Possibly. However, since the deployment has an indexer, if the indexer is used by the search head as search peer, SA-ldapsearch needs to be installed there as well if it is not already installed. ... View more

Cool. That is great. Is there an indexer between the forwarder and the search head? ... View more

Like this one? https://answers.splunk.com/answers/72028/disk-space-pie-charts-from-df-script-in-unix-app.html ... View more

Does the forwarder have SA-ldapsearch installed? It was not clear to me whether it was installed on the forwarder. Domain controllers have a forwarder with the TA-Windows deployed via server class ... View more

This is a totally different question which was already answered here ... View more

Assuming you have the raw XML above ingested, you should be able to parse it using SPL like below at search time: | makeresults | eval _raw = "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'> <System> <Provider Name='Microsoft-Windows-TerminalServices-Gateway' Guid='{4D5AE6A1-C7C8-4E6D-B840-4D8080B42E1B}'/> <EventID>303</EventID> <Version>0</Version> <Level>4</Level> <Task>3</Task> <Opcode>44</Opcode> <Keywords>0x4000000001000000</Keywords> <TimeCreated SystemTime='2020-04-16T16:16:53.376065200Z'/> <EventRecordID>17096</EventRecordID> <Correlation ActivityID='{320C9F53-4311-4E6E-8CA7-243377CB0000}'/> <Execution ProcessID='4676' ThreadID='13572'/> <Channel>Microsoft-Windows-TerminalServices-Gateway/Operational</Channel> <Computer>MACHINE.example.com</Computer> <Security UserID='S-1-5-20'/> </System> <UserData> <EventInfo xmlns='aag'> <Username>EXAMPLE\testuser</Username> <IpAddress>10.0.0.5</IpAddress> <AuthType></AuthType> <Resource>machine2</Resource> <BytesReceived>134859</BytesReceived> <BytesTransfered>116524</BytesTransfered> <SessionDuration>39</SessionDuration> <ConnectionProtocol>HTTP</ConnectionProtocol> <ErrorCode>1226</ErrorCode> </EventInfo> </UserData> </Event>" | spath | rename Event.UserData.EventInfo.Username as UserName | rename Event.UserData.EventInfo.IpAddress as IpAddress | rename Event.UserData.EventInfo.Resource as Resource | rename Event.UserData.EventInfo.BytesReceived as BytesReceived | rename Event.UserData.EventInfo.BytesTransfered as BytesTransfered | rename Event.UserData.EventInfo.SessionDuration as SessionDuration | rename Event.UserData.EventInfo.ConnectionProtocol as ConnectionProtocol | rename Event.UserData.EventInfo.ErrorCode as ErrorCode | table UserName, IpAddress, Resource,BytesReceived,BytesTransfered,SessionDuration,ConnectionProtocol,ErrorCode I don't know the details of your setup on the forwarder so couldn't comment on that. ... View more

What seemed to be the issue? I ran the powershell command on a Windows 10 box and got this 2020/05/03 13:59:26.9012287 3660 3744 DownloadManager Queueing update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1 for download handler request generation. 2020/05/03 13:59:26.9015056 3660 3744 DownloadManager Handler can skip block validation for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1 2020/05/03 13:59:26.9039594 3660 11408 DownloadManager Disabling chunked mode for download. updateid: 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1 2020/05/03 13:59:26.9039675 3660 11408 DownloadManager Generating download request for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1. 2020/05/03 13:59:26.9051260 3660 11408 DownloadManager Calling into handler 0x9 to generate download request for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1. 2020/05/03 13:59:26.9083917 3660 11408 DownloadManager Found existing StreamingDataSource for update {5A85CA90-4A7B-4CF2-A1EE-0F457C832095} [d:EE659EBE] 2020/05/03 13:59:26.9085315 3660 11408 Handler AppX GDR: Existing deployment operation for 5A85CA90-4A7B-4CF2-A1EE-0F457C832095 2020/05/03 13:59:26.9085362 3660 11408 Handler AppX GDR: Waiting 0 ms for download execute or completion event. 2020/05/03 13:59:26.9085413 3660 11408 Handler AppX GDR: WAIT_TIMEOUT seen. Wait timed out. 2020/05/03 13:59:26.9085614 3660 11408 DownloadManager GenerateDownloadRequest returned WU_E_OPERATIONINPROGRESS for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1. 2020/05/03 13:59:26.9589331 3660 31768 DownloadManager Dynamic download data fetcher for ServiceId 7971F918-A847-4430-9279-4A52D1EFE18D does not exist. 2020/05/03 13:59:30.4371243 3660 31768 DownloadManager Dynamic download data fetcher for ServiceId 7971F918-A847-4430-9279-4A52D1EFE18D does not exist. 2020/05/03 13:59:30.7685639 3660 3744 DownloadManager Handler returned total download size for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1 (session data (null)) as 47893581 How did the symbols get corrupted? This sounds like a Windows admin question to me. ... View more

Splunk App for Windows Infrastructure needs the Splunk Supporting Add-on for Active Directory to get the domain specific data. Please refer to Configure the Splunk App for Windows Infrastructure for more details. Were the prerequisite checks bypassed when the app was installed? ... View more

There is a modular input Prometheus Metrics for Splunk which was not certified for Splunk Enterprise 8.x so YMMV. More details could be found in its Github repository. There are some questions under this tag. ... View more

I don't have any issue with my setup. Server: Splunk Enterprise 8.0, Splunk Add-on for F5 BIG-IP 3.1.0 running on Mac OSX 10.15.4. Client: Google Chrome Version 81.0.4044.129 (Official Build) (64-bit) What is the error you see in your browser's developer tool (under Chrome, it is under More Tools --> Developer Tools ) console? ... View more

Just trying to understand, Application Server module in ITSI only supports Tomcat and WebSphere out of the box. Are you trying to use the underlying TA to onboard WebLogic? ... View more

Yes, assume that the correct fields are readily available, your script can write into a metrics index via TCP/UDP or from HTTP/HTTPS clients. You do NOT have to have an intermediary CSV file. ... View more

What is your search? I did a dummy search like this, index=_internal sourcetype=splunkd_ui_access | erex METHOD examples="GET , POST" | table METHOD | dedup METHOD and I was able to see logs like this 2020-05-04 17:14:29,457 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:16:15,310 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:16:15,411 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:16:55,592 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:16:55,744 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:17:18,915 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:17:20,037 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:17:31,770 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:17:41,178 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:17:53,240 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:18:00,550 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:18:03,215 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:18:04,787 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:18:07,979 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:18:08,187 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:18:10,647 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:18:12,615 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:18:14,448 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:18:16,148 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS 2020-05-04 17:21:48,911 -0700 INFO erex:25 - erex run with examples: GET , POST 2020-05-04 17:21:50,206 -0700 INFO FieldLearning:62 - GENERATING RULES FROM 100 EVENTS The log level is INFO. ... View more

@SplunkLunk the search above provided by @to4kawa will get what you need. ... View more

@muralikoppula you are most welcome. If it answers your question, could you please accept it as an answer? Thanks. ... View more

This is strange indeed. Did you see any other errors in _internal index? Also, if you do a port scan of local ports, what do you see? Is port 8088 open? Port Scan has started… Port Scanning host: 127.0.0.1 Open TCP Port: 8000 irdmi Open TCP Port: 8065 Open TCP Port: 8088 radan-http Open TCP Port: 8089 Open TCP Port: 8191 Port Scan has completed… ... View more

You can either ask for permission, or you can extract it to another folder in which you have permission to write, e.g., ~/opt instead of /opt ... View more

OK. I found something published on Splunk website, pay attention to 5m40s mark of the video tutorial. ... View more

If I understand your requirement correctly, you would like to filter out some of the events in the result, so that events only show up every five minutes in the result set. This is easy to do as only a filter is needed to look at the minute component of the event time stamps. index = _internal | eval curMin = strftime(_time,"%M") | eval eventtext = "my event " + curMin | table _time, eventtext, curMin | search curMin=*0 OR curMin=*5 The second line in the search parse the minute of the timestamp in the event, and the last line has a filter to only return the events that occurred during the time when the minute is divisible by 5. Of course you can tailor the filter (e.g., adding more restrictions on the second portion of the time stamp as well) to however you see fit. OR, do you want the neighboring events in the result to be at least 5 minutes apart? ... View more

If you install the app on the search head and restart Splunk of a supported version, it should ingest the local data and show dashboards visualizing the data right away (see attached). Even though it says it only supports Splunk Versions: 6.5, 6.4, 6.3, 6.2, 6.1, 6.0, 5.0, you can get it running on 7.0 as well. If you have a heavy forwarder, it is easy, just install the app and forward it to the right index, browser in this case. However, to get data in from a remote machine with UF is another ball game, as this app uses Python, you will have to install your own Python interpreter on the UF and tinker around to make it work. ... View more

I would like to know which domains are in tmpingestedzonefile and which are not in tmpingestedzonefile. I am trying to understand, did you mean you would like to know which domains are IN tmpzonefile but NOT in tmpingestedzonefile ? If this is the case, the comparison logic would be temp1 = ['twotwotwo.nl','two.nl', 'three.nl', 'four.nl', 'five.nl'] temp2 = ['twotwo.nl', 'three.nl','four.nl'] list(set(temp1)-( set(temp2))) with the following results ['two.nl', 'twotwotwo.nl', 'five.nl'] ... View more

Here is my take: It might be a red herring, but are you sure the credentials are accepted at CLI? In Splunk 8.0.x, if you use the default admin credentials, it would ask the user to change the password from changeme to something else before it allows the user to do anything else. $ ./splunk http-event-collector create sdapp01 -uri https://localhost:8089 -description "this is a new token" -disabled 1 Splunk username: admin Password: The administrator requires you to change your password. Please enter a new password: Also, can you go to Splunk web and make sure that this HEC token is indeed shown as enabled there? If not, click on Global Settings and make sure that Enabled is set there. IF STILL TO NO VAIL, TRY THIS , this is the nuke of all CLI commands arsenal for HEC, this is the ULTIMATE ULTIMATE WEAPON curl -k https://127.0.0.1:8088/services/collector/event -H "Authorization: Splunk [your token]" -d '{"event": "Dodge this!"}' And the end of all these, you should be able to get a response saying {"text":"Success","code":0} Then go to Splunk Web to do a search: source=http:sdapp01 You should be able to see the event there. Good luck! ... View more

What is the setup? Is there a firewall or proxy between your browser on Windows and the server running Splunk? What happens if you do ping or tracert the server from the client Windows machine? ... View more

In this case, (assume you have all the counts already) you can set <option name="charting.chart.stackMode">default</option> Simple XML for an example panel is listed below: <title>Not Stacked</title> <chart> <search> <query>| gentimes start=3/29/2018 increment=24h end=04/29/2018 | eval startunix=strptime(starthuman,"%a %B %d %H:%M:%S.%N %Y") | eval c_time=strftime(starttime,"%Y-%m-%d") | eval TOTALCOUNT = starttime%100000/100 | eval SUCCESSONE = floor((random() % TOTALCOUNT)/2 + 1) | eval FAILEDONE = TOTALCOUNT - SUCCESSONE | eval SUCCESSTWO = floor((random() % FAILEDONE)/2 + 1) | eval FAILEDTWO = FAILEDONE - SUCCESSTWO | table c_time, TOTALCOUNT, SUCCESSONE, FAILEDONE, SUCCESSTWO,FAILEDTWO</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> ... View more