Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About cyndiback
cyndiback
Path Finder
Member since:
03-16-2011
10-10-2020
Community Statistics
| Posts | 35 |
| Solutions | 1 |
| Karma Given | 23 |
| Karma Received | 11 |
| Member Since | 03-16-2011 |
Activity Feed
- Karma Re: After upgrading to Splunk 6.4.0, why is my Data inputs list in Splunk Web incomplete? for nicolas_rofort. 06-05-2020 12:48 AM
- Karma Re: For Splunk Enterprise, Splunk Light, and Hunk pre 6.3, default root certificates expire on July 21, 2016 - Recommendations? for newbiesplunk. 06-05-2020 12:48 AM
- Karma Re: For Splunk Enterprise, Splunk Light, and Hunk pre 6.3, default root certificates expire on July 21, 2016 - Recommendations? for splunker12er. 06-05-2020 12:48 AM
- Karma Re: For Splunk Enterprise, Splunk Light, and Hunk pre 6.3, default root certificates expire on July 21, 2016 - Recommendations? for splunker12er. 06-05-2020 12:48 AM
- Got Karma for Upgraded heavy forwarder from 6.1.2 to 6.4.2 and unable to access data inputs from web.. 06-05-2020 12:48 AM
- Got Karma for Upgraded heavy forwarder from 6.1.2 to 6.4.2 and unable to access data inputs from web.. 06-05-2020 12:48 AM
- Karma Re: How to convert Week of Year number to a standard Date format? for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for Blackboard bb-access-logs not parsing correctly. 06-05-2020 12:47 AM
- Got Karma for Re: Blackboard bb-access-logs not parsing correctly. 06-05-2020 12:47 AM
- Karma Re: How can i convert String Type Time field(a) to a human readable Date Type Time field(#)? for ghostworks. 06-05-2020 12:46 AM
- Karma Re: How do I to redirect for website? for dfigurello. 06-05-2020 12:46 AM
- Karma Re: Guidance for using Splunk Apps while restricting access to data per department for gfuente. 06-05-2020 12:46 AM
- Karma Re: Is there a search or other way to easily list the indexes I am permissioned to search? for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: Is there a search or other way to easily list the indexes I am permissioned to search? for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: Map geostats display City instead of latitude and longitude for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: Override downstream autoRun? for sideview. 06-05-2020 12:46 AM
- Karma Re: Simple Dropdown for RicoSuave. 06-05-2020 12:46 AM
- Karma Re: How do I get distinct values for a derived field in a search? for Ayn. 06-05-2020 12:46 AM
- Karma Re: Creating an Automatic Lookup that applies to all hosts/sources/sourcetypes. for Ayn. 06-05-2020 12:46 AM
- Karma Re: Can you use a searchbar and a hiddensearch? for sideview. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 2 |
10-20-2016
01:35 PM
Yes, right now I'm using the api.cloudflare.com to index logs based on a range of times (grab last 5 minutes of data) and save into a json file that Splunk indexes. This has become unreliable.
Is your code leveraging the Python CloudFlare API modules?
... View more
10-16-2016
04:36 PM
How are you bringing in CloudFlare logs?
... View more
10-16-2016
04:35 PM
Were you able to successfully bring in CloudFlare logs?
... View more
07-25-2016
06:48 PM
I'm getting this same error - I only need the users to be able to run dbxquery. Did you find a solution?
... View more
07-15-2016
03:46 PM
I've opened as support case and will let you know what they say.
... View more
07-14-2016
06:49 AM
I'm received the error but did not disable the splunk_httpinput app. I tried disabling and re-enabling the app. Did not help.
... View more
07-14-2016
06:24 AM
2 Karma
Upgraded heavy forwarder from 6.1.2 to 6.4.2 unable to access data inputs from web. From Splunk forwarder webpage >> Settings >> Data Inputs >> I get 500 error below (I removed the dns name from the link). This has happened on 4 of my forwarders same version upgrade
500 Internal Server Error
Return to Splunk home page
View more information about your request (request ID = 578791ed777f92503880d0) in Search
This page was linked to from https://dns_name:8000/en-US/app/launcher/home.
... View more
Labels
- Labels:
-
heavy forwarder
-
upgrade
07-12-2016
12:04 PM
Is this needed for upgrades to version 6.4.x?
... View more
12-17-2015
09:48 AM
Actual solution - The issue was Blackboard does not write complete events but instead queues data, writes, pauses to queue again and writes. Splunk support advised - As Splunk's tailing process can see the pause and interprets the complete event has been written and then tries to ingest the data. A majority of the time the data is written as complete events but not always. Easy way to check for bb-access-log accuracy is have search look if there are logs that do not contact source ip (e.g. NOT src_ip=*)
To resolve add time_before_close to forwarder inputs.
time_before_close = 30
Doc: http://docs.splunk.com/Documentation/Splunk/6.2.6/Admin/Inputsconf
time_before_close = integer
Modtime delta required before Splunk can close a file on EOF.
Tells the system not to close files that have been updated in past seconds.
Defaults to 3.
... View more
10-09-2015
10:41 AM
1 Karma
Found the issue - The logs are being written in incomplete chunks by blackboard. Splunk is indexing logs as it sees it.
Hard learned lesson to tail your files to see how they are being written.
... View more
10-09-2015
09:37 AM
My original confs did not contain line breaker and the issue started.
... View more
10-06-2015
03:18 PM
Other LINE_BREAKER regex tried:
()\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\s\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}
(\b(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])){3}\b)\s((\b(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])){3}\b)|\-)\s
... View more
10-06-2015
03:09 PM
Updated
LINE_BREAKER = (\b(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])){3}\b)\s((\b(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])){3}\b)|\-)\s
We've tried variations of the regex including
()\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\s\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}
... View more
10-06-2015
03:03 PM
1 Karma
Blackboard has changed the format of the bb-access-logs to include session information. With the new data the logs are being split into several logs and some are being indexed with the wrong timestamp. Is anyone else working with these logs and successfully indexing them?
Splunk universal forwarder, inputs.conf:
[monitor:///usr/local/blackboard/apps/tomcat/logs/bb-access-log.*.txt]
index=oc_dev
sourcetype=bb-access-log
ignoreOlderThan=1h
Splunk indexer props.conf:
[bb-access-log]
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
MAX_TIMESTAMP_LOOKAHEAD = 85
SHOULD_LINEMERGE = False
TRUNCATE = 25000
LINE_BREAKER = ([\n\r]+)(\b(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])){3}\b)\s((\b(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])){3}\b)|\-)\s
EXTRACT-webcampus_access-fields = (?<src_ip>\b(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\b)\s(?<dest_ip>.*?)\s(?<HTTPComponent>.*?)\s(?<duid>.*?)\s(?<dateInternal>\[(.*?)\])\s(?<HTTP>\"(.*?)\")\s(?<http_status_code>.*?)\s(?<unknownDigits2>.*?)\s(?<http_user_agent>\".*?\")\s
Example of possible log formatting:
ip_address ip_address http_code duid [%d/%b/%Y:%H:%M:%S %z] "http activity" digit digit "browser information" "session information" digit digit
ip_address - http_code duid [%d/%b/%Y:%H:%M:%S %z] "http activity" digit digit "browser information" "session information" digit digit
ip_address - http_code {unset id} [%d/%b/%Y:%H:%M:%S %z] "http activity" digit digit "-" "-" digit digit
- - - {unset id} [%d/%b/%Y:%H:%M:%S %z] "http activity" digit digit "-" "-" digit digit
Example of possible logs:
1.1.1.1 1.1.1.1 http-nio-8081-exec-3 _1_2 [06/Oct/2015:13:58:22 -0700] "POST /webapps/bb-social-learning-BBLEARN/dwr_open/call/plaincall/ToolActivityService.getActivityForAllTools.dwr HTTP/1.1" 200 116 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36" "JSESSIONID=123456789123456879; BIGipServer~Part-Apps~blackboard-8081=155738122.37151.0000; cookies_enabled=yes; JSESSIONID=123456789123456879; web_client_cache_guid=57a5cf06-3530-48d4-a15f-24f7b7ad0c86; __utma=180787233.108259193.1444163123.1444163123.1444163123.1; __utmb=180787233.17.10.1444163123; __utmc=180787233; __utmz=180787233.1444163123.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); session_id=123456789123456879; s_session_id=123456789123456879" 14 116
1.1.1.1 - http-nio-8081-exec-7 {unset id} [06/Oct/2015:14:45:52 -0700] "GET / " 200 975 "-" "-" 78 975
1.1.1.1 1.1.1.1 http-nio-8081-exec-39 _1_2 [06/Oct/2015:14:45:50 -0700] "POST /webapps/blackboard/dwr_open/call/plaincall/ToolActivityService.getActivityForAllTools.dwr HTTP/1.1" 200 116 "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" "JSESSIONID=123456789123456879; AMCV_774C31DD5342CAF40A490D44%40AdobeOrg=793872103%7CMCIDTS%7C16709%7CMCMID%7C54023606677090264832941195089008334173%7CMCAAMLH-1444243530%7C7%7CMCAAMB-1444243530%7CNRX38WO0n5BH8Th-nqAG_A%7CMCAID%7CNONE; s_vnum=1446231162345%26vn%3D1; optimizelySegments=%7B%22183805944%22%3A%22none%22%2C%22183871552%22%3A%22direct%22%2C%22183916464%22%3A%22false%22%2C%22184368091%22%3A%22gc%22%7D; optimizelyEndUserId=123456789123456879.123456789123456879; optimizelyBuckets=%7B%7D; s_fid=123456789123456879-1F5618C69F6F5C95; mbox=session#1443638730148-106896#1443641446|PC#1443638730148-106896.17_60#1444849186; _ga=GA1.2.1929637067.1443278384; BIGipServer~Part-Apps~blackboard-8081=155738122.37151.0000; xythosdrive=0; web_client_cache_guid=6251af67-d5e0-4752-a2f7-0a05da0b8839; __utma=184114681.1929637067.1443278384.1443715769.1444002370.6; __utmc=184114681; __utmz=184114681.1443278384.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); JSESSIONID=123456789123456879; __utma=180787233.1929637067.1443278384.1444154819.1444159011.35; __utmc=180787233; __utmz=180787233.1443320404.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); session_id=123456789123456879; s_session_id=123456789123456879" 3 116
Original post did not update successfully.
... View more
02-19-2015
07:55 AM
Same issue
OS: Windows Server 2012
Universal forwarder 6.1.2.2213098
Source: WinEventLog:Security and WinEventLog:Application
... View more
03-28-2014
02:49 PM
Using your answer provides the City and Count in an easy to read format, results:
City: Count
Anaheim 1
Apple Valley 2
etc
FYI - I tried showing both count and distinct count..Not easy to read
...| geostats count, dc by City
Results:
count: CityA #
count: CityB #
dc: CityA #
dc: CityB #
... View more
03-28-2014
11:08 AM
1 Karma
Using simple XML dashboard. Is there a way to show the City name in the pop-up window instead of longitude and latitude (see image)
Dashboard xml:
<map>
<title>Successful connections</title>
<searchString>index=auth_application | iplocation src_ip | geostats count(src_ip), dc(src_ip)</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
</map>
... View more
03-27-2014
08:01 AM
Passing tokens to a pivot dashboard:
Using simple xml I created a dashboard with a dropdown selector.
All my dashboard panels were created with a pivot search.
When creating the search I added the token $host$ into the filter and saved the dashboard.
The dashboard works as expected
Is there any unintended consequences with using pivot this way?
Dropdown search:
<populatingSearch fieldForValue="selected_host" fieldForLabel="selected_host">
<![CDATA[| pivot WebCampus_Access webcampus_authentication SPLITROW host AS "selected_host" SORT 100 host]]>
</populatingSearch>
Dashboard searcH:
<searchString>| pivot WebCampus_Access webcampus_authentication count(evt_code) AS "Count of event_code" SPLITROW _time AS "_time" PERIOD auto SPLITCOL host FILTER evt_code = 0 FILTER host is $selected_host$ SORT 0 _time NUMCOLS 100</searchString>
... View more
03-21-2014
02:24 PM
My post should have been submitted as a comment to this answer. Using solution I could not get the earliest/latest date/times to display in the DateTime modules by default.
... View more
03-21-2014
02:22 PM
I've tried using the solution provided but dates are not displaying in the fields when the page is loaded (screenshot included). I am building a form that has a text field for username and then the datetime for earliest and latest.
<module name="TextField" layoutPanel="panel_row1_col1">
<param name="label">Username</param>
<param name="name">user</param>
<module name="Search" autoRun="True">
<param name="latest">@h</param>
<param name="earliest">-24h@h</param>
<param name="search"><![CDATA[
| stats count | fields - count | addinfo | rename info_min_time as earliest info_max_time as latest
]]></param>
<module name="ResultsValueSetter">
<param name="fields">earliest, latest</param>
<module name="DateTime">
<param name="label">Start date:</param>
<param name="name">earliest</param>
<module name="DateTime">
<param name="label">End date:</param>
<param name="name">latest</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
Runtime Debug (datetime after ResultsValueSetter)
Debug Module : DateTime0_3_0
Search values added/modified for downstream modules (none) Normal keys added/modified for downstream modules (none) Search values inherited from upstream
- search: | stats count | fields - count | addinfo | rename info_min_time as earliest info_max_time as latest
- timerange (-24h@h,@h) over custom relative time range
- search id 1395436519.1159 Normal keys inherited from upstream
- user.element [object Object]
- earliest 1395349200.000
- latest 1395435600.000
... View more
10-30-2013
08:00 AM
Looking for best practices/guidance
Our organization has several departments. Each department maintains their own Windows/Unix servers. Forwarders (mixture of universal/heavy) are installed on each server. We have a single Splunk instance (indexer and search head to same machine). We have a requirement that each department should only see data generated by their equipment. We would like to use the Splunk Windows and Linux apps. We have been restricting access by index but these apps use index=os by default.
What is the best approach for deploying the apps while restricting access to the data per department?
... View more
02-27-2013
09:09 AM
1 Karma
Splunk version 4.3.4 and Sideview Utils version 2.4.1
I am unable to edit or create new views. When I launch sideview editor the drop down options for App and Views are blank.
==Update
Browser: Firefox 19.0
Tools > Web Developer > Error Console > No errors logged. Some warnings (example below):
Timestamp: 2/27/2013 3:10:59 PM
Warning: Unknown property '-moz-border-radius-topleft'. Declaration dropped.
Source File: https://oc05.oc/en-US/static/@136012/css/skins/default/default.css
Line: 203
I tried upgrading Sideview Utils (restarting splunk)
I removed sideview utils completely and re-installed (restarted splunk)
Cleared browser cache (see same issue when accessing editor on different machines)
OS: CentOS release 6.3
... View more
09-05-2012
05:29 PM
Perfect solution! Thank you very much. Can't wait to explore everything else SideviewUtils can help with.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-10-2020
03:53 PM
|
Karma from
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 2 | |
| 2 | |
| 3 |
