About zebulajams

zebulajams · ‎03-15-2022

I know this is a commonly asked question due to it's complexity, but I cannot figure out how to get emails to send via Splunk alert. I created a simple search to find a specific string and created an alert with the following: App: Search Permissions: Private. Owned by admin. Alert Type: Real-Time Trigger Condition: Per-Result Actions: Send email / Add to Triggered Alerts I see it being triggered, but it never sends the email. I've tried sending it to two different email addresses. One to my work email, and another to my phone as a text (phoneNumber@mms.att.net) and neither of them work. The trigger appears in the list though. I have tried multiple mail hosts in the configuration, but the current one is the default that appeared when I opened it: smtp-mail.outlook.com:587 Email security: I have tried all three options No user/pass currently configured Allowed Domains: mms.att.net Send Emails As: SplunkAlert@test.edu I've been sifting through the Splunk documentation for hours now and can't seem to get it right. Any ideas? Thanks

zebulajams · ‎01-25-2022

I restarted Splunk at the start, removed the Dashboard Example app and restarted Splunk again. Followed the install instructions from Splunkbase itself and it still does not work. Also checked their FAQ section around the app and can't find an answer there or the problem itself relating to the app. Oh well. I'll just start making my own dashboards via trial and error - best way to learn, right? Maybe if I'm feeling motivated at some point in the future I'll create a case to their support asking why it doesn't work. Thanks for your help again, Rich.

zebulajams · ‎01-24-2022

Thanks, Rich. Looks like they're throwing a bunch of different errors depending on the app I try to run. The RWI one throws a "404 Not Found" and a "Uncaught Error: Script error for: ..." The RWI Dashboard throws a bunch of "Uncaught (in promise) Error: Module name" or module name related errors. I found this post where they changed the language in the URL but it looks like it's already pulling the correct en-US for me. Also tried: splunk restart splunkweb that was mentioned in that thread. Any ideas?

zebulajams · ‎01-24-2022

Hey all, Learning Splunk and I've tried to install a few apps to see how they work but none of them seem to be working. Currently running Splunk Enterprise 8.2.4 installed on Server 2019 and I've tried to install "RWI - Executive Dashboard" as well as "Splunk Dashboard Examples" When I open the "Examples" page of the latter, it is a completely blank white page. But the other three pages seem to work (Overview, Dashboards, Search). As for the RWI Dasshboard, if I click the "Continue to app setup page", it also takes me to a blank white screen where I can't do anything. I have tried Internet Explorer as well as Chrome for my browser and updated the server. Is there something simple I am missing to make apps work properly? Thanks!

zebulajams · ‎01-20-2022

That worked, but I think I discovered a fundamental problem with my search. As I said, I'm really new to Splunk and didn't know I needed a search at the beginning before I did the stats command. What I did was: "no phase found for entry" OR "no work order found" | stats count(eval(searchmatch("no phase found for entry"))) AS count_no_phase count(eval(searchmatch("no work order found"))) AS count_no_order Before the pipe command, can I just search for anything? Or does it have to match exactly what I'm looking for in the searchmatch? EDIT: Also, it doesn't look like I can plot these results (50 for count_no_phase & 2 for count_no_order) on something like a pie chart after running that search. It splits them into a table format, but I'm not so sure how to get it onto a pie or line chart.

zebulajams · ‎01-20-2022

Hmm. That didn't seem to work. All it returns is: No results found. Try expanding the time range. I expanded to the last 7 days to make sure and it still didn't find anything. I also just tried doing | eval no_phase=if(match(_raw,"no phase found for entry"),1,0) | stats sum(no_phase) AS phase This also did not return any results. Any other ideas?

zebulajams · ‎01-20-2022

Hey all, Newbie here learning Splunk. I'm starting to get into dashboards and want to create either a pie chart or just a simple count of how many times a certain string occurs in a log file. | stats count("no phase found for entry") count("no work order found") This returns two columns but they both have 0 in them. But if I just search for each string individually or with an OR statement, it returns all entries (which is around 118 combined). I've been reading through the Splunk Documentation on stats but can't seem to find an answer on how to combine two counts of anything. Any help is appreciated!

zebulajams · ‎01-18-2022

After spinning up a new VM and starting from scratch, creating the 9997 listening port in Splunk, enabling the firewall rules, and keeping all the default port configurations, it still does not communicate with Splunk Enterprise. I found this link which I've been reading through and following but it does not seem to help. I have already configured it as the documentation says. Not sure what else to try even after watching a LinkedIn Learning beginners guide on installing Splunk and the UF and not working from there either. Thanks to everyone for the help. Looks like this one is left a mystery on how to get Splunk to work! Thanks again!

zebulajams · ‎01-18-2022

Interesting. Maybe I'll create a separate VM and install Splunk Enterprise there to see if it will communicate with that one first. I'm baffled why it won't accept anything from the Universal Forwarder machine, even after completely disabling the firewall. I verified it can ping other machines too, but it can't ping my local machine which might have something to do with it (no idea why it doesn't like my machine even though other VM's can ping it just fine). I guess I'll try that and go from there. Not much else I can do.

zebulajams · ‎01-18-2022

The only other thing I can think that is wrong is that the VM resides on vSphere on our domain, but the VM itself is not on the domain whereas the Splunk server (my machine) is on the domain. Is that an issue? I haven't read anywhere where they need to be on the same domain.

zebulajams · ‎01-18-2022

I have changed the ports but now it's not restarting the service in a timely fashion, nor is it sending any data to my Splunk server from the Forwarder. I am also receiving errors about "The TCP output processor has paused the data flow." Seems like installing/configuring Splunk is a difficult and long process. I've been using the Splunk documentation to try to install, is there a video reference for this I can use too? Otherwise I think I might give up on learning Splunk lol.

zebulajams · ‎01-18-2022

Looks like it does not return anything when I run that command. If I try to restart it again it is now telling me that mgmt port [8089] is already bound and says http port [8000] is open. If I do that same netstat command for 8089 it does not return anything either.

zebulajams · ‎01-18-2022

I double checked and followed the Splunk Troubleshooting Universal Forwarder On Windows .pdf and set the inbound and outbound rules to accept the connections from the desired ports. However now when I restart Splunk from the CLI I get, "ERROR: http port [8000] - port is already bount. Splunk needs to use this port. Would you like to change ports? [y/n]:" Is there a better port I can switch it to?

zebulajams · ‎01-18-2022

Ok. I reinstalled Splunk on my local machine and then installed the Universal Forwarder on my VM and set the IP to my local machine and the port to the one I set within the Receiving settings. However if I do a search for anything it does not return any results. Is there something I missed in the Forwarder setup? I checked all the boxes that it offered and also told it to monitor a directory I created on the VM. Thanks for your help so far!

zebulajams · ‎01-18-2022

Oh. So if I understand correctly: even though the Splunk server URL is http://127.0.0.1:8000/en-US/, I can keep it that way without modifying those files and just tell the forwarder to look for my machine's IP instead and use port 9997? Then just set up the receiving port on the Splunk server to be 9997. Is that right?

zebulajams · ‎01-18-2022

Hello all, I'm am new to Splunk and installed the free Enterprise version to start learning to expand my skill set. I am able to install Splunk locally and monitor files on the computer it is installed on. However I am now wanting to try to monitor a remote computer. I have set up a test VM and was going to install the Universal Forwarder when it asked me for my Receiving Indexer. Obviously I cannot input the 127.0.0.1 for the IP, so I tried changing the IP where the Splunk server is running. Per the Splunk documentation, I changed the mgmtHostPort line in the web.conf from 127.0.0.1:8089 to 10.xx.xx.xx:8089. I also added the SPLUNK_BINDIP=10.xx.xx.xx to the splunk-launch.conf file. After doing this, I tried to restart Splunk and it timed out due with a entry in the log, "Could not bind to ip 10.xx.xx.xx port 8089". Ok - so I reverted all my changes to their default configuration and now when I try to log into Splunk, I get "500 Internal Server Error". Everything is as it was when it was first installed and I could log in, and I've also tried 3-4 times restarting the Splunk service on my PC. This is a Windows installation p.s. Any ideas? This happened last week and the only thing I could do to fix it was uninstall and reinstall Splunk. Is that the only fix for when Splunk acts up? Thanks!

Posts	16
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎01-18-2022

Online Status	Offline
Date Last Visited	‎03-15-2022 05:37 PM

How to get emails to send, it shows as triggered b...

Splunk apps returning blank screens

Count and chart two different queries

500 Internal Server Error After Reconfigure

How to get emails to send, it shows as triggered b...

Re: Splunk apps returning blank screens

Re: Splunk apps returning blank screens

Splunk apps returning blank screens

Re: Count and chart two different queries

Re: Count and chart two different queries

Count and chart two different queries

Re: 500 Internal Server Error After Reconfigure

Re: 500 Internal Server Error After Reconfigure

Re: 500 Internal Server Error After Reconfigure

Re: 500 Internal Server Error After Reconfigure

Re: 500 Internal Server Error After Reconfigure

Re: 500 Internal Server Error After Reconfigure

Re: 500 Internal Server Error After Reconfigure

Re: 500 Internal Server Error After Reconfigure

500 Internal Server Error After Reconfigure

Are you a member of the Splunk Community?