Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About R15
R15
Communicator
Member since:
12-14-2022
2 weeks ago
Community Statistics
| Posts | 50 |
| Solutions | 4 |
| Karma Given | 320 |
| Karma Received | 2 |
| Member Since | 12-14-2022 |
Activity Feed
- Karma Re: Confusion about setting up data model acceleration for munang. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for gcusello. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for PickleRick. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for munang. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for PickleRick. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for munang. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for PickleRick. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for gcusello. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for PickleRick. 2 weeks ago
- Karma Re: Confusion about setting up data model acceleration for munang. 2 weeks ago
- Karma Are you ready for TLS 1.3 adoption? for hrawat. 2 weeks ago
- Karma Re: Are you ready for TLS 1.3 adoption? for gjanders. 2 weeks ago
- Karma Re: Are you ready for TLS 1.3 adoption? for hrawat. 2 weeks ago
- Karma Re: Are you ready for TLS 1.3 adoption? for terminaloutcome. 2 weeks ago
- Karma Re: Are you ready for TLS 1.3 adoption? for hrawat. 2 weeks ago
- Posted Re: How to add new forwarders when requireClientCert is true? on Getting Data In. 3 weeks ago
- Posted Re: How to add new forwarders when requireClientCert is true? on Getting Data In. 3 weeks ago
- Karma Re: How to add new forwarders when requireClientCert is true? for livehybrid. 3 weeks ago
- Posted How to add new forwarders when requireClientCert is true? on Getting Data In. 3 weeks ago
- Karma Re: How to Set up TLS Between a Universal Forwarder (UF) and an Indexer for moliminous. 3 weeks ago
3 weeks ago
I know, I was lucky to get individual certs for each splunk box. We're going with one cert for all forwarders.
... View more
3 weeks ago
Would you use the same cert? I'm assuming this would need to be in an app so another app could take precedence. I don't think we have deployment scripts currently, I believe we're just cloning a golden image that has splunk installed but I'll ask. I thought about scripting disabling/enabling requireClientCert on the DS regularly, but some hosts are not always online and may still be missed. It seems silly to have to do that constantly.
... View more
3 weeks ago
Hi, We recently set up (mostly) mTLS, just have a generic forwarder cert. But with the cert being deployed via an app on the deployment server, which has requireClientCert=true, new forwarders can't connect to grab the apps. I disabled it temporarily and everything is fine now, but how is this usually handled long term?
... View more
Labels
- Labels:
-
universal forwarder
08-05-2025
12:07 PM
The issue came up again with only one alert. The app it's in had been set up with the fix to use request.ui_dispatch_app = search but when clicking the view results link in the email it was still going to the same app. I made the app visible and the page now loads. In /apps/<app_name>/local/app.conf add: [ui]
is_visible = true
... View more
07-03-2025
08:11 AM
Sorry I forgot to post the solution, I can't remember what it was. It was most likely one of these: https://splunk.my.site.com/customer/s/article/Links-leading-to-alert-configuration-throw-404-error https://community.splunk.com/t5/Security/Why-am-I-getting-a-quot-404-Not-Found-Page-not-found-quot-error/m-p/209742
... View more
05-19-2025
07:19 AM
I'm assuming they thought the "very stupid question" part was directed at the OP.
... View more
02-06-2025
10:37 AM
This worked great. For anyone else, I verified the totals between the new and old searches just in case with | addtotals row=f col=t Thank you!
... View more
02-06-2025
07:29 AM
Refer to the tables in my original post. I'm doing a count of events per each span using tstats. So just how many events were there from 00:00-04:00, 04:00-08:00 etc. But splunk chooses that starting point of 00:00 and sometimes it's a very poor choice so I would like to be able to adjust it. So instead it would be 01:00-05:00, 05:00-09:00 etc. The methods I've found in the forum do not seem to work with tstats. As shown in my second table, the _time labels are adjusted but the values are not recalculated.
... View more
02-05-2025
07:02 AM
I'm searching for a method for general use that I can apply as needed. Currently for testing I'm using a simple tstats search counting events by ip, in spans of 4 hours. I need a way to adjust the starting point of the spans but as shown above, it's not actually shifting where it's searching the data. It's just changing the time labels in the table.
... View more
02-04-2025
05:01 PM
I've tried a few methods shared here to adjust the start/end times of span. Mainly: 1 - | eval _time=_time-3600
| bin _time span=4h
| eval _time=_time+3600 2 - | timechart span=4h aligntime=@h-120m However after testing, neither of these is actually offsetting the span. It only changes the times shown in the resulting table. The values (in my case counts) in each box do not change, just the _time values. Am I doing something wrong? For example: _time A B C 1/28 00:00 2 1 2 1/28 04:00 4 2 4 1/28 08:00 6 3 6 1/28 12:00 8 4 8 1/28 16:00 10 5 10 _time A B C 1/27 22:00 2 1 2 1/28 02:00 4 2 4 1/28 06:00 6 3 6 1/28 10:00 8 4 8 1/28 14:00 10 5 10
... View more
09-17-2024
03:52 PM
Thank you for letting me know! Unfortunately the workaround didn't fix it, hopefully the next update will.
... View more
09-04-2024
07:59 AM
Careful, the linked documentation page says not to modify that app in any way.
... View more
07-30-2024
12:41 PM
Recently upgraded to 9.2.2 and Historic License Usage panels in the Monitoring Console are now broken. The panels in License Usage - Today still work. Most answers I found had to do with the license manager not indexing or reading the usage data. But on the license manager the panels all work in Settings » Licensing » License Usage Reporting. The suggestion in this post did not apply either: https://community.splunk.com/t5/Splunk-Enterprise/Why-is-Historical-license-usage-page-showing-blank/m-p/635412
... View more
Labels
- Labels:
-
monitoring console
07-11-2024
07:28 AM
In case anyone else stumbles upon this thread, this solution worked for me.
... View more
06-26-2024
09:46 AM
I haven't messed with that at all, I simply have the box checked for Link to Results.
... View more
06-26-2024
08:42 AM
The search is very basic. The system is isolated so I can't copy/paste but it's just searching for one event code, action, and signature and tabling the results. There is nothing unique or unusual from other alert searches. I don't understand how anything in the search string would cause a 404 error.
... View more
06-26-2024
07:47 AM
Can you elaborate on that? The search works fine on its own, and if the search was bad why would that cause the web page to not load?
... View more
06-25-2024
05:03 PM
One of my alerts is having an issue with the email link to the results not working. I get a 404 that says Oops. Page not found! I'm the admin, so I don't think it's a permissions issue. Other alerts from the same app are working fine. Any ideas?
... View more
Labels
- Labels:
-
email
06-06-2024
12:21 PM
1 Karma
After setting this aside until we finally upgraded splunk, a solution has been found. Working with splunk support for weeks, we were not able to fix it directly and concluded that the errors are due to splunk trying to read the files before they are done being written by our diode software. The files are transferred once every 24 hours, so I created a script run by a scheduled task that copies the files to a different set of folders and set up batch inputs to read then delete the copies. All logs come through without any extra junk. Thanks for your help! @yeahnah @isoutamo
... View more
03-26-2024
10:04 AM
Neither are working for me. Their search gives an unwieldy table with 100+ columns, yours has only blanks for avg and max. Splunk 9.1.2
... View more
02-22-2024
12:48 PM
We upgraded splunk then the app to 1.4.6, but kept getting the same errors. The solution was rather silly. It couldn't run python3.exe because the python installer named it python312.exe... renamed and the app started working.
... View more
