Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Apps & Add-ons
- :
- About schandrasekar
schandrasekar
Loves-to-Learn
Member since:
04-27-2020
10-14-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-27-2020 |
Activity Feed
- Posted Re: Noob guide to configure on All Apps and Add-ons. 10-13-2020 05:42 PM
- Tagged Re: Noob guide to configure on All Apps and Add-ons. 10-13-2020 05:42 PM
- Posted Re: Can someone explain how splunk stream can be used to get email headers on All Apps and Add-ons. 08-04-2020 10:48 PM
- Posted Can someone explain how splunk stream can be used to get email headers on All Apps and Add-ons. 08-04-2020 08:50 PM
- Tagged Can someone explain how splunk stream can be used to get email headers on All Apps and Add-ons. 08-04-2020 08:50 PM
- Tagged Can someone explain how splunk stream can be used to get email headers on All Apps and Add-ons. 08-04-2020 08:50 PM
- Posted Re: How does Splunk Streams handle a SMTP stream containing multiple emails? on All Apps and Add-ons. 08-04-2020 08:42 PM
- Tagged Re: How does Splunk Streams handle a SMTP stream containing multiple emails? on All Apps and Add-ons. 08-04-2020 08:42 PM
- Tagged Re: How does Splunk Streams handle a SMTP stream containing multiple emails? on All Apps and Add-ons. 08-04-2020 08:42 PM
- Posted Re: Building AD Lookups in MS Windows AD Objects on All Apps and Add-ons. 07-21-2020 07:10 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-01-2022
05:30 AM
We are using python 3.7 and multiple python versions are installed on the server, but in $SPLUNK_HOME/etc/system/local we set python.version = force_python3
... View more
10-13-2020
05:42 PM
Hi , I am looking to integrate Splunk and MobileIron Core. At MobileIron Core end , it is prompting to enter Inder details. Our current architecture is UF->HF->IDX->SH, I am looking for ways to configure either to HFs or IDX cluster ? Is there any docs or leads please? Also, where to download the app "MobileIron App for Splunk Enterprise"?
... View more
10-13-2020
05:35 PM
Hi, I am looking at how to integrate MobileIron Core data to Splunk HFs or Splunk Index cluster. Any leads, please?
... View more
10-13-2020
05:19 PM
Hi , Our existing splunk architecture UF->HF->IDx->SH MY question here is, is that the only way to get data from MobileIron Core to splunk? How do i send the data to HF instead of IDX? thanks, Sangeetha
... View more
08-04-2020
10:48 PM
@thambisetty date_time doesn't look like the time when the message was sent by the user. Also, I am looking for original IP field to be the actual sender IP https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking?view=exchserver-2019
... View more
08-04-2020
08:42 PM
Can someone explain how splunk stream can be used to get email headers
... View more
07-21-2020
07:10 PM
schHi Shogan, I am getting the same error whenever i run the report ms_ad_obj_sched_sync_user subsearch]: No matching fields exist. [subsearch]: No results. Created empty file 'AD_Objects_Queue_Main'. Also, field sync_dn_chg is always 0. Pleas help . Issue is for all the searches that uses the macro |`ms_ad_obj_sched_sync_objects_base("","")`
... View more
05-03-2020
08:22 PM
Only for the stanza icann_top_level_domain_list , we are getting error "threat list download failed after multiple retries" Learn more.list" retries_remaining="-1" status="threat list download failed after multiple retries" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
Here is the sample log
2020-04-16 23:30:15,664+0000 INFO pid=17793 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="2" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-04-16 23:31:45,919+0000 INFO pid=17793 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="1" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-04-16 23:33:16,208+0000 INFO pid=17793 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="0" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-04-16 23:34:16,256+0000 INFO pid=17793 tid=MainThread file=threatlist.py:download_csv:417 | stanza="icann_top_level_domain_list" retries_remaining="-1" status="threat list download failed after multiple retries" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-04-17 02:51:43,154+0000 INFO pid=17044 tid=MainThread file=threatlist.py:run:459 | status="continuing" msg="Processing stanza" name="threatlist://icann_top_level_domain_list"
2020-04-17 02:51:43,154+0000 INFO pid=17044 tid=MainThread file=threatlist.py:run:473 | status="retrieved_checkpoint_data" stanza="icann_top_level_domain_list" last_run="1587079694.838963"
2020-04-17 02:51:43,154+0000 INFO pid=17044 tid=MainThread file=threatlist.py:download_csv:364 | status="CSV download starting" stanza="icann_top_level_domain_list"
2020-04-17 02:52:13,381+0000 INFO pid=17044 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="3" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-04-17 02:53:43,697+0000 INFO pid=17044 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="2" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-04-17 02:55:13,916+0000 INFO pid=17044 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="1" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-04-17 02:56:44,174+0000 INFO pid=17044 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="0" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-04-17 02:57:44,234+0000 INFO pid=17044 tid=MainThread file=threatlist.py:download_csv:417 | stanza="icann_top_level_domain_list" retries_remaining="-1" status="threat list download failed after multiple retries" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-05-02 02:51:43,206+0000 INFO pid=23520 tid=MainThread file=threatlist.py:run:459 | status="continuing" msg="Processing stanza" name="threatlist://icann_top_level_domain_list"
2020-05-02 02:51:43,207+0000 INFO pid=23520 tid=MainThread file=threatlist.py:run:473 | status="retrieved_checkpoint_data" stanza="icann_top_level_domain_list" last_run="1587091903.1543882"
2020-05-02 02:51:43,207+0000 INFO pid=23520 tid=MainThread file=threatlist.py:download_csv:364 | status="CSV download starting" stanza="icann_top_level_domain_list"
2020-05-02 02:52:13,858+0000 INFO pid=23520 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="3" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-05-02 02:53:44,127+0000 INFO pid=23520 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="2" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-05-02 02:55:14,407+0000 INFO pid=23520 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="1" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-05-02 02:56:44,681+0000 INFO pid=23520 tid=MainThread file=threatlist.py:download_csv:390 | stanza="icann_top_level_domain_list" retries_remaining="0" status="retrying download" retry_interval="60" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
2020-05-02 02:57:44,703+0000 INFO pid=23520 tid=MainThread file=threatlist.py:download_csv:417 | stanza="icann_top_level_domain_list" retries_remaining="-1" status="threat list download failed after multiple retries" url="https://data.iana.org/TLD/tlds-alpha-by-domain.txt"
... View more
04-29-2020
03:45 PM
Health Check:msg="A script exited abnormally with exit status:1" are poppling for below inputs
input=".opt/splunk/etc/apps/SA-Utils/bin/dm_accel_settings.py"
input="opt/splunk/etc/apps/SA-Utils/bin/configuration_check.py"
Internal log for all above shows "Client is not authenticated"
Internal log dm_accel_settings.log
ERROR pid=23024 tid=MainThread file=dm_accel_settings.py:run:182 | status="REST exception encountered when updating acceleration settings" model=Splunk_Audit,exc=[HTTP 401] Client is not authenitcated
ERROR pid=23024 tid=MainThread file=dm_accel_settings.py:run:182 | status="REST exception encountered when updating acceleration settings" model=Risk,exc=[HTTP 401] Client is not authenitcated
ERROR pid=23024 tid=MainThread file=dm_accel_settings.py:run:182 | status="REST exception encountered when updating acceleration settings" model=Incident_Management,exc=[HTTP 401] Client is not authenitcated
ERROR pid=23024 tid=MainThread file=dm_accel_settings.py:run:182 | status="REST exception encountered when updating acceleration settings" model=Endpoint,exc=[HTTP 401] Client is not authenitcated
ERROR pid=23024 tid=MainThread file=dm_accel_settings.py:run:182 | status="REST exception encountered when updating acceleration settings" model=Domain_Analysis,exc=[HTTP 401] Client is not authenitcated
ERROR pid=23024 tid=MainThread file=dm_accel_settings.py:run:182 | status="REST exception encountered when updating acceleration settings" model=Change,exc=[HTTP 401] Client is not authenitcated
Internal log
... View more
05-21-2020
06:20 AM
I try to remember to post my resolutions after things get fixed, but unfortunately this one slipped through the cracks. It was a long time ago, and if I remember correctly, the fix was indirect. (Its been a while, but I THINK this is what happened)
Main problem: Our indexer had MUCH too slow storage. (networked raid5, probably 300 iops shared with multiple VMs)
Our network was not consistent, and latency was high (look up "long fat pipe"). Basically, didn't matter how "fast" the pipe was, the TCP round trip time was an artificial throttle.
To resolve:
We worked with our users to reduce our logs (had to kick someone off for a while, they were accounting for 10 of the 15 gigs). This let us continue to collect the critical logs while we came up with a path forward.
Our system was originally designed to handle ~5GB tops (about 5x more than the requirement!), and peaking at 15 gigs was waaaay outside scope. We got our hands on some money and purchased 2x dedicated servers (indexers) with SSD storage for the warm buckets
I feel that the main issue causing this whole thing was the slow storage on the indexers. Nothing was really reporting queues full except the forwarder, but reducing the incoming logs fixed it immediately, and upgrading the hardware we are able to push 20-30gb a day with no issues.
The slow network has since been upgraded (latency is same, pipe is fatter) but I am not certain that was ever the issue.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-14-2020
12:02 AM
|
