About FRoth

FRoth · ‎11-27-2017

I provide an App that uses an executable on Windows systems to generate some data. This program is located in the bin directory of my App named "TA-myapp". In the inputs.conf I set a scripted input that executes the program and indexes the output. [script://$SPLUNK_HOME/etc/apps/TA-myapp/bin/evaluator.exe] My problem is that our customer wants to deploy different versions of our app with different settings. So he renames myapp to myapp1 and myapp2 ... and so on. Is there a environment variable that references the App home directory so that I could use that variable to configure an input like this: [script://$APP_HOME/bin/evaluator.exe] I am using $APP_HOME in that example because I've found references in different splunk developer documentation pages but it doesn't work. The splunkd.log states: ERROR FrameworkUtils - Incorrect path to script: \$APP_HOME\bin\evaluator.exe. Script must be located inside $SPLUNK_HOME\bin\scripts.

FRoth · ‎06-29-2017

I noticed that a tag definition doesn't get immediately applied but takes up 1 min to become active. E.g. I define a tag false_positive on the search head (we have a single indexer): MD5=4bc41dc57d4ababc2810b9905b91ac2f Then I run a search and don't see the messages tagged false_positive . I run another search - still no tagging. After a minute or so I run the same search and see the events tagged. Why is that? The same strange behaviour applies to cases in which I delete a tag definition. The search still returns the tagged log lines and it takes around a minute until the tag disappears.

FRoth · ‎05-03-2017

I solved this issue by using http://localhost:8000 instead of http://127.0.0.1:8000

FRoth · ‎05-06-2016

I have found a workaround. Problem still exists in all Splunk versions since version 6.3.4 (see my comments to the initial questions). If I add the following section to my "default.xml" ... <collection label="All Analysis Views"> <saved source="unclassified" /> </collection> ... both the new section with all unclassified saved searches and the other menu with my selected searches appear. Removing the section again and both sections disappear. I reproduced this behaviour with my THOR App version 1.2.1, which I will update soon to fix this nasty bug with the workaround. Again - that's the behaviour: Not showing <collection label="Analysis">  <saved name="Base Analysis" default="true" />  <saved name="Rare Warnings and Alerts" />  </collection> Showing both menu elements <collection label="All Analysis Views"> <saved source="unclassified" /> </collection> <collection label="Analysis">  <saved name="Base Analysis" default="true" />  <saved name="Rare Warnings and Alerts" />  </collection> I wonder why no one else has reported this issue since the version 6.3.4 release?

FRoth · ‎05-06-2016

This is a bug. How do I report bugs?

FRoth · ‎05-05-2016

Verified - this error exists since version 6.3.4. My app works fine in 6.2.4 6.2.9 6.3.0 6.3.1 6.3.2 6.3.3 (yes, I've downloaded and installed them all) I also cross-checked for statements that are marked as obsolete here and the known issues in 6.3.4 here

FRoth · ‎05-05-2016

I do have the exact same problem here. Everyting worked fine in version 6.2 but I upgraded to version 6.4 recently. All the saved searches (reports) navigation bar elements show up in search views but not in the dashboard views. I noticed that the value "request.ui_dispatch_view" is set to "search" by default. Removing it doesn't solve the issue. I'll downgrade to version 6.2 to see if the problem is related to version 6.4. default.xml <nav search_view="search" color="#333333">  <collection label="Dashboards"> <view name="overview" default="true" /> </collection> <collection label="Analysis">  <saved name="Base Analysis" default="true" />  <saved name="Rare Warnings and Alerts" />  </collection> <view name="data_models" /> <collection label="Testing"> <view name="simple_search"/>  </collection> </nav> savedsearches.conf [Base Analysis] action.email.reportServerEnabled = 0 action.email.useNSSubject = 1 alert.track = 0 description = Basic search to build useful search statements upon dispatch.earliest_time = 0 display.events.fields = ["system","level","mainreason","duration","source","sourcetype","host","session_id","eventtype","score","module","matching_strings","message"] display.general.type = statistics display.page.search.tab = statistics display.visualizations.chartHeight = 233 display.visualizations.show = 0 request.ui_dispatch_app = thor request.ui_dispatch_view = search search = eventtype=events NOT tag=false_positive ( level=Alert OR level=Warning ) | table system,module,score,mainreason,file,_raw

FRoth · ‎03-03-2016

I defined a new input folder that receives gzipped server logs from a scp copy job on our servers. inputs.conf [monitor://F:\ssh_incoming\Logs] disabled = false recursive = false host_regex = pl\-([^_]+)_ index = plserver sourcetype = syslog The problem is that the props.conf of the learned app grows and grows until dispatching of new searches takes longer and longer until no searches start at all. (Inspect Job shows that dispatch.evaluate takes more than ten minutes to complete) /learned/local/props.conf [pl-www1_20160303053001_sudo-too_small] PREFIX_SOURCETYPE = True SHOULD_LINEMERGE = False is_valid = True maxDist = 9999 [pl-www1_20160303053001_system-too_small] PREFIX_SOURCETYPE = True SHOULD_LINEMERGE = False is_valid = True maxDist = 9999 [pl-www1_20160303060001_crond-too_small] PREFIX_SOURCETYPE = True SHOULD_LINEMERGE = False is_valid = True maxDist = 9999 [pl-www1_20160303060001_sshd-too_small] PREFIX_SOURCETYPE = True SHOULD_LINEMERGE = False is_valid = True maxDist = 9999 So as long as logs keep incoming in that folder, the props.conf grows and grows. I even disabled the "learned" App but that didn't solve the problem. The file keeps growing. I have also tried to set LEARN_SOURCETYPE to false in the props.conf definition for the "syslog" sourcetype. [syslog] CHARSET = latin-1 LEARN_SOURCETYPE = false I am using Splunk 6.2.2 with Enterprise License.

FRoth · ‎10-13-2015

Hi - the THOR APT Scanner App only works in combination with the Add-on. And it can only be used to extract and display fields from THOR APT Scanner log data.

FRoth · ‎02-01-2015

I installed the Splunk App for Enterprise Security, but all dashboards and reports are empty. The Splunk_TA_windows Add-on is installed and "indexes.conf" contains the index "windows" that has 20 GB of current log data coming from Splunk Universal Forwarders in our environment. It's a single system deployment processing about 1-2GB of Windows events per day. It looks like every search/report is empty. I've seen that some data has to be tagged with "web" or "proxy" to appear in the dashboards. I checked the "tags.conf" of the "Splunk_TA_windows" and it seems that all the events in the "windows" index are tagged with "windows" automatically. The user "ess_user" has access to all non-internal indexes. I even added the index "windows" to the indexes that should be searched by default. I haven't filled the "lists and lookup" CSVs so far. Could this be the problem? How comes that all views are empty?

FRoth · ‎11-26-2014

I was at least able to restore my former version 6.1.3 with: splunk enable boot-start

FRoth · ‎11-26-2014

Still waiting for a solution. (German version here)

FRoth · ‎08-18-2014

Yes - it does not do what it is supposed to do. I want to extract the day from "Aug 18 17:11:16" and "Aug 8 17:11:16". %e is not white space padded.

FRoth · ‎05-26-2014

We configured some alerts that should send an email when fired, but no email gets through. We noticed errors in the internal log that said: 05-26-2014 17:32:56.527 +0200 ERROR ScriptRunner - stderr from 'E:\splunk\etc\apps\search\bin\sendemail.py': ERROR:root:(501, '5.5.4 Invalid domain name') while sending mail to: a.miller@company.com The SMTP server itself logs: 2014-05-26T05:38:08.117Z,SV0490\Relay SV0490,08D1455F6B42D2E9,3,10.40.13.54:25,10.41.3.200:26174,<,ehlo SV0842.company.com., 2014-05-26T05:38:08.117Z,SV0490\Relay SV0490,08D1455F6B42D2E9,4,10.40.13.54:25,10.41.3.200:26174,*,Tarpit for '0.00:00:05', 2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,5,10.40.13.54:25,10.41.3.200:26174,>,501 5.5.4 Invalid domain name, 2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,6,10.40.13.54:25,10.41.3.200:26174,<,helo SV0842.company.com., 2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,7,10.40.13.54:25,10.41.3.200:26174,*,Tarpit for '0.00:00:05', 2014-05-26T05:38:18.133Z,SV0490\Relay SV0490,08D1455F6B42D2E9,8,10.40.13.54:25,10.41.3.200:26174,>,501 5.5.4 Invalid domain name, The mail admins said that our source IP should be free to send with any source address - we configured splunk@server, splunk@server.fqdn.com without any success. We also changed the server name in the General Settings to the FQDN but nothing helped. We believe that it has to do with the name sent after HELO/EHLO but we cant see what it is. We have no idea what the reason for this behaviour could be. Any ideas?

FRoth · ‎05-02-2014

I changed it a bit so that it also includes the last key/value pair (?<KEY_1>[A-Z]+): (?<VAL_1>.*?)(?=(\s[A-Z]+:)|$)

FRoth · ‎04-29-2014

Awesome. This works. Thanks

FRoth · ‎04-29-2014

No. There are more than 40 different formats. I use to extract them separately by specific extraction rules and would like to extract all by a single rule. i.e. what I normally do is "DOMAIN: (? .*?) [A-Z_]+:".

FRoth · ‎04-29-2014

I have a log format that contains KEY/VALUE pairs in this format: Feb 10 12:02:38 192.168.56.101 Feb 10 12:02:37 PROMETHEUS/192.168.56.101 THOR: Info: MODULE: UserAccounts MESSAGE: User Account USER: trinity FULL_NAME: trinity PRIV: 1 LAST_LOGON: 03/02/2014 13:52:38 BADPWCOUNT: 0 LOGON_SERVER: \\* NUM_LOGONS: 8 PASS_AGE: 78.00 days The thing is, that the values are terminated by the next key, so the extraction would be: (?<_KEY_1>[A-Z_]+): (?<_VAL_1>.*?) [A-Z_]+: The problem I face is that it only extracts the first, third, fifth, seventh ... key/value pair as it skips the following key as part of the first extraction. Is there a way to handle this?

FRoth · ‎03-18-2014

Is there a fast way to count all logging systems to a certain index? Currently I use the "stats" command with the "distinct_count" and it is very slow on that index. index=windows | stats distinct_count(system)

FRoth · ‎12-19-2013

Can they be applied to the _raw field as well?

FRoth · ‎12-18-2013

Ahhh - worse. Those are "| pivot" panels.

FRoth · ‎12-18-2013

Are there savedsearches in splunk 6 panels? All my panel searches are inline searches. I'll check if I can save most of them and use them from the panels, thanks.

FRoth · ‎12-18-2013

What do you regards as the best practice to filter false positives from all views. Currently I add all false positives to a search macro like this: Macro: fps Expression: ( "user1234" OR "admin123" ) Then I use the " NOT `fps`" string in the search to filter the false positives from the view. Would you regard this as a good idea. I find it quite handy to change the single statement that is included in all searches and panels. A problem I have is that the expression grew pretty big and some of the searches from dashboard panels fail because of an over long URL query. Would you prefer using "tags" or something else?

FRoth · ‎12-18-2013

I defined a huge search macro and use it in some of my panels. (used this to define a lot of false positives like "xxx" OR "yyy" OR ...) Now - every time someone clicks the panel cell or row the macro gets expanded and fills half of the screen. Is there a way to avoid the expansion and still see the macro name on clicks in panels?

FRoth · ‎12-10-2013

but severity is a string value. Sorting would not solve the problem, wouldn't it?

Posts	98
Solutions	4
Karma Given	24
Karma Received	36
Member Since	‎05-03-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Environment variable in scripted input relative to...

Tag definition not immediately applied

Splunk learned app should stop learning / too_smal...

Splunk App for Enterprise Security: Why are all da...

Splunk Alerting by Email Error - 501 5.5.4 Invalid...

Multiple Key Value Pair Extraction

Count logging systems

Best practice on false positives

Avoid macro expansion

Use "Data Model" definitions to extract fields in ...

Environment variable in scripted input relative to...

Tag definition not immediately applied

Re: Unable to login into splunk , just downloaded ...

Re: Why does my saved search not appear in the nav...

Re: Why does my saved search not appear in the nav...

Re: Why does my saved search not appear in the nav...

Re: Why does my saved search not appear in the nav...

Splunk learned app should stop learning / too_smal...

Re: eventtype=thor_events

Splunk App for Enterprise Security: Why are all da...

Re: Upgrade to 6.2 fails on windows 7 with "ERROR ...

Re: Why am I getting "Splunk Enterprise setup wiza...

Re: How do I configure timestamp extraction where ...

Splunk Alerting by Email Error - 501 5.5.4 Invalid...

Re: Multiple Key Value Pair Extraction

Re: Multiple Key Value Pair Extraction

Re: Multiple Key Value Pair Extraction

Multiple Key Value Pair Extraction

Count logging systems

Re: Best practice on false positives

Re: Avoid macro expansion

Re: Avoid macro expansion

Best practice on false positives

Avoid macro expansion

Re: Define specific Pie Chart colors by string fie...