About cklunck

cklunck · ‎07-30-2023

index=_configtracker

cklunck · ‎07-30-2023

I’ve seen issues like this after an upgrade where Splunk wanted us to re-accept the license, and our startup script didn’t account for that. Rich is spot-on as usual - if there was a problem starting the process, splunkd.log will describe why.

cklunck · ‎07-30-2023

It appears the limit of 340 commands in a search pipeline is a hard-coded value and cannot be increased. I was able to find this previous Community post which applies to your situation: Executed search contains more than 340 commands

cklunck · ‎07-30-2023

If all the data you're interested in was going to some_index_1 before 20th July, and after that date the data was going to some_index_2, would it work if the queries search both indexes? For example: (index=some_index_1 OR index=some_index_2) <other stuff> Then the searches could span across the 20th July boundary and retrieve results from both old and new indexes.

cklunck · ‎07-29-2023

Splunk is being asked to run a PowerShell script on what looks like a *nix system. Is there a PowerShell interpreter installed on this Splunk host? If so, you may need to do something like: [script://path/to/pwsh $SPLUNK_HOME/etc/apps/phishalert/bin/phishalert_output.ps1] There are a few other options in the [script] section of inputs.conf.spec that you might want to explore, including "start_by_shell".

cklunck · ‎07-28-2023

Are you trying to connect to a SQL Server database using a Windows Active Directory credential? You'll probably need to talk to your SQL Server DBA and/or Windows AD admin to help troubleshoot the issue. Here are two Internet resources that you can point them to: Troubleshooting "Login from Untrusted Domain" How to Fix "Login from Untrusted Domain"

cklunck · ‎07-28-2023

The credentials an Oracle database will accept is based on what back-end authentication provider(s) it's configured with. If you create a DB Connect identity (username and password) and pass it to Oracle, Splunk doesn't really know or care if Oracle is looking in its local store, an LDAP directory, or somewhere else. As long as they're correct, your credentials should work fine. On the topic of DB Connect and LDAP, if what you really need is to use an LDAP URL to connect to the database, there's information about using LDAP instead of JDBC in the database connection section of the DB Connect manual.

cklunck · ‎07-28-2023

You can follow these instructions in the section titled "Create admin credentials with user-seed.conf". These admin credentials can be used to log into the web GUI, as well as for command-line actions that require authentication.

cklunck · ‎07-27-2023

That stanza was added in v8.2.0, which was about the time federated search was rolled out. If I had to guess, that stanza could lay the foundation for leasing authentication tokens from a vault (like HashiCorp Vault or Amazon STS), so those leased credentials can be used with distributed/federated search. Admittedly, this is nothing more than wild speculation on my part. But given that it's not yet documented, it's probably not in use anywhere. And since it's disabled by default, you're probably safe changing the verify clause to true without it impacting anything. However, if it does break something, you didn't hear that from me Source: completely baseless speculation

cklunck · ‎07-26-2023

After the extraction is complete, are you hoping to have fields and field values like the following? action=Accept origin=10.111.10.111 layer_name="Some text"

cklunck · ‎07-26-2023

You may need to escape your backslashes. Does the following work? <original_search> | rex <extract Dir field here> | search Dir!="*ANYTHING\\STUFF\\*" Whether you use != or NOT as your exclusion operator is up to you - but understand that they may return different results. Check the article Difference between != and NOT for more details.

cklunck · ‎07-26-2023

Something like this should work. <your search> | rex field=_raw " \[(?<Field_1>.+?)\] \[(?<Field_2>.+?)\] " You might have to adjust some of the spaces and other characters to match your events. The brief description of the regex above is: Look in the raw event field Find a space character followed by a left square bracket Start capturing a value and name it "Field_1" Find any set of characters - this will be what ends up in "Field_1" Stop when you find a right square bracket Then there should be a space followed by another left square bracket Start capturing a value and name it "Field_2" Find any set of characters - this will be what ends up in "Field_2" Stop when you find a right square bracket followed by a space Documentation for rex has some good examples. Hope that helps!

cklunck · ‎07-26-2023

There was a .conf presentation about troubleshooting queues. The section called "How to Find Problematic Queues" might help you figure out the issue. To remember how the queues and pipelines are ordered, and what each one does, I refer to this excellent Splunk Community post. My favorite part is that it tells me which configuration file setting controls each part of the pipeline.

cklunck · ‎07-25-2023

I think you want to use eval instead of fieldformat, so it creates a new field. Fieldformat only creates a "view" into a field, which means we can't use it with the fields command later in the search. Sorry I didn't catch that the first time! Something like this worked for me: <base_search>| | eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours))) | fieldformat duration = tostring(duration, "duration") | eval duration_in_minutes = duration / 60 | fields cls_id duration_in_minutes Regarding your question about the fields command - yes, once you use fields to specify only the fields you wish to keep, then all the other fields are discarded from your results for the current search.

cklunck · ‎07-25-2023

The simplest way is probably to use the | fields command: <base_search> | stuff | more stuff | fields cis_id duration_in_minutes This tells Splunk to only keep these two fields. (You can also write it as | fields + cis_id duration_in_minutes if you prefer the operator being shown.)

cklunck · ‎07-24-2023

@sekhar463 wrote: but when i am removing the server from deployment server ,still this search output showing the server in down status, it should not visible in splunk search. When you say you're "removing the server from the deployment server", what action specifically are you taking? If a host appears even just once in the metrics log during the time range you're searching, then it will be included in your result set. If the time it was last seen is older than 7200 seconds, it will be marked as DOWN. Only if your search does not find any results for a host in the metrics log will that host disappear from the result set.

cklunck · ‎07-24-2023

What if you change line 4 to: | timechart Count as Timestamp span=1mon partial=f This will drop the data from the "partial" data set for the current month, and will only display months that have a complete set of data. Note that this will also remove a "partial" month at the beginning of the dataset, if one exists. You might need to extend your time range back a bit farther to account for that.

cklunck · ‎07-24-2023

I'm not sure if it's possible to sort by a different column. However...there is a way to display the "size" field in a pretty format, while retaining the underlying numerical data for sorting. This could work as long as you're not married to using the "size_pretty" from your JSON. Here's an example search (with some additional data I added to test the sorting): | makeresults format=json data="[{\"item\":\"disk1\", \"size\":2147483648, \"size_pretty\":\"2 GB\"}, {\"item\":\"disk2\", \"size\":1099511627776, \"size_pretty\":\"1 TB\"}, {\"item\":\"disk3\", \"size\":660, \"size_pretty\":\"660 B\"}, {\"item\":\"disk4\", \"size\":20147483648, \"size_pretty\":\"18 GB\"}, {\"item\":\"disk5\", \"size\":1047548, \"size_pretty\":\"1,023 KB\"}]" | fieldformat size=printf("%4u",round(size/pow(1024,if(size=0,0,floor(min(log(size,1024),10)))),2)).case(size=0 OR log(size,1024)<1," B", log(size,1024)<2," KB", log(size,1024)<3," MB", log(size,1024)<4," GB", log(size,1024)<5," TB", log(size,1024)<6," PB", log(size,1024)<7," EB", 1=1, " EB") | table item size size_pretty This outputs a table like the following. It sorts the size column as expected, while retaining the pretty formatting: You can remove the "size_pretty" field from the | table command if you no longer wish to display it. The color scale is up to you, but I think it might still be do-able since the underlying numeric data is still there. This answer was inspired by the following post: Smart conversion of large numbers to human-readable format (Splunk Answers)

Posts	18
Solutions	2
Karma Given	4
Karma Received	8
Member Since	‎2023-05-16

Re: How to get Apps installed in HF using splunk

Re: Yum updates breaking a working configuration

Re: How to increase limit of "The pipeline size li...

Re: Dynamically change index value based on differ...

Re: How to ingest PowerShell script that outputs j...

Re: Getting error while creating connect in db app

Re: Splunk authentication to database using LDAP

Re: Intance Login failed

Re: What is the distributed_leases stanza for?

Re: Extracting specific parts from _raw logs

Re: How to search to exclude part of DIR from wind...

Re: need help with regex field extraction between ...

Re: How do we fix the blocked queue in the splunk ...

Re: How to get rid of fields/columns generated by ...

Re: How to get rid of fields/columns generated by ...

Re: Splunk search to check forwarder status based ...

Re: How to restrict particular month data?

Re: Sort by alternative column