About R15

R15

This has followed us on 9.2, 9.3, and 9.4. This didn't work either, but thank you for sharing your solution. I'll try it again once we move to 10.

R15 · ‎11-18-2025

I know, I was lucky to get individual certs for each splunk box. We're going with one cert for all forwarders.

R15 · ‎11-17-2025

Would you use the same cert? I'm assuming this would need to be in an app so another app could take precedence. I don't think we have deployment scripts currently, I believe we're just cloning a golden image that has splunk installed but I'll ask. I thought about scripting disabling/enabling requireClientCert on the DS regularly, but some hosts are not always online and may still be missed. It seems silly to have to do that constantly.

R15 · ‎11-17-2025

Hi, We recently set up (mostly) mTLS, just have a generic forwarder cert. But with the cert being deployed via an app on the deployment server, which has requireClientCert=true, new forwarders can't connect to grab the apps. I disabled it temporarily and everything is fine now, but how is this usually handled long term?

R15 · ‎08-05-2025

The issue came up again with only one alert. The app it's in had been set up with the fix to use request.ui_dispatch_app = search but when clicking the view results link in the email it was still going to the same app. I made the app visible and the page now loads. In /apps/<app_name>/local/app.conf add: [ui] is_visible = true

R15 · ‎07-03-2025

Sorry I forgot to post the solution, I can't remember what it was. It was most likely one of these: https://splunk.my.site.com/customer/s/article/Links-leading-to-alert-configuration-throw-404-error https://community.splunk.com/t5/Security/Why-am-I-getting-a-quot-404-Not-Found-Page-not-found-quot-error/m-p/209742

R15 · ‎05-19-2025

I'm assuming they thought the "very stupid question" part was directed at the OP.

R15 · ‎02-06-2025

This worked great. For anyone else, I verified the totals between the new and old searches just in case with | addtotals row=f col=t Thank you!

R15 · ‎02-06-2025

Refer to the tables in my original post. I'm doing a count of events per each span using tstats. So just how many events were there from 00:00-04:00, 04:00-08:00 etc. But splunk chooses that starting point of 00:00 and sometimes it's a very poor choice so I would like to be able to adjust it. So instead it would be 01:00-05:00, 05:00-09:00 etc. The methods I've found in the forum do not seem to work with tstats. As shown in my second table, the _time labels are adjusted but the values are not recalculated.

R15 · ‎02-06-2025

Does it work with tstats?

R15 · ‎02-05-2025

I'm searching for a method for general use that I can apply as needed. Currently for testing I'm using a simple tstats search counting events by ip, in spans of 4 hours. I need a way to adjust the starting point of the spans but as shown above, it's not actually shifting where it's searching the data. It's just changing the time labels in the table.

R15 · ‎02-04-2025

I've tried a few methods shared here to adjust the start/end times of span. Mainly: 1 - | eval _time=_time-3600 | bin _time span=4h | eval _time=_time+3600 2 - | timechart span=4h aligntime=@h-120m However after testing, neither of these is actually offsetting the span. It only changes the times shown in the resulting table. The values (in my case counts) in each box do not change, just the _time values. Am I doing something wrong? For example: _time A B C 1/28 00:00 2 1 2 1/28 04:00 4 2 4 1/28 08:00 6 3 6 1/28 12:00 8 4 8 1/28 16:00 10 5 10 _time A B C 1/27 22:00 2 1 2 1/28 02:00 4 2 4 1/28 06:00 6 3 6 1/28 10:00 8 4 8 1/28 14:00 10 5 10

R15 · ‎10-01-2024

This list has aged quite a bit, is it still accurate? @yannK

R15 · ‎09-17-2024

Thank you for letting me know! Unfortunately the workaround didn't fix it, hopefully the next update will.

R15 · ‎09-04-2024

Careful, the linked documentation page says not to modify that app in any way.

R15 · ‎07-30-2024

Recently upgraded to 9.2.2 and Historic License Usage panels in the Monitoring Console are now broken. The panels in License Usage - Today still work. Most answers I found had to do with the license manager not indexing or reading the usage data. But on the license manager the panels all work in Settings » Licensing » License Usage Reporting. The suggestion in this post did not apply either: https://community.splunk.com/t5/Splunk-Enterprise/Why-is-Historical-license-usage-page-showing-blank/m-p/635412

R15 · ‎07-11-2024

In case anyone else stumbles upon this thread, this solution worked for me.

R15 · ‎06-26-2024

I haven't messed with that at all, I simply have the box checked for Link to Results.

R15 · ‎06-26-2024

The search is very basic. The system is isolated so I can't copy/paste but it's just searching for one event code, action, and signature and tabling the results. There is nothing unique or unusual from other alert searches. I don't understand how anything in the search string would cause a 404 error.

R15 · ‎06-26-2024

Can you elaborate on that? The search works fine on its own, and if the search was bad why would that cause the web page to not load?

R15 · ‎06-25-2024

One of my alerts is having an issue with the email link to the results not working. I get a 404 that says Oops. Page not found! I'm the admin, so I don't think it's a permissions issue. Other alerts from the same app are working fine. Any ideas?

R15 · ‎06-25-2024

I would consult the Nessus forums.

R15 · ‎06-06-2024

I posted a workaround if you're still having this issue.

R15 · ‎06-06-2024

After setting this aside until we finally upgraded splunk, a solution has been found. Working with splunk support for weeks, we were not able to fix it directly and concluded that the errors are due to splunk trying to read the files before they are done being written by our diode software. The files are transferred once every 24 hours, so I created a script run by a scheduled task that copies the files to a different set of folders and set up batch inputs to read then delete the copies. All logs come through without any extra junk. Thanks for your help! @yeahnah @isoutamo

R15 · ‎03-26-2024

Neither are working for me. Their search gives an unwieldy table with 100+ columns, yours has only blanks for avg and max. Splunk 9.1.2

Posts	51
Solutions	4
Karma Given	321
Karma Received	2
Member Since	‎12-14-2022

Online Status	Offline
Date Last Visited	Thursday

How to add new forwarders when requireClientCert i...

How to change span alignment

MC Historic License Usage Broken

View results email link leads to 404 Not Found

File/Directory Information Input app help

The avg function is unsupported or undefined

How to get events for .csv headers?

Splunk Upgrade Requirement Clarification

Upgrade Requirement Clarification

Re: MC Historic License Usage Broken

Re: How to add new forwarders when requireClientCe...

Re: How to add new forwarders when requireClientCe...

How to add new forwarders when requireClientCert i...

Re: View results email link leads to 404 Not Found

Re: View results email link leads to 404 Not Found

Re: Splunk 9.3+ Deployment on CIS Red Hat 9 level ...

Re: How to change span alignment

Re: How to change span alignment

Re: How to change span alignment

Re: How to change span alignment

How to change span alignment

Re: How to reindex data from a forwarder

Re: MC Historic License Usage Broken

Re: The Client forwarder management not showing th...

MC Historic License Usage Broken

Re: Indexer Discovery Error (IndexerDiscoveryHeart...

Re: View results email link leads to 404 Not Found

Re: View results email link leads to 404 Not Found

Re: View results email link leads to 404 Not Found

View results email link leads to 404 Not Found

Re: Nessus scan

Re: How to get events for .csv headers?

Re: Getting events for .csv headers

Re: Search lag error

Join the Conversation