Hello Splunk Answers, I am looking to build a static lookup table for Firewall ACL lookup. Essentially, I would like the lookup to match on dst_port and determine if the port matches an existing acl rule name. I have an any-any rule that I'm trying to clean-up and the idea is to have Splunk tell me if the dst_port matches an existing acl rule entry. If no rule match is made, then the connection is permitted via an any-any rule. I'm looking to match on dst_port. In this example, traffic connections on 80, 53 would match rule_name like in the example below. fields: dst_port, rule_name 80, permit_web 53, permit_dns The idea is, if traffic connections do not match on a specific entry, then state something like this: dst_port, rule_name 8748, any_any I appreciate the assistance. -ktang ... View more

Greetings Splunk Answers, I recently upgraded from Splunk DB Connect 1.0.8 to 1.0.9 and am now experiencing an issue where the Java Bridge Server stays in a "loading" state. I don't utilize search head pooling in my env. I don't see the 'Splunkd REST Keep-alive' entries in the dbx.log. I am seeing numerous entries where the BridgeSession continually executes...but successfully. status=0 ...? dbx.log: 2013-05-08 22:28:03.665 dbx6779:INFO:BridgeSession - Executing Bridge command: BridgeExecutionInfo{className=com.splunk.bridge.cmd.Reload} 2013-05-08 22:28:03.665 dbx6779:INFO:Reload - Reloading component=dbmon 2013-05-08 22:28:03.666 dbx6779:INFO:BridgeSession - Execution finished in duration=1 ms with status=0 2013-05-08 22:28:03.666 dbx6779:INFO:ExecutionContext - Execution finished in duration=2 ms I'm not seeing any issues with in the jbridge.log file. jbridge.log: 2013-05-08 21:00:09,055 DEBUG starting pid watcher... 2013-05-08 22:25:55,240 DEBUG cleanup callback... termingating process 2013-05-08 22:25:55,240 DEBUG sending shutdown command to jbridge server 2013-05-08 22:25:55,240 DEBUG Running btool for 'java.conf'. 2013-05-08 22:26:57,064 DEBUG Setting up Java Environment: app=dbx, cfg_name=java, cfg_stanza=java, java_home=None 2013-05-08 22:26:57,357 DEBUG JAVA_HOME=/usr/jre/jdk1.7.0_21/ 2013-05-08 22:26:57,358 DEBUG options=['-Xmx256m', '-Dfile.encoding=UTF-8', '-server', '-Duser.language=en', '-Duser.region=', '-Dsplunk.app.ctx=dbx'] 2013-05-08 22:26:57,358 INFO Checking for obsolete java libraries in /opt/splunk/etc/apps/dbx/bin/lib 2013-05-08 22:26:57,358 DEBUG Starting JavaBridgeServer... 2013-05-08 22:26:57,358 DEBUG Executing (native) CMD /usr/jre/jdk1.7.0_21/bin/java -cp /opt/splunk/etc/apps/dbx/bin/lib/jdbm-2.2.jar:/opt/splunk/etc/apps/dbx/bin/lib/commons-logging-1.0.4.jar:/opt/splunk/etc/apps/dbx/bin/lib/dbx.jar:/opt/splunk/etc/apps/dbx/bin/lib/mysql-connector-java-5.1.24-bin.jar:/opt/splunk/etc/apps/dbx/bin/lib/xstream-1.4.1.jar:/opt/splunk/etc/apps/dbx/bin/lib/sqlite-jdbc-3.7.2.jar:/opt/splunk/etc/apps/dbx/bin/lib/stringtemplate-3.2.1.jar:/opt/splunk/etc/apps/dbx/bin/lib/hsqldb.jar:/opt/splunk/etc/apps/dbx/bin/lib/antlr-2.7.7.jar:/opt/splunk/etc/apps/dbx/bin/lib/log4j-1.2.15.jar:/opt/splunk/etc/apps/dbx/bin/lib/h2-1.3.162.jar:/opt/splunk/etc/apps/dbx/bin/lib/jtds-1.2.6.jar:/opt/splunk/etc/apps/dbx/bin/lib/commons-pool-1.5.6.jar:/opt/splunk/etc/apps/dbx/bin/lib/postgresql-9.0-801.jdbc3.jar -Xmx256m -Dfile.encoding=UTF-8 -server -Duser.language=en -Duser.region= -Dsplunk.app.ctx=dbx com.splunk.bridge.JavaBridgeServer 30254 2013-05-08 22:26:57,390 INFO Started JavaBridgeServer PID=30272 I suppose the answer lies in why I'm getting numerous BridgeSession executions...but I'm not sure. Can anyone help with this? Thanks, ktang ... View more

Greetings Splunk Answers, I am having an issue with the Splunk DB Connect app where database inputs are not indexing. I'm using dbmon-dump and dbmon-tail to query my DB as data sources. I can see a return of result counts in the dbx.log when the dbmon-dump monitor runs, yet a Splunk search using "source = dbmon-dump://~" does not produce the key-value data from DB table that I am expecting. There are no issues with the db connection. Running an sql statement in DB query produces the key-value data of my table. Is anybody experiencing a similar issue with the Splunk DB Connect app? Am I doing this wrong? Any assistance is appreciated. Thanks, ktang ... View more

Hello, On my Windows box, I've added a new monitor stanza in my local inputs.conf file. The config is: [monitor://<local_dir_path>] index = rsop I'm not seeing the directory being monitored. It doesn't look like the data is being fed. Nor do I see any events in my splunkd.log file indicating the monitor path or index. The splunkd logon account has full control to the directory. Am I missing something? How else can I troubleshoot my issue? Thanks, ktang ... View more