About rijhwani

rijhwani · ‎04-28-2014

No, but you could get all the users assigned to a Splunk group in the LDAP, and craft your group search accordingly. It is, after all, how LDAP was supposed to be used.

rijhwani · ‎06-15-2012

The configs are indeed on the indexers. It is only specific messages I want to lose, so diverting an entire sourcetype to the black hole is not suitable. (As you might guess - only the Cacti polling. Any other unexpected SNMP I want to see.)

rijhwani · ‎06-13-2012

I can understand the spaces needing escaping, but whilst it is sloppy I would have expected '.' in the regex to match anything, including a literal ".". It hasn't worked, BTW.

rijhwani · ‎06-13-2012

In /var/log/messages on numerous machines I have the following messages: Jun 13 19:55:34 hostabc snmpd[27898]: Received SNMP packet(s) from UDP: [p.q.r.s]:46999 Jun 13 19:55:34 hostabc snmpd[27898]: Connection from UDP: [p.q.r.s]:46999 I just want to eradicate these particular messages. I Ideally, I would like to not have them forwarded from to the indexers in the first place, but as a first goal I just want to stop them being indexed. Taking my cues from Splunk online docs I have made config additions on both the indexers: In etc/local/props.conf : [source::/var/log/messages] TRANSFORMS-null= ditchCacti In etc/local/transforms.conf : [ditchCacti] REGEX = from UDP: \[p.q.r.s\]: DEST_KEY = queue FORMAT = nullQueue Splunk has been restarted, but the offending messages continue to be indexed. Am I on the right track, or have I completely misunderstood something?

rijhwani · ‎05-23-2012

OK, so it only floats right during the real time aggregation. On completion it floats back left. Odd behaviour, and not documented anywhere I could find.

rijhwani · ‎05-23-2012

Search: index=_internal source=*license_usage.log | eval ISODate=strftime(strptime(date_year."-".date_month."-".date_mday, "%Y-%b-%d"), "%Y-%m-%d (%a)") | eval MB=b/1024/1024 | chart eval(round(sum(MB),0)) over i by ISODate limit=0 | addcoltotals labelfield=i I'm not sure the ISODate evaluation is the best way to achieve my end, but that is not the issue here. The problem is that when I use this chart, the column with the indexer UIDs is floated to the rightmost position in the table (presumably due to the fact that a simple alphanumeric string sort puts the dates before the letter "i"). What I need is to anchor the indexer column to the left regardless.

rijhwani · ‎03-02-2012

SSL is by its very nature an endpoint to endpoint protocol. The encrypted connection is established before any identifying traffic passes in either direction (other than the certificate exchange). You can never share encrypted and unencrypted traffic on the same server port.

Posts	7
Solutions	1
Karma Given	5
Karma Received	6
Member Since	‎01-13-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Discarding log entries by specific content

addcoltotals floats the label column to the right

Re: LDAP user role setting

Re: Discarding log entries by specific content

Re: Discarding log entries by specific content

Discarding log entries by specific content

Re: addcoltotals floats the label column to the ri...

addcoltotals floats the label column to the right

Re: Can a Splunk indexer accept ssl and non-ssl co...