Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About andrew_burnett
andrew_burnett
Path Finder
Member since:
10-14-2021
08-11-2023
Community Statistics
| Posts | 65 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 10-14-2021 |
Activity Feed
- Posted Re: Splunk Rest Commands Invalid on Monitoring Splunk. 08-11-2023 08:52 AM
- Posted Splunk Rest Commands Invalid on Monitoring Splunk. 08-11-2023 08:39 AM
- Posted Re: Splunk Lookup Editor App on Splunk Enterprise. 08-01-2023 02:02 PM
- Posted Splunk Lookup Editor App: Why are changes to KVstore not being saved after upgrading? on Splunk Enterprise. 08-01-2023 12:45 PM
- Posted Re: Why are we missing data on Tenable Add-On? on All Apps and Add-ons. 07-17-2023 12:59 PM
- Posted Why are we missing data on Tenable Add-On? on All Apps and Add-ons. 07-12-2023 08:55 AM
- Posted Re: Error in splunkd - fileclassifiermanager - Error (bad allocation) encountered ... on Getting Data In. 05-11-2023 10:26 AM
- Karma Re: CSV Header Issues for woodcock. 04-14-2023 12:53 PM
- Posted Re: CSV Header Issues on Splunk Enterprise. 04-14-2023 12:36 PM
- Posted Re: CSV Header Issues on Splunk Enterprise. 04-14-2023 12:35 PM
- Posted Re: CSV Header Issues on Splunk Enterprise. 04-14-2023 12:29 PM
- Posted Any advice on how to resolve multiple CSV header issues? on Splunk Enterprise. 04-14-2023 09:43 AM
- Posted Re: How to find CSV issue? on Knowledge Management. 03-30-2023 11:56 AM
- Posted How to find CSV issue? on Knowledge Management. 03-30-2023 08:40 AM
- Posted Re: KVStore Memory Leak on Splunk Enterprise. 03-20-2023 07:34 AM
- Posted KVStore Memory Leak- How to manage without restarting every week? on Splunk Enterprise. 03-17-2023 12:37 PM
- Karma Re: IDX crashed out of nowhere- What is the cause of this? for richgalloway. 02-13-2023 11:54 AM
- Posted IDX crashed out of nowhere- What is the cause of this? on Splunk Enterprise. 02-13-2023 08:58 AM
- Posted Re: Error in splunkd - fileclassifiermanager - Error (bad allocation) encountered ... on Getting Data In. 02-10-2023 08:09 AM
- Posted Re: Need help with a Search on Splunk Search. 09-28-2022 12:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-11-2023
08:52 AM
It makes no difference if I change it and run it on the HF locally itself, the second REST command never works.
... View more
08-11-2023
08:39 AM
I have a HF that was recently expanded in terms of its RAM capacity. Ever since, there has been an issue with REST commands off specific endpoint. Example: | rest splunk_server=splunk-hf1 /services/server/info (Works great and gives me the expected results) | rest splunk_server_group=dmc_group_* /services/server/status/resource-usage/hostwide (When I run it it acts like some of my servers, including a HF has 0 memory)
... View more
Labels
- Labels:
-
monitoring console
08-01-2023
02:02 PM
This is being experienced by multiple users, so a browser cache isn't the issue.
... View more
08-01-2023
12:45 PM
Ever since we upgraded to Lookup Editor 4.0.1, any KVstore changes made in the app don't save for some reason. It says they do, but they don't. CSV files work normally.
... View more
- Tags:
- splunk-search
Labels
- Labels:
-
upgrade
07-17-2023
12:59 PM
No the issue is that it's not getting to Splunk, but I have no clue why that would be. The data is in Tenable Cloud but not getting to Splunk apparently.
... View more
07-12-2023
08:55 AM
We have an issue where Splunk is not showing vulnerabilities in fixed state, but Tenable Cloud has the correct information. So we're likely losing data between Tenable Cloud and Splunk at least for the update of the fixed status of vulnerabilities, but I have no clue why. Logs look clean, we're getting data. And the issue cannot be on Tenable side since they have the correct data and we collect that right off the API. Any ideas?
... View more
Labels
- Labels:
-
troubleshooting
05-11-2023
10:26 AM
Anyone figure out why? I'm having this exact same issue.
... View more
04-14-2023
12:36 PM
Oh I see it now, the word is in the CSV file itself. But I'm only concerned with the headers, is that not what the alert means?
... View more
04-14-2023
12:35 PM
Well see we are trying to find specific keywords, so I know like one I'm trying to test. When I run your second command, it pulls in a ton of CSV files. Checking one, and the word isn't in the CSV header at all?
... View more
04-14-2023
12:29 PM
So the first one command, every word it brings back is a duplicated one?
... View more
04-14-2023
09:43 AM
We are getting multiple errors like this
Corrupt csv header in CSV file , 2 columns with the same name
However we have so many CSV files that finding them will be all but impossible.
Can someone provide advice on how to find them?
... View more
Labels
- Labels:
-
other
03-30-2023
11:56 AM
It's not in the search results as I get it, rather it's tracked by Mongo and that is how we're seeing it. So I don't have search.log indexed into Splunk and therefore have no visibility.
... View more
03-30-2023
08:40 AM
We have error messages like " Corrupt csv header in CSV file , 2 columns with the same name 'Severity" & CSV file contains invalid field ''. How do I find this? My SHC has hundreds of CSV files, so it is hard to find issues even with grep.
... View more
Labels
- Labels:
-
lookup
03-17-2023
12:37 PM
Our KVStore, which is wiredTiger, slowly grows and consumes the entire cache and then will eventually grow outside the cache until restarted. It requires rolling restarts about once a week, and has persisted for months. Anyone else had this issue?
... View more
Labels
- Labels:
-
troubleshooting
02-13-2023
08:58 AM
We had a Splunk indexer crash out of nowhere, and this is the message I received before the crash in the logs.
Encountered S2S Exception=Unexpected duplicate in addUncommittedEventId eventid=57 received from for data received from src=*.
What is the cause of this?
... View more
Labels
- Labels:
-
troubleshooting
02-10-2023
08:09 AM
I'm also getting this issue, except my UF is delayed by 400 hours sending logs to Splunk. And only for Windows Events.
... View more
09-28-2022
12:46 PM
@ITWhisperer So I am trying to find sporadic hosts, or hosts that will have over 24-hour gaps or maybe just 24-hour gaps in between sending data to indexers. My search looks like this | tstats count as hourcount where (index=_* OR index=*) by _time,host span=1h | appendpipe [ | stats count by host | addinfo | eval _time = mvappend(info_mintime,info_maxtime) | stats values(_time) as Time by host | mvexpand Time | rename Time as _time ] | sort 0 _time host | streamstats time_window=24h count as skipno by host | where skipno=1 AND _time>relative_time(now(),"-13d@d") | stats sum(skipno) as count by host | eval mySporadicFlag = if(count=1,"yes","no") Except the problem is if it reports every 48 hours in a 14-day period, that's sporadic but the streamstats count would be higher than 1. But if you reversed the yes and no, than everything would be sporadic even hosts that only have minute gaps in data. So I'm stuck on how to improve this search from here to find actually sporadic hosts.
... View more
09-28-2022
10:03 AM
Trying to build a search looking for sporadic servers in the past 14 days, here is my search so far.
| tstats count as hourcount where (index=_* OR index=*) by _time, host span=1h
| appendpipe [
| stats count by host
| addinfo
| eval _time = mvappend(info_mintime,info_maxtime)
| stats values(_time) as Time by host
| mvexpand Time
| rename Time as _time
]
| sort 0 _time host
| streamstats time_window=24h count as skipno by host
| where skipno = 1
| stats sum(skipno) as count by host
| eval mySporadicFlag = if(count=1,"no","yes")
But how the streamstats is set up, and the filtering. Every host starts at 1, the first time an event was encountered in the first 14 days. So it's flagging all my hosts as sporadic despite there being no gap. Any assistance?
... View more
Labels
- Labels:
-
stats
06-30-2022
10:19 PM
What about the ones where that doesn’t fix it?
... View more
06-30-2022
05:09 PM
A lot of our Windows UF are getting this message in Windows Event Logs, "Splunk could not get the description for this event". Does anyone know why?
... View more
Labels
- Labels:
-
other
06-06-2022
07:45 AM
This is the update of the first search.
... View more
06-03-2022
07:23 AM
It came back within 2 hours and is now affecting two indexers.
... View more
06-02-2022
01:58 PM
Well there is no errors in Splunk for that sourcetype, so nothing like that is flagging in the data. And all the connections seem fine, there is other add-ons on that HF that are reporting fine.
... View more
06-02-2022
01:22 PM
Beyond just a second ago when I restarted it, I have nothing popping up.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-11-2023
12:33 PM
|
