About srauhala_splunk

srauhala_splunk

@vinothnaga If you do a partial backup the entities will not be included. Try it out! You can also unzip the backups to have a look what is included. /Seb

srauhala_splunk

I have come across this many times as well. Your best option in my opinion is to move the savedsearches, macros etc. from the /itsi/local app context to your self managed application context. for example project-x_itsi_addon. Then promote the configurations from this app to a higher environment. I am not 100% how the adaptive thresholds search would act if you try migrate that one this way so be a bit extra careful with those. In general it's also good practice to maintain your KPI searches and Correlation searches in your separate application context. You can there after use a reference to a savedsearch in the ITSI KPI/KPI Base/Correlation searches with "| savedsearch my_saved_search_from_app_1" Note that the my_saved_search_from_app_1 needs to be shared globally. This will enable you to promote KPI search changes to another Splunk environment from your custom app context without needing to restore a ITSI backup. /Seb

srauhala_splunk

Okey @taparshi1. Looking around in the documentation and in the UI this use case does not seem to be supported. Please add it to https://ideas.splunk.com. However in you situation I would solve it slightly different. You can manage information fields of the entities to achieve the same result. Service Template: my_database_service_template For example create a service using a service template where you defined a set of entity filters. At the time you run the service import job you will set these filters to match a value from your CSV. Simple Example: Service name: my_oracle_db Service Template: my_oracle_db_service_template Entity filter: my_entity_type:oracle_db, my_qualifier_info_field:true With the above setup you can instead manipulate the info field "my_qualifier_info_field" of the entities to activate / deactivate entities from your service. The qualifier for true/false can in turn be managed in a lookup, that in turn are used doing scheduled updates / imports of entities. This decouples the service from fixed list of entity host names and makes it adaptable to entities available that passes the entity filter. /Seb

srauhala_splunk

What kind of alerts? check what process search are generating them and what their trigger conditions are and importantly what the values was at the time the alert war triggered. /Seb

srauhala_splunk

Do you specialise exactly which entities you want in the entity filter? and then use scheduled service imports to change that? I have not tried that. One option as a walkaround could be to have more generic entity filter and instead use info fields of entities to pass the filter or not. I.e. let a scheduled import/update of the entities define whether they qualify for being used by the services. /Seb

srauhala_splunk

You could consider searching the raw data in the glass table instead of using the itsi kpi summary. Remember that the KPI will have a time unit. For example number of logins per minute the past one minute. If you change this KPI to be calculate every X seconds either change the KPI to calculate the number of logins for the past X seconds as well. Also note that there will always be some ingestion delay, i.e. time from when an event/metrics was created to when splunk will be able to retrieve it from an index. Configuring ITSI to search to close to the current time can case KPIs to show up as "NA" since no data for that time was available at the time the search was executed. /Seb

srauhala_splunk · ‎02-02-2023

Hi! What is not working for you the "/servicesNS/nobody/SA-ITOA/itoa_interface/entity/bulk_update?is_partial_data=1" endpoint? What was the response? This works for me on SE 9.0.3 curl -k -u user:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/bulk_update?is_partial_data=1 -H "Content-Type: application json" -X POST -d '[{"_key":"entity_guid","cpu":["56"]}]' Note that the payload needs to be a JSON list.

srauhala_splunk · ‎01-04-2023

Hi! Try something like this: | tstats latest(_time) as _time latest(alert_level) as alert_level latest(itsi_group_severity) as itsi_group_severity latest(itsi_group_status) as itsi_group_status where index=itsi_grouped_alerts AND NOT itsi_group_status::5 earliest=-24h latest=now by itsi_group_id /Seb

srauhala_splunk · ‎01-04-2023

To add to joys answer. If you have that meta data of the entities available in Splunk and or in a CSV. You can use the import entities with search or CSV method to append additional info fields (meta data) to the entities. See doc at: https://docs.splunk.com/Documentation/ITSI/4.15.0/Entity/ImportSearch /Seb

srauhala_splunk · ‎01-04-2023

Hi! You should not use stats in a KPI search, in most cases that will never be needed. Reasons are: 1. ITSI itself is doing the "stats" for you. 2. stats if done wrong removes _time which might be the problem in you case. I would suggest changing your KPI search to something like: index=my_index sourcetype=my_type transaction=* | eval has_transaction=1 Now you can extract 2 KPIs depending on you use case, either sum of has_transaction (Number of logged transactions in past X min) or do a dc by transaction (Number of unique transaction in the past X min) /Seb

srauhala_splunk · ‎01-04-2023

No deleting service in ITSI does not affect the entities. In your case I would: * identify what filters are used to filter entities to the services you are to delete. * Use the entity management view to verify if these entities used in any other services? If yes, do you really want to delete them? If no select and delete them from the entity management UI. Preferably before deleting the service so you can verify in the service that the entities now are gone. Also note that if these entities and or services are created by a scheduled job, they might reappear when those jobs are run again. /Seb

srauhala_splunk · ‎03-23-2021

Creating a specific role to manage deployment servers serverclass I experienced the same issue with User 'ds_user' with roles { ds_role, ds_user, user } cannot write: /nobody/system/serverclass/serverClass:My_server_class:app:my_app/restartSplunkWeb { read : [ * ], write : [ admin ] }, removable: no The ds_role has the capabilities: edit_deployment_client, edit_deployment_server, list_deployment_client list_deployment_server To be able to add an app to a serverclass the only option was to give the capability admin_all_objects. Which effectively would make ds_role users admins. To avoid this our workaround was to edit /opt/splunk/etc/system/metadata/local.meta to grant write privilege for ds_role to serverclass objects #On Deployment Server #/opt/splunk/etc/system/metadata/local.meta [serverclass] access = write : [ admin, ds_role ] export = system

srauhala_splunk · ‎10-07-2020

To list the Glass Table Keys and Title you can use: | rest /servicesNS/-/-/itoa_interface/glass_table report_as=text fields="_key,title" | eval value=spath(value,"{}") | mvexpand value | eval glass_table_id=spath(value, "_key"), glass_table_title=spath(value, "title") | fields - value

srauhala_splunk · ‎03-11-2020

I had a situation where Splunk web refused to start after upgrading to SE 8.0.1, with UnicodeDecodeError. In our situation if was due to the system locale being set to sv_SE. Changing it to en_GB helped.

srauhala_splunk · ‎03-11-2020

To answer my own question, our problem was that the user running the splunk process had the locale sv_SE. This cased python3 to fail when importing formecode. Workaround is to set the system and user locale to en_GB or en_US [splunk@ip-10-202-18-65 ~]$ LANG=en_US.utf8 [splunk@ip-10-202-18-65 ~]$ /opt/splunk/bin/splunk start

srauhala_splunk · ‎03-11-2020

After upgrading from SE 7.3 to SE 8.0.1 Splunk web failed to start [splunk@ip-10-202-18-65 ~]$ /opt/splunk/bin/splunk start The splunk daemon (splunkd) is already running. [MISSLYCKADES] Waiting for web server at http://127.0.0.1:8000 to be available............................................................................................................................................................................................................................................................................................................ WARNING: web interface does not seem to be available! [splunk@ip-10-202-18-65 ~]$ cat /opt/splunk/var/log/splunk/web_service.log 2020-03-11 14:13:29,700 ERROR [5e68f209517f57edcf17d0] root:770 - 'ascii' codec can't decode byte 0xc3 in position 17: ordinal not in range(128) Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py", line 132, in from splunk.appserver.mrsparkle.controllers.top import TopController File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/top.py", line 27, in from splunk.appserver.mrsparkle.controllers.admin import AdminController File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 17, in import formencode File "/opt/splunk/lib/python3.7/site-packages/formencode/init.py", line 3, in from formencode.api import ( File "/opt/splunk/lib/python3.7/site-packages/formencode/api.py", line 65, in set_stdtranslation() File "/opt/splunk/lib/python3.7/site-packages/formencode/api.py", line 58, in set_stdtranslation localedir=localedir, fallback=True) File "/opt/splunk/lib/python3.7/gettext.py", line 533, in translation t = translations.setdefault(key, class(fp)) File "/opt/splunk/lib/python3.7/gettext.py", line 260, in init self.parse(fp) File "/opt/splunk/lib/python3.7/gettext.py", line 421, in _parse catalog[str(msg, charset)] = str(tmsg, charset) UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 17: ordinal not in range(128) 2020-03-11 14:35:51,498 INFO [5e68f747617fbbe19b7f90] __init:174 - Using default logging config file: /opt/splunk/etc/log.cfg 2020-03-11 14:35:51,499 INFO [5e68f747617fbbe19b7f90] __init:212 - Setting logger=splunk level=INFO 2020-03-11 14:35:51,499 INFO [5e68f747617fbbe19b7f90] __init:212 - Setting logger=splunk.appserver level=INFO 2020-03-11 14:35:51,499 INFO [5e68f747617fbbe19b7f90] __init:212 - Setting logger=splunk.appserver.controllers level=INFO 2020-03-11 14:35:51,499 INFO [5e68f747617fbbe19b7f90] __init:212 - Setting logger=splunk.appserver.controllers.proxy level=INFO 2020-03-11 14:35:51,499 INFO [5e68f747617fbbe19b7f90] __init:212 - Setting logger=splunk.appserver.lib level=WARN 2020-03-11 14:35:51,499 INFO [5e68f747617fbbe19b7f90] __init:212 - Setting logger=splunk.pdfgen level=INFO 2020-03-11 14:35:51,499 INFO [5e68f747617fbbe19b7f90] __init:212 - Setting logger=splunk.archiver_restoration level=INFO 2020-03-11 14:35:51,551 ERROR [5e68f747617fbbe19b7f90] root:769 - Unable to start splunkweb 2020-03-11 14:35:51,551 ERROR [5e68f747617fbbe19b7f90] root:770 - 'ascii' codec can't decode byte 0xc3 in position 17: ordinal not in range(128) Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py", line 132, in from splunk.appserver.mrsparkle.controllers.top import TopController File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/top.py", line 27, in from splunk.appserver.mrsparkle.controllers.admin import AdminController File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 17, in import formencode File "/opt/splunk/lib/python3.7/site-packages/formencode/init.py", line 3, in from formencode.api import ( File "/opt/splunk/lib/python3.7/site-packages/formencode/api.py", line 65, in set_stdtranslation() File "/opt/splunk/lib/python3.7/site-packages/formencode/api.py", line 58, in set_stdtranslation localedir=localedir, fallback=True) File "/opt/splunk/lib/python3.7/gettext.py", line 533, in translation t = _translations.setdefault(key, class(fp)) File "/opt/splunk/lib/python3.7/gettext.py", line 260, in init self._parse(fp) File "/opt/splunk/lib/python3.7/gettext.py", line 421, in _parse catalog[str(msg, charset)] = str(tmsg, charset) UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 17: ordinal not in range(128)

Posts	16
Solutions	0
Karma Given	0
Karma Received	5
Member Since	‎03-11-2020

Online Status	Offline
Date Last Visited	3 hours ago

Splunk web fails to start after upgrade to 8.0.1 -...

Re: How ITSI backup and restore works for custom "...

Re: How ITSI backup and restore works for custom "...

Re: ITSi Recurring Service Import Job- Is this a b...

Re: Splunk ITSI KPIs Threshold values High 98% an...

Re: ITSi Recurring Service Import Job- Is this a b...

Re: How to set KPI Search Schedule less than 1 min...

Re: Updating Entities using ITSI REST API?

Re: How to consolidate all the alerts from ITSI?

Re: Is there a way to automatically retrieve Entit...

Re: How to get search into KPIs?

Re: Deletion of ITSI entities and Services-If I de...

Re: What capabilities are needed for a non-admin u...

Re: Hi Team, Can we get the list of All Glass tabl...

Re: After upgrading from 7.3.0 to 8.0.0, Splunk We...

Re: Splunk web fails to start after upgrade to 8.0...

Splunk web fails to start after upgrade to 8.0.1 -...