Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About snowmizer
snowmizer
Communicator
Member since:
05-07-2010
01-24-2025
Community Statistics
| Posts | 68 |
| Solutions | 7 |
| Karma Given | 136 |
| Karma Received | 75 |
| Member Since | 05-07-2010 |
Activity Feed
- Posted Using OAUTH v2 to access ServiceNow security incident table on All Apps and Add-ons. 01-23-2025 02:06 PM
- Got Karma for Re: How to monitor all windows event logs?. 06-18-2020 05:58 PM
- Got Karma for Re: CSV File Issues. 06-18-2020 05:58 PM
- Got Karma for Re: Is there a comprehensive list of configuration options for the Donut - Custom Visualization app?. 06-18-2020 05:58 PM
- Got Karma for Re: Splunk Forwarder 7.0.0 -- Can I set the index that is selected before the Splunk forwarder is installed?. 06-18-2020 05:57 PM
- Got Karma for Re: How do I return values that match column in Lookup table?. 06-18-2020 05:57 PM
- Got Karma for Re: How to replace a field value with a value from another field?. 06-18-2020 05:57 PM
- Got Karma for Re: Need to present a use case for applications. 06-18-2020 05:57 PM
- Got Karma for Re: Splunk Python Script error - ImportError: No module named azure.keyvault. 06-18-2020 05:57 PM
- Got Karma for Re: How do I configure and enforce a 6 month data retention policy?. 06-18-2020 05:57 PM
- Got Karma for Re: Splunk Alerting. 06-18-2020 05:56 PM
- Posted Re: Splunk Alerting on Alerting. 06-10-2020 12:27 PM
- Posted Re: Splunk Alerting on Alerting. 06-10-2020 11:54 AM
- Karma Re: Indexer hosts with shared storage for Richfez. 06-05-2020 12:49 AM
- Karma Re: Indexer hosts with shared storage for dwaddle. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk Forwarder 7.0.0 -- Can I set the index that is selected before the Splunk forwarder is installed?. 06-05-2020 12:49 AM
- Got Karma for Re: How do I return values that match column in Lookup table?. 06-05-2020 12:49 AM
- Karma Re: How can i split a json array in mutiple events? for alacercogitatus. 06-05-2020 12:48 AM
- Karma Re: Get top pages per time period for alacercogitatus. 06-05-2020 12:48 AM
- Karma Re: datamodel_summary directory in _internaldb - can we delete? for dshpritz. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 4 | |||
| 3 | |||
| 1 | |||
| 4 | |||
| 5 | |||
| 0 | |||
| 4 | |||
| 10 | |||
| 3 |
01-23-2025
02:06 PM
I have configured a OAUTH client ID and secret on my client's ServiceNow instance. I configured the account in the Splunk Add-on for ServiceNow application. The configuration completed without issue. I was then able to configure an input to pull from the CMDB database using the OAUTH credentials. However when I try to pull the "sn_si_incident" table from the SIR database I'm getting the message "Insufficient rights to query records: Fields present in the query do not have permission to be read". When I configured the OAUTH credentials in the add-on I used an account (e.g. svc_account1) that I know has permissions to read from this table. We have also tested with Postman and can pull from the security incident table. In Postman we configured the client ID/secret as well as the username and password (using svc_account1). We noticed that when we try using the OAUTH using Postman the user is the correct user (svc_account1). However when we use the Splunk add-on the user is my user account. Has anyone every tried to use OAUTH to access the security database tables? Is the add-on built to handle the security database tables? I wonder about this because when I try to select a table from the dropdown I don't see "sn_si_incident" (probably because the only tables available are from the CMDB database). Thanks.
... View more
Labels
- Labels:
-
troubleshooting
06-10-2020
12:27 PM
Maybe create a lookup of user ids that have been found as locked (with the date time found) and then when you find a user do a lookup match and only return events where the user isn't in the lookup and as a final step update the lookup with new users.
... View more
06-10-2020
11:54 AM
1 Karma
Throttling will control how often the email is sent. You will need to craft your search so that it detects new lockout events during the time range. Then you can set the alert criteria to alert if the returned event count > 0.
... View more
06-26-2019
05:38 AM
1 Karma
frozenTimePeriodInSecs will force your retention settings on your index. In this case you are correct that your settings will force the data to roll off after 6 months.
... View more
06-26-2019
05:32 AM
1 Karma
It is possible that when you ran the pip install command the azure-keyvault module got installed in the directories pertaining to the Linux system version of Python and not the Splunk version of Python. When I have needed modules that aren't in the Splunk Python I add the module to the bin folder of my app so that it's part of the app. Installing/placing the module in Splunk's Python means that when you upgrade Splunk the module could get removed.
... View more
06-19-2019
06:20 AM
1 Karma
Splunk by itself is great for getting data into one place for viewing. Splunk will try its best to extract fields it sees but doesn't always get everything. Also, dashboards that provide value related to a particular data source (e.g. web proxy logs) don't exist by default in Splunk. Applications provide the following functionality:
Knowledge objects to parse the data (field extractions, eventtypes that classify data into types (e.g. authentication events))
Dashboards to view the data in a meaningful way
Some applications provide modular inputs to pull data from a particular source into Splunk
To do this yourself you will find the task to be daunting. Applications make that easier. If you download and install an app in your Splunk environment you may find that there is some tweaking that will need to be done (e.g. specifying what index your data resides). Splunk applications allow the end user to customize an app to fit in their environment. Apps aren't compiled. You have access to all of the Python scripts (if there are any) and configuration files.
Bottom line applications (if written correctly) can make your life simpler.
... View more
06-19-2019
06:10 AM
1 Karma
Does every event have tcp,alert? If not (or there's some other distinguishing factor between events) then you could extract the two fields into separate fields and then use eval coalesce command to combine them into one field.
Example:
eval url=coalesce(fielda,fieldb)
Info on the coalesce command: https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/ConditionalFunctions#coalesce.28X.2C....29
... View more
12-13-2017
08:40 AM
2 Karma
At first glance it seems like you're wanting to filter your results using lookupfile. By default the lookup command adds additional fields to your results. In order to filter you're probably going to want to use inputlookup in a subsearch.
Basic example:
index=abc sourcetype=abcdef [search | inputlookup lookupfile | fields user]...
... View more
10-16-2017
07:56 AM
I would set up an app on your deployment server that pushes the inputs.conf out for each server. You can change the index in that file. Then when you configure the UF you can set the deployment server to access and it will pull the new configuration down. This method ensures that all forwarders (that match the criteria for the serverclass) get the same configuration.
... View more
10-11-2017
08:35 AM
2 Karma
When possible it's also a good idea to test upgrades in a test environment to make sure things like this don't happen.
... View more
08-22-2016
11:11 AM
1 Karma
Hi Romantic_warrior1,
It looks like you're working with this donut https://splunkbase.splunk.com/app/3238 instead of our app https://splunkbase.splunk.com/app/3150 . To verify this run this search "index=_internal | stats count by sourcetype", in the results click on the visualization tab and select the donut chart. If you're using our version you will see a "Format" menu. Under the format menu there should be an option to select a "3D" donut as well as a "2D" donut. If this is missing you are not using our app.
I did verify that the drilldown functionality works in our version (https://splunkbase.splunk.com/app/3150 ).
Thanks.
... View more
10-02-2015
05:05 AM
If you're using deployment server you can set up an app that contains the inputs.conf that you want on your Windows servers and then just push it to all of the servers. That will keep you from needing to touch every server.
... View more
10-01-2015
02:49 PM
Testing the config above does not work. I also looked at this doc and didn't see anything that said you could use a wildcard. It looks like you have to specify each log individually.
http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/Inputsconf
... View more
10-01-2015
02:32 PM
I'm in the process of testing this myself. I'll let you know what I find out.
... View more
10-01-2015
12:57 PM
1 Karma
You can modify the inputs.conf stanza on the Windows server you're monitoring. This link shows some good examples:
http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdata#Use_inputs.conf_to_configure_event_log_monitoring
... View more
10-01-2015
07:57 AM
This command came from a presentation that was given at .Conf last week. It may help you testing....modify to fit your module names.
splunk cmd splunkd print-‐modinput-‐config
| $SPLUNK_HOME/bin/splunk cmd python
... View more
04-02-2015
11:05 AM
After further testing putting the apps in $SPLUNK_HOME/etc/apps allowed me to also put them in $SPLUNK_HOME/etc/master-apps and deploy to my indexers from my cluster master. So it appears that validation is happening when the apps reside in $SPLUNK_HOME/etc/apps but Splunk doesn't look for spec files in $SPLUNK_HOME/etc/master-apps when the app has been place here.
Thanks dwaddle!!!
... View more
04-02-2015
06:48 AM
Thanks dwaddle. I did have the spec file in the $SPLUNK_HOME/etc/master-apps/Splunk_TA_vmware/README and the references were in the inputs.conf.spec file. It appears that there is an issue when the app doesn't reside in the $SPLUNK_HOME/etc/apps folder. I installed the app on the indexers manually instead of via the cluster master and everything works fine.
... View more
04-01-2015
09:09 AM
1 Karma
Alteek did you get this resolved? I'm running into the same issue.
... View more
03-16-2015
08:41 AM
1 Karma
I ran this on our problem servers and was able to install the forwarders as well.
Thanks.
... View more
12-19-2014
07:21 AM
We did a little more testing and figured out that the forwarder thinks the release is incompatible because the server is an Intel server and the install thinks it's an AMD64.
... View more
12-18-2014
01:28 PM
4 Karma
I'm trying to install the v6.2.1 Windows 2008 64-bit version of the universal forwarder. It is failing during the installation. When I look at the log file I see the following:
InstallRegmonDrvCA
InstallRegmonDrv: Warning: Invalid property ignored: FailCA=.
InstallRegmonDrv: Info: Driver inf file: C:\Program Files\SplunkUniversalForwarder\bin\splunkdrv-win6.inf.
InstallRegmonDrv: Error: DriverPackageInstall failed with: 0xa.
InstallRegmonDrv: Warning: Failed to install regmon driver.
InstallRegmonDrv: Error 0x80004005: Cannot install regmon driver.
CustomAction InstallRegmonDrv returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 15:13:28: InstallFinalize. Return value 3.
Looking up the 0x80004005 error this points to permissions problem.
Anyone else seen this and have any solutions on how to fix?
Thanks.
... View more
08-05-2014
10:26 AM
2 Karma
Actually we figured out that the problem was the "Invalid key..." message from the inputs.conf file. Once I commented out these lines in the default inputs.conf file all messages disappeared.
... View more
08-04-2014
05:57 PM
3 Karma
I am trying to deploy the latest version of the Splunk_TA_Windows Add-on (from July 30, 2014) to my cluster. When I deploy the bundle I get the messages:
TSTSplunkCM01.int.hlc.com:No spec file for: /opt/splunk/etc/master-apps/Splunk_TA_windows/default/admon.conf
TSTSplunkCM01.int.hlc.com:No spec file for: /opt/splunk/etc/master-apps/Splunk_TA_windows/default/eventgen.conf
...
This same error shows up for the perfmon.conf, regmon-filters.conf, paletteinputs.conf, palettepallettes.conf, palettepanels.conf, palettesearches.conf and splunk_msftapp.conf. These errors prevent the configuration bundle from being distributed.
Has anyone else seen this message and how did you fix it?
Thanks.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-24-2025
10:36 AM
|
Karma from
