Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About JoshWhaley
JoshWhaley
Path Finder
Member since:
06-16-2015
06-05-2020
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 35 |
| Karma Received | 10 |
| Member Since | 06-16-2015 |
Activity Feed
- Got Karma for Re: Keyboard Shortcut to Format Search. 07-23-2024 11:51 AM
- Karma Re: Splunk DB Connect 2.4: How to resolve "AuthenticationError: Request failed: Session is not logged in" error on Heavy Forwarder? for jkat54. 06-05-2020 12:48 AM
- Karma Re: How do I filter data with Python/REST KV Store query ? for goodsellt. 06-05-2020 12:48 AM
- Karma Search formatting in Splunk 6.5.0 for easier readability for markdflip. 06-05-2020 12:48 AM
- Karma Re: Search formatting in Splunk 6.5.0 for easier readability for lquinn. 06-05-2020 12:48 AM
- Karma Re: Keyboard Shortcut to Format Search for lukejadamec. 06-05-2020 12:48 AM
- Karma Why is Splunk DB Connect 2 not rotating py_health.log on a Windows Heavy forwarder for ragedsparrow. 06-05-2020 12:48 AM
- Karma How to resolve Splunk SDK for Python custom streaming search command? for kcnolan13. 06-05-2020 12:48 AM
- Karma Re: How to resolve Splunk SDK for Python custom streaming search command? for kcnolan13. 06-05-2020 12:48 AM
- Karma Re: What happened to the Hadoop Connect app? for ChrisG. 06-05-2020 12:48 AM
- Karma Re: What happened to the Hadoop Connect app? for rdagan_splunk. 06-05-2020 12:48 AM
- Got Karma for Keyboard Shortcut to Format Search. 06-05-2020 12:48 AM
- Got Karma for Keyboard Shortcut to Format Search. 06-05-2020 12:48 AM
- Got Karma for Keyboard Shortcut to Format Search. 06-05-2020 12:48 AM
- Got Karma for Keyboard Shortcut to Format Search. 06-05-2020 12:48 AM
- Got Karma for Re: Keyboard Shortcut to Format Search. 06-05-2020 12:48 AM
- Got Karma for Re: Keyboard Shortcut to Format Search. 06-05-2020 12:48 AM
- Karma Stability issues with db connect 2 'The read operation timed out' for ManfredGrill. 06-05-2020 12:47 AM
- Karma Can Base Searches be nested? for roukepouw. 06-05-2020 12:47 AM
- Karma Re: Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer? for Jason_S. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 4 | |||
| 0 |
04-10-2017
01:28 PM
Although this isn't the answer I was hoping to find, I appreciated the response nonetheless. It's frustrating that, rather than download an already created free app, my only option would now seem to be spending $3k+. I'll set this as the accepted solution however, as it would seem to be the only way to accomplish what I'm looking to do. Thanks for your time.
... View more
04-10-2017
09:56 AM
I'mg looking for a way to ingest data from HDFS data into Splunk Enterprise, and found several blog posts pointing to the Hadoop Connect app. Unfortunately, that seems to have been deleted (getting a 404 error). Does anyone know what happened to the app, or if there is some other way to ingest data from HDFS into Splunk 6.5?
... View more
10-06-2016
01:57 PM
4 Karma
At .conf this year, a new feature was showed off that allowed auto-formatting of SPL in the search bar with the press of a button in 6.5. It took a search from a single line:
index=myindex | stats count by action
to multiple lines:
index=myindex
| stats count by action
Does anyone know what the key is that accomplishes this?
... View more
04-01-2016
07:42 AM
I'm running on Splunk 6.3.1 with DB Connect version 1.1.6, and DB Connect v2 version 2.1.0. Having the same issues you describe here. Did you ever find an answer to your question?
... View more
12-08-2015
10:12 AM
Has there been any progress made here? We're having the same issues on our system, and would really like to finish our upgrade from db connect 1 as soon as possible, as many of our tasks rely on database queries.
... View more
11-16-2015
12:15 PM
I'm on 2.0.4, so it's possible it could be something there, but that doesn't seem likely. One last idea would be to double-check the permissions on the .conf file. Other than that, I'm sorry I couldn't be of more help.
... View more
11-16-2015
10:29 AM
Assuming you did restart Splunk, then I'm fresh out of ideas.. What version of DB Connect are you running?
... View more
11-16-2015
07:07 AM
I would think that should work, although I didn't provide any hiddens= or other parameters, and just have a line with [*]. This will use the default stanza from the default directory. Did you restart Splunk after saving the conf file?
... View more
11-13-2015
10:07 AM
1 Karma
EDIT: Apparently this didn't resolve the issue.. It seemed to for awhile, but I am receiving the errors again. Please disregards the "solution" below.
After editing bin/dbx2/health.py to log the actual exception rather than "The user [user] is not allowed to use the health logger." I was able to see the following:
11/13/2015 10:27:33 [WARNING] [health.py] [HTTP 404] https://127.0.0.1:8089/servicesNS/myUsername/splunk_app_db_connect/db_connect/health/myUsername; [{'type': 'ERROR', 'code': None, 'text': "In handler 'health': Could not find object id=myUsername"}]
Navigating to the parent of this URL showed an 'admin' object, and a 'nobody' object. Doing some digging turned up healthlog.conf inside the default directory. Adding my username as a stanza (or * if you'd like everyone to have permission) to healthlog.conf inside the local directory stopped the error messages, and has seemed to resolve the issue.
... View more
09-17-2015
07:28 AM
2 Karma
I was finally able to resolve this issue once I realized that, unlike web.conf, server.conf's trustedIP only allows for a single IP address. Removing the second IP address, leaving only localhost (127.0.0.1), fixed the problem, and SSO began to work as expected.
... View more
09-17-2015
07:25 AM
Maybe the fact that you didn't add anything to the trustedIP in server.conf is what fixed it for you, believe it or not. I ended up resolving the issue when I realize that, unlike web.conf, server.conf's trustedIP only allows a single IP address. Removing the second IP address (leaving only localhost) from server.conf's trustedIP field resolved the issue for us.
... View more
08-13-2015
11:35 AM
After a lot of searching, I found that my issue was caused by the assumption that the click's provided field would be equal to $click.name$ like many other modules, but as I found here, the field is equal to the y-axis (equal to $click.name2 ).
If your issue is similar to mine, changing the field="" line should resolve the issue.
... View more
08-13-2015
09:33 AM
Also having this issue.. Do charts not support the condition tag within drilldown?
... View more
08-12-2015
07:08 AM
+1 for requesting this feature. It seems odd that maps don't support this feature while others do.
... View more
07-22-2015
12:29 PM
Did you ever find a solution to this? I'm having the same issue.
... View more
07-21-2015
11:14 AM
See my updated question. None of these have worked, and I'm still seeing SSO Enabled: No.
... View more
07-21-2015
10:22 AM
I am working on enabling SSO with a Splunk Enterprise instance, and have set up the reverse proxy on our Windows server. When viewing the /debug/sso page, I am correctly receiving the Remote-User parameter, but it is showing that SSO is not enabled ( SSO Enabled: No ). I have the following in system/local/web.conf :
SSOMode = permissive # I've tried strict as well, which doesn't seem to be affecting anything (even after a restart). I'm still taken to a login page, which shouldn't happen.
remoteUser = Remote-User
trustedIP = <ip of my reverse proxy>,127.0.0.1
tools.proxy.on = false # true takes me to a page saying "Forbidden: Strict SSO" when trying to view anything other than debug pages
# I get this same error even if SSOMode is set to permissive
system/local/server.conf :
trustedIP = 127.0.0.1,<ip of reverse proxy>
What else needs to be changed in order to enable SSO on my Splunk instance? To me, it seems like my SSOMode option is being totally ignored by Splunk.
Here's a screenshot of what /debug/sso looks like:
EDIT: For clarification, I added more info from my web.conf, and from server.conf as well.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
