About cmeo

jayh · ‎08-14-2024

Hello, Can you please extend on how option 2) Consider periodically reading the database in batch mode into a lookup file (or KV store). Each read would overwrite the existing lookup file so you'd only have the most recent data in Splunk. could be implemented?

joshiro · ‎02-03-2023

We need to clean the dispatch directory in a SH clustered environment. We didnt found any best practices for the clean-dispatch command and the Splunk documentation doesnt help either. https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Dispatchdirectoryandsearchartifacts Should we run the clean-dispatch command node per node? Stop node, clean-dispatch, start node? Or should we stop the whole SH cluster, then clean-dispatch each node, and then start the nodes?

jotne · ‎08-28-2022

Search time normalization of mac addresses. This will convert any mac format to XX:XX:XX:XX:XX:XX One liner: | rex mode=sed field=mac "s/[^0-9a-fA-F]//g s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/g y/abcdef/ABCDEF/" Other versions: | rex mode=sed field=mac "s/[^0-9a-fA-F]//g" | eval mac=upper(replace(mac, "(..)(..)(..)(..)(..)(..)", "\1:\2:\3:\4:\5:\6")) | rex mode=sed field=mac "s/[^0-9a-fA-F]//g s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/g" | eval mac=upper(mac)

Jhyde517 · ‎11-03-2021

Hi, super long shot, but was a solution ever found to this? We seem to be having this issue right now. Last week all the host fields were parsed to include the domain part, this week they are back to being hostname only. I've compared 2 logs from the same host, with the same event ID. The only difference I can see in the logs is that dvc_nt_host is different between the 2, while dvc is the fqdn on both. Which is super off because this line is in the props.conf of the Windows TA app FIELDALIAS-dvc = host as dvc, host as dvc_nt_host

jaxjohnny2000 · ‎10-28-2021

nice response. Thank you. What if the event log has spaces, found in the Applications and services node? Do we need quotes or anything? [WinEventLog://Microsoft-Windows-AppLocker/EXE and DLL] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/MSI and Script] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Deployment] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Execution] disabled = 0 index = wineventlog interval = 60

rphillips_splk · ‎09-19-2021

You can run from the Monitoring Console (splunk_monitoring_console app context) to check THP effective state: | rest /services/server/sysinfo splunk_server_group=dmc_group_indexer | table splunk_server version numberOfCores, numberOfVirtualCores physicalMemoryMB ulimits.open_files transparent_hugepages.effective_state | sort +splunk_server

Esky73 · ‎04-26-2021

This is still working in 8.1x But also please vote for an official method for wildcarding sourcertypes : https://ideas.splunk.com/ideas/E-I-11

mscomms · ‎01-21-2021

I edit the css within the dashboard by adding a css panel then once it is working as expected then move it to a file. That way it just works with a save rather than having to bump the server <row> <panel depends="$alwaysHideCSS$"> <html> <label>CSS Panel Do Not Delete</label> <style> CSS Goes Here </style> </html> </panel> </row>

cmeo · ‎10-17-2019

Pretty much as I thought then. It seems to me that if you're using something like git to store your splunk configs--and you should be!--it will be simpler in most cases to assemble an app to splunk your git repo and search your configuration elements that way. I have actually done this myself years ago but neglected to retain the exact method when I left that engagement. What I do remember is that it involved using only one depth of the repo (i.e. current master versions for all configs) and storing the full path, the conf file path and name, and the specific element which was configured. Keyword searches for any item then showed you what sort of a thing it was, where it was defined and additionally where it was used. This was also handy for finding out whether you had an existing sourcetype you could use, or whether you had to create a new one. Might seem trivial, but it isn't when you have hundreds or thousands of data sources and sourcetypes in a large enterprise. Ah well, might need to figure out how to do it all over again!

cmeo · ‎02-18-2019

In that case it looks like a permissions issue. If you want to use these aliases inside search, change the permissions for the aliases in local.meta so that they're exported system wide for read. And also any other objects inside the app that you might want to use from another app. I haven't loaded this app since I don't have a fortigate, but typically an installation will set the knowledge objects to be only visible within the originating app. Make sure, of course, that any objects you do this to, don't conflict with things exported from other apps (unlikely, as they should be tied to sourcetypes only applicable to fortigate, but worth checking nonetheless), or you won't get the results you expect. You can use btool to check the work.

cmeo · ‎11-27-2018

You won't be able to run a SPARC V9 binary on Solaris X86. Get the X86 UF from here: https://www.splunk.com/en_us/download/universal-forwarder.html#tabs/solaris

jvarshney · ‎10-27-2018

I fixed the problem by changing the scripts for vmstat and top inputs. Thanks Charles for the guidance.

cmeo · ‎08-21-2018

Can this problem be solved using a standalone search peer which is just for this purpose? In some places I've worked putting the production cluster into maintenance mode to load old data is simply not an option. There must be a better way. It seems needlessly restrictive and complicated to have to restore the buckets on the cluster nodes it first came from. Enhancement needed?

cmeo · ‎06-01-2017

Yeah thought it might be something like that because I did notice that 'Thruput' wasn't listed. Interesting though, that it can be rounded even though it's hiding. Well, that's show business.

cmeo · ‎05-30-2017

OK thanks to the responders, problem solved. Create tokens for the four values passed (N, S, E, W limits) and make sure the target search includes lats and longs. For instance: sourcetype=customer| eval l_location=upper(location)|eval state="VIC" | lookup locations suburb as l_location state output lat lon | where (lon >= $lon1$ AND lon < $lon2$) AND (lat >= $lat2$ AND lat < $lat1$) | sort surname1 | table firstname1 surname1 phone1 email1 address location And the thing that threw me: I'm in the southern hemisphere, note that the relation operators for lats are reversed because all our lats are negative! Thanks to my good lady wife for spotting that one...D'oh!

cmeo · ‎12-13-2016

The only other time I've seen something like this is where you have a combination of INDEXED_EXTRACTIONS (which I use) and routing as documented here: http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Routeandfilterdatad There is unfortunately SPL-98594 about this which from what Support tell me is very difficult to fix and has low priority. It's been open for three years now but I didn't know about it until after I'd written the TA. If you are using it in conjunction with routing, unexpected things may happen. I cannot suggest a workaround if this is the issue; we had to turn off routing. This may or may not be an option for you. The symptoms were much the same: some but not all sourcetypes being silently dropped on the floor. If this isn't what's happening, please discuss with me further by email as suggested above.

ddrillic · ‎08-27-2017

@sahr, you better open a new thread and refer to this one for reference...

summitsplunk · ‎11-28-2017

"You can manually trigger config snapshot via CLI: aws configservice deliver-config-snapshot deliver-config-snapshot" When I run this command I get an error saying "--delivery-channel-name is required" Any chance you could show me an example of how I'm supposed to run the command?

vshcherbakov_sp · ‎02-24-2016

Sorry for long delay in response.. Request acknowledged - will discuss with PM and see what we can do.

pchen_splunk · ‎12-22-2015

AWS app tries to fill AWS account ID every time when you are in configure page and the account ID is empty. You can try the following steps: Open splunk_app_aws/configure page, check if "Account ID" has value. If not, check all_account_ids.csv in "lookup" folder to see if it records your account ID. It should record your ID, otherwise, you can check splunkd.log and saas_app_aws.log to see if any exceptions popped. If no account ID and error has been found, you can try to add it manually. You follow steps as czhang posted.

_d_ · ‎11-19-2015

You can change the center of the panel two ways: Edit Source and enter your own center coordinates which are currently set as such: (42.879094,-97.381205) Edit Panel, zoom/pane to your desired location and click on "Populate with current map settings"

fshao_splunk · ‎11-19-2015

Hi, Thank you for your comment ! The savedsearch in AWS App is non-scheduled at first place (which is a practice we need to follow). And you can enable it by any modifications of "AWS Config" on configuration page, then, the topology data will be generated by schedule automatically. It will run every 20 minutes. For more information about it, please refer to http://docs.splunk.com/Documentation/AWS/4.0.0/Installation/Config Thanks!

Runals · ‎06-24-2015

I like the idea of a bootstrap process at the initial install. The challenge is making that work in a distributed environment where you have more than one server and/or an environment where you have Splunk servers not listed as search peers of the search head where this app is installed. When you do a | rest query in Splunk on a search head the data that comes back will be from that system as well as any search peers it is connected to (indexers typically) unless you put in splunk_server=local. I'd guess that doesn't typically include other search heads - at least our environment doesn't though it is why Splunk has gone that route with the distributed management console. Another scenario is a company having multiple environments but perhaps one management search head with visibility across all. At any rate all of those factors and more went into why I created the TA as a component for this app which would then be shipped out to each component server and with the queries running the splunk_server=local 'switch'.

Simon · ‎07-26-2015

Hi cmeo Thanks a lot for your suggestion. Honestly, I haven't been aware it was possible to run a rest call without adding an app or user. The enhancement has been committed and will be released soon, together with the 2.0 release. Thanks Simon

jbullough · ‎06-28-2016

Thank you for this. A year later and this is still not pointed out clearly in docs. A slightly strange place to put the TA (at least to me).

Posts	134
Solutions	2
Karma Given	0
Karma Received	38
Member Since	‎06-21-2010

Online Status	Offline
Date Last Visited	‎12-16-2021 03:35 AM

Where do fields come from?

How does DB connect handle a row update?

Rounding in chart with by clause

geostats cluster map drilldown: what token/s are a...

CSS reference

Files not reindexing even after deleting the fishb...

AWS app: description vs config

Splunk App for Stream: Suggestions for enhancement...

Splunk App for AWS: Why is all_account_ids.csv not...

Splunk App for AWS Cloudtrail activity by location...

Re: How does DB connect handle a row update?

Re: Where can I find documentation for splunkd cle...

Re: How to normalize MAC address format?

Re: Where does windows get its host field from?

Re: How do I collect basic Windows OS Event Log da...

Re: How do I disable Transparent Huge Pages (THP) ...

Re: Is it possible to use wildcards in sourcetype ...

Re: CSS reference

Re: Where do fields come from?

Re: Fortigate logs are not in CIM format

Re: ./splunk: cannot execute

Re: Splunk TA for Solaris 11 doesn't give correct ...

Re: How do I thaw frozen buckets in a multi-site i...

Re: Rounding in chart with by clause

Re: geostats cluster map drilldown: what token/s a...

Re: Splunk TA for Solaris 11: How to get the Solar...

Re: Files not reindexing even after deleting the f...

Re: AWS app: description vs config

Re: Splunk App for Stream: Suggestions for enhance...

Re: Splunk App for AWS: Why is all_account_ids.csv...

Re: Splunk App for AWS Cloudtrail activity by loca...

Re: Splunk App for AWS: topology tsidx does not ge...

Re: Troubleshooting the App

Re: Not so much a question as a suggestion

Re: Where has the TA for alert manager gone?

Are you a member of the Splunk Community?