Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cmeerbeek
cmeerbeek
Path Finder
Member since:
04-12-2013
06-05-2020
Community Statistics
| Posts | 35 |
| Solutions | 4 |
| Karma Given | 2 |
| Karma Received | 13 |
| Member Since | 04-12-2013 |
Activity Feed
- Got Karma for Re: Splunk Add-On Builder: Is there any documentation or information about the helper functions?. 08-29-2022 03:15 PM
- Got Karma for Re: Splunk Add-On Builder: Is there any documentation or information about the helper functions?. 03-12-2022 08:05 AM
- Got Karma for Re: Why is the DispatchCommandProcessor failing to rename?. 04-01-2021 08:52 AM
- Got Karma for Re: Can I safely remove old cluster remote-bundle directories to free up disk space?. 06-25-2020 01:58 PM
- Got Karma for Re: Why is the DispatchCommandProcessor failing to rename?. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk Add-On Builder: Is there any documentation or information about the helper functions?. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-On Builder: Is there any documentation or information about the helper functions?. 06-05-2020 12:48 AM
- Got Karma for Pick colours for certain value. 06-05-2020 12:48 AM
- Got Karma for Re: Pick colours for certain value. 06-05-2020 12:48 AM
- Got Karma for Splunk license for use with other products?. 06-05-2020 12:48 AM
- Got Karma for Re: Verify a list of values. 06-05-2020 12:48 AM
- Got Karma for Re: Why do saved searches take too much time in dashboards?. 06-05-2020 12:48 AM
- Karma Re: How to split a json array into multiple events with separate timestamps? for Gilberto_Castil. 06-05-2020 12:47 AM
- Got Karma for Splunk Add-on for Unix and Linux: Why are we seeing multiple hostnames for /var/log logfiles on Linux?. 06-05-2020 12:47 AM
- Karma Re: Send Drilldown Search to a New Window for Lowell. 06-05-2020 12:46 AM
- Posted Re: ITSI Episode entities from correlation searches on Splunk ITSI. 12-12-2018 05:56 AM
- Posted ITSI Episode entities from correlation searches on Splunk ITSI. 12-10-2018 07:23 AM
- Posted Re: Why is WebLogic server.out parsing not working? on Getting Data In. 06-22-2018 09:13 AM
- Posted Why is WebLogic server.out parsing not working? on Getting Data In. 06-04-2018 05:32 AM
- Tagged Why is WebLogic server.out parsing not working? on Getting Data In. 06-04-2018 05:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
12-12-2018
05:56 AM
Today I've discovered that if I disable Smart Grouping the Impacted Entities do work and are being filled. So it seems like an issue with Smart Grouping? The Smart Grouping docs are a little bit to "simple" to know how this should work.
... View more
12-10-2018
07:23 AM
I have a ITSI 4.0.x question regarding Episodes...
How do you connect an Entity to the results of a Correlation Search?
I have configured the Entity Lookup Field and when I look at the individual events the entity_title field is correctly filled but when I go to Episodes the entity_title column is empty and Impacted Entities in the Episode Details screen is also empty....
When I go to the Entity Screen and select Entity Health the new screen shows me the single events but again not the Episodes.
... View more
06-22-2018
09:13 AM
Parsing is happening on the HF. I know that the UF can't do that. Sorry for not mentioning this.
... View more
06-04-2018
05:32 AM
Hi all,
I have a Splunk installation here with lot's or Oracle WebLogic logging.
Everything except the *server.out files are working great but whatever I do I cannot get it to work properly for those files.
My current props.conf is:
LINE_BREAKER=([\n\r]+)<\w{3}\s\d{1,2},\s\d{4}\s\d{1,2}:\d{1,2}:\d{1,2}\s\w{2}\s\w+>
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
TIME_FORMAT=%b %d, %Y %I:%M:%S %P %Z
TIME_PREFIX=^<
TRUNCATE=999999
This works fine when I manually use the data upload via the webui but it is not working from the UF.
Any advice on this?
How does WebLogic write data to this file?
My next step is looking at time_before_close but that is the last resort.
... View more
02-06-2018
08:09 AM
2 Karma
Fixed it by repairing permissions using icacls.exe /T /Q /P /reset. Thanks!
... View more
02-05-2018
05:31 AM
I am in a an index cluster environment which shows me the following error on all indexers:
ERROR DispatchCommandProcessor - Search results may be incomplete, peer YYYY's search ended prematurely. Error = failed to rename src=D:\Splunk\var\run\splunk\cluster\search-buckets\search_site2_gen349191_1517832906.155032_tmp.csv.gz, dst=D:\Splunk\var\run\splunk\cluster\search-buckets\search_site2_gen349191.csv.gz, rv=5.
Has anyone seen this before? How can I fix this?
... View more
07-07-2017
07:03 AM
1 Karma
Hi Christian. De fill is overwritten by another CSS. Try to use fill: rgb(255,0,0) !important;
Add !important.
... View more
07-04-2017
05:34 AM
1 Karma
I use the timeline app to visualize the state of process running over time.
If the process is not running I want to show a red bar and if it is running I want to use a green bar.
The query works fine, look at attched screenshot.
The data is also fine...other screenshot.
How can I make sure that Running is green and Not Running is red?
... View more
03-29-2017
12:31 AM
1 Karma
Large bundles is not a Splunk issue but usaully an issue with large lookups which should not be pushed to the indexers.
Try to blacklist lookups so they won't get pushed to the indexers.
... View more
03-24-2017
09:15 AM
OK thanks for posting! Good to know.
... View more
03-20-2017
05:49 AM
Got any _internal logging that point to a possible problem?
If SecurityComplianceCenter doesn't show up in the inputs config it might be that your azure app is not setup correctly.
... View more
03-20-2017
02:26 AM
No this is one browser tab open in the browser. I did not try to use another browser or emptying the cache.
Do you want me to test this?
I hope you agree this is a killer bug 😉
... View more
03-17-2017
08:09 AM
1 Karma
This related post has a good answer which points you in the right direction:
https://answers.splunk.com/answers/233092/how-to-cache-app-dashboard-to-avoid-search-query-e.html
You need to use scheduled searches and call those reports. Splunk will first try to get the cached results and will not execute the search.
If you search for "Splunk dashboard saved searches" or "Splunk dashboard cache" you will find other topics about this matter.
... View more
03-17-2017
08:06 AM
Looking at the following URL I think SharePoint Webservices or REST API are your best bet.
http://stackoverflow.com/questions/1665755/how-do-i-query-the-sharepoint-database
... View more
03-17-2017
07:59 AM
The regex works it seems but you cannot be 100% sure that tabs and spaces are the same in Splunk... Did you tried the same regex with the rex command? What is the result than?
Small tip; try to be more specific in your regex. If you change http_status from .*? to \d{3} performance will be much better.
... View more
03-17-2017
07:50 AM
Hi ehaddad,
The issue is that if I edit add-on A I see inputs I've created for add-on B.
The same for field extractions. I created field extractions in add-on A but the props.conf in add-on got updated with the created settings...
... View more
03-17-2017
03:09 AM
OK clear. No permissions error than.
Than there must be an issue with the regex. Can you share the regex101 you've created? Press save on the left and they will generate an URL which you can share.
... View more
03-17-2017
02:47 AM
Did this work before?
Please be aware of app-context and permissions. If you define props and transforms in one app and want to search the data in the other app these settings need to be set to global.
... View more
03-17-2017
02:41 AM
I just started using the Add-on builder and today I wanted to create my second project but than things get messy.
The inputs and field extractions for my new add-on ended up in my first add-on.
I made my app set visible = true but when I got to the add-on page I end up with an empty dashboard page instead of the input configuration page like my first add-on is properly showing.]
When I removed the app I could not recreate inputs since the sourcetypes are somewhere in Splunk but I cannot find it...
Looking at the "known issues" list on docs I kind a have the feeling this project is not really reliable...
Can you someone tell me I am doing something wrong and that it is not the add-ons fault?
... View more
03-17-2017
02:35 AM
I don't think this is true.
The idea behind the AoB is that you create generic inputs that can be mapped to multiple sourcetypes.
The Splunk Add-on for MS Cloud Services is a good example of this.
You have one Azure Resource Blob input with which you can create multiple inputs with different sourcetypes. You just need to configure this when you create the input.
This is an assumption but I think it is a correct one 😉
... View more
03-13-2017
05:00 AM
Hi uhaba,
The prop.conf you show here contain fields which are not related to search time field extractions but have to do with how Splunk should store the data in the index.
For props.conf and transforms.conf the docs are very good. The same for deployment.
... View more
03-13-2017
04:57 AM
1 Karma
My solution would be:
1. Create a lookup file with the services that you expect. Two columns; service_name and status. Status is a dummy field.
2. Create a search which starts with | inputlookup and join that with your search so if your search doesn't return a result you miss a field from that search. Finish the search with | search NOT certainField = *
3. Create an alert based on that search which results in all events from the lookup for which no data was found in the index.
... View more
03-10-2017
08:35 AM
4 Karma
They have been released. Hope they help you as much as they have helped me 😉
http://docs.splunk.com/Documentation/AddonBuilder/2.1.0/UserGuide/PythonHelperFunctions
... View more
03-09-2017
01:37 AM
1 Karma
I was wondering the following: 1. Am I allowed to use Splunk as a data platform behind another cloud-based product and resell that product to customers? For example; I have a cloud-based product where reporting on usage is a feature and I use Splunk to store that data. I use the API to query Splunk and display the data in my own product. 2. If so, how does this work license-wise? Do I just need to buy a regular Splunk license from Splunk (partner)? 3. Are there any examples of products which use Splunk as stated in question 1 or is there anyone on this forum who uses Splunk like this?
Answers much appreciated.
... View more
Labels
- Labels:
-
license
12-15-2016
08:55 AM
I solved my own problem but I still don't know how to do a bulk update.
What I did was:
<setup>
<block title="Octopus Deploy Machines" endpoint="admin/script" entity=".%252Fbin%252Fget_machines.py">
<input field="interval">
<label>Polling Interval (sec): $name$</label>
<type>text</type>
</input>
<input field="enabled" old_style_disable="true">
<label>Enable: $name$</label>
<type>bool</type>
</input>
</block>
<block title="Octopus Deploy Projects" endpoint="admin/script" entity=".%252Fbin%252Fget_projects.py">
<input field="interval">
<label>Polling Interval (sec): $name$</label>
<type>text</type>
</input>
<input field="enabled" old_style_disable="true">
<label>Enable: $name$</label>
<type>bool</type>
</input>
</block>
</setup>
The Python files are hardcoded and the input stanza is different than it as.
Inputs.conf was: [script://$SPLUNK_HOME/etc/apps/TA-Octopus-Fwd/bin/get_machines.py] and now is [script://./bin/get_machines.py].
If someone knows a way to write a setup.xml which handles all inputs I am happy!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
