Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About bjoernhansen
bjoernhansen
Path Finder
Member since:
04-08-2017
04-03-2025
Community Statistics
| Posts | 23 |
| Solutions | 4 |
| Karma Given | 38 |
| Karma Received | 19 |
| Member Since | 08-04-2017 |
Activity Feed
- Got Karma for Re: How to change password using CLI in splunk. 2 weeks ago
- Got Karma for Re: How to change password using CLI in splunk. 11-13-2023 09:21 AM
- Got Karma for Re: How to change password using CLI in splunk. 05-05-2022 05:56 AM
- Got Karma for Re: How to change password using CLI in splunk. 01-21-2022 03:07 PM
- Got Karma for Re: How to change password using CLI in splunk. 12-07-2020 12:12 PM
- Got Karma for Splunk ISE TA fails when distributed via Cluster Master. 07-08-2020 07:53 AM
- Karma Re: Why is join slow? for nickhills. 06-05-2020 12:50 AM
- Karma Re: Eval=case not working for FrankVl. 06-05-2020 12:49 AM
- Karma Re: Splunk add-on for servicenow - additional fields for ChrisBell04. 06-05-2020 12:49 AM
- Karma Re: Common Information Model (CIM) Data Model Editor misbehaviour and broken error reporting for smoir_splunk. 06-05-2020 12:49 AM
- Karma Re: Eval=case not working for kamlesh_vaghela. 06-05-2020 12:49 AM
- Karma Re: With Splunk DB Connect v3, How do I reindex data when I have a rising column input? for pmalcakdoj. 06-05-2020 12:49 AM
- Karma Re: How to restart Universal Forwarder from a Deploy Server? for klemaned. 06-05-2020 12:49 AM
- Karma Re: Estreamer vs syslog from ASA firewalls for Richfez. 06-05-2020 12:49 AM
- Karma Re: Average command vs count and average command for FrankVl. 06-05-2020 12:49 AM
- Karma Re: Forwarding to a 3rd party for dthompsonsplunk. 06-05-2020 12:49 AM
- Karma Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2? for marycordova. 06-05-2020 12:49 AM
- Got Karma for Re: add on for windows on centos. 06-05-2020 12:49 AM
- Karma Re: Splunk ISE TA fails when distributed via Cluster Master for jcspigler2010. 06-05-2020 12:48 AM
- Karma Merging local into default using git? for dominiquevocat. 06-05-2020 12:48 AM
Topics I've Started
04-29-2018
01:13 AM
Am I getting this right?
You don't want to have three copies of your app, with the only difference being which index they should put their index into?
... View more
04-29-2018
12:51 AM
1 Karma
To answer your question:
Yes, Splunk is perfectly fine with Windows TA/windows data being sent to a Linux box running Splunk.
As FrankVI pointed out, you're most likely having a problem with either your inputs or outputs on the UF.
Try a search like index=_internal host=yourwindowshostname
If you debt get any results at all, your UF is missing a proper outputs.conf to actually forward the data to your Splunk instance.
EDIT: On the Windows machine, start a shell/CLI, go to Splunk UF install directory, go to subdirectory bin, run splunk.exe list forward-server . If it shows no active forward, you might have a firewall issue.
... View more
02-26-2018
06:46 AM
Would agree on that. Also, for the case shown above, you can simply use if() instead of case() 🙂
... View more
02-26-2018
06:19 AM
The "activities" page in the Partner Portal is just a summary of things you need to do for that certification. It will show "green/done" when you looked at all the information - but it has no way of tracking if you actually did what you were supposed to.
If you have successfully completed a certification, you'll get a mail from the Splunk certification team that will say so, and also tell you where to download things.
Hint: It will be there: https://partners.splunk.com/English/Resellers/certification/my_certifications.aspx
If it doesn't show up there, you haven't finished your certification, or something went wrong - in that case send a mail to certification@splunk.com
... View more
02-26-2018
06:14 AM
If you send your data from Splunk to syslog-ng using the syslog output, it's the raw data. The information about the index will never reach syslog-ng, and therefore can't be put into the event.
I'd stick with FrankVI's question and ask - why (the hell ;-)) would you do such a setup? Forward it to the second Splunk indexer cluster right from the UFs. If anything needs to be manipulated before, use Heavy Forwarders instead of syslog-ng in-between?
... View more
02-26-2018
06:09 AM
Can you give more examples to this? I can't see how you would get to 7 based on that data - maybe I'm missing something?
... View more
02-26-2018
06:07 AM
Hey,
to Splunk, these email addresses are all the same.
It can't even know if there is some kind of distribution or shared mailbox behind the address - so this is 99% sure not a Splunk issue.
I'd take a look in the splunkd.log to see if there are any errors related to mail sending thrown by whatever mail server is being used to deliver the mails.
If not, I would ask my mail server admin to take a look in the mail server log at the time a mail is supposed to be sent, to check if anything pops up there.
... View more
02-19-2018
11:58 AM
Hey subtrakt,
try this one:
(?i).*(?<testfromend>(Facility\=|Message\=)[^$]*?)$
Update: even better:
(?i)(?<testfromend>(Facility\=|Message\=)[^\=]*?)$
... View more
01-22-2018
08:51 AM
6 Karma
The easiest way is actually to put a space in front of the command. That shouldn't log it to history.
... View more
12-15-2017
02:24 AM
As this is a top result on Google when searching for this issue, I'd like to offer an alternative way I found, using a 3rd party tool called crudini.
Splunk config files work well enough with that tool, so if you don't want to create a complete "packaged" app, but just combine two Splunk config files, with no restriction if they're in the same app, use crudini - at least for RedHat, it's available from the EPEL repo, and also available in Debian.
crudini works like this:
crudini --merge default/props.conf < local/props.conf
The result is a .conf file, that contains the data from the default props, updated and completed by whatever is available in the local props file. It can obviously also be used to set/change/delete values in Splunk conf files from within your scripts.
Disclaimer: I did not yet properly test it with all edge cases, e.g. multiline values. Use at your own discretion 😉
... View more
11-07-2017
02:58 AM
Should be like this:
i index=_audit action="login attempt" | stats latest(user) by user
It should actually not matter what you put inside the latest()...
... View more
07-30-2017
09:17 AM
30.07.2017 - same need here. Really looking forward to a solution 🙂
... View more
05-05-2017
10:45 AM
OMG I love you so much... I tried all the combinations on my German keyboard to get that feature to work, but this (completely unrelated) key combo works fine. Yeah! 😄
... View more
05-05-2017
07:59 AM
11 Karma
Hey,
I use this TA on an Indexer cluster, and it fails to actually process any event. After some troubleshooting, the core of the problem lies here:
05-05-2017 16:49:01.514 +0200 ERROR AggregatorMiningProcessor - Uncaught exception in Aggregator, skipping an event: Can't open DateParser XML configuration file "/opt/splunk/etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml": No such file or directory - data_source="/opt/logfiles/10.1.2.3/2017-05-05.log", data_host="10.1.2.3", data_sourcetype="cisco:ise:syslog"
When the app is distributed via the cluster master, it is stored in /etc/slave-apps on the indexers, and the reference in the default/props.conf does not work:
[cisco:ise]
DATETIME_CONFIG = /etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml
[cisco:ise:syslog]
DATETIME_CONFIG = /etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml
I fixed this by creating a local/props.conf like this:
[cisco:ise]
DATETIME_CONFIG = /etc/slave-apps/Splunk_TA_cisco-ise/default/datetime_udp.xml
[cisco:ise:syslog]
DATETIME_CONFIG = /etc/slave-apps/Splunk_TA_cisco-ise/default/datetime_udp.xml
This obviously only fixes it for cluster environments.
From my understanding, DATETIME_CONFIG allows for no variable that includes the app path, so I see no obvious solution to fix this.
If it can't be fixed, at least an eye-catching hint about this in the install guide could be helpful.
... View more
04-18-2017
07:51 AM
That's actually the complete hostname. When I turned on debugging, Splunk with debug turned on actually reported that my stanza matched - so that part seems to be okay.
... View more
04-18-2017
02:04 AM
Yes, the domain matches exactly. I even did a tcpdump to make sure that the event being sent does not include something like a weird UTF-8 character, a space or something like that, but it doesn't. My debug activity shows me that at least the props.conf stanza actually matches:
04-16-2017 22:09:09.085 +0200 DEBUG PropertiesMapConfig - Pattern 'host_rename_vsp' matches with priority 100
And, as you can see - I already changed the stanza name to make sure that no strange behaviour regarding the "-" is the reason for my problems.
... View more
04-17-2017
02:10 PM
I restarted both indexers with --debug for half a minute.
The log actually states that the props stanza matches:
04-16-2017 22:09:09.085 +0200 DEBUG PropertiesMapConfig - Pattern 'host_rename_vsp' matches with priority 100
Nevertheless - no change at all.
... View more
04-17-2017
02:06 PM
Hey,
thanks for the suggestion. Unfortunately, I already tried that 😉
I must have tried each and any possible combination by now...
... View more
04-16-2017
11:02 AM
I know this will only affect new events, but that UF is pushing events almost continously, so it's easy to monitor for it. I tried manually restarting the indexers. The one props-transform (see above) works fine - the other is still broken. I have no clue...
... View more
04-15-2017
04:15 PM
As it seems I can not edit my question, here is a pastebin of the btool output for props and transforms regarding my stanzas:
https://pastebin.com/GhjyqJan
I also tried to rename the stanza to host_rename_vsp to avoid any issues with "-", but to no success.
... View more
04-15-2017
10:28 AM
1 Karma
Hey guys,
so I'm rather new to Splunk, and we're implementing a small cluster for logfile collection and SIEM purposes.
One of our systems is a MobileIron Core Appliance, which features a built-in Splunk forwarder 6.0.3, while the rest of our Splunk system is running 6.5.3.
This system is using a fixed hostname for the events forwarded to our Splunk system, and the system automatically uses the configured (external) system name, but I'd like to use our internal host name for these events.
So, following the documentation and a few threads here on Splunk answers, I tried to set up the following:
/opt/splunk/etc/master-apps/_cluster/local/props.conf
[host::vsp.my-domain.de]
TRANSFORMS-host_rename = host_rename-vsp.my-domain.de
/opt/splunk/etc/master-apps/_cluster/local/transforms.conf
[host_rename-vsp.my-domain.de]
REGEX = .
DEST_KEY = MetaData:Host
FORMAT = host::somehost.local.lan
This all is being distributed by the cluster master through the cluster bundle - I verified the files on the indexers.
Still, all events show up with the original hostname.
I have this in the cluster bundle to:
/opt/splunk/etc/master-apps/_cluster/local/props.conf
[host::10.0.1.2]
TRANSFORMS-drop = drop-loadbalancer
[host::10.0.1.3]
TRANSFORMS-drop = drop-loadbalancer
/opt/splunk/etc/master-apps/_cluster/local/transforms.conf
[drop-loadbalancer]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
These change works perfectly fine, so I'm pretty sure it's not an issue with the cluster distribution or the regex.
Any idea on what kind of stupid mistake I might have made?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-03-2025
08:15 PM
|
Karma given to
