Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About rmsit
rmsit
Communicator
Member since:
04-17-2013
06-05-2020
Community Statistics
| Posts | 73 |
| Solutions | 4 |
| Karma Given | 0 |
| Karma Received | 20 |
| Member Since | 04-17-2013 |
Activity Feed
- Got Karma for Re: Splunk DB Connect 2 ConfPathMapper and ExecProcessor Errors. 03-02-2023 05:37 AM
- Got Karma for Re: Having trouble connecting to LDAP server with SSL (LDAPS). 09-16-2021 09:53 AM
- Got Karma for Re: Having trouble connecting to LDAP server with SSL (LDAPS). 06-05-2020 12:49 AM
- Got Karma for Re: Having trouble connecting to LDAP server with SSL (LDAPS). 06-05-2020 12:49 AM
- Got Karma for Re: Having trouble connecting to LDAP server with SSL (LDAPS). 06-05-2020 12:49 AM
- Got Karma for Splunk DB Connect 2 ConfPathMapper and ExecProcessor Errors. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting an error and failed replication config bundle to search peer 'server:8089' in Splunk 6.2.1?. 06-05-2020 12:47 AM
- Got Karma for Splunk App for Web Analytics: Eventtype not found or disabled. 06-05-2020 12:47 AM
- Got Karma for Re: After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this?. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I getting an error and failed replication config bundle to search peer 'server:8089' in Splunk 6.2.1?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App Windows Infrastructure upgrade - No "sourcetype="MSAD*" found. 06-05-2020 12:47 AM
- Got Karma for Why can I not delete a dashboard I created in Splunk 6.2 and receiving error?. 06-05-2020 12:47 AM
- Got Karma for S.O.S 3.1 Upgrade on Windows 2008 R2. 06-05-2020 12:46 AM
- Got Karma for Re: App for Windows Infrastructure 1.0.1. 06-05-2020 12:46 AM
- Got Karma for App for Windows Infrastructure 1.0.1. 06-05-2020 12:46 AM
- Got Karma for Re: How to get data in custom index on Windows App. 06-05-2020 12:46 AM
- Got Karma for S.O.S 3.1 Upgrade on Windows 2008 R2. 06-05-2020 12:46 AM
- Got Karma for S.O.S 3.1 Upgrade on Windows 2008 R2. 06-05-2020 12:46 AM
- Got Karma for S.O.S 3.1 Upgrade on Windows 2008 R2. 06-05-2020 12:46 AM
- Got Karma for S.O.S 3.1 Upgrade on Windows 2008 R2. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
01-25-2018
07:57 AM
Try this
sourcetype= my sourcetype index=my index user=* | stats count | where cs_uri>1000 | table date_month date time user category cs_uri
... View more
01-25-2018
07:42 AM
Did you try removing the comma from 1,000?
... View more
01-23-2018
12:14 PM
Believe so. Each line begins with a timestamp and there are several values for the fields shown that appear on each line. This is a dump of the netstat -ano command on a Windows server.
... View more
01-23-2018
11:53 AM
Hi all,
How would I go about merging multiple values on multiple lines so all values are captured? Currenlty, I am only seeing values from the first line. Data below.
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="135" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID="860"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="443" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="4"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="445" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="4"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="3389" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID="2480"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="4445" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="enstart64" PID="1760"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="5985" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="4"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="8089" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="splunkd" PID="10180"
Thanks!
... View more
- Tags:
- splunk-enterprise
01-22-2018
06:29 PM
Thanks. It works now. I had to change my sourcetype too as netstat was used elsewhere. There was actually no need to modify props.conf.
[script://.\bin\winports.bat]
disabled = 0
interval = 300
sourcetype = winports and not netstat - which is used by Unix app
source = Script:Winports
... View more
I was able to get my LDAPS connection to Active Directory working by doing the following:
Combine all required certificates in chain to a single pem file.
Comment out TLS_CACERTDIR. The output of ldapsearch should tell you that it loaded the file from #1 so no need to have addition certs.
I have TLS_REQCERT set to "never" which I think is default.
ldap.conf
TLS_REQCERT never
TLS_CACERT /opt/splunk/etc/openldap/certs/Your_Cert_Chain.pem
TLS_CACERTDIR /opt/splunk/etc/openldap/certs
TLS_PROTOCOL_MIN 3.3
TLS_CIPHER_SUITE ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
I am running Splunk 7.0.1 on CentOS 7.
... View more
07-02-2017
01:04 PM
Hi all,
I'm using the winports app to index the result of the netstat -ano on my Windows servers. A few months ago the results displayed the various values under the LocalPort field, however, now only the first 3 ports show. I'm thinking that a Splunk upgrade may be the cause. Is there any way to correct this? There should be several more ports available.
Sample Event:
7/2/17
3:51:11.000 PM
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="135" Remo
teAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID=
"704"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="445" Remo
teAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="
4"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="1433" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="sqlservr" PI
D="1284"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="3389" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID
="1824"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="4445" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="enstart64" P
ID="1160"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="8089" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="splunkd" PID
="1596"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="10000" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="beremote" P
ID="2020"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="47001" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID
="4"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49152" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="wininit" PI
D="424"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49153" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PI
D="796"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49154" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PI
D="836"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="53108" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="lsass" PID=
"540"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="53130" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="services" P
ID="532"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="127.0.0.1" LocalPort="1434" R
emoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="sqlservr"
PID="1284"
LocalPort Values:
Values Count %
135 145 63.596%
80 79 34.649%
25 4 1.754%
Thanks,
James
... View more
- Tags:
- splunk-enterprise
10-09-2016
07:40 AM
1 Karma
I did not. Splunk support recommended I upgrade to the latest app version, which I did, but I still saw the errors. I did notice the file system permissions (for me Windows) were not consistent throughout the app's subdirectories which resolve the other issue I was having with files in /local not being read.
Hope this helps...
... View more
08-17-2016
12:50 PM
I figured it out. The external lookup script works.
... View more
08-17-2016
12:32 PM
Hello, all.
I wanted to know if others are resolving the src_ip and dest_ip fields native to the app with actual hostnames? If so, how is it done? External lookup command built into Splunk using the external_lookup.py script?
Thanks.
... View more
08-05-2016
09:56 AM
Thank you, sni.
... View more
08-04-2016
12:54 PM
Hello, all.
Does anyone know if there is a way to keep the app from disabling a given database connection if there is a network disruption or if the database is offline briefly? I've had to restart Splunk each day after in order to re-enable the connection and also re-enable each input. So far, I've changed the maxWaitMillis value indb_connection_types.conf but my custom setting does not appear to take.
Thanks,
James
... View more
06-29-2016
03:38 PM
Should I apply these changes to my global props.conf under \etc\local? Will the changes impact other applications.
... View more
06-29-2016
03:03 PM
Thank you! I will try this.
... View more
06-25-2016
12:12 PM
Hi all,
I would like to modify the \apps\Splunk_TA_windows\bin\win_listening_ports.bat script so that the netstat -anb command outputs the -b switch that shows the process executable. How do I do this? Any help would be greatly appreciated.
James
... View more
05-30-2016
01:24 PM
Hi, all.
I am looking to add an indexer to my existing environment that consists of 1 dedicated indexer and 1 dedicated search head. I do not wish to enable clustering as I simply want to introduce load balancing to indexer function. Are there instructions available on how to add a standalone indexer to an existing deployment? Is the process as simple as:
Install Splunk on new instance, point to existing license master
Copy etc/system/local directory from existing indexer to new indexer - this should create any custom props, transforms, inputs, index configurations on new server
Copy etc/apps from existing indexer to new indexer
Configure ouput.conf files on forwarders to load balance
Add new indexer as search peer on search head
Thank you
James
... View more
- Tags:
- splunk-enterprise
05-30-2016
01:09 PM
1 Karma
Hi, all.
I receiving the following errors in Splunk after enabling several database inputs which do work. I have reinstalled the latest app version with the same results. Any ideas on the cause?
05-30-2016 15:46:09.929 -0400 ERROR ExecProcessor - message from "python "D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Degrade mode - ENTERING - (pid=8512) rename failed. File in use? exception=[Error 32] The process cannot access the file because it is being used by another process
05-30-2016 15:46:09.686 -0400 ERROR ExecProcessor - message from "python "D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Degrade mode - ENTERING - (pid=4804) rename failed. File in use? exception=[Error 32] The process cannot access the file because it is being used by another process
05-30-2016 15:46:08.902 -0400 ERROR ConfPathMapper - ConfPathMapper: D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\local: Refused forced reload of inputs.conf: outstanding write
Thank you
... View more
- Tags:
- Splunk DB Connect
04-01-2016
01:04 PM
I may have answered by own question. I will see if this works. Thanks again.
REGEX = c_ip=("192.80.134.59|192.67.213.194|192.67.213.166")
... View more
04-01-2016
12:12 PM
Thanks so much. So if I wanted to drop a specific IP addresses from field "c_ip", I would specify this in transforms.conf? How could I specific multiple IP addresses not on the same subnet?
[filter_ip]
REGEX = c_ip=192.168.1.254
DEST_KEY = queue
FORMAT = nullQueue
... View more
04-01-2016
09:15 AM
Hello, all.
I would like to filter out a specific client IP address from my IIS logs. What would be the best approach, have the UF or indexer perform the filtering and how do I go about doing that? Configuration for indexer below. Thanks! - James
Props.conf
[iis]
pulldown_type = true
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = False
CHECK_FOR_HEADER = False
TZ = GMT
REPORT-iisw3cfields = iisw3cfields
TRANSFORMS-removecomments = removecomments
Transforms.conf
IIS W3C Log field extractions (Identical in IIS 6 and 7)
These assume that you have enabled all available fields to be logged
[iisw3cfields]
DELIMS = " "
FIELDS = date,time,s_sitename,s_computername,s_ip,cs_method,cs_uri_stem,cs_uri_query,s_port,cs_username,c_ip,cs_version,cs(User_Agent),cs(Cookie),cs(Referer),cs_host,sc_status,sc_substatus,sc_win32_status,sc_bytes,cs_bytes,time_taken
... View more
- Tags:
- iis
01-14-2016
07:27 AM
It is normal Windows event log data. Nothing else is blacklisted/whitelisted for the Application log.
1/14/16
9:56:32.000 AM
01/14/2016 09:56:32 AM
LogName=Application
SourceName=SCLIntra Mobile Sync Service
EventCode=100
EventType=2
Severity = Error
SourceName = SCLIntra Mobile Sync Service
host = v1651ancay014
index = wineventlog
linecount = 55
source = WinEventLog:Application
sourcetype = WinEventLog:Application
... View more
01-14-2016
05:40 AM
I am still seeing this SoureName from my forwarder. Is it possible the UF cannot filter it? The UF is version 6.3.1.
... View more
01-13-2016
01:15 PM
Thank you. I will try it.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
