Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jgoddard
jgoddard
Path Finder
Member since:
09-09-2012
06-05-2020
Community Statistics
| Posts | 36 |
| Solutions | 1 |
| Karma Given | 8 |
| Karma Received | 13 |
| Member Since | 09-09-2012 |
Activity Feed
- Got Karma for Re: Is it safe to deploy apps with lookups using the deployment server?. 08-17-2022 06:44 AM
- Karma Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light? for gblock_splunk. 06-05-2020 12:48 AM
- Karma Re: Splunk Add-On for Palo Alto and Splunk for Palo Alto Networks for btorresgil. 06-05-2020 12:47 AM
- Karma Re: Fireye Analytics Daily Report for TonyLeeVT. 06-05-2020 12:47 AM
- Karma Re: Error msg="A script exited abnormally" status="exited with code 1" for Lowell. 06-05-2020 12:47 AM
- Karma Re: SA-ldapsearch error SSL configuration issue: sslVersions=""['tls1.2']"" is an invalid combination for jamesarmitage. 06-05-2020 12:47 AM
- Got Karma for Wrong props/transforms in this one. easy to fix.. 06-05-2020 12:47 AM
- Got Karma for Re: search head cluster - ERROR UserManagerPro - Failed to get LDAP user="undefined" from any configured servers. 06-05-2020 12:47 AM
- Got Karma for Re: search head cluster - ERROR UserManagerPro - Failed to get LDAP user="undefined" from any configured servers. 06-05-2020 12:47 AM
- Got Karma for Re: search head cluster - ERROR UserManagerPro - Failed to get LDAP user="undefined" from any configured servers. 06-05-2020 12:47 AM
- Got Karma for Re: search head cluster - ERROR UserManagerPro - Failed to get LDAP user="undefined" from any configured servers. 06-05-2020 12:47 AM
- Got Karma for What does this mean? ERROR IntrospectionGenerator:resource_usage - KVStorageProvider - Internal read failed with error code '13436' and message 'not master or secondary; cannot currently read from this replSet member'. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk Add-on for ServiceNow 2.6.0: Why does the latest version of the app use the [default] stanza, overriding other sourcetypes in my environment?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk Add-on for ServiceNow 2.6.0: Why does the latest version of the app use the [default] stanza, overriding other sourcetypes in my environment?. 06-05-2020 12:47 AM
- Got Karma for SA-ldapsearch error SSL configuration issue: sslVersions=""['tls1.2']"" is an invalid combination. 06-05-2020 12:47 AM
- Got Karma for SA-ldapsearch error SSL configuration issue: sslVersions=""['tls1.2']"" is an invalid combination. 06-05-2020 12:47 AM
- Got Karma for SA-ldapsearch error SSL configuration issue: sslVersions=""['tls1.2']"" is an invalid combination. 06-05-2020 12:47 AM
- Karma Re: Change forwarder password in a large deployment for I_am_Jeff. 06-05-2020 12:46 AM
- Karma Re: TA-Forefront-Security-for-Exchange add-on for ahall_splunk. 06-05-2020 12:46 AM
- Got Karma for Re: Apache access_combined with X-Forwarded-For instead of host. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
09-12-2016
05:07 PM
Is there a user tool to lookup bugs that have been submitted to splunk? This definitely feels like a bug, but I don't want to submit duplicates, there are a few bugs that I am still waiting on. 🙂
If this isn't already in their buglist, I am happy to create one.
... View more
06-10-2016
04:36 PM
Thank you for the prompt response. I understand how the TA and the event-forwarder on carbon black interact. On the other hand, the new Carbon Black Integration app (https://splunkbase.splunk.com/app/3099/#/documentation) seems to indicate that the only requirement is using your Carbon Black API key:
To setup the Splunk App:
Navigate to the Apps Manager page.
Look for the Carbon Black Enterprise Response App
Click 'Set up'
Enter your server URL in the 'CB server URL' text box. (example: https://cbserver.mycompany.com)
Paste the Carbon Black API Token into the text box labelled 'API Key'.
Click 'Save'
So, my question is does the new splunk app need the apikey functionality, the cb-event-forwarder JSON converter, AND the carbon black TA, or is it able to do all data collection via the API, or are they completely separate?
Thanks.
... View more
06-10-2016
03:40 PM
It isn't completely clear from the readme how this app fits with the cb-event-forwarder https://github.com/carbonblack/cb-event-forwarder and the Carbon Black TA (https://splunkbase.splunk.com/app/2790/).
Do I still need to have the TA connect to the event forwarder, or does the new app leverage the search heads to directly query the carbon black server via API (which is how it sounds).
Thanks.
... View more
11-20-2015
08:25 AM
Thanks Brian, I have the new app & Splunk_TA being tested now, and it looks great.
... View more
11-13-2015
12:10 PM
I really like the Bit9 Security Platform app, but not only do I really hate Flash, but it is banned from running in more and more browsers, and I refuse to allow it on my Linux workstation at all.
Are you all working on a version that removes the remaining Flash panels?
Thanks,
Jim
... View more
11-03-2015
05:11 PM
1 Karma
I have a solution that works pretty well, at least in our environments. I haven't tested it thoroughly against IPv6 addresses, but the few "fake" ones I am getting look to come through.
Note, in our environments we have the ClientIP field for the webserver replaced by the X-Forwarded-For IP list if we get that header. So we took the default access-extractions REGEX from $SPLUNK_HOME/etc/system/default/transforms.conf, took out the [[nspaces:clientip]], and replaced it with the following:
(?<all_xff_ip>(([.\d]+|[a-fA-f0-9\:\.]+|-|localhost)(?:,\s)?)+)
Then we have a second transform to break the individual IPs out as needed.
#A multivalue definition to capture all the xff ips
[mv_xff_ip]
SOURCE_KEY=all_xff_ip
REGEX = (?P [.:\d]+|[a-fA-f0-9:.]+|-|localhost)
MV_ADD = true
... View more
10-21-2015
01:20 PM
I just realized that a different app that I was struggling with specifically states that it is unsupported on a search head cluster, and before I spend any more cycles looking into oddness on the web analytics app, I was wondering if this configuration has been tested/validated/or not supported?
Thanks,
Jim Goddard
... View more
10-21-2015
09:44 AM
I just upgraded to version 1.5 of the Splunk App for Web Analytics, and I ran into a couple of issues. One was previously answered, about only one of the eventtypes being set to global. When I saw this error, I took a look at the local.meta file, and there are a lot of entries that I think you might want to clear out for the next release.
Stanzas I saw that should probably be removed would be the [inputs] ones, like:
inputs/monitor%3A%2F%2F%24SPLUNK_HOME%2Fetc%2Fapps%2FSplunkAppForWebAnalytics%2Fsampledata%2Fiis.log
One that also might want to be app specific (currently global) is below, but it doesn't seem to be affecting anything so far.
[tags/eventtype%3Dweb-traffic]
Thanks, keep up the great work!
... View more
10-16-2015
05:34 PM
That was indeed the ticket. On Ubuntu 14.04, adding the following extra packages make it better:
libc6:i386 (pulls in gcc-4.9-base:i386 libc6:i386 libgcc1:i386 )
libpam0g:i386 (pulls in libaudit1:i386)
... View more
10-16-2015
05:20 PM
I am also having this issue on Ubuntu. The files all have appropriate permissions. I've placed the symlink for libcpc++ into /lib/ verified that I have a current glibc (libc6) and libpam0g-dev installed.
using strings and a grep for .so gives me this list:
/lib/ld-linux.so.2
libpthread.so.0
libresolv.so.2
libdl.so.2
libpam.so.0
libnsl.so.1
libcpc++-libc6.1-2.so.3
libc.so.6
It appears that the issue is due to opsec_pull_cert requiring the i386 versions of all the libraries... I'm about half through installing those, will report back if i either kill my splunk server or get it working...
... View more
10-09-2015
10:56 AM
Thank you for this. I had just dove deep enough to find that error and was scratching my head as to where the "division by zero" error was coming from.
No longer seeing the error.
... View more
10-09-2015
10:31 AM
I have a different issue with rlog.sh, but the permission issue for the audit.log is pretty easy to fix, assuming you can change /etc/audit/auditd.conf
Just add "log_group = splunk" to your auditd.conf file (assuming your splunk user is a member of the "splunk" group. Personally, I have my config management add the splunk user to the "adm" group, as that gets it read rights to just about all the logfiles, then you could make the auditd.conf file have log_group=adm and you would still be ok.
... View more
09-30-2015
03:31 PM
yes, yes i do.
I will open a case about this for updates, but I am willing to switch the shell that my splunk user gets, if you have a suggestion that is less broken than dash.
... View more
09-30-2015
02:50 PM
Realized i did not specifically answer your question about the OS. We are using ubuntu for these devices.
... View more
09-29-2015
01:49 PM
I seem to get one error routinely:
2015-09-29 20:44:28,971 ERROR pid=8318 tid=MainThread file=Splunk_TA_f5_bigip_main.py:stream_events:117 | Error in getting task definitions by restful API(maybe splunk daemon is down?) - Traceback:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py", line 104, in _stream_events
server_manager.reload()
File "/opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip/Modules/F5Servers.py", line 297, in reload
splunk.rest.simpleRequest(F5ServerModel.build_id(None, None, None) + "/_reload", sessionKey=self._sessionKey)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init_.py", line 508, in simpleRequest
raise splunk.AuthenticationFailed
AuthenticationFailed: [HTTP 401] Client is not authenticated
... View more
09-29-2015
12:15 PM
I do not seem to be able to prevent this python script from starting, and as we do not use any of the API connections, it is unnecessary. Additionally, the script launches many copies of itself which do not get shut down when Splunk restarts. I routinely end up with many of these processes left behind after splunk stops:
splunk 533 0.0 0.1 44088 23948 ? S Aug25 5:11 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 574 0.0 0.1 44076 23952 ? S Aug23 5:35 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 2215 0.0 0.1 44068 23948 ? S Aug26 13:20 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 2624 0.0 0.1 43828 23752 ? S Sep17 14:21 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 3241 0.0 0.1 43816 23744 ? S Sep04 10:54 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 5024 0.0 0.1 44076 23960 ? S Aug26 6:00 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 6351 0.0 0.1 44076 23960 ? S Sep16 4:07 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 7133 0.1 0.1 43820 23484 ? S 18:46 0:00 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 8910 0.0 0.0 4440 652 ? Ss 18:55 0:00 /bin/sh -c python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
splunk 8911 0.3 0.1 43812 23484 ? S 18:55 0:00 python /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
Thanks.
... View more
09-17-2015
10:37 AM
Thanks a lot for that tip, James. I will deploy and verify that gets rid of the error I was having.
... View more
09-11-2015
03:20 PM
3 Karma
This is the only error that I get, no further information, and so far i haven't been able to run the python from the cli to see if I can get any more information. I have pinned splunkweb to TLS1.2 for quite a while, have had no other issues. My ldap authentication for splunkweb is functioning fine. I don't see this error on answers, and I am confused.
I had suspected that this was a Cert issue, but after doing a lot of checking, I believe it is an issue with the SA-ldapsearch configs.
It appears that even though server.conf understands "tls1.2" as an sslVersion= value for the sslConfig stanza, SA-ldapsearch does NOT. I changed, in $SPLUNK_HOME/etc/apps/SA-ldapsearch/local/ssl.conf to have:
[sslConfig]
sslVersions=tls
and everthing is working. I would like to request an enhancement to SA-ldapsearch such that it understands the sslVersion string of tls1.2
... View more
07-31-2015
10:20 AM
from the Known Issues:
The PDF Report Server App, which was deprecated in version 6.0, has been removed. In Splunk 6.2, you cannot generate PDFs from dashboards that are implemented using advanced XML.
Not sure if that is the root issue for this report or not.
... View more
07-31-2015
10:12 AM
I get nothing but errors from this report. I suspect this is due to Splunk retiring the PDF generator as of 6.0, but that might not be it.
The email report error message states:
An error occurred while generating the PDF. Please see python.log for detail
Looking at the python log, I see:
2015-07-30 23:58:01,684 +0000 INFO sendemail:954 - sendemail pdfService = pdfgen
2015-07-30 23:58:01,684 +0000 INFO sendemail:1080 - sendemail:mail effectiveTime=1438300680
2015-07-30 23:58:02,078 +0000 INFO pdfgen_endpoint:386 - pdf time-of-report=1438300680.0
2015-07-30 23:58:02,092 +0000 ERROR pdfgen_endpoint:188 - Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Untitled" to PDF. Row on line=3 specifies row grouping but has <panel> children, which is not allowed
Traceback (most recent call last):
File "/opt/splunk/etc/system/bin/pdfgen_endpoint.py", line 162, in initialize
sessionKey=self.sessionKey)
File "/opt/splunk/lib/python2.7/site-packages/splunk/pdf/pdfgen_views.py", line 150, in getDashboardTitleAndPanels
return getDashboardTitleAndPanelsFromXml(dashboard.data, namespace, owner, sessionKey)
File "/opt/splunk/lib/python2.7/site-packages/splunk/pdf/pdfgen_views.py", line 160, in getDashboardTitleAndPanelsFromXml
dashboard = createDashboardFromXml(et.fromstring(dashboardXml), sourceApp=namespace)
File "/opt/splunk/lib/python2.7/site-packages/splunk/models/view_escaping/fromdash.py", line 107, in createDashboardFromXml
dashboard.rows.append(createRowFromXml(rowNode, sourceApp))
File "/opt/splunk/lib/python2.7/site-packages/splunk/models/view_escaping/fromdash.py", line 278, in createRowFromXml
raise Exception(('Row on line=%s specifies row grouping but has children, which is not allowed') % rowNode.sourceline)
Exception: Row on line=3 specifies row grouping but has <panel> children, which is not allowed
2015-07-30 23:58:02,114 +0000 ERROR sendemail:965 - An error occurred while generating a PDF: Failed to fetch PDF (status = 400): Unable to render PDF.<br/><ul><li>Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Untitled" to PDF. Row on line=3 specifies row grouping but has <panel> children, which is not allowed</li></ul>
I am wondering what the fix is for this. I'd love to get the report, don't care if its PDF format or not.
... View more
07-16-2015
03:12 PM
I am a bit unclear as to how to get this app configured correctly in a distributed setup.
I hope to use the REST api and JSON for the format of the data, and my plan was to point the Fireeye to the REST api of a heavy forwarder, but the documentation is not very clear as to whether this is possible, and whether this setup requires the full app to be on my heavy forwarder (as it appears from looking at the app).
Also, is the Fireeye_v3 app compatible with search head clusters?
Thanks,
Jim
... View more
06-25-2015
02:05 PM
2 Karma
Ok, that is what i get for not checking versions. The issue I ranted about is indeed not present in the 2.6.0 version of the TA, it does exist in 2.5.0, which is what i was seeing.
I will update mine to the current version.
Thanks for fixing, and the tip!
... View more
06-25-2015
10:34 AM
The most recent version of this app has a change that makes it bad.
The default/props.conf contains:
[default]
MAX_TIMESTAMP_LOOKAHEAD = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TZ = UTC
REPORT-sys_id = sys_id
the [default] stanza should NOT be used in an app, as it overrides EVERYTHING that isn't specifically set somewhere else. So, for every sourcetype in my environment now, I have a "REPORT=sys_id = sys_id". And for any other sourcetype, where the MAX_TIMESTAMP_LOOKAHEAD isn't specifically set, is now getting that setting of only look 1 character forward... Not going to pick up many timestamps that way. btool reports picking up stanzas from Splunk_TA_snow for just about all of my sourcetypes.
I am reverting [default] to [snow] in my copy, which is what it was previously, and that should provide the default settings to all the snow: sourcetypes but NOT globally override other settings.
Jim
... View more
06-11-2015
02:40 PM
1 Karma
Index: props.conf
@@ -32,7 +32,7 @@
disabled=false
maxDist=75
pulldown_type=true
-LOOKUP-action_for_pan_config = pan_action_lookup vendor_action OUTPUT action
+LOOKUP-action_for_pmp_config = pmp_action_lookup operation_type OUTPUT action
LOOKUP-status_for_pmp_config = pmp_status_lookup status_of_operation OUTPUT status
LOOKUP-category_for_pmp_config = pmp_category_lookup operation_type OUTPUT object_category
@@ -49,6 +49,6 @@
disabled=false
maxDist=75
pulldown_type=true
-LOOKUP-action_for_pan_config = pan_action_lookup vendor_action OUTPUT action
+LOOKUP-action_for_pmp_config = pmp_action_lookup operation_type OUTPUT action
LOOKUP-status_for_pmp_config = pmp_status_lookup status_of_operation OUTPUT status
LOOKUP-category_for_pmp_config = pmp_category_lookup operation_type OUTPUT object_category
... View more
06-05-2015
04:16 PM
I am also looking for fresh advice/guidance for:
1) how exactly does one deploy for PaloAlto splunking in a distributed environment, especially with Enterprise Security in the mix. There were comments around saying that the TA-paloalto from E.S. is NOT compatible with this new app. However, if you do the naive thing like I did and send the app to your indexers and heavy forwarders, you end up with every splunk instance independently running the saved searches, which is bad. That is not hard to fix by making sure that you change the savedsearches to disabled=true EXCEPT on one webserver/cluster.
2) Is the 3.3.0 TA-paloalto now compatible with the SplunkforPaloAltoNetworks app? Because if they contain the same props/transforms/tags (it isn't trivial to determine this for me), i'd much prefer just distributing the TA.
3) Would it be recommended instead to just make my own TA-paloalto that contains the props,transforms,etc. and distribute that to my non-searching splunk servers.
4) the point about the sourcetypes is valid as well. I currently have some local mods to make sure that both old and new style sourcetypes are collected.
Thanks,
Jim
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
