About kcantrel

kcantrel · ‎04-02-2021

Turns out what worked for me was: https: // prd-p-0qk3h.splunkcloud.com:8088/services/collector/raw (I put spaces around the "//" to appease the bulletin board). Note the "prd-p-0qk3h" was unique to my instance. I found that by looking at the URL when I was logged into the console. Also note that it will use a self signed certificate, so you'll have to ignore that SSL warning. But, other than that, it worked!

kcantrel · ‎12-18-2020

@scelikokI asked the product manager (I work for Cloudflare) and he confirmed that there will always be a new line character between log entries, and that the order of the fields is never guaranteed, so there is no reason to try and match on the field after the new line character.

kcantrel · ‎12-17-2020

Yes, I understand all that, but if you look at the screenshot I am showing that ALL the indexes I have are greyed out. That includes the sytem ones, and the ones that I created (e.g. cloudflare_raw).

kcantrel · ‎12-17-2020

I've logged in as sc_admin, which of course has the sc_admin role, but when I go to the Setting->index screen, this is what I see:

kcantrel · ‎12-17-2020

Okay, so there must be something else that is causing my existing HEC to not use the updated sourcetype. I created a new HEC and started using it, and got the desired results. I'm going to stick with the basic "each event is on a separate line" logic, since as far as I have seen that has been the case, and trying to decide what should be after the "{" is non-deterministic. My final question, how can I delete an index? I created a new user and give it all the roles, including "can_delete," but when I go to the index page, the "delete" link is greyed out.

kcantrel · ‎12-17-2020

Thanks for the info. Can you quantify "takes time"? It's been over an hour since I made a change that should have fixed the problem, but I'm not seeing it. And, yes, I am looking at new data coming in. Thanks!

kcantrel · ‎12-17-2020

Keep in mind I am new to Splunk, but I definitely see what you are saying. Crazy that the sourcetype from Cloudflare is so wrong (i.e. this is what comes with the "Cloudflare App.") Having said that, it would appear to me that the basic "([\r\n]+)" should suffice, since as far as I can tell from the output, there is a "new line" at the end of each event. Although, I tried that, and your suggestion, and it didn't seem to work. Is there anything else I need to do after changing that regular expression in the sourcetype to have it go into effect? Or, does it take some time before the change is reflected in the index? And yes, I am looking at data that was imported after I made the change.

kcantrel · ‎12-16-2020

So, I'm using Splunk Cloud, so I'm not sure how to get the props.conf file. The sourcetype is "cloudflare:json". I attached a screenshot of the configuration it. Does that give you the information you are looking for? Thanks for your help.

kcantrel · ‎12-16-2020

I'm using the "LogPush" feature from Cloudflare to get "log events" put into a Splunk index. The log events are all JSON, but apparently many records are sent in a single "push". My problem is, if I search for a "field=value" it will only match if the "field" is in the first record. If I search with just the "value" the record is found, but I need Splunk to recognize the fields. I attached a screenshot of the search results when I just searched for "60286da6ca69eb29". I want to find that "record" via "RayID=60286da6ca69eb29". And really, I just want that record, that starts with the RayID field, and ends with the "WorkerSubrequest". If I search for "RayID=60286dc754aac4e8" (the first record) it matches the way I would expect. So, the question is: Is there a way to get just that portion of the log entry (i.e. just the portion that has "RayID=60286da6ca69eb29), or is that impossible because of the way the records are put into Splunk?

kcantrel · ‎12-02-2020

Okay. I had tried that account as well, but it wouldn't work either. However, when I clicked on the link to this question from my email it required that I log in again. This time it required that I confirm the email address. Once I did that, then using the splunkbase credentials did work. Thanks!

kcantrel · ‎12-02-2020

When I try and install an app (e.g. Cloudflare App for Splunk) I am prompted for my username and password. I provided that, but it says I have given a bad username or password. I've tried multiple times, as well as logged out and back in, of course using the same credentials, so I'm pretty sure I am providing the correct username and password. Is the problem the account doesn't have the appropriate permissions to add an app? If so, what permission does it need? I'm logged in as the "sc_admin" account. I'm using a free cloud account I just started, in case that matters.

kcantrel · ‎12-02-2020

Sorry for the newbie question, but I can't seem to figure out how to use HEC. I am using a free cloud account. I first went into Settings->Data Input and created a HEC and got the token. But, nowhere on that page does it tell me what the endpoint should be. I found this document, that talks about three different ways of creating a HEC depending on your software type. While I know I don't have Enterprise, is the free account a "Self Serve"? Or, a "Managed"? I assume it is "Managed" because the first thing you are supposed to do is go to the "Global Settings" from the HEC page to enable HEC, however when I go to my HEC page there isn't a Global Setting link. Now, if I follow the instructions there it says to go to Settings->Add Data->Monitor->HEC, which I did, but it appeared to just go through the same steps I did when I just went to Settings->Data Input. Regardless, I went through the process and got yet another token. Now, further down the document it has a "How to send data to the HEC" and shows this as the endpoint "<protocol>://input-<host>:<port>/<endpoint>" which is fine, except it doesn't tell you what "host" is. I figured it would be the same as the URL that I used to login: "prd-p-0qk3h.splunkcloud.com", however, the DNS entry for http-inputs-prd-p-0qk3h.splunkcloud.com doesn't exist, nor does input-prd-p-0qk3h.splunikcloud.com. So, at this point I am stuck. If anyone can get me over this hurdle, I'd greatly appreciate it.

Posts	12
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎12-02-2020

Online Status	Offline
Date Last Visited	‎04-02-2021 12:47 PM

Trouble getting a very basic search to work- Is th...

Can't install an app

How to determine you "host" name for an HEC endpoi...

Re: How to determine you "host" name for an HEC en...

Re: Trouble getting a very basic search to work

Re: Trouble getting a very basic search to work

Re: Trouble getting a very basic search to work

Re: Trouble getting a very basic search to work

Re: Trouble getting a very basic search to work

Re: Trouble getting a very basic search to work

Re: Trouble getting a very basic search to work

Trouble getting a very basic search to work- Is th...

Re: Can't install an app

Can't install an app

How to determine you "host" name for an HEC endpoi...