About jsb22

jsb22 · ‎10-03-2012

If you're deploying your configuration via a deployment server, I believe the config files you are editing on a deployment server should be pushed to etc/apps/deploymentapp, not under etc/system/local. I know in my environment, I don't have anything more than the "[default] host=hostname" in etc/system/local/inputs.conf file, and specify the other items (index=indexname) n the etc/apps/deploymentapp/local/inputs.conf. I would assume(and maybe i shouldn't) that your deployment app should be deployed to etc/apps/production_servers/local/inputs.conf. If your etc/system/local/inputs.conf specifies "index=prod", then I believe it will default all data to that unless otherwize specified in the deployment app in etc/apps/production_server/local/inputs.conf

jsb22 · ‎09-28-2012

Can you provide an example of what you see and what you want to see? Are you looking for something like this where you would convert the data within a field? Or are you not getting fields, and wnat to extract them into a fields?

jsb22 · ‎09-25-2012

I am leveraging the rlog.sh script on a universal forwarder. The forwarder receives it's confuration in the form of a deployment app from a deployment server(windows). When the client pulls the package, the machine recognizes the rlog.sh script as a new file and sets the default permissions (no execute bit due to umask settings). Splunk then throws an error of "permissions denied" when running the script. I can resolve the issue temporarily by adding execute permissions for the owner after the file is pulled to the client, but any time the client pulls the package down again, it resets the permissions. I'm unable to modify our umask values due to security requirements. The rlog.sh script is leveraged in the inputs.conf as follows: [script://./bin/rlog.sh] sourcetype = auditd source = auditd interval = 60 disabled = 0 followTail=1 Any ideas on how to get splunk to recognize it is an executable without setting permissons for an executable (i.e. rw-r------ instead of (rwxr-----)?

jsb22 · ‎09-14-2012

To access minutes in your search, you can add the following "| eval min_of_the_day=strftime(_time,"%M") " and search on "min_of_the_day" but there is an issue with my solution as if you're only searching for "min_of_the_day < 31", it will only look at the first half hour of EVERY hour, not just the last one. Unfortunately I'm not good at regex strings, so this is where I have to bow out.

jsb22 · ‎05-14-2012

Ensure the splunkweb service is started. If it is, I would try to restart it and check the windows event logs for any details it could give.

jsb22 · ‎04-24-2012

Ended up using the following, for anyone interested. I just needed to put the carat in the CDATA string. Thanks guys! (index=windows_7 OR index=windows_2008_R2) source=wineventlog:security Process_Name="C:\Windows\System32\winlogon.exe" Logon_GUID!="{00000000-0000-0000-0000-000000000000}" host=$Computer$ user=$User$ | eval hour_of_the_day=strftime(_time,"%H") | where (hour_of_the_day >= 17 <![CDATA[or hour_of_the_day < 6]]>) | timechart count by user

jsb22 · ‎04-23-2012

Still not quite working. Ayn's response cleared the error, but it's not giving the results I would expect. Search line is as follows: (index=windows_7 OR index=windows_2008_R2) source=wineventlog:security Process_Name="C:\Windows\System32\winlogon.exe" Logon_GUID!="{00000000-0000-0000-0000-000000000000}" | eval hour_of_the_day=strftime(_time,"%H") | where (hour_of_the_day >= 17 or hour_of_the_day > <![CDATA[ 6) | timechart count by user]]>

jsb22 · ‎04-20-2012

Works in the search, but not forms. Unfortunately the less than comparator is being seen as part of an html tag in my form so I'm getting "Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 47: StartTag: invalid element name" Any ideas?

jsb22 · ‎04-19-2012

Anyone know splunk's built-in time variables? For example, I'm trying to create a search based on events occuring after 5 PM and before 6 AM, but the "date_hour" or "day_hour" variables that I've seen in other posts don't seem to be working. Any ideas?

jsb22 · ‎04-12-2012

Is it possible you're sending the logs to a non default index? try specifying "index=* host=< >" in the search bar to see if you can see any events from your linux machine. Also ensure you enabled log collection for the new linx machine running as the server under manager -> data inputs.

jsb22 · ‎04-10-2012

Correct me if I'm wrong, but you're trying to send logs from the RHEL 5.6 client via a universal forwarder to your splunk server (indexer). You see data going out from the client, but nothing showing up in the server? While I may not have your solution, a good troubleshooting step would be to go to the splunk indexer and open the splunk.log file under $SPLUNK_HOME/var/log/splunk and see if you're getting any major errors. If that log is clear, I would check the outputs.conf($splunk_home/etc/system/local/) file on the client and ensure it's pointing to the correct server and port: "server = splunk:9997" where splunk is the servername (should be able to ping it) and 9997 is the receive port you specified under Receive data on the server. More information on configuring the outputs.conf can be found at http://docs.splunk.com/Documentation/Splunk/latest/admin/Outputsconf

jsb22 · ‎04-05-2012

Turns out it was the escape character, I tested that before, and it didn't work, tested again to try to digest what the CDATA statement does and it worked, must have fat-fingered it somewhere. So my origional code was correct except for the escape character you recommended. Thanks again!

jsb22 · ‎04-05-2012

Essentailly I'm trying to create a form that uses a wildcard by default so users can just hit search on page load and get all values of the field, then the user can input specific values in the field so they can limit what they're seeing. When I specify "< default>*< /default>" it errors out with "Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side". THe fieldset and searchTemplate stream is as follows: < fieldset> < input type="text" token="Administrator" /> < default>*< /default> < /fieldset> < searchTemplate>(index=windows_7 OR index=windows_2008_R2) source=wineventlog:security EventCode=4720 src_user=$Administrator$ | table _time, src_user, host, dest_nt_domain, signature, user, Display_Name< /searchTemplate>

jsb22 · ‎04-03-2012

This does not directly address your question, but if this does become an issue, you may be able to switch from archiving events, to 'overwrite events older than X days' and increasing the log size so it has time to pull. Although, I don't think you'll have that issue, I just don't have any proof to support it. Just a suggestion though.

jsb22 · ‎03-27-2012

When dealing with indexes, a restart of splunk is required to poll the new information. The 'splunk reload deploy-server' will only re-read information pertaining to deployment server and client aspects, whereas the indexes is not thought of as part of the deployment-server/client aspect. Please mark this question as answered for the appropriate person please. Thanks!

jsb22 · ‎03-27-2012

Forgive me for stating what could be obvious, but check your indexs page under Manager to ensure the newly created indexes show up and they are enabled. Typically a restart of splunk ensures the new configuration is used, and a check of the $SPLUNK_HOME/var/log/splunk/splunk.log will return errors if you are incorrectly configured. Otherwise, from my experience, ensure you didn't fat-finger any of the configuration files. That seems to be my demise 50% of the time.

jsb22 · ‎03-14-2012

Thank you, thats' what I needed. It appears when I copied the indexes over, the permissions only applied to the folders and not the subfolders and files. Once I applied to all, everything poped in and the errors were resolved.

jsb22 · ‎03-06-2012

I have just gone through the process of migrating to a new server, I did the following: Installed splunk on new server & did basic configurations (Authentication, etc) Copied a custom app with custom dashboards Stopped the old and new server Copied the indexes from the old server to the new server Copied the indexes.conf over to the new server Started the new server Ensured the indexes were enabled by default for the user role i'm using When I check my custom dashboards, they are only showing results for items that have come in since I started the new server. All indexes are named the same, and it appears it's seeing it because it's showing new events, just not the old ones. Also, the servers are running the same versions. Any ideas? UPDATE: The splunkd.log is reflecting the following: -0400 ERROR DatabaseDirectoryManager - failed to open < >\db\db_1330693566_1330645912_92.sizeManifest4.1 for writing size (Access is denied.) Permission issue? Anyone know the default permission set for an index folder on Server 2008 R2?

jsb22 · ‎03-01-2012

It kind of sounds like they aren't able to see the actual index the data is in. Check whether the role they are in has that particular index enabled. It can be found under Manager->Access Controls->Roles->< > and take a look at the Indexes section. If they have ALL the same roles as you have, this wouldn't be the issue, but if you have an extra role, this could be the issue?

jsb22 · ‎03-01-2012

Before you go creating your own search for license usage, have you checked the available apps out there for license usage? http://splunk-base.splunk.com/apps/search/?q=license+usage Please mark as answered if your question has been answered. Thanks!

Posts	29
Solutions	3
Karma Given	12
Karma Received	15
Member Since	‎04-12-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

universal forwarder scripts linux

Specific Hour Search

Form Creation, Wildcard use

Migrated to new server, not displaying results for...

Convert audit.log uid to usernames using rlog.sh

Re: DeploymentClient : haven't configured correct ...

Re: Convert audit.log TTY data

universal forwarder scripts linux

Re: Specific Hour Search

Re: Problem with splunk login

Re: Specific Hour Search

Re: Specific Hour Search

Re: Specific Hour Search

Specific Hour Search

Re: Help with SUF for Linux and Server not receivi...

Re: Help with SUF for Linux and Server not receivi...

Re: Form Creation, Wildcard use

Form Creation, Wildcard use

Re: Missing Windows Event Logs?

Re: what splunk internal logs for configuration is...

Re: what splunk internal logs for configuration is...

Re: Migrated to new server, not displaying results...

Migrated to new server, not displaying results for...

Re: Drilldown not working for some users

Re: search to show value for each day in a month