Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About johnrbhancock
johnrbhancock
Engager
Member since:
05-14-2020
12-18-2023
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 05-14-2020 |
Activity Feed
- Posted help indexing XML on Splunk Enterprise. 12-18-2023 02:22 PM
- Posted Re: How to extend Splunk log retention to forever? on Splunk Search. 11-14-2023 05:14 PM
- Posted How to extend Splunk log retention to forever? on Splunk Search. 11-14-2023 05:00 PM
- Posted Re: scom: how to remove resolved events that are monitored using dedup on Splunk Search. 03-30-2022 02:23 PM
- Posted returning values that dont exist on Splunk Search. 04-07-2021 04:58 PM
- Posted Re: OAUTH2 authentication in splunk service now on All Apps and Add-ons. 05-14-2020 04:56 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
12-18-2023
02:22 PM
I am attempting to ingest an XML file but am getting stuck can someone please help. The data will ingest if I remove "BREAK_ONLY_BEFORE =\<item\>" but with a new event per item. this is the XML and code I have tried <?xml version="1.0" standalone="yes"?>
<DocumentElement>
<item>
<hierarchy>ASA</hierarchy>
<hostname>AComputer</hostname>
<lastscandate>2023-12-17T11:08:21+11:00</lastscandate>
<manufacturer>VMware, Inc.</manufacturer>
<model>VMware7,1</model>
<operatingsystem>Microsoft Windows 10 Enterprise</operatingsystem>
<ipaddress>168.132.11.200</ipaddress>
<vendor />
<lastloggedonuser>JohnSmith</lastloggedonuser>
<totalcost>0.00</totalcost>
</item>
<item>
<hierarchy>ASA</hierarchy>
<hostname>AComputer</hostname>
<lastscandate>2023-12-17T12:20:21+11:00</lastscandate>
<manufacturer>Hewlett-Packard</manufacturer>
<model>HP Compaq Elite 8300 SFF</model>
<operatingsystem>Microsoft Windows 8.1 Enterprise</operatingsystem>
<ipaddress>168.132.136.160</ipaddress>
<vendor />
<lastloggedonuser>JohnSmith</lastloggedonuser>
<totalcost>0.00</totalcost>
</item>
<item>
<hierarchy>ASA</hierarchy>
<hostname>AComputer</hostname>
<lastscandate>2023-12-17T11:54:28+11:00</lastscandate>
<manufacturer>HP</manufacturer>
<model>HP EliteBook 850 G5</model>
<operatingsystem>Microsoft Windows 10 Enterprise</operatingsystem>
<ipaddress>168.132.219.32, 192.168.1.221</ipaddress>
<vendor />
<lastloggedonuser>JohnSmith</lastloggedonuser>
<totalcost>0.00</totalcost>
</item>
<item>
<hierarchy>ASA</hierarchy>
<hostname>AComputer</hostname>
<lastscandate>2023-12-17T11:50:20+11:00</lastscandate>
<manufacturer>VMware, Inc.</manufacturer>
<model>VMware7,1</model>
<operatingsystem>Microsoft Windows 10 Enterprise</operatingsystem>
<ipaddress>168.132.11.251</ipaddress>
<vendor />
<lastloggedonuser>JohnSmith</lastloggedonuser>
<totalcost>0.00</totalcost>
</item> Inputs.conf [monitor://D:\SplunkImportData\SNOW\*.xml]
sourcetype=snow:all:devices
index=asgmonitoring
disabled = 0 Props.conf [snow:all:devices]
KV_MODE=xml
BREAK_ONLY_BEFORE =\<item\>
SHOULD_LINEMERGE = false
DATETIME_CONFIG = NONE
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
11-14-2023
05:14 PM
Wow thankyou for such a quick response. What is the maximum for Hot > Cold. The data size is negligible 17 mb for 3 months so no issues with disk size. Comparable to the security logs its a drop in the ocean.
... View more
11-14-2023
05:00 PM
We use splunk for data analysing and monitoring. We have the Service Now add in to collect CMDB data. It goes back and collects all the data then only collects new info on changes. Therefore if we have any logs at any point being set from hot/cold to cold/frozen it will remove the data points we require. The add-on is not setup to grab all the data again. This means we cannot lose any of that data otherwise the results wil be incomplete. I would like to make it so that the data never goes from hot/cold cold/frozen or have some input on how we can best make this scenario work.
... View more
03-30-2022
02:23 PM
I have been brainstorming the same issue. The issue is when the alert is closed then reopened it wont recongnise the same event id as the id seems to change, so if it flaps youll get alert storms. My solution is to use the monitoringobjectid and the name together. The monitoringobjectid is unique to each object but can have multiple different alerts raised against it. So using the name you ensure you only get unique events for that object. This will help with Maintenance Mode and alert storms. Even with disk alerts that seem to continue raising events at certain intervals of disk usage have different ids.
... View more
04-07-2021
04:58 PM
I have two queries. I have enabled the installed software script in splunk so I can determine where software is not installed on a windows server. How do I run a query to return all hosts that do not have specific software installed. The not function seems to only return items in a table. for example I have operations manager installed on serverx but not serverb how do I query all the servers to return server b. The second query I have is: I have pulled in two csv data sources. The first list is our CMDB server list (call it A) and the second list is an extract of servers that have agents installed (call it B). I would like to compare the two lists and return the hosts that are in list A but not in list B. The two liosts are in the same index and have the same field name (Name) for servername.
... View more
05-14-2020
04:56 PM
According to their documentation it should be available but the option is not in the app
https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/ConfigureServiceNowtointegratewithSplunkEnterprise
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-18-2023
09:47 PM
|
