About maaneeel

maaneeel · ‎06-17-2021

Hello, After configure DBConnect to get data from a SQL database, I found the following error after restart the splunk service: Invalid key in stanza [nameOfMyQuery] in /opt/splunk/etc/apps/splunk_app_db_connect/local/db_inputs.conf, line XX: tail_rising_column_init_ckpt_value (value:{"value":"0","columnType":4}) Checking the documentation https://docs.splunk.com/Documentation/DBX/3.5.1/DeployDBX/dbinputs it seems like is not a deprecated parameter... Removing this line from the config file, the data input works properly but I don't know if could I get repeated inputs or any similar error. How could I solve the problem? Thanks Thanks

maaneeel · ‎06-02-2021

Thanks I didn't know spath command, but after try it I have the same problem with the new field... Any idea? Thanks

maaneeel · ‎06-02-2021

I also tried use eval and filter by the new result without success

maaneeel · ‎06-02-2021

Hello again, It's not working, Thanks for your help @isoutamo

maaneeel · ‎06-01-2021

Hi, I'm using the PRTG app to get logs from this monitoring tool and build clean reports about our servers health. The API is returning a JSON and the automatic field extraction gets fields like sensors{}.sensor. How could I build a query referencing to this fields? If I try something like this fails: index=prtg "sensors{}.sensor"=Ping Thanks

maaneeel · ‎02-15-2021

Thanks for the answers. Using search account_name = * works properly, but I would like to remove the default value (*) from the input textbox, just to prevent that when the analyst finish a search of a specific user, doesn't need to type * again to display any user.

maaneeel · ‎02-15-2021

Hello, I need to create a dashboard panel (table) doing a query that uses the following filtering condition: account_name = "$userNameToken$") How could I prevent the situation where the token is not defined and display any user? Thanks

maaneeel · ‎01-25-2021

Hello, A few minutes ago, I discovered that my problem was produced by another log management platform that we have betweeen deep security and splunk (I thought that it was sending the log to the Heavy Forwarders) but it was sending these logs directly to the indexers, so the transmorfation has not been applied. After try to send logs directly to Heavy Forwarders the sourcetype is being replaced properly, a change that I also did is modify all files inside default directory and write the name of the index that I'm using before the queries that just contains sourcetype. Thanks!

maaneeel · ‎01-25-2021

So, you deployed a different input app on Heavy Forwarders for each sourcetype and then set these sourcetypes on the same input, right' thanks for you quick reply!

maaneeel · ‎01-25-2021

Hello, I have the same problem on my splunk (all servers are on prem), I installed the app on Heavy Forwarders, Indexers and Search Heads, and I'm receiving all logs but all events are tagged as deepsecurity instead of deepsecurity-antimalware, deepsecurity-firewal.... At the beggining I had the app on Indexers and Search Heads, and Heavy forwarders had a simple app created by me that just monitor the file writted by rsyslog, now I deployed the DeepSecurity app and copy inputs.conf inside. What could I check? Thanks

Posts	10
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎01-25-2021

Online Status	Offline
Date Last Visited	‎06-07-2022 12:15 PM

DBConnect - tail_rising_column_init_ckpt_value

Work with fieldnames that contains {}. +PRTG

Use token just if is defined

DBConnect - tail_rising_column_init_ckpt_value

Re: Work with fieldnames that contains {}. +PRTG

Re: Work with fieldnames that contains {}. +PRTG

Re: Work with fieldnames that contains {}. +PRTG

Work with fieldnames that contains {}. +PRTG

Re: Use token just if is defined

Use token just if is defined

Re: Trend Micro Deep Security for Splunk - sourcet...

Re: Trend Micro Deep Security for Splunk - sourcet...

Re: Trend Micro Deep Security for Splunk - sourcet...