About R15

R15

Careful, the linked documentation page says not to modify that app in any way.

R15 · ‎07-30-2024

Recently upgraded to 9.2.2 and Historic License Usage panels in the Monitoring Console are now broken. The panels in License Usage - Today still work. Most answers I found had to do with the license manager not indexing or reading the usage data. But on the license manager the panels all work in Settings » Licensing » License Usage Reporting. The suggestion in this post did not apply either: https://community.splunk.com/t5/Splunk-Enterprise/Why-is-Historical-license-usage-page-showing-blank/m-p/635412

R15 · ‎07-11-2024

In case anyone else stumbles upon this thread, this solution worked for me.

R15 · ‎06-26-2024

I haven't messed with that at all, I simply have the box checked for Link to Results.

R15 · ‎06-26-2024

The search is very basic. The system is isolated so I can't copy/paste but it's just searching for one event code, action, and signature and tabling the results. There is nothing unique or unusual from other alert searches. I don't understand how anything in the search string would cause a 404 error.

R15 · ‎06-26-2024

Can you elaborate on that? The search works fine on its own, and if the search was bad why would that cause the web page to not load?

R15 · ‎06-25-2024

One of my alerts is having an issue with the email link to the results not working. I'm the admin, so I don't think it's a permissions issue. Other alerts from the same app are working fine. Any ideas?

R15 · ‎06-25-2024

I would consult the Nessus forums.

R15 · ‎06-06-2024

I posted a workaround if you're still having this issue.

R15 · ‎06-06-2024

After setting this aside until we finally upgraded splunk, a solution has been found. Working with splunk support for weeks, we were not able to fix it directly and concluded that the errors are due to splunk trying to read the files before they are done being written by our diode software. The files are transferred once every 24 hours, so I created a script run by a scheduled task that copies the files to a different set of folders and set up batch inputs to read then delete the copies. All logs come through without any extra junk. Thanks for your help! @yeahnah @isoutamo

R15 · ‎03-26-2024

Neither are working for me. Their search gives an unwieldy table with 100+ columns, yours has only blanks for avg and max. Splunk 9.1.2

R15 · ‎03-18-2024

'Diminsh' typo in the video

R15 · ‎02-22-2024

We upgraded splunk then the app to 1.4.6, but kept getting the same errors. The solution was rather silly. It couldn't run python3.exe because the python installer named it python312.exe... renamed and the app started working.

R15 · ‎11-29-2023

No, I don't believe so.

R15 · ‎11-28-2023

What version of splunk are you running? We're still on 8, but upgrading to 9 soon™.

R15 · ‎11-15-2023

@LukeMurphey I'm trying to run the File/Directory Information Input app (v1.4.5) on a universal forwarder. It's a windows server and I've installed the latest version of python 3 (and set the app to use 3). I keep getting the same 3 errors in splunkd (copied from another post as my system is isolated): "09-18-2019 10:47:10.099 +0200 ERROR ModularInputs - Introspecting scheme=file_meta_data: Unable to run "python "C:\Program Files\SplunkUniversalForwarder\etc\apps\file_meta_data\bin\file_meta_data.py" --scheme": child failed to start: The system cannot find the file specified. 09-18-2019 10:47:10.356 +0200 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts 09-18-2019 10:47:10.356 +0200 ERROR ModularInputs - Unable to initialize modular input "file_meta_data" defined in the app "file_meta_data": Introspecting scheme=file_meta_data: Unable to run "python "C:\Program Files\SplunkUniversalForwarder\etc\apps\file_meta_data\bin\file_meta_data.py" --scheme": child failed to start: The system cannot find the file specified.." (Except it says Python3.exe instead of python). Other posts with these errors did not have python installed, or one said their path environment variable was incorrect but didn't elaborate. My path is set with the 2 default values from the installer if that matters.

R15 · ‎11-01-2023

@isoutamo @inventsekar We'll be upgrading soon but until then I'm stuck.

R15 · ‎10-31-2023

@inventsekar apparently avg is not an eval function in my version of splunk. It's available with other things like chart and stats, but not eval. Something like this works however: ... | chart eval(avg(bytes) ...

R15 · ‎10-31-2023

There is no other portion, running the same search as in your screenshot I get the error.

R15 · ‎10-30-2023

I was building a new search and started getting this error with various functions. I simplified my search down to something straight out of the documentation to make sure I wasn't missing something silly, but still get the error even with this: index=* | eval c=avg(1, 2, 3) What's going on?

R15 · ‎05-25-2023

@yeahnah I have confirmed the forwarder and indexer are both on 8.0.6. We intend to upgrade but I'd be lucky if it's by the end of the year. With no sourcetype or with the default csv sourcetype the events do not have proper timestamps. So I know my sourcetype is definitely being applied, and it works, it's just throwing out these junk events as well for some reason. I replaced it with the code from @isoutamo and got the same result. I will turn to support for further troubleshooting. Thank you both for your time!

R15 · ‎05-24-2023

I did some testing before implementing by starting to add a sample directly to an indexer, and the events preview looked good. There were no extra events. I will push your sourcetype code and report back (I'll just replace MAX_DAYS_AGO=9999 with TIMESTAMP_FIELDS=TimeCreated). Our forwarders are running 8.0.6

R15 · ‎05-23-2023

I've checked and that box was already ticked. I ran that search and there are events when I made changes yesterday and last week. Are we at a dead end?

R15 · ‎05-22-2023

@yeahnah I've added that line and removed HEADER_FIELD_LINE_NUMBER but to no effect. You mentioned restarting the forwarder which I haven't been doing as I don't have permissions. I've been pushing these changes from a deployment server (which I have full access/control).

R15 · ‎05-17-2023

I do have access and have looked through a few dozen of them. They all appear normal/identical for the first two lines. I can't copy and paste from that environment so I only typed the first few fields of line 2: #TYPE System.Diagnostics.Eventing.Reader.EventLogRecord "Message","Id","Version","Qualifiers","Level","Task" They're all Windows event logs with the same fields. To reiterate, before I was getting all events correctly plus an additional event containing only line 2. After adding HEADER_FIELD_LINE_NUMBER = 2, I'm still getting that additional event plus another containing only line 1.

Posts	31
Solutions	3
Karma Given	224
Karma Received	1
Member Since	‎12-14-2022

Online Status	Offline
Date Last Visited	Sunday

MC Historic License Usage Broken

View results email link leads to 404 Not Found

File/Directory Information Input app help

The avg function is unsupported or undefined

How to get events for .csv headers?

Splunk Upgrade Requirement Clarification

Upgrade Requirement Clarification

Re: The Client forwarder management not showing th...

MC Historic License Usage Broken

Re: Indexer Discovery Error (IndexerDiscoveryHeart...

Re: View results email link leads to 404 Not Found

Re: View results email link leads to 404 Not Found

Re: View results email link leads to 404 Not Found

View results email link leads to 404 Not Found

Re: Nessus scan

Re: How to get events for .csv headers?

Re: Getting events for .csv headers

Re: Search lag error

Re: .conf24 | Registration Open!

Re: File/Directory Information Input app help

Re: How to get events for .csv headers?

Re: How to get events for .csv headers?

File/Directory Information Input app help

Re: The avg function is unsupported or undefined

Re: The avg function is unsupported or undefined

Re: The avg function is unsupported or undefined

The avg function is unsupported or undefined

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers