About dave_null

dave_null · ‎06-01-2021

It sounds like you are on the right path. Are you able to identify which search is causing this error? The setting that you have to change to up the limit is different depending on whether the broken search uses subsearches or join commands.

dave_null · ‎06-01-2021

Normally Splunk stores indexed data in cold buckets until the retention period expires. When that happens, Splunk moves the data to "Frozen" storage. Frozen storage can be either an archive system or just deletion. It sounds to me like you're asking how to set up Frozen storage to store data after the retention period in Splunk. Depending on the archiving system, there are many ways to do this. Perhaps this helps? https://community.splunk.com/t5/All-Apps-and-Add-ons/Frozen-archives-into-Amazon-S3/m-p/41024 https://www.splunk.com/en_us/blog/tips-and-tricks/shuttl-for-big-data-archiving.html

dave_null · ‎05-18-2021

Hello, I have an on-prem Splunk cluster and an AWS cluster. Each one has its own indexers and clustermaster, though only the on-prem setup has a search head and a deployment server. When I use the deployment server to deploy configurations to a splunk forwarder in AWS, it keeps failing to deploy. I have checked: Forwarder is installed on machine to send logs DS can contact the machine to send apps via port 8089 I used TCPDump on the forwarder machine on port 8089 and can see packets from the deployment server Unfortunately all I can get from the internal logs is this delightfully descriptive error message: 05-19-2021 08:04:42.818 +0200 WARN ClientSessionsManager - ip=<omitted> name=<omitted> Updating record for sc=<serverclass name> app=<app name>: action=Download result=Fail checksum=0 Can anyone suggest more areas to look at? I can't figure out why it is not deploying properly.

dave_null · ‎05-18-2021

Yeah just nest them: | eval Team_Color=if(<check 1>, <value if check1 true> , if( <check 2> , <value if check2 true>, <value if both false>)) E.g. | eval Team_Color = if(team="Blue", team_name, if(team="Red",team_name, ""))

dave_null · ‎04-09-2021

1. Are you getting any logs at all from this app? Whether sign ins, users, directory audit, risk detections, or directory devices? 2. Are you using the latest version of the app? 3. Are you using a proxy in your environment? I see from the message that it is not using a in the app, but if a proxy is blocking your internet access then this could make a problem. 4. Have you double-checked your Tenant ID, Client ID, and Client Secret (the latter two are for your App Registration which must have the required permissions https://docs.google.com/spreadsheets/d/1YJAqNmcXZU-7O9CxVKupOkR6q2S8TXriMeLAUMYmMs4/edit?usp=sharing )

dave_null · ‎04-09-2021

This worked very well for me, thanks. One modification though if your HEX value may contain upper and lower case is to add A-F to the regex. eval ascii=urldecode(ltrim(replace(value,"([a-fA-F0-9]{2})","%\1"),"0x"))

dave_null · ‎03-05-2021

Can you set up the "| ldapsearch " command in your Splunk environment, so that it can perform LDAP queries to your AD? https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.2/User/Theldapsearchcommand https://www.splunk.com/en_us/blog/tips-and-tricks/integrating-active-directory-into-splunk-with-sa-ldapsearch.html Once that is complete, you can search for users with a "accountExpires" time: | ldapsearch domain="default" search="(&(objectclass=user))" attrs="cn,displayName,title,department,whenCreated,mail,lastLogonTimestamp,accountExpires" | table cn mail displayName title department whenCreated lastLogonTimestamp accountExpires

dave_null · ‎03-05-2021

In the first line of your search, you misspelled "seach_id"

dave_null · ‎03-05-2021

From my perspective your props.conf looks good. Are your events currently being indexed line by line?

dave_null · ‎03-05-2021

I assume you are using the Splunk DB Connect app, and it is able to execute SQL queries to your database. Are you able to make a new data input which has id(int) as the rising column, instead of modifying the old one?

dave_null · ‎03-05-2021

Are you talking about this app? https://splunkbase.splunk.com/app/273/ If you have access to the app config files, you should be able to swap the netstat command with "ss," though I couldn't tell you exactly how without knowing which app you are referring to.

dave_null · ‎03-05-2021

Ah sorry, it is <event> (not plural) What are all the sections it is wrapped in? I may have a workaround but I don't know how it would interfere with your other XML The workaround is to put a table into the base search, but leave the base search in a <event> section so that it saves the fields in the table, but does not display them as a table: <search id="baseSearch"> <query>index=myIndex $clientType$ region=$region$ | table timestamp applicationName message entryKey</query> <earliest>$reportWindow.earliest$</earliest> <latest>$reportWindow.latest$</latest> <refresh>$refreshInterval$</refresh> <refreshType>delay</refreshType> </search>

dave_null · ‎03-05-2021

Is the base search in an <events> xml section? The problem may be that the base search is doing a Fast search and not properly extracting the fields for the next search. When you press the "Open in Search" button, then Splunk combines the searches so that the baseSearch is required to find fields for the subsequent search.

dave_null · ‎03-04-2021

Ultimately you need the memory usage information to appear in a log on the server so that Splunk can work with it. If you don't have a log with this information, then you will have to generate it yourself, either by installing a monitoring software or by running a scripted input. One potential solution would be to run a scripted input on each linux server, which indexes the result of the "free -m" command. (perhaps with a grep to get a single line) To do this, make an app or modify an app that is deployed to your linux servers. Here is the stanza for the inputs.conf of the app: (insert app name, index, interval, and sourcetype name below) [script://$SPLUNK_HOME/etc/apps/<appName>/bin/getmem.sh] disabled = false index = ???? interval = 60 sourcetype = ???? Here is the code for the script: (save to $SPLUNK_HOME/etc/apps/<appname>/bin/getmem.sh #!/bin/bash free -m | grep "Mem"

dave_null · ‎03-04-2021

Could you also post the base search XML, with sensitive information omitted?

Posts	23
Solutions	5
Karma Given	16
Karma Received	2
Member Since	‎11-28-2019

Online Status	Offline
Date Last Visited	‎12-09-2022 11:51 AM

Debugging app deployment to AWS cluster

Anyone know when NetApp Data for Ontap TA will be ...

Re: Currently we are facing issues that Splunk can...

Re: Retention in the Cloud

Debugging app deployment to AWS cluster

Re: Check to see if value is in a field if not get...

Re: microsoft azure add-on for Splunk is unable to...

Re: How to convert Hex to Ascii in Splunk?

Re: search for temporary users in privileged group...

Re: List indexes that are being used

Re: Parsing McAfee Firewall Logs

Re: Checkpoint value is changing from rising colum...

Re: Unix / Linux Addon

Re: Statistics table does not show results for val...

Re: Statistics table does not show results for val...

Re: Query to get average memory usage in linux

Re: Statistics table does not show results for val...