Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Voltaire
Voltaire
Communicator
Member since:
05-07-2010
10-11-2025
Community Statistics
| Posts | 49 |
| Solutions | 3 |
| Karma Given | 0 |
| Karma Received | 16 |
| Member Since | 05-07-2010 |
Activity Feed
- Got Karma for Re: LDAP Search don't work. 06-05-2020 12:46 AM
- Got Karma for Re: Group reports. 06-05-2020 12:46 AM
- Got Karma for Error after migration to 4.1.2: Invalid latest_time: latest_time must be after earliest_time.. 06-05-2020 12:45 AM
- Got Karma for Error after migration to 4.1.2: Invalid latest_time: latest_time must be after earliest_time.. 06-05-2020 12:45 AM
- Got Karma for Error after migration to 4.1.2: Invalid latest_time: latest_time must be after earliest_time.. 06-05-2020 12:45 AM
- Got Karma for Re: Error after migration to 4.1.2: Invalid latest_time: latest_time must be after earliest_time.. 06-05-2020 12:45 AM
- Got Karma for Disk usage Alerts. 06-05-2020 12:45 AM
- Got Karma for Disk usage Alerts. 06-05-2020 12:45 AM
- Got Karma for Re: Received event for unconfigured/disabled index... : When was this event received?. 06-05-2020 12:45 AM
- Got Karma for Re: Received event for unconfigured/disabled index... : When was this event received?. 06-05-2020 12:45 AM
- Got Karma for Re: Received event for unconfigured/disabled index... : When was this event received?. 06-05-2020 12:45 AM
- Got Karma for Re: Unsuccessful in installing Splunk on Windows 2003 server. 06-05-2020 12:45 AM
- Got Karma for Re: Unsuccessful in installing Splunk on Windows 2003 server. 06-05-2020 12:45 AM
- Got Karma for Re: add additional server to windows app. 06-05-2020 12:45 AM
- Got Karma for Re: splunk stopped forwarding.... 06-05-2020 12:45 AM
- Got Karma for Re: Splunk upgrade questions. 06-05-2020 12:45 AM
- Posted Re: LDAP Search don't work on Security. 11-30-2015 02:05 PM
- Posted Re: ERROR TcpChannel - Error trying to begin socket accept: An invalid argument was supplied. on Deployment Architecture. 02-04-2015 12:57 PM
- Posted Re: Error in 'databasePartitionPolicy': Failed to read 1 event(s) from rawdata from bucket 'main-112-C7BC880D-F64C-B288-6A8FF984920D',Rawdata ma be corrupt,see search.log on Splunk Search. 01-23-2015 05:13 PM
- Posted Re: Add-on/App for Splunk,Apps/Add-ons for Networking Appliances on All Apps and Add-ons. 01-16-2015 01:25 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 3 | |||
| 0 |
11-30-2015
02:05 PM
1 Karma
Not sure how your AD is defined, however here is an example with a virtual AD for testing
Here is a sample LDAP search query
ldapsearch -h "YOURHOSTNAME" or "Ipaddress" -p "your LDAP port" -b "CN=Splunk Users,OU=Security Groups - SPLUNK,DC=YOURS,DC=IT,DC=Splunk,DC=edu" -x -D "Splunk service account" -W "groupNameAttribute"
My AD has a "OU" or group called "Security Groups-Splunk" Under that Group,
I created a "CN" or group called Splunk Users, you can place your potential users in that group.
The display or real user name is "Splunk Service account" -You will need to specify credentials when you test with LDAP search. So ensure you have the correct password. Otherwise your account maybe locked out based upon your inherent Security Group policies.
You can also substitute "realNameAttribute" "displayname" "member" "userNameAttribute"" after -W for further testing
Sample (Domain Component) or your Domain name = yours.IT.Splunk.edu
You can verify your ad configuration using another LDAP Windows GUI browser. I used Active Directory Explorer
Once it works go to Map groups to verify users from Splunk web interface
"http://YourSplunkServer.yours.IT.Splunk.edu8000/en-US/manager/yours/authentication/providers/LDAP"
HTHs
... View more
02-04-2015
12:57 PM
Are you using IPV6?
I had a similar issue with Splunk 6.0 build 182037. "ERROR TcpChannel - Error trying to begin socket accept: An invalid argument was supplied."
I pinged the Splunk Indexer and found that it was using IPV6 to resolve the hostname. I disabled IPV6, then added the hostname IPV4 address in the localhosts file. Restarted Splunk and it is working fine now.
... View more
01-23-2015
05:13 PM
What version of Splunk are you using? BTW- Is it a VMware or virtual system? I am experiencing something similar with a VMware Splunk server.
splunk stop splunkd
/opt/splunk/bin/./splunk fsck --all --repair
splunk start splunkd
The other option would be to Clean the indexes and start over with a new index.
http://answers.splunk.com/answers/134553/how-to-delete-data-index-reset-start-from-scratch.html
Hope that helps!
... View more
01-16-2015
01:25 PM
Not sure about the cost or Free status. Sure your time is valuable.
You can start here
Netflow https://apps.splunk.com/app/489/
Palo Alto https://apps.splunk.com/app/491/
Splunk for F5 https://apps.splunk.com/app/812/
and or cruise around through the apps...
... View more
07-23-2014
12:22 PM
Did you configure LDAP roles in Splunk for authentications? If yes, did you use LDAP search method or another utility to verify the LDAP attributes in configuring the "LDAP connection settings"
For example did you verify The Group base DN? Exaple
"OU=Security Groups - AIS,DC=ad,DC=it,DC=yourdc,DC=ext
... View more
07-23-2014
11:22 AM
If it is Splunk, yu can change the password here "$SPLUNKHOME/etc/passwd" Restart splunk and login with the Splunk default password
... View more
07-23-2014
11:08 AM
If you can not remove disk space ? you can modify the "Pause indexing if free disk space (in MB) falls below this value" in
http://MYSPLUNKSERVER:8000/en-US/manager/search/server/settings/settings?action=edit and may have to restart Splunk.
... View more
06-03-2013
02:18 PM
One way would be to create a new data input, send it to a specific index, create an application\dashboard with that index and associated searches, then assign users to that application. You can also assign specific rights and rles to that app in Access controls, Users.
HTHs
... View more
06-03-2013
01:50 PM
Yes , Go to Manager ., Access controls, choose the user, choose their default app, then give them the correct privileges, and or role. You can also create a new role for these users.
I hope that helps..
... View more
05-05-2013
10:55 AM
Did you enable TCP or UDP in the Splunk configuration? What level of logging did you choose for your cisco devices? what OS are you using for your splunk server?
... View more
05-03-2013
04:38 PM
I can successfully list the contents of the lookup table with the input lookup command. However I can not see the fields output. I will reread the "Addfieldsfromexternaldatasources" and start over. I did notice that there was no props.conf in the /usr/local/splunk/etc/apps/maps/local directory. Do I need a corresponding props.conf for each lookup table?
Thank you !,
... View more
05-02-2013
05:27 PM
Tried experimenting with the Http Status codes example in the documentation for lookup tables. This is the error.
Could not find the specified look up fields in the look up table for conf, source=mine look up table HttpStatusCodes
Any assistance or reference material would be appreciated.
Thanks in advance
... View more
- Tags:
- lookups
02-15-2013
12:31 PM
You should upgrade to Windows 2003 or higher. Since Microsoft has stopped supporting Windows 2000. http://windows.microsoft.com/en-US/windows/products/lifecycle
... View more
12-26-2012
10:20 AM
The logs are being imported through syslog-ng into one nginx log file on a forwarder.The Challenge is Splunk sees all of the hosts coming from one host. "as3.br0.la.somecompany.com" instead of the individual hosts on the first line of the log, which have similar naming contexts, just different numerical values. What is the best way to extract the correct host fields when indexed, so they appear correctly in the search results? I have tried creating field extractions with this regex,
index=nginx sourcetype="Nginx" host="" | rex "(?i)^(?:[^ ] ){3}(?P<fieldname>[^ ]+)" | top 50 FIELDNAME
This appears to work however I would like to extract the correct fields before the data is indexed ? ,
Dec 17 17:56:04 as1.br0.la.somecompany.com nginx: 68.232.40.28 - - [17/Dec/2012:17:56:04 -0800] GET/cdn/asset/view/client/partizan/package/library/id/300590/format/o/h/f0107484aa8d9bdf4eba080bc7c6a492/7a6013aef28682d61703dff120d21b12266b54a2a637283d7d4f0c0b4aa1f551916c39f5b8b23b8e8cb43d3055c3e48ed1864a6112 HTTP/1.1" 200 13333227 "-" "QuickTime/7.6.6 (qtver=7.6.6;cpu=IA32;os=Mac 10.6.8)" request_time 3.174 upstream_time 0.071
My inputs.conf file
host=as3.br0.la.somecompany.com
sourcetype=Nginx
source=/var/log/nginx-access.log
index=nginx
Thank you
Mark
... View more
12-26-2012
10:14 AM
Thanks Kyle, I have tried this method, however it does not produce the results I was hoping for with indexing the data. I set up a field extraction with this reg ex to remove the hostnames in a search. index=nginx sourcetype="Nginx" host="" | rex "(?i)^(?:[^ ] ){3}(?P [^ ]+)" | top 50 FIELDNAME. This appears to work however I would like to extract the correct fields before the data is indexed ?
... View more
12-17-2012
06:06 PM
5:56:04.000 PM
Dec 17 17:56:04 as1.br0.la.somecompany.com nginx: 68.232.40.28 - - [17/Dec/2012:17:56:04 -0800] "GET /cdn/asset/view/client/partizan/package/library/id/300590/format/o/h/f0107484aa8d9bdf4eba080bc7c6a492/?7a6013aef28682d61703dff120d21b12266b54a2a637283d7d4f0c0b4aa1f551916c39f5b8b23b8e8cb43d3055c3e48ed1864a6112 HTTP/1.1" 200 13333227 "-" "QuickTime/7.6.6 (qtver=7.6.6;cpu=IA32;os=Mac 10.6.8)" request_time 3.174 upstream_time 0.071
host=as3.br0.la.somecompany.com Options|
sourcetype=Nginx Options|
source=/var/log/nginx-access.log Options|
index=nginx Options
The logs are being imported through syslog-ng into one nginx log file on a forwarder.The Challenge is Splunk sees them all coming from one host. "as3.br0.la.somecompany.com" instead of the individual hosts on the first line which have similar naming contexts, just different numerical values. What si the best way to extract the correct hostfields so they appear correctly in the search results? I have tried creating field extractions, however that is not working correctly, and is only appears to be available after the data is consumed.
Thank you
... View more
- Tags:
- fields
11-20-2012
11:07 AM
Excellent, just modified inputs.conf on my forwarder. Would this command work if I wanted to exclude all files under the www directory in any of the subfolders? or do I have to add a different syntax ?
for example
[monitor:///wd/code/websites/wd-current/www/.../*]
Thank you!
... View more
11-20-2012
10:27 AM
I am trying to block files from being read by splunk in those directories.
Thank you.
... View more
11-19-2012
06:18 PM
I am attempting to blacklist all files that end with these extensions in my inputs.conf file. The blacklist is not working correctly. These are image files located under a /images directory on the web server. These files are Not in the same directory as the log file. They are directory entries in the nginx-access log file contents.
For example
/wd/code/websites/wd-current/www/images/*
/wd/code/websites/wd-current/www/js/resources/*
/wd/code/websites/sample.it/www/resources/*
I have attempted a few different methods. Any suggestions?
[default]
host = oh.br0ther.com
[monitor:///var/log/nginx-access.log]
blacklist= \.(jpg|png|gif|mov|js|swf|mp4|jar|signed|flv)$
... View more
- Tags:
- blacklist
11-08-2012
12:57 PM
The forwarders will continue sending information to the main indexer one they are put back online. I had the same situation with some dormant forwarders. Once they were back online they refreshed all of the data from the last event that was available. Takes a wee bit of time based uupon the quantity of data. Do you specfy an index for your forwarded data? It is easy to verify when your configure your data inputs to use a specific index. Otherwise review your data inputs and check the default index used. YOu can search that indexfor the missing frowarders data easily.
... View more
11-08-2012
12:52 PM
Dont know about the Excel app, however I installed Splunk on AIX yesterday. Works fine.
wget -O splunk-5.0-140868-AIX-powerpc.tgz 'http://www.splunk.com/page/download_track?file=5.0/splunk/aix/splunk-5.0-140868-AIX-powerpc.tgz&ac=&wget=true&name=wget&typed=releases'
... View more
