About luke_monahan

luke_monahan · ‎07-25-2022

WSL2 will create a Linux environment running as an application under Windows. You will need to install Splunk in this environment (the same as a normal Linux installation) then install the modular input on that Splunk instance.

luke_monahan · ‎07-14-2022

The modular input for Splunk is a binary which is only currently compiled for Linux x86_64. You'll find that in the splunk_modinput_prometheus/bin/ directory. I have not attempted to compile on Windows to produce a native version here, but it should be possible as Golang is fairly portable. If you would like to have an attempt at compiling a Windows version it may work, otherwise please raise an issue on the Github for native Windows support. FYI: It definitely works in WSL2 which may solve your problem in the short term.

luke_monahan · ‎07-28-2021

Your Prometheus config is sending the data to port 8089 -- the main Splunkd port, rather than the prometheusrw port. The prometheusrw input opens up a new port (8098) that can handle the content-type that Prometheus will send. You need to update your Prometheus configuration to use port 8098 and (in this case) use http and not https.

luke_monahan · ‎03-23-2020

I think that this is due to the way that Leaflet.js (an underlying library for this viz) handles lines that cross the date line. It will generally go the long way around rather than cross the date line. There's a workaround presented here: https://github.com/Leaflet/Leaflet/issues/82 I'll have to spend some time trying to figure out how that workaround could be applied in the context of this Splunk viz. I'll try have a go at this on the weekend and report back.

luke_monahan · ‎02-04-2020

This app does not get "launched" in any conventional way. It instead adds a new visualisation style that you can choose on dashboards you create in other apps. So you are probably just being directed back to the last app you were in when you try to click on it. When you are choosing a visualisation (e.g. bar chart, pie chart etc.) on any report or dashboard, you should also have the Missile Map as an option once this app is installed. But you will not have an extra app with it's own dashboards etc.

luke_monahan · ‎01-06-2020

You are likely using an old version of Missile Map: please update from apps.splunk.com.

luke_monahan · ‎01-05-2020

It doesn't appear as if anything should have changed for Splunk 8+: If you select "Splunk (offline)" as the tile set option, it should populate just using the internal maps that Splunk provides. I've just tested this on Splunk 8.0.1 without issue.

luke_monahan · ‎09-10-2019

The visualisation uses leaflet.js as the underlying map rendering library. For leaflet to render mapbox vector tiles, it needs an experimental plugin to be added -- https://github.com/mapbox/mapbox-gl-leaflet. I have no plans to try and integrate this plugin myself, but if you wished to try this you can give it a go using the Missile Map code on github: https://github.com/lukemonahan/missile_map

luke_monahan · ‎05-09-2019

A search similar to this should give you log output from the input. The modular input will dump an error to splunkd.log if there is a problem with communicating with a Prometheus HTTP endpoint: index=_internal host=<polling host> sourcetype=splunkd ExecProcessor prometheus

luke_monahan · ‎02-09-2019

I think the easiest way to get some debugging output will be to relax the time-window restriction for the sourcetype and restart the OTX ingest so we can see what's coming back from the API. Add "max_days_hence=10950" in props.conf for the [otx:pulse] and [otx:indicator] sourcetypes Remove the checkpoint file for OTX input ($SPLUNK_HOME/var/lib/modinputs/otx/*.json by default) The next run of the input should attempt the backlog again, and index it in the future rather than dumping it. Once that's done we should have the raw data, which will show us what the timestamp format is coming back as. If this fails, I'll send you a version of the input which will log the timestamps in splunkd.log so we can see them. The input expects %Y-%m-%dT%H:%M:%S.xxxxxx (without milliseconds for indicators) for what it's worth. This is fairly ISO standard, so I'm not sure why it would ever change. I just quickly tested and got this format.

luke_monahan · ‎02-07-2019

That certainly seems like a mis-parsed timestamp. Can you do a search into the future so I can see the raw format the timestamps are being returned from OTX for you? e.g. index=otx earliest=now latest=+5y

luke_monahan · ‎01-16-2019

We haven't yet written any functionality for properly doing HTTP basic auth. If you can please raise a feature request on Github (https://github.com/lukemonahan/splunk_modinput_prometheus). You could try specifying it in your url, e.g.: https://user:password@host/metrics Or similar to this.I haven't tested this use case, however, so it may not work. I will typically make the "host" the polled server in this case, however it really depends on what suits you best. insecureSkipVerify setting should be correct in this case, if the SSL certificate is not properly signed and trusted.

luke_monahan · ‎10-18-2018

The Prometheus server will always append the timestamp. If you are getting your metrics from the Prometheus server, whether you are using federation or remote write, the input will use the Prometheus provided timestamp. If you are polling a simple exporter instead, the timestamp may or may not be present as it's optional. If it's present it will be used, but if it's not present the time the poll occurred will be used. This may be slightly different to the _indextime as it will be the time on the forwarder that is doing the polling.

luke_monahan · ‎10-15-2018

Hi. The visualisation is written using leaflet.js, so anything possible in this library is theoretically possible within Missile Map -- but it does need to be coded. If you want to have a look at this, you can find the code on Github: https://github.com/lukemonahan/missile_map/blob/master/appserver/static/visualizations/missile_map/src/missile_map.js If you don't have the ability to do this yourself, then can you raise an issue on Github with a bit of a description of exactly what enhancement would work best, and I'll see if I can fit doing that change in sometime in the near future.

luke_monahan · ‎09-11-2018

I have just uploaded version 1.2.2 which gives you this option in the XML (although not in the user interface). <option name="missile_map.missile_map.scrollWheelZoom">0</option> This will control the scrollWheelZoom option in the Leaflet map initialisation.

luke_monahan · ‎08-28-2018

You are best to choose a set of map tiles which suit you from the included list. You might possibly find a way to change the colour of an SVG tileset with custom CSS injected into your dashboard, but I'm not entirely sure how to do that and I don't think it would be a great idea anyway. If none of the included maps suit you, you may find one you like here: http://alexurquhart.github.io/free-tiles/ Clicking on the "Info" button on that site will give you the URL to use for the selected map style, which will work in Missile Map as a custom map URL.

luke_monahan · ‎07-02-2018

The geographical point is from the Maxmind database, which is updated relatively frequently with the geographical locations of all known IP ranges. The free version is bundled with Splunk, but you may need to update it yourself if you are not updating Splunk regularly. There's a fairly good description in the iplocation command reference: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Iplocation To completely exclude a non-mappable IP I typically just exclude anything that did not get a "Country" field. e.g.: <search> | iplocation src_ip | search NOT Country=* | ... Or something similar.

luke_monahan · ‎07-02-2018

The geographical point in your screenshot is 0,0. My guess is that some IP addresses with undetermined locations are being put there. You may have to take some steps in your query to exclude or otherwise deal with such addresses. If your Splunk is not up-to-date then also consider updating the iplocation database separately to get better geo resolution of addresses. You can download the latest db from https://dev.maxmind.com/geoip/geoip2/geolite2/ and point to it in your limits.conf.

luke_monahan · ‎06-14-2018

Since upgrade to 7.x multiple installations I have access to have had very heavy indexer CPU usage. I have upgraded to 7.1.1 to ensure I have all bug fixes. This has been chased down to datamodels that appear to continually accelerate the full time period over and over, rather than just checking the last 5 minutes of new data each time. The datamodels are all showing 100% complete, but searches running to the full 3600 seconds all the time also. Skip ratio for these searches is through the roof. To reproduce, I have installed uberAgent and it's event generator in a test instance of Splunk 7.1.1. I can see the base LISPY of the acceleration jobs appear to be looking at (pretty much) "All time" on every invocation, e.g.: 06-15-2018 11:58:09.119 INFO BatchSearch - Searching index:uberagent with LISPY:'[ AND sourcetype::uberagent:application:outlookpluginload [ OR _indextime::12* _indextime::13* _indextime::14* _indextime::150* _indextime::151* _indextime::1520* _indextime::1521* _indextime::1522* _indextime::1523* _indextime::1524* _indextime::1525* _indextime::1526* _indextime::1527* _indextime::1528* _indextime::152900* _indextime::152901* _indextime::1529020* _indextime::1529021* _indextime::1529022* _indextime::1529023* _indextime::1529024* _indextime::1529025* _indextime::1529026* _indextime::15290270* _indextime::15290271* _indextime::15290272* _indextime::15290273* _indextime::15290274* _indextime::15290275* _indextime::15290276* _indextime::152902770* _indextime::152902771* _indextime::152902772* _indextime::152902773* _indextime::152902774* _indextime::152902775* _indextime::152902776* _indextime::152902777* _indextime::152902778* _indextime::1529027790 _indextime::1529027791 _indextime::1529027792 _indextime::1529027793 _indextime::1529027794 _indextime::1529027795 _indextime::1529027796 _indextime::1529027797 _indextime::1529027798 ] ]' To me it appears that this LISPY is looking at events with an _indextime beginning with "12*" and later, or pretty much a"All time" for any practical purpose. This LISPY is the same pattern on every acceleration search for every datamodel. I've managed to calm down the problem by setting acceleration.backfill_time to -1d by default. This seems to make each acceleration search invocation scan only 1 day of data every time, not the entire acceleration duration. Far from ideal, but it has stopped this being a complete Splunk breaking issue, and the accelerations continue to be built and stored. Is there anything else I should be looking at to figure this one out, or ideas on how to fix it? What might be the change in 7.x that has caused this?

luke_monahan · ‎04-08-2018

It should be, but I haven't got around to updating the Splunkbase listing. I will re-run tests and update the listing accordingly.

luke_monahan · ‎02-26-2018

Hi: Please post an example line of your results. It will typically fail to render if one of the fields is incorrect or improperly formatted.

luke_monahan · ‎02-26-2018

The viz just needs a valid lat/lon, and does not care whether these are retrieved from the geolocate DB or via any other method. The currently published version contains an option to use Splunk internal maps for the map tiles. This option uses the map tiles published by Splunkweb and do not require an internet connection.

luke_monahan · ‎12-13-2017

The README will be in the application directory once you've installed the SPL file (e.g. in $SPLUNK_HOME/etc/apps/missile_map). This file is essentially the same as the detailed notes on the Splunkbase page, but you can also see it here: https://github.com/lukemonahan/missile_map

luke_monahan · ‎07-30-2017

Splunk should publish it's own internal map tiles at: https:///en-GB/splunkd/__raw/services/mbtiles/splunk-tiles/{z}/{x}/{y} Or something very similar. You could try this as the "Custom tile set" within Missile Map?

luke_monahan · ‎07-13-2017

What version of Splunk? I think it may look like this if you are on an older Splunk that does not support the latest custom visualisation framework.

Posts	26
Solutions	6
Karma Given	0
Karma Received	12
Member Since	‎07-05-2017

Online Status	Offline
Date Last Visited	‎08-09-2022 02:26 AM

Why is the datamodel acceleration constantly doing...

Re: Why am I Unable to fetch Prometheus metrics in...

Re: Why am I Unable to fetch Prometheus metrics in...

Re: Prometheus 415 Unsupported Media Type

Re: Missile map Change of starting point

Re: ,Missile Map Installation

Re: Use Missile Map in Offline Mode ?

Re: Use Missile Map in Offline Mode ?

Re: Custom style with MapBox map

Re: Prometheus static exporter status

Re: OTX data not importing

Re: OTX data not importing

Re: Question on credentials on the static promethe...

Re: Time stamp handling

Re: Is it possible to add a Tooltip or Drilldown t...

Re: Is it possible to disable "scrollWheelZoom set...

Re: How do I change the color of the missile map?

Re: Missile map show strange location

Re: Missile map show strange location

Why is the datamodel acceleration constantly doing...

Re: Is the mIssile map app compatible with Splunk ...

Re: Lat/Lon are flipped.

Re: Use Missile Map in Offline Mode ?

Re: download File not complete for Missile Map

Re: Use Missile Map in Offline Mode ?

Re: Lat/Lon are flipped.