Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About delink
delink
Communicator
Member since:
05-17-2011
03-30-2021
Community Statistics
| Posts | 52 |
| Solutions | 5 |
| Karma Given | 34 |
| Karma Received | 18 |
| Member Since | 05-17-2011 |
Activity Feed
- Got Karma for Re: Enterprise Security Message. 09-14-2022 06:42 AM
- Got Karma for Re: WinEventLog:ForwardedEvents override. 11-12-2020 02:21 AM
- Got Karma for Re: slim package includes dot_underscore files and appinspect fails because of them. 06-05-2020 12:50 AM
- Karma Re: DB Connect app issue - Cannot communicate with task server for chskm. 06-05-2020 12:49 AM
- Karma Re: Why won't SplunkWeb start after ES was upgraded? for LukeMurphey. 06-05-2020 12:49 AM
- Got Karma for Re: Session timeout log. 06-05-2020 12:49 AM
- Got Karma for Re: Session timeout log. 06-05-2020 12:49 AM
- Karma Splunk 6.6.1 stops monitoring files for craigkleen. 06-05-2020 12:48 AM
- Karma Enterprise Security 4.7 - Threat Intel Downloads Won't Stop Despite Disabling for thomas_porter. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk 6.6.1 stops monitoring files. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk 6.6.1 stops monitoring files. 06-05-2020 12:48 AM
- Karma Why does our Splunk 6.3 Search Head Cluster fail only when a specific member is elected as the Captain? for kwasielewski. 06-05-2020 12:47 AM
- Karma Re: Has anybody been successful with configuring the Splunk Support for Active Directory app on Splunk 6.1.1? for m4him7. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect 2 - dbxquery only returns 1001 rows for jeff. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect 2 - dbxquery only returns 1001 rows for clayramey. 06-05-2020 12:47 AM
- Karma Re: Why is the "map" command not working in dashboard and the corresponding panel displays "Waiting for inputs"? for wbcem. 06-05-2020 12:47 AM
- Karma Re: cannot get all clients via 'list deploy-clients' after upgrading splunk 6.2.0 for nicolas_perreau. 06-05-2020 12:47 AM
- Karma Re: Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations? for mookiie2005. 06-05-2020 12:47 AM
- Karma Does Splunk recommend 1200 IOPS or 1200 Random Seeks per second? for alexandercouto. 06-05-2020 12:47 AM
- Karma Re: No data showing in Hurricane Check Point Splunk application - OPSEC LEA working fine? for k3153717nn. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 |
01-31-2019
01:54 PM
1 Karma
I would highly recommend the advice on this site.
http://drmuey.com/?do=page&id=15
COPYFILE_DISABLE=true should always be in your environment when packaging tarballs on macOS.
... View more
01-31-2019
04:57 AM
A slightly safer way to do this is just transfer the captaincy to another member of the cluster so that it rebuilds the replicaSet configuration for mongod. No stops or cleans required.
https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Transfercaptain#Change_the_captain
... View more
01-10-2019
08:04 AM
2 Karma
Isn't WRITE_META = true needed when modifying these kinds of values in transforms?
Additionally, the "source" field is very important in windows event logs, so shouldn't there also be a transform for that here?
The props configuration should also reference the source rather than sourcetype to better work with version 5 and up of the Windows TA.
... View more
06-05-2018
08:38 AM
I downvoted this post because the answer does not solve the problem. the accepted answer should be moved to jeffland's below.
... View more
06-05-2018
08:37 AM
This answer is the correct solution for this not the accepted answer above. I was able to get it work with the following:
[mask_ssn01_cs_uri_query]
SOURCE_KEY = _meta
REGEX = (?i)(.*(?:ssn|SearchValue)=)\d{0,5}(\d{4}.*)
DEST_KEY = _meta
WRITE_META = false
FORMAT = $1XXX-XX-$2
... View more
05-21-2018
07:45 AM
It looks like you might be able to use the Cache SQL Gateway to do this in DB Connect.
http://docs.intersystems.com/latest/csp/docbook/DocBook.UI.Page.cls?KEY=BGJD_gateway
... View more
04-23-2018
11:54 AM
I have noticed that Splunk sometimes hangs on startup in one customer's enviroment, and when it does, it seems to be trying to access a directory in /home that doesn't make much sense. Here is the behavior and where it is hanging:
$ ps ax|grep splunk
32023 pts/0 S 0:00 /opt/splunk/bin/splunk start
32032 pts/0 S 0:00 python -u /opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py _py_internal check-xml-files
32055 pts/0 S+ 0:00 grep --color=auto splunk
$ strace -p 32032
Process 32032 attached
--- SIGCONT {si_signo=SIGCONT, si_code=SI_USER, si_pid=30777, si_uid=74782} ---
stat("/home/build/build-home/kimono/lib/tls/x86_64",
This seems to happen on many versions, but sometimes the directory name is different (It seems like a codename for the version).
Why is Splunk trying to access /home/build on a production installation?
... View more
01-08-2018
07:21 AM
rb_ is specifically a replicated bucket, meaning it is there because another peer replicated it to this peer. db_ buckets are the primary buckets when the repfactor is greater than 1.
... View more
12-07-2017
01:38 PM
2 Karma
We were trying to answer this same question and came up with nothing. There does not seem to be a log anywhere that shows a session getting reaped.
An example of a search I ran is:
index=_internal sourcetype=splunk_web_service | stats count by reason
... View more
09-14-2017
06:45 AM
We do have a case open with Splunk on this, and it is a noted bug now. My customer was running the case with support, so I do not have the JIRA for it, but they did offer a hotfix, so I think this may be fixed in either 6.6.3 or whenever 6.6.4 comes out.
... View more
07-07-2017
07:54 AM
I am seeing this issue in both 4.7.0 and 4.7.1 as well. It almost seems like it isn't paying attention to the configuration and just doing what is configured by default out of the box.
... View more
06-27-2017
01:48 PM
2 Karma
Did a case get opened on this? I think I am seeing the same thing, and we can open one also.
... View more
05-26-2017
06:03 AM
I can't find anything in here on how it would be deployed on clustered indexers. I would assume I'd use a similar configuration pushed from master-apps, but it would be a good thing to cover in the docs!
... View more
09-14-2016
10:21 AM
Blacklist by eventcode is a feature of the WinEventLog input method, which you are not using. There is no way to make that work with WMI collection. The method specified in this post is the right way to do it for WMI.
... View more
08-26-2016
01:32 PM
You might want to consider writing a more complicated SQL query to do all of those joins on the backend, then present only the individual fields that you care about from the joined SQL results by narrowing down what you include in the SELECT statement.
... View more
07-30-2016
12:49 PM
It seems like the latest version upped this limit to 5001, but the problem bit me too, and I was going crazy trying to figure out why my query was behaving differently between Splunk and the mysql client. I also raised the limit inside the code to the maximum allowed value for maxSetRows, which seems to be 50,000,000 for this particular driver.
... View more
03-30-2016
06:06 AM
I am seeing this issue with the Cisco Security App's Firewall Overview panel on the current version of Splunk Cloud as well. Is there an ETA on when this bug might be fixed? Thanks!
... View more
03-28-2016
11:58 AM
You need to use REPORT-windows_firewall not EXTRACT.
... View more
03-09-2016
09:32 AM
I downvoted this post because splunk now supports saml natively, so there should be a way to do it in the software without a reverse proxy.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-30-2021
01:19 PM
|
Karma given to
