Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About KeithH
KeithH
Path Finder
Member since:
12-23-2020
01-29-2024
Community Statistics
| Posts | 27 |
| Solutions | 1 |
| Karma Given | 9 |
| Karma Received | 3 |
| Member Since | 23-12-2020 |
Activity Feed
- Karma Re: Escaping special characters in text input for bowesmana. 01-29-2024 07:35 PM
- Posted Re: Escaping special characters in text input on Splunk Search. 01-29-2024 05:54 PM
- Posted Re: Why is Splunk DB Connect 3.0 unable to start Task Server? on All Apps and Add-ons. 01-29-2024 11:49 AM
- Got Karma for Why is Upgrade Readiness App version 4.1.2 missing?. 01-28-2024 10:53 PM
- Posted Why is Upgrade Readiness App version 4.1.2 missing? on All Apps and Add-ons. 08-23-2023 04:03 PM
- Karma Re: Difference between outputlookup and outputcsv for alacercogitatus. 04-20-2022 04:12 PM
- Karma Re: Simple search not working but search for NOT != does work. for VatsalJagani. 04-10-2022 09:46 PM
- Posted Re: Simple search not working but search for NOT != does work. on Splunk Search. 04-10-2022 09:43 PM
- Tagged Re: Simple search not working but search for NOT != does work. on Splunk Search. 04-10-2022 09:43 PM
- Karma Re: Simple search not working but search for NOT != does work. for kamlesh_vaghela. 04-10-2022 09:38 PM
- Posted Re: Simple search not working but search for NOT != does work. on Splunk Search. 04-10-2022 09:37 PM
- Posted Re: Simple search not working but search for NOT != does work. on Splunk Search. 04-07-2022 08:44 PM
- Posted Simple search not working but search for NOT != does work. on Splunk Search. 04-07-2022 08:41 PM
- Posted Why is Search not working but search for NOT != does work? on Splunk Search. 04-07-2022 03:03 PM
- Karma Re: How to reindex data from a forwarder for yannK. 04-07-2022 02:25 PM
- Karma Re: Does CVE-2021-3422 also affect HWFs and IFs for richgalloway. 03-28-2022 12:58 PM
- Posted Re: Does CVE-2021-3422 also affect HWFs and IFs? on Security. 03-27-2022 12:32 PM
- Posted Re: Does CVE-2021-3422 also affect HWFs and IFs on Security. 03-24-2022 05:17 PM
- Karma Re: How can I see a list of the questions I have asked across the various communities? for scelikok. 03-24-2022 03:20 PM
- Posted Does CVE-2021-3422 also affect HWFs and IFs? on Security. 03-24-2022 03:08 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-29-2024
05:54 PM
Can anyone point me to where this escaping is documented in the Splunk manuals? I can across it in a dashboard today and have not been able to track it down - very confusing until a colleague told me what it did.
... View more
01-29-2024
11:49 AM
FYI and perhaps this will be helpful to others. I was getting all the same errors and finding little of use in the log files. In my case the problem was that something had deleted these files: C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\windows_x86_64\bin\dbxquery.exe C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\windows_x86_64\bin\server.exe Files of the same name still existed under: ...\windows_x86\bin ...\linux_x86\bin ...\linux_x86_64\bin So we suspect some antivirus or similar must have deleted them for some reason. As soon as I put them back DB Connect was fine.
... View more
08-23-2023
04:03 PM
1 Karma
Hi,
I have the "Upgrade Readiness App" version 4.1.2 installed on my prod and non-prod splunks.
https://splunkbase.splunk.com/app/5483
I had a problem with it so uninstalled it and was going to reinstall it but I see the latest version on splunkbase is now 4.1.1.
What happened to 4.1.2 - was it withdrawn? Is that documented anywhere?
Thanks, Keith
... View more
- Tags:
- readiness app
- upgrade
Labels
- Labels:
-
upgrade
04-10-2022
09:43 PM
Hi Vatsal, Thanks for that. Your suggestion works. I would have thought that Splunk would search on the field transaction_type which is extracted at search time as a single character field. Does this mean if I want to search on the field value (as opposed to words in the _raw) do I need to extract these at index time? Thanks
... View more
- Tags:
- Hi Vatsal
04-10-2022
09:37 PM
Hi Kamlesh, Thanks for the suggestion. I ran what you sent but it shows the field values as 1 byte long. So its not htat.
... View more
04-07-2022
08:44 PM
Oh - I am running Enterprise version 8.2.4
... View more
04-07-2022
08:41 PM
Hi All, I hope someone can enlighten me with this seemingly simple problem. I have this very simple search return 32 rows and showing that all events have a transaction_type value. If I click on the D highlighted above I would expect it to show me just the 20 D rows but instead I get: Very weird. If I change the search to index=orafin sourcetype=ORAFIN2 NOT transaction_type!=D Then I get what I want: Can someone please explain what is happening? Thanks, Keith
... View more
Labels
- Labels:
-
fields
04-07-2022
03:03 PM
Hi All,
I am doing a very simple search over All Time of:
index=index=orafin sourcetype=ORAFIN2
It returns 26 rows and, as this shows, all have a transaction_type value:
If I then select D it adds that to the search but retuns NO rows:
Oddly if I change the search to a double negative I get my data:
Whats going on?
Hoping to be enlightened,
Keith
... View more
Labels
- Labels:
-
fields
03-27-2022
12:32 PM
This site seems to have the best overview of the problem - still doesnt make it clear to me though if a HWF (that isnt indexing) might be affected: https://claroty.com/2022/03/24/blog-research-splunk-patches-indexer-vulnerability-disclosed-by-team82/ Splunks announcement provides little detail: https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
... View more
03-24-2022
05:17 PM
Hi Rich, That was my conern too but the description of the CVE says "Indexer denial-of-service via malformed S2S request" Which makes it sound related to the indexer functions. Is an HWF or IF that is not indexing still at risk? Ta, Keith
... View more
03-24-2022
03:08 PM
Hi All,
Does the recently announced security vulnerability CVE-2021-3422 also apply to HWFs and IF that might be receiving and/or cooking data?
Thanks
... View more
Labels
- Labels:
-
access control
03-02-2022
01:36 PM
the page that teh "see" above referred to was: https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Configureforwardingwithoutputs.conf
... View more
03-02-2022
01:35 PM
Hi All,
We just upgraded our HWF to version 8.2.5 and now when we start splunk we get this this message:
"ERROR: Detected httpout stanza in outputs.conf , forwarding data over HTTP is only supported on Universal Forwarders. For more information, see "
This HWF is outputting all data to the HEC on another splunk instance and is working fine.
What is the meaning of the message? Is this function going to be deprecated?
Note the page it refers to says things like "Supported on Splunk universal forwarders only."
It would be a real concern if this is to be deprecated - does anyone have any idea?
Thanks, Keith
... View more
Labels
- Labels:
-
heavy forwarder
-
universal forwarder
10-28-2021
04:50 PM
Hi Somesoni2 - thanks for the reply. I had seen the post you referred to and re-read it again but it doesnt helpe becuase: 1) the capability is not in the list to select when editing a role - see screenshot below 2) I cant edit the authorize.conf because I am running Splunk Cloud which means I cant access the folders on the server. Any other suggestions???? Thanks, Keith
... View more
10-28-2021
02:58 PM
Hi.
I am trying to run this in splunk cloud:
|rest /services/search/jobs|search isRealTimeSearch=1
But getting this:
Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability
I have looked at users and roles and that capability is not in the list to choose. It is in theSplunk Cloud documentation but simply isnt there to select.
Any ideas why?
Thanks, Keith
... View more
Labels
- Labels:
-
permissions
04-11-2021
07:52 PM
Hi Scelikok, I don't think that's the reason. They do go on to say that hybrid search imposes performance issues especially over time if the cloud gets upgraded and the on-prem doesn't. Hopefully we will find out more as hybrid seems a good solution for the rare time when a longer search is required. thanks
... View more
04-07-2021
06:40 PM
How can I see a list of the questions I have asked across the various communities?
... View more
Labels
- Labels:
-
introduction
04-07-2021
04:26 PM
Hi, I recently completed the Splunk Cloud Admin course and it made mention that a Hybrid Search Head could be set up on-prem to read data across on-prem and cloud. I have also read about this here and all seems fine: Splunk Cloud Platform Service Details But now I have just listened to this video “Apps for Splunk Cloud - Premium Apps” here https://splunkpartnerlearningcenter.mindtickle.com/#/course/1346827044233204509?series=1305980034355667330 Then go into the course and play the THIRD video and listen to time from 3:10 to 3:25 it says that the use of a Hybrid search is only for up to 90 days. Perhaps that video is out of date or perhaps I am misunderstanding. Does anyone know about this 90 day limit as we have several customers moving to the cloud and several want Hybrid search as an option. Thanks
... View more
Labels
- Labels:
-
search head
03-29-2021
03:46 PM
Hi blsoumi, Did you try using this app in Splunk 8? Did it work? I am upgrading from our Splunk 7.3 to Splunk 8 with Cloud so wondered if it worked for you. Thanks
... View more
02-01-2021
02:05 PM
Hi Giuseppe, You are right I didn't put enough info in. I am signing onto the main search head which is on the same box as Indexer 1 (of 2). All the event count details are blank for all indexes but I can search on most of them and find very recent transactions. See screenshots below I am guessing that perhaps the search head (even though its on the same server) is a different instance from the indexer and perhaps I have to sign on to the indexers webpage to see these counts. But that seems a bit daft and I dont know what the url for the indexer would be. Any other suggestions?
... View more
01-31-2021
08:43 PM
Is it possible to disable a dashboard. I can see it is very easy to disable an App or a Report but I cant find anything to simply disable a Dashboard. A i missing something? thanks
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-29-2024
09:40 PM
|
Karma given to
