Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bjoernhansen
bjoernhansen
Path Finder
Member since:
04-08-2017
03-01-2022
Community Statistics
| Posts | 22 |
| Solutions | 4 |
| Karma Given | 38 |
| Karma Received | 17 |
| Member Since | 08-04-2017 |
Activity Feed
- Got Karma for Re: How to change password using CLI in splunk. 05-05-2022 05:56 AM
- Got Karma for Re: How to change password using CLI in splunk. 01-21-2022 03:07 PM
- Got Karma for Re: How to change password using CLI in splunk. 12-07-2020 12:12 PM
- Got Karma for Splunk ISE TA fails when distributed via Cluster Master. 07-08-2020 07:53 AM
- Karma Re: Why is join slow? for nickhills. 06-05-2020 12:50 AM
- Karma Re: Eval=case not working for FrankVl. 06-05-2020 12:49 AM
- Karma Re: Splunk add-on for servicenow - additional fields for ChrisBell04. 06-05-2020 12:49 AM
- Karma Re: Common Information Model (CIM) Data Model Editor misbehaviour and broken error reporting for smoir_splunk. 06-05-2020 12:49 AM
- Karma Re: Eval=case not working for kamlesh_vaghela. 06-05-2020 12:49 AM
- Karma Re: With Splunk DB Connect v3, How do I reindex data when I have a rising column input? for pmalcakdoj. 06-05-2020 12:49 AM
- Karma Re: How to restart Universal Forwarder from a Deploy Server? for klemaned. 06-05-2020 12:49 AM
- Karma Re: Estreamer vs syslog from ASA firewalls for Richfez. 06-05-2020 12:49 AM
- Karma Re: Average command vs count and average command for FrankVl. 06-05-2020 12:49 AM
- Karma Re: Forwarding to a 3rd party for dthompsonsplunk. 06-05-2020 12:49 AM
- Karma Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2? for marycordova. 06-05-2020 12:49 AM
- Got Karma for Re: add on for windows on centos. 06-05-2020 12:49 AM
- Karma Re: Splunk ISE TA fails when distributed via Cluster Master for jcspigler2010. 06-05-2020 12:48 AM
- Karma Merging local into default using git? for dominiquevocat. 06-05-2020 12:48 AM
- Karma What are the pain points with deploying your Splunk architecture on Windows OS? for woodcock. 06-05-2020 12:48 AM
- Karma Re: How to change password using CLI in splunk for koshyk. 06-05-2020 12:48 AM
Topics I've Started
04-29-2018
01:13 AM
Am I getting this right?
You don't want to have three copies of your app, with the only difference being which index they should put their index into?
... View more
04-29-2018
12:51 AM
1 Karma
To answer your question:
Yes, Splunk is perfectly fine with Windows TA/windows data being sent to a Linux box running Splunk.
As FrankVI pointed out, you're most likely having a problem with either your inputs or outputs on the UF.
Try a search like index=_internal host=yourwindowshostname
If you debt get any results at all, your UF is missing a proper outputs.conf to actually forward the data to your Splunk instance.
EDIT: On the Windows machine, start a shell/CLI, go to Splunk UF install directory, go to subdirectory bin, run splunk.exe list forward-server . If it shows no active forward, you might have a firewall issue.
... View more
02-26-2018
06:46 AM
Would agree on that. Also, for the case shown above, you can simply use if() instead of case() 🙂
... View more
02-26-2018
06:19 AM
The "activities" page in the Partner Portal is just a summary of things you need to do for that certification. It will show "green/done" when you looked at all the information - but it has no way of tracking if you actually did what you were supposed to.
If you have successfully completed a certification, you'll get a mail from the Splunk certification team that will say so, and also tell you where to download things.
Hint: It will be there: https://partners.splunk.com/English/Resellers/certification/my_certifications.aspx
If it doesn't show up there, you haven't finished your certification, or something went wrong - in that case send a mail to certification@splunk.com
... View more
02-26-2018
06:14 AM
If you send your data from Splunk to syslog-ng using the syslog output, it's the raw data. The information about the index will never reach syslog-ng, and therefore can't be put into the event.
I'd stick with FrankVI's question and ask - why (the hell ;-)) would you do such a setup? Forward it to the second Splunk indexer cluster right from the UFs. If anything needs to be manipulated before, use Heavy Forwarders instead of syslog-ng in-between?
... View more
02-26-2018
06:09 AM
Can you give more examples to this? I can't see how you would get to 7 based on that data - maybe I'm missing something?
... View more
02-26-2018
06:07 AM
Hey,
to Splunk, these email addresses are all the same.
It can't even know if there is some kind of distribution or shared mailbox behind the address - so this is 99% sure not a Splunk issue.
I'd take a look in the splunkd.log to see if there are any errors related to mail sending thrown by whatever mail server is being used to deliver the mails.
If not, I would ask my mail server admin to take a look in the mail server log at the time a mail is supposed to be sent, to check if anything pops up there.
... View more
02-19-2018
11:58 AM
Hey subtrakt,
try this one:
(?i).*(?<testfromend>(Facility\=|Message\=)[^$]*?)$
Update: even better:
(?i)(?<testfromend>(Facility\=|Message\=)[^\=]*?)$
... View more
01-22-2018
08:51 AM
4 Karma
The easiest way is actually to put a space in front of the command. That shouldn't log it to history.
... View more
12-15-2017
02:24 AM
As this is a top result on Google when searching for this issue, I'd like to offer an alternative way I found, using a 3rd party tool called crudini.
Splunk config files work well enough with that tool, so if you don't want to create a complete "packaged" app, but just combine two Splunk config files, with no restriction if they're in the same app, use crudini - at least for RedHat, it's available from the EPEL repo, and also available in Debian.
crudini works like this:
crudini --merge default/props.conf < local/props.conf
The result is a .conf file, that contains the data from the default props, updated and completed by whatever is available in the local props file. It can obviously also be used to set/change/delete values in Splunk conf files from within your scripts.
Disclaimer: I did not yet properly test it with all edge cases, e.g. multiline values. Use at your own discretion 😉
... View more
11-07-2017
02:58 AM
Should be like this:
i index=_audit action="login attempt" | stats latest(user) by user
It should actually not matter what you put inside the latest()...
... View more
07-30-2017
09:17 AM
30.07.2017 - same need here. Really looking forward to a solution 🙂
... View more
05-05-2017
10:45 AM
OMG I love you so much... I tried all the combinations on my German keyboard to get that feature to work, but this (completely unrelated) key combo works fine. Yeah! 😄
... View more
05-05-2017
07:59 AM
11 Karma
Hey,
I use this TA on an Indexer cluster, and it fails to actually process any event. After some troubleshooting, the core of the problem lies here:
05-05-2017 16:49:01.514 +0200 ERROR AggregatorMiningProcessor - Uncaught exception in Aggregator, skipping an event: Can't open DateParser XML configuration file "/opt/splunk/etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml": No such file or directory - data_source="/opt/logfiles/10.1.2.3/2017-05-05.log", data_host="10.1.2.3", data_sourcetype="cisco:ise:syslog"
When the app is distributed via the cluster master, it is stored in /etc/slave-apps on the indexers, and the reference in the default/props.conf does not work:
[cisco:ise]
DATETIME_CONFIG = /etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml
[cisco:ise:syslog]
DATETIME_CONFIG = /etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml
I fixed this by creating a local/props.conf like this:
[cisco:ise]
DATETIME_CONFIG = /etc/slave-apps/Splunk_TA_cisco-ise/default/datetime_udp.xml
[cisco:ise:syslog]
DATETIME_CONFIG = /etc/slave-apps/Splunk_TA_cisco-ise/default/datetime_udp.xml
This obviously only fixes it for cluster environments.
From my understanding, DATETIME_CONFIG allows for no variable that includes the app path, so I see no obvious solution to fix this.
If it can't be fixed, at least an eye-catching hint about this in the install guide could be helpful.
... View more
04-18-2017
07:51 AM
That's actually the complete hostname. When I turned on debugging, Splunk with debug turned on actually reported that my stanza matched - so that part seems to be okay.
... View more
04-18-2017
02:04 AM
Yes, the domain matches exactly. I even did a tcpdump to make sure that the event being sent does not include something like a weird UTF-8 character, a space or something like that, but it doesn't. My debug activity shows me that at least the props.conf stanza actually matches:
04-16-2017 22:09:09.085 +0200 DEBUG PropertiesMapConfig - Pattern 'host_rename_vsp' matches with priority 100
And, as you can see - I already changed the stanza name to make sure that no strange behaviour regarding the "-" is the reason for my problems.
... View more
04-17-2017
02:10 PM
I restarted both indexers with --debug for half a minute.
The log actually states that the props stanza matches:
04-16-2017 22:09:09.085 +0200 DEBUG PropertiesMapConfig - Pattern 'host_rename_vsp' matches with priority 100
Nevertheless - no change at all.
... View more
04-17-2017
02:06 PM
Hey,
thanks for the suggestion. Unfortunately, I already tried that 😉
I must have tried each and any possible combination by now...
... View more
04-16-2017
11:02 AM
I know this will only affect new events, but that UF is pushing events almost continously, so it's easy to monitor for it. I tried manually restarting the indexers. The one props-transform (see above) works fine - the other is still broken. I have no clue...
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-01-2022
09:14 AM
|
Karma given to
