Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mikaelbje
mikaelbje
Motivator
Member since:
09-05-2012
06-05-2020
Community Statistics
| Posts | 443 |
| Solutions | 40 |
| Karma Given | 216 |
| Karma Received | 153 |
| Member Since | 09-05-2012 |
Activity Feed
- Got Karma for Re: Is there a way to specify the Splunk search Schedule Window defaults?. 03-10-2023 03:23 AM
- Got Karma for Re: How can I change the location of accelerated data model summary data?. 12-01-2022 01:31 AM
- Got Karma for Re: Indexer Cluster and Search Head Cluster with Datamodel Acceleration. 07-20-2022 09:18 AM
- Got Karma for Re: Why would the source type cisco:ios not be getting created? Can I add it manually?. 02-13-2022 06:35 PM
- Got Karma for Re: Forwarding logs from Windows Event Collector. 08-29-2020 02:56 AM
- Got Karma for Re: How would one correctly configure DATETIME_CONFIG for an app that could be installed in either an indexer cluster or standalone splunk?. 07-21-2020 01:47 AM
- Karma Re: Syslog events not matching IOS XR regex to transform for rphillips_splk. 06-05-2020 12:49 AM
- Got Karma for Re: Cisco ESA Combine logs. 06-05-2020 12:49 AM
- Got Karma for Re: Cisco ESA Combine logs. 06-05-2020 12:49 AM
- Got Karma for Re: Cisco Firepower Systems (FTD) . Any ready made addons/TA available?. 06-05-2020 12:49 AM
- Karma Is there a Splunk App or Add-on that will help read and comprehend ADFS 3.0 authentication logs? for mgrulke. 06-05-2020 12:48 AM
- Karma Update of Splunk WSA Plugin to support WSA 10.x for tmayer. 06-05-2020 12:48 AM
- Karma How to set a token with eval? for jamesmarlowww. 06-05-2020 12:48 AM
- Karma Getting Cisco Ironport ESA data into the Common Information Model for kalifehj. 06-05-2020 12:48 AM
- Karma Re: Getting Cisco Ironport ESA data into the Common Information Model for kalifehj. 06-05-2020 12:48 AM
- Karma Why are searches stuck at "finalizing job" after upgrade to 6.5.0? for varad_joshi. 06-05-2020 12:48 AM
- Karma Re: Why are searches stuck at "finalizing job" after upgrade to 6.5.0? for sgarvin55. 06-05-2020 12:48 AM
- Karma Re: How to search for fields that cross correlate with a specified field? for jeffland. 06-05-2020 12:48 AM
- Karma Is it possible to do a "dry-run" of a serverclass configuration to see how it will actually deploy? for reedmohn. 06-05-2020 12:48 AM
- Karma Re: How to use my LDAP strategy to add all users in a domain to Splunk? for DalJeanis. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
11-27-2019
01:47 AM
Four years later and I am returning to this issue. Our official answer and the best way to get DNS logs in is to use Splunk Stream, but in case you are prevented from doing that, please see my updated answer above which should properly clean up Windows DNS logs, also accounting for the edge case raised by @asieira
... View more
04-15-2019
09:18 PM
You need to set the sourcetype to cisco:ios upon ingesting the data in Splunk. Do it on the input you defined.
Notice that it is cisco colon ios
... View more
04-15-2019
09:03 PM
Your sourcetype is cisco whereas the add-on requires it to be cisco:ios
See if changing it helps.
... View more
04-15-2019
05:35 AM
Install and configure the Cisco Networks Add-on and Cisco Networks App, both available from Splunkbase. You will get all the extractions and the overview page has the search you need in a panel called Port Flapping.
... View more
04-09-2019
06:21 AM
Also the add-on should not be visible in that drop-down. Looks like someone has changed the contents of the app and add-on in some way.
... View more
04-09-2019
06:20 AM
The app name looks very strange. Are you sure you installed it correctly? If it was installed correctly you should get to an overview page with a summary of the events from your Cisco network infrastructure. Have a look in the Splunk app install folder under etc/apps and check if anything looks strange compared to other apps
... View more
04-09-2019
06:08 AM
You need the App as well, not just the add-on.
This is mentioned in the documentation 🙂
... View more
01-07-2019
01:26 PM
You can in fact do this with the app if you use the companion "multi tenancy" add-on. It comes with a charge. Let me know if you are interested. The add-on will let you define a set of indexes per Splunk role and change views depending on your permissions (honoring the indexes you are allowed to see)
... View more
01-07-2019
01:21 PM
Should be fixed in the latest 2.5.6 version of the app. Tested against recent Splunk versions.
... View more
01-07-2019
01:17 PM
This should be fixed in the latest version which is 2.5.6 without having to do any customizations. Please let me know if this is not the case.
... View more
10-30-2018
02:13 PM
Still nothing? Just ran into this on a 7.1.0 to 7.2.0 upgrade
... View more
07-24-2018
02:09 AM
Also version 2.5.4 of the Cisco Networks app has a bug that breaks the overview dashboard. Upgrade to Splunk latest and version 2.5.5 of the app.
... View more
07-10-2018
12:21 AM
See (from http://pubs.opengroup.org/onlinepubs/009695399/functions/strptime.html)
%d
The day of the month [01,31]; leading zeros are permitted but not required
This should also work in Splunk
... View more
07-04-2018
11:19 PM
Hi,
you will have to set a TIME_FORMAT and TIME_PREFIX for the cisco:ios sourcetype (see props.conf)
Use something like Rubular.com to test it.
For TIME_PREFIX this may work:
TIME_PREFIX = \S+:\s\S+:\s
However you may have false positives as it is very generic.
Regarding TIME_FORMAT you may have issues with the asterisk. For IOS devices the asterisk is there to indicate that the time is not synced with NTP (ref. https://networkengineering.stackexchange.com/questions/10168/interpreting-cisco-logging-symbols), but I am not sure if the meaning is the same for WLC.
I prefer to trust the syslog server time instead of the device time for Cisco networking devices, but maybe that's just me.
... View more
07-04-2018
05:03 AM
I am trying to do the following:
| pivot Cisco_IOS_Event Cisco_IOS_Event count(Cisco_IOS_Event) AS "Events" dc(host) AS "Unique Devices" dc(index) AS "Unique Indexes" FILTER product in (IOS) FILTER index in (index1,index2)
However this fails as the "index" field is not part of the Cisco_IOS_Event data model.
If I use tstats (which doesn't support real-time searching) it works:
| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product IN (IOS) index IN (index1,index2) BY host index
I believe if I add "index" as a field to my data model I will be able to filter, but I'm wondering if this is intentional, as tstats supports this without "index" as part of the data model. _time, source, sourcetype and host are inherited fields in all data models, so I'm having a hard time understanding why index isn't.
... View more
