About deca2499

deca2499 · ‎02-24-2021

Hi @scelikok , I was just able to get the export done with 14k results, but when I bumped it up to 24 hours with 330k results, it failed and gave me that error.

deca2499 · ‎02-24-2021

Has anyone seen this in any way? We are running the free version of Splunk and it seems like whatever time range I choose, I get the same error.

deca2499 · ‎02-18-2021

Hey all, I hope this is the correct board for this question, but I am having an issue when I try to export a search to CSV from a search. I keep getting the following error when trying to run the export. Has anyone seen this and how to resolve it? I am using version 8.1.2 FWIW. Unrecoverable error in the server. Traceback (most recent call last): File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\_cpwsgi.py", line 184, in trap return func(*args, **kwargs) File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\_cpwsgi.py", line 277, in __next__ return next(self.iter_response) File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\lib\encoding.py", line 99, in encoder for chunk in body: File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\splunk\rest\__init__.py", line 698, in readall data = response.read(blocksize) File "C:\Program Files\Splunk\Python-3.7\lib\http\client.py", line 457, in read n = self.readinto(b) File "C:\Program Files\Splunk\Python-3.7\lib\http\client.py", line 501, in readinto n = self.fp.readinto(b) File "C:\Program Files\Splunk\Python-3.7\lib\socket.py", line 589, in readinto return self._sock.recv_into(b) File "C:\Program Files\Splunk\Python-3.7\lib\ssl.py", line 1071, in recv_into return self.read(nbytes, buffer) File "C:\Program Files\Splunk\Python-3.7\lib\ssl.py", line 929, in read return self._sslobj.read(len, buffer) socket.timeout: The read operation timed out THanks!

deca2499 · ‎01-27-2021

DANGIT! ! I didnt even think to look at the kiwi service that is on the server.. It was running, so it was probably getting them before Splunk.. I have now disabled the service and Splunk is getting what I was expected to... Sometimes, you just have to look at the simple things. Thanks!

deca2499 · ‎01-27-2021

Hello all, I am having a problem with my Splunk install that it has stopped accepting syslogs from my Cisco ASA. It was working until 2 days ago. I have the ASA sending the logs to the Splunk server. I am trying to get it back up and running so that I can try and get my ASA access lists worked on. The Splunk install is on a Windows 2016 server and I do not know much about Linux. I really do not want to blow it away and have to redo it all from scratch... I know the server is getting the logs as I have Kiwi on the box as well and it shows the logs as they come in. The firewall is off on the Windows server as well. Can anyone help and point me in the right direction to find out what is going on and get it fixed? Thanks!

deca2499 · ‎01-13-2021

Hi richgalloway, I apologize to make is sound as if we were going to use Splunk to make the real-time decisions. We will be using the ASA to make those decisions in real time, but at the moment the ASA is just passing everything between production and lab. We want to see what traffic is going on at the moment so we can come up with the proper rules to put on the ASA. Currently we just have the ACLs as 'permit any any' both ways. I just need help in using Splunk to see what traffic is going on so that I can start to come up with a 'valid traffic' list. I hope that helps in clearing things up. Sorry for not being clear in the first post. Thanks!

deca2499 · ‎01-13-2021

Hello all, Serious newbie to Splunk here. I have been tasked with trying to identify traffic and create rules to either allow or block traffic coming and going from our company IT lab. I installed a Cisco ASA 5525 in transparent mode and now they want me to start locking it down. Thus I need to ID the traffic. I could really use the help on how to go about this with Splunk. I thought maybe trying to use netflow to do this but do not seem to be having much luck with getting it running on our Splunk install. I do not even know if I am doing that correctly at this point.. LOL.. One thing of note, as this is a lab, I have been told there is a budget of $0 for this. 😞 Thank you in advance for all of your help!

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-13-2021

Online Status	Offline
Date Last Visited	‎02-24-2021 07:39 PM

Read error when exporting to CSV file

Splunk not getting syslogs.

Best way to ID traffic from Cisco ASA

Re: Read error when exporting to CSV file

Re: Read error when exporting to CSV file

Read error when exporting to CSV file

Re: Splunk not getting syslogs.

Splunk not getting syslogs.

Re: Best way to ID traffic from Cisco ASA

Best way to ID traffic from Cisco ASA