Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mbrenton
mbrenton
Explorer
Member since:
08-05-2014
10-09-2020
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 3 |
| Member Since | 08-05-2014 |
Activity Feed
- Karma How to get a daily report of license usage by index across all indexers? for lesterw. 06-05-2020 12:46 AM
- Karma Re: Daily License Usage by Index across all Indexers? for crash1011. 06-05-2020 12:46 AM
- Karma Re: Filtering windows security event logs with Regex for lukejadamec. 06-05-2020 12:46 AM
- Got Karma for Re: Daily License Usage by Index across all Indexers?. 06-05-2020 12:46 AM
- Got Karma for Re: Daily License Usage by Index across all Indexers?. 06-05-2020 12:46 AM
- Got Karma for Re: Daily License Usage by Index across all Indexers?. 06-05-2020 12:46 AM
- Posted Re: Splunk Add-on for Microsoft Cloud Services - "Certificate Status: Auto-generated but not yet verified" - Does anyone have details on the verification process? on All Apps and Add-ons. 07-15-2016 09:48 AM
- Posted Re: Splunk Add-on for Microsoft Cloud Services - "Certificate Status: Auto-generated but not yet verified" - Does anyone have details on the verification process? on All Apps and Add-ons. 07-13-2016 01:57 PM
- Posted Splunk Add-on for Microsoft Cloud Services - "Certificate Status: Auto-generated but not yet verified" - Does anyone have details on the verification process? on All Apps and Add-ons. 07-13-2016 01:28 PM
- Tagged Splunk Add-on for Microsoft Cloud Services - "Certificate Status: Auto-generated but not yet verified" - Does anyone have details on the verification process? on All Apps and Add-ons. 07-13-2016 01:28 PM
- Tagged Splunk Add-on for Microsoft Cloud Services - "Certificate Status: Auto-generated but not yet verified" - Does anyone have details on the verification process? on All Apps and Add-ons. 07-13-2016 01:28 PM
- Posted Re: Filtering windows security event logs with Regex on Splunk Search. 06-23-2016 11:42 AM
- Posted Re: Daily License Usage by Index across all Indexers? on Installation. 12-18-2015 01:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
07-15-2016
09:48 AM
We're running version 6.4.1. It has been 3 days now since we set this up and we are still seeing "Auto-generated but not verified yet".
I restarted Splunk on the server just now, still not verified but I'll keep checking it and report if it does successfully verify.
This may be related or not, we haven't had any new events come in since we set this up on Tuesday. The troubleshooting page states that we have 1 account and 1 input, neither of which are invalid.
... View more
07-13-2016
01:57 PM
Yep. We tried twice with auto-generated certificates, once with our own certificate, and then a third time with the auto-generated certificate. The certificate was not verified any of the times.
... View more
07-13-2016
01:28 PM
We installed the Splunk Add-on for Microsoft Cloud Services and connected it with our Office 365 instance. We are successfully getting logs but our certificate status is is still "Auto-generated but not yet verified".
Per the instructions in the documentation troubleshooting section we have rinsed and repeated 3 times, and finally just decided we would wait to see if the process took some time. It has now been 24 hours and our certificate is not verified.
Does anyone know exactly how the certificate process works, including but not necessarily limited to protocol and direction? The documentation leaves something to be desired with regards to firewall exceptions.
... View more
06-23-2016
11:42 AM
Thank you so much for this! I expanded on this idea and came up with the following two regex lines for transforms.conf (events 4624 and 4625 have two account name fields, 4634 and 4768-4771 only have one):
REGEX = (?msi)^EventCode=(4624|4625)\D.*Account\s+Name:\s+-.*Account\s+Name:\s+[a-z0-9-]+[\$]
REGEX = (?msi)^EventCode=(4634|4768|4769|4770|4771)\D.*Account\s+Name:\s+[a-z0-9-]+[\$]
... View more
12-18-2015
01:03 PM
3 Karma
This is what I use now. I took crash1011's work and ran with it (thank you!)
Create a new dashboard and edit source, paste this into the XML field.
<form>
<label>License Usage</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" searchWhenChanged="true" token="field1">
<label></label>
<default>
<earliest>-7d@d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<title>Daily License Usage by Index</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | rename idx AS index | timechart span=1d eval(round(sum(b)/1024/1024/1024,2)) AS "Total GB Used" by index</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">License Usage</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.placement">right</option>
<option name="charting.axisLabelsY.majorUnit">10</option>
<option name="charting.axisY.maximumNumber">60</option>
<option name="charting.axisY.minimumNumber">0</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>Total Daily License Usage</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | timechart span=1d eval(round(sum(b)/1024/1024/1024,2)) AS "Total GB Used"</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">GB</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.placement">right</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="charting.axisLabelsY.majorUnit">25</option>
</chart>
</panel>
<panel>
<table>
<title>Daily License Usage by Index Stats</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage earliest=-7d@d | rename idx AS index | timechart span=1d eval(round(sum(b)/1024/1024/1024,2)) AS "Total GB Used" by index</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
<row>
<panel>
<chart>
<title>License Usage by Host</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by h | eval GB= round(bytes/1024/1024/1024,2) | fields h GB | rename h as host | sort -GB</query></query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
<panel>
<chart>
<title>License Usage by Sourcetype</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by st | eval GB= round(bytes/1024/1024/1024,2) | fields st GB | rename st as Sourcetype | sort -GB</query></query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
<panel>
<chart>
<title>License Usage by Source</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by s | eval GB= round(bytes/1024/1024/1024,2) | fields s GB | rename s as Source | sort -GB</query></query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.axisY2.enabled">undefined</option>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<title>License Usage by Host Stats</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by h | eval GB= round(bytes/1024/1024/1024,2) | fields h GB | rename h as host | sort -GB</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
<panel>
<table>
<title>License Usage by Sourcetype Stats</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by st | eval GB= round(bytes/1024/1024/1024,2) | fields st GB | rename st as Sourcetype | sort -GB</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
<panel>
<table>
<title>License Usage by Source Stats</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by s | eval GB= round(bytes/1024/1024/1024,2) | fields s GB | rename s as Sourcetype | sort -GB</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</form>
... View more
