenance mode and did a rolling restart. Everything worked fine except when I count the events in both indexes for ALL TIME, the old index is ~40 million events and the new index is ~111 million events. We have a SF & RF of 3. My thoughts are that its something with the RF of 3 however the math does not really workout to be 3x.
... View more
09-28-2022
09:37 AM
Please explain your use case. Why would you want a broken (because macros are missing) search to complete successfully? Wouldn't that run the risk of returning incorrect results?
... View more
08-26-2022
06:32 AM
1 Karma
You can get that from the Cluster Manager using REST. https://<CM URL>:8089/services/cluster/config
... View more
04-26-2022
05:58 AM
We built a custom app and deployed it in splunk. It is writing logs in splunk/var/log/appname/appname.log. I would like to find a way handle the logs natively within splunk, possibly using log.cfg to roll the log at a certain size as well as retention. I added a stanza to log.cfg in an attempt to manage this log but splunk doesnt appear to care about the added configs. Anyone use this file in such a way? Is it even possible? Below is a snippet of the config I added to log.cfg for the app. appender.appname=RollingFileAppender appender.appname.fileName=${SPLUNK_HOME}/var/log/appname/appname.log appender.appname.maxFileSize=25000000 # default: 25MB (specified in bytes). appender.appname.maxBackupIndex=5 appender.appname.layout=PatternLayout appender.appname.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
... View more
Labels
- Labels:
-
app
12-22-2021
11:54 AM
Shortly, you could run rest towards all defined search peers. This is the reason why it works on MC. Basically you could add additional peers (like HFs, currently as indexers) and then get that information from them.
... View more
08-03-2021
07:26 AM
for anyone interested. I just need to encode the commas separating the values severity=Critical%2CHigh%2CModerate
... View more
06-23-2021
04:48 AM
I had the same issue after copying a known working server.conf file (with encrypted pass4symmkey) to new peer, and once i had it on the new peer I updated the password (so that it wasnt encrypted) and saved. BUT then i realized it was in "DOS" format, and I used vim command ":set ff=unix" and then saved. Switching from DOS to UNIX file format is what mangled it so that it could no longer be used. To resolve, i opened server.conf and removed the encrypted pass4symmkey and replace it with the unencrypted value and restarted.
... View more
06-22-2021
05:09 AM
For anyone interested. I found an alias someone create using _time. "FIELDALIAS-ts = ts as _time". Once removed, all was working as it should.
... View more
02-10-2021
03:15 AM
Thanks for the quick reply Jacob. While that didnt work for our specific case I do appreciate the response. In the end, and I am usure why TBH, this is whats currently in place and working for us to blacklist files that start with a dot (.) blacklist = \/dir\/dir\/syslog\/\.\S+
... View more
12-03-2020
04:55 AM
I know how to create/edit the navigation menu and create collections however, I would like to create a "Tools" collection then is displayed on every current and any new app created. Is there a way to create this once and have it displayed by default in every App so that I dont have to go to each one and add this collection specifically?
... View more
Labels
- Labels:
-
other
08-21-2020
05:21 AM
I installed Search Activity App 3.0.1 on a 7.3.4 Splunk instance. I do not have LDAP in this environment. I cannot step through the setup process. I cant get passed the Collecting Data page. One thing that I am curious about is that the "Existing Configuration Retrieved" check says "in Progress" however I have never installed Search Activity before. Not sure if this never changing from "in Progress" is the reason the I cannot pass this page. the Next button is greyed out. I want to be able to configure this with the "No LDAP" option.
... View more
- Tags:
- Search Activity
08-21-2020
04:59 AM
I installed Search Activity App 3.0.1 on a 7.3.4 Splunk instance. I do not have LDAP in this environment. I cannot step through the setup process. I cant get passed the Collecting Data page. One thing that I am curious about is that the "Existing Configuration Retrieved" check says "in Progress" however I have never installed Search Activity before. Not sure if this never changing from "in Progress" is the reason the I cannot pass this page. the Next button is greyed out. I want to be able to configure this with the "No LDAP" option.
... View more
- Tags:
- Search Activity
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
