Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jarizeloyola
jarizeloyola
Path Finder
Member since:
01-08-2020
10-30-2024
Community Statistics
| Posts | 28 |
| Solutions | 4 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 01-08-2020 |
Activity Feed
- Got Karma for Re: How to replicate data to the indexer *and* a syslog server. 06-05-2020 12:51 AM
- Got Karma for Re: How to replicate data to the indexer *and* a syslog server. 06-05-2020 12:51 AM
- Got Karma for Re: How to replicate data to the indexer *and* a syslog server. 06-05-2020 12:51 AM
- Got Karma for Re: How can I integrate this IF statement into the panel?. 06-05-2020 12:50 AM
- Got Karma for Re: Question on data retention. 06-05-2020 12:50 AM
- Posted Re: How to extract time from bash_history # timestamp? on Deployment Architecture. 01-16-2020 06:15 PM
- Posted Re: How to extract time from bash_history # timestamp? on Deployment Architecture. 01-16-2020 03:49 PM
- Posted Re: eventid.net on All Apps and Add-ons. 01-14-2020 08:57 PM
- Posted Re: Indexed data till date with no access on license master. on Deployment Architecture. 01-14-2020 08:26 PM
- Posted Re: HTTP Event collector Log ingestion on Getting Data In. 01-14-2020 08:01 PM
- Posted Re: Windows Universal Forwarder Not Forwarding to Indexer on Getting Data In. 01-14-2020 04:04 PM
- Posted Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps? on Splunk Search. 01-14-2020 12:25 PM
- Posted Re: Tenable.sc or nessus scanner? on All Apps and Add-ons. 01-12-2020 04:27 PM
- Posted Re: How to install Eventgen and configure Splunk Buttercup Games online data on All Apps and Add-ons. 01-12-2020 02:43 PM
- Posted Re: How to replicate data to the indexer *and* a syslog server on Deployment Architecture. 01-10-2020 02:39 PM
- Posted Re: How to replicate data to the indexer *and* a syslog server on Deployment Architecture. 01-10-2020 02:26 PM
- Posted Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps? on Splunk Search. 01-10-2020 06:59 AM
- Posted Re: How to replicate data to the indexer *and* a syslog server on Deployment Architecture. 01-10-2020 06:54 AM
- Posted Re: Custom timestamp detection for a sourcetype with some event w/o timestamp on Getting Data In. 01-10-2020 06:26 AM
- Posted Re: eventid.net on All Apps and Add-ons. 01-10-2020 06:04 AM
Topics I've Started
No posts to display.
01-16-2020
06:15 PM
Try
# props.conf
[bash_history]
# define event breaking behavior
LINE_BREAKER = ([\r\n]+)\#\d+
SHOULD_LINEMERGE = false
# define time parsing behavior
TIME_PREFIX = #
TIME_FORMAT = %s
MAX_TIMESTAMP_LOOKAHEAD = 12
... View more
01-16-2020
03:49 PM
Where did you place your props.conf ?
... View more
01-14-2020
08:57 PM
can you run a btool on the uf , just to check what inputs.conf it is getting ?
... View more
01-14-2020
08:26 PM
Do you have a monitoring console?
Do you have gui access to the license master?
Is your searchhead and license master are search peers?
You can try to use rest commands for example:
| rest /services/licenser/pools
Or you can check this reference
https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTlicense
... View more
01-14-2020
08:01 PM
You can give them the HEC token you will generate from the HF and make sure HEC/HEC Token is enabled, it is also good if you can provide them the index name and sourcetype they will use. You need to make sure they can talk to your HF and allow port 8088 (default port).You dont need to enable port 8088 on indexers since your HEC receiver is the HF and it will forward the data to the indexers with listening port 9997(default port).
... View more
01-14-2020
04:04 PM
Have you check the connection between the forwarder and indexer?
you can run openssl command in splunk/bin to test the certificates if it can get through to the indexer.
Check the metrics.log too.
... View more
01-14-2020
12:25 PM
it is just a sample , you can run it in any of the shc member or to the MC. you should be an admin or have the right privilege to get the result.
| rest "/servicesNS/-/-/admin/savedsearch/" splunk_server="*"
... View more
01-12-2020
04:27 PM
Based from the app description the prerequisites is Tenable Nessus scanner 6.x , so from my understanding it is the nessus scanner API. For tenable.sc there's a different add-on for it.
... View more
01-12-2020
02:43 PM
You just need to configure the eventgen.conf and add sample logs to the sample directory of the app.
Check the links below for more info about the eventgen.
http://splunk.github.io/eventgen/
simulating-data-with-the-splunk-event-generator
... View more
01-10-2020
02:39 PM
2 Karma
Your configuration for the syslog routing looks correct. However, you can try to remove the _tcp_routing for the indexer , its already in [tcpout] defaultGroup of outputs.conf. By default, the forwarder will automatically sends all events to all specified target groups.
... View more
01-10-2020
02:26 PM
hello , can you mark it as an answer if it does help you ? .
Do you mean defaultGroup for the tcpout of indexers ?
I only use defaultGroup for the tcpout . For the syslog routing only transforms and syslog stanza in outputs.conf because its sends the data through a separate output processor.
You may want to check this reference
https://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Forwarddatatothird-partysystemsd#Syslog_dat
... View more
01-10-2020
06:59 AM
When you run those rest command in splunk search it will give you the information you needed for the knowledge objects for example (you can run in MC):
| rest "/servicesNS/-/-/admin/savedsearch/" search="is_scheduled=1" search="disabled=0" splunk_server=sh*
[| makeresults
| eval earliest_time=relative_time(now(), "-0s@s"), latest_time=relative_time(now(), "+15m@s")
| return earliest_time, latest_time ]
| table splunk_server eai:acl.app eai:acl.owner cron_schedule title scheduled_times
... View more
01-10-2020
06:54 AM
1 Karma
Your configuration for the syslog routing looks correct. However, you can try to remove the _tcp_routing for the indexer , its already in [tcpout] defaultGroup of outputs.conf. By default, the forwarder will automatically sends all events to all specified target groups.
... View more
01-10-2020
06:26 AM
Depends on his requirements , either at the index or search time. whatever that helps him. 🙂
... View more
01-10-2020
06:04 AM
Is the configuration in the inputs.conf sending to the right index?
Is the data is stored in a different index? you can update the macros.conf [event_sources] section.
... View more
01-10-2020
05:53 AM
yes , just add it as a search head to the cluster master
but check the splunk version compatibility
https://docs.splunk.com/Documentation/Splunk/8.0.1/DistSearch/Distsearchsystemrequirements
... View more
01-10-2020
05:48 AM
@nathanluke86
Have your try this ?
<row depends="$hidden$">
<panel>
<html>
<style>
.dashboard-row .dashboard-panel .error-details .error-indicator {
display: none; !important;
}
</style>
</html>
</panel>
</row>
... View more
01-10-2020
05:35 AM
Im not sure if I parsed your question correctly but based from what I understand you want to get the 2 latest events and concat it with a string. Based from your given example your log is in key/field=value form so that is automatically extracted . If you want to get the latest values it is better to use stats, its a lot faster and efficient instead of using sort which is too intensive , sorting should always be in the last.
index=MY_INDEX sourcetype=my:source stats latest
| stats latest(foo1) as foo1 latest(foo2) as foo2
| eval NEED1="new_".foo1
| eval NEED2="new_".foo2
| table NEED1 NEED2
Just incase you need a rex |rex field=_raw "fo(\w|\w\d+)\=(?<value>[a-z0-9].*)"
... View more
01-10-2020
04:38 AM
index = blah sourcetype = blah source IN ("*CSV-01","*CSV-02") |stats count by _time City "Traffic(GB)"|rename "Traffic(GB)" as Traffic| fields - count
... View more
01-09-2020
07:03 PM
Another way to solve this is to use INGEST_EVAL in transforms.conf.
I tried this config and works for me.
props.conf
[test]
LINE_BREAKER = ([\r\n]+)(\d+|\w+)
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 30
TRANSFORMS = modtimestamp
transforms.conf
[modtimestamp]
INGEST_EVAL = _time[float]:=if(match(_raw,"^(?!\d+-\d+-\d+).*"),time(),_time)
it filters the events that doesnt start with the year and apply the condition
time() is more expensive and acts on every event separately. now() appears to only be valid in search and is the time of the search itself.
Note: This configuration might be very impactful on the indexer's performance.
... View more
01-09-2020
01:04 PM
1 Karma
It's a cluster so the settings are supposed to be the same across the board, that means you have to be configured according to the smallest indexer.
Increasing the index size will not cause issues with the data. However, It will have an effect on your disk storage consumption, your indexers might get full and it will cause your data to be frozen before the intended retention time to free up space. So it is important to understand the Splunk data lifecycle and set things properly like the data retention policy etc. (volume limits too)
The question is , does your smallest indexer can meet your 1 year retention policy ?
https://wiki.splunk.com/Deploy:BucketRotationAndRetention
https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Configureindexstorage
https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf
... View more
01-09-2020
11:35 AM
You can use conditional functions https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/ConditionalFunctions and create report/alert from it.
... View more
01-09-2020
11:25 AM
You cannot set time retention on hot or warm buckets, it rolls once a certain limit is reached.
This links will help you set that up and understand the Splunk Data life cycle
https://wiki.splunk.com/Deploy:BucketRotationAndRetention
https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Configureindexstorage
https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf
... View more
01-09-2020
10:48 AM
You can use rest commands to know what apps those knowledge objects are associated.
There's alot of rest commands in this link https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTlist ,depends on what you need.
For example:
https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTknowledge
https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTsearch
... View more
01-08-2020
09:40 PM
Missing or Truncated? By default Splunk default maximum line length is 10000, in bytes.
If your event is more than the default value you can increase the TRUNCATE value in props.conf but never ever set it to 0.
Make sure that you set properly the props.conf of the sourcetype of that data.
- DATETIME_CONFIG
- TIME_PREFIX
- TIME_FORMAT
- MAX_TIMESTAMP_LOOKAHEAD
- TZ
- LINE_BREAKER
- SHOULD_LINEMERGE
Check splunkd.log for messages such as "AggregatorMiningProcessor" to know more what's happening
... View more
