About corey_dick

corey_dick · ‎07-22-2020

I'm having the same issue. I double checked and the account that Splunk is running under has Full Control of both the file and the folder.

corey_dick · ‎07-20-2020

Is the link working for you now? Or did you find it somewhere else?

corey_dick · ‎07-16-2020

I've been looking for it recently as well. Seems to have been missing for at least a few weeks at this point.

corey_dick · ‎04-17-2019

There are at least a few things to change but without having your datasets I can't test exactly what you are trying to do. Try this to see if that helps or not: | dbxquery connection=NCreporter query=[| search index=nc_alarms sourcetype=nc_alarms NODE=* NETWORK=233 (ALERTGROUP=DOOR OR ALERTGROUP=DOOR.D OR ALERTKEY=Mobility OR LOCATION=CELL) NOT (ALERTGROUP=*A) | table SERVERSERIAL,SERVERNAME | format | eval search=replace(search,"\"","'") | eval dbquery=("\"SELECT NODE,LOCATION,FIRSTOCCURRENCE,LASTOCCURRENCE,SUMMARY,CLEARTIME,TALLY,ALERTGROUP,ALERTKEY from REPORTER_STATUS where ".search."\"") | return $dbquery]

corey_dick · ‎08-01-2018

I believe that you are looking for the following: | rest splunk_server=local /servicesNS/-/-/configs/conf-db_inputs/ I had been searching for this as well and found a post about DB Connect connections that got me thinking in the right direction to figure this out.

corey_dick · ‎07-12-2018

You're seeing the same issue as this other user (https://answers.splunk.com/answers/2230/ldap-authentication-users-from-another-trusted-domain.html). It seems that the issue has to do with the way that AD responds back to the query. I'm having a similar issue as the linked problem.

corey_dick · ‎05-02-2017

We're currently running DB Connect 1 on Enterprise 6.5.3. Just so you know we are seeing incredibly very different query times between DB Connect 1 and 3. For example, a SQL query ran through dbquery from DB Connect 1 will return in 9 to 12 seconds; however, when the same SQL query is ran through dbxquery from DB Connect 3 it takes 300 to 700 seconds to complete. I'm not sure why exactly but on some comments in this (https://answers.splunk.com/answers/243910/splunk-db-connect-2-is-there-a-known-search-perfor.html) I'm guessing that the health logging built into DB Connect 2 and 3 is the culprit. Hope that helps.

corey_dick · ‎05-01-2017

If you insist on downvoting could you then provide an actual solution to the problem than telling everyone that it must be their environment that is causing the issue. That is a very anti-customer response to a very serious issue. I can tell you that I'm seeing similar issues as these other users and that all I have to do is use DB Connect v1 to get a significantly better response time. In DB Connect v2/3 (dbxquery command) the report takes 600+ seconds but if I run the same exact SQL in DB Connect v1 (dbquery command) it takes 10 to 30 seconds. These are running on the same 6.5.3 instance of Splunk Enterprise.

corey_dick · ‎01-12-2017

The problem with the assertion that "We automatically collect all fields" is that the original Splunk for Service Now app communicated to ServiceNow in such a way that all the lookups that bwindham is mentioning were returned without any special work after implementing the app. This is actually my biggest reason for still using the old app since it returns the data in a useful way.

corey_dick · ‎06-29-2016

Using admon which indexes the AD object data into several indices as we have several domains within our environment.

corey_dick · ‎06-27-2016

How can you set up the MS Windows AD Objects app to use indexes with names other than msad? I can't find any documentation for that, even though the setup acts like it should work. Trying to use it with admon and some indexes that we have already created.

corey_dick · ‎01-22-2016

The solution is to remove the following line from the admon stanza in inputs.conf file in the system\default folder: baseline=0 Adding baseline=1 to the inputs.conf in the system\local folder has no effect from what I could see. This issue effects all versions of 6.2 and 6.3.

Posts	12
Solutions	2
Karma Given	6
Karma Received	1
Member Since	‎04-06-2015

Online Status	Offline
Date Last Visited	‎01-29-2021 02:29 PM

How to use indexes with names other than msad for ...

Re: WARN FileClassifierManager: The file is invali...

Re: Deploying Splunk Inside Virtual Environments

Re: Deploying Splunk Inside Virtual Environments

Re: dbxquery with subsearch creating an extra spac...

Re: How to get state of Splunk DB Connect App inpu...

Re: LDAP Authentication, single group with multipl...

Re: DBConnect 1 on Splunk 6.5.3

Re: Splunk DB Connect 2: Is there a known search p...

Re: Splunk App & Add-on for ServiceNow: What confi...

Re: How to use indexes with names other than msad ...

How to use indexes with names other than msad for ...

Re: Active Directory inputs missing SYNC event typ...