About Rakzskull

Rakzskull · ‎10-24-2024

@Kirantcs I'm having the same issue as I can not add/modify/delete exisiting inputs however I can see the logs coming from the inputs. Have you resolved the issue?

Rakzskull · ‎08-23-2024

Hi Folks, I was working on Splunk webhook however I'm getting below error while sending payload though Webhook also the webhook url has been allowed aleardy. action=webhook STDERR - Error sending webhook request: <urlopen error [Errno -2] Name or service not known> Does anyone have any ideas on how to resolve this issue?

Rakzskull · ‎03-13-2024

Hi @spkriyaz , Could you please share the detailed step by step procedure to apply this solution?

Rakzskull · ‎11-29-2023

Hi Splunkers, This problem is occurring on Splunk_TA_paloalto app panels. Is there someone who knows how to handle this problem? I understand it has no effect on any search, but it's still annoying. 😉 Thanks in advance.

Rakzskull · ‎11-29-2023

@rivars You are a lifesaver! 🙂

Rakzskull · ‎07-25-2023

Hi Folks When I enter the Ingest actions page from our Splunk portal, we get the error shown below. "Unable to load sourcetypes: An unexpected error occurred" I also attempted to clear the browser's cookies, which worked for a short time and returning to the same error page. Is anyone aware of this problem? If this is the case, please provide an approach for eliminating it. How to reproduce an issue. Splunk Homepage > Setting > Ingest Action > Click on any rule

Rakzskull · ‎04-25-2023

@ITWhisperer Thanks for the reply. We already have N number of alerts set up to go out when the count crosses certain thresholds. Having all the alerts configured this this way is not a fesilbe choice. Is there an achievable Splunk solution I can use to schedule a downtime?

Rakzskull · ‎04-24-2023

Hi I intend to mute the alerts at a specified time during the maintenance window, and they should start up again once the maintenance window is to finish. Can someone please guide me on how to achieve this? because Splunk doesn't have a feature for scheduling maintenance. Thanks 🙂

Rakzskull · ‎04-24-2023

@ITWhispererI'd want to extract fields, however some of them aren't in interesting fields. The first one you provided worked. so if you could make the rex for this as well : [04/24/2023 05:47:38.551][530e4835abe4717b,530e4835abe4717b,,][CAPIRESP] [ec-25] I [go.web.filter.APILoggingFilter: ] [en_US] [ANDROID] [23.3.0] I'd want to copy the text in bold above.

Rakzskull · ‎04-24-2023

@ITWhisperer What would be the rex for --> [en_US] [ANDROID] [23.3.0] Thanks in advance

Rakzskull · ‎04-24-2023

Hi Guys, Could you possibly assist me with creating a rex for the log below? Rex for "CEOTransactionSessionId":"1D2667DC-7849-1122-3FE3-C4A08EAC9FEB"

Rakzskull · ‎04-20-2023

One more thing: just out of curiosity, I changed the output.conf file with the new HF IP. Is it necessary to also change the same HF IP in the deploymentclient.conf ?

Rakzskull · ‎04-20-2023

The local config directory of the UF’s does not contain outputs.conf file. I can only see below files in opt/splunk/etc/system/local deploymentclient.conf inputs.conf migration.conf server.conf

Rakzskull · ‎04-20-2023

Hi Guys, I deployed a new heavy forwarder in our environment, however I'd want to repoint certain devices to the freshly deployed forwarder. I tried updating the ip in the local/deploymentclient.conf, but I'm still getting the old HF information in logs. Could you demonstrate to me how to do so?

Rakzskull · ‎01-08-2023

I'd want to merge two regex strings into a single one; any suggestions would be greatly appreciated. Reference Search Query - index=* sourcetype=XYZ "<ABC2>" "<ABC1>" | regex _raw="<ABC1>[^\x00-\x7F]" | regex _raw="<ABC2>[^\x00-\x7F]" Thanks in advance. 🙂

Rakzskull · ‎09-30-2022

@gcusello I'm a rookie, so I don't know much about creating lookup csv. If you could explain the detailed technique with steps, I'd appreciate it. 🙂

Rakzskull · ‎09-29-2022

I've seen a few posts on the subject, but I'd like to know how we can disable the multiple alerts throughout the maintenance window. For example, I'd like to disable alerts 1, 2, and 3 from Saturday 11:30 p.m. until Sunday 6:00 a.m. Thank you in advance. ------------------------------------ reference alert query index=ABC sourcetype=XYZ ("Internal System Error") |stats count |where count >=30

Posts	17
Solutions	0
Karma Given	9
Karma Received	0
Member Since	‎09-15-2022

Online Status	Offline
Date Last Visited	‎10-24-2024 03:04 AM

Webhook Error

A custom JavaScript error caused an issue loading ...

An unexpected error occurred on Ingest Action afte...

How to mute alerts during maintenance?

Rex for "CEOTransactionSessionId":"1D2667DC-7849-1...

How to repoint the UF to the newly added forwarder...

How to merge two regex in single query?

How to stop alerts from being generated during mai...

Re: Not able to see the inputs in db_inputs.conf

Webhook Error

Re: Why am I Receiving "A custom JavaScript error ...

A custom JavaScript error caused an issue loading ...

Re: Cortex XDR Add-On installation

An unexpected error occurred on Ingest Action afte...

Re: How to mute alerts during maintenance?