Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About dtrelford
dtrelford
Path Finder
Member since:
12-07-2017
08-12-2020
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 5 |
| Member Since | 12-07-2017 |
Activity Feed
- Posted Re: Ingesting logs from Microsoft Teams on All Apps and Add-ons. 08-07-2020 08:04 AM
- Posted Re: Ingesting logs from Microsoft Teams on All Apps and Add-ons. 08-07-2020 08:00 AM
- Posted Re: Server.conf allowRemoteLogin set to never, but splunk server still allows remote login? on Security. 08-07-2020 07:19 AM
- Karma Re: Server.conf allowRemoteLogin set to never, but splunk server still allows remote login? for isoutamo. 08-07-2020 07:19 AM
- Posted Re: Server.conf allowRemoteLogin set to never, but splunk server still allows remote login? on Security. 08-06-2020 05:06 AM
- Posted Re: Server.conf allowRemoteLogin set to never, but splunk server still allows remote login? on Security. 08-05-2020 07:08 AM
- Posted Server.conf allowRemoteLogin set to never, but splunk server still allows remote login? on Security. 08-04-2020 12:42 PM
- Karma Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security" for napomokoetle. 06-05-2020 12:50 AM
- Got Karma for Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security". 06-05-2020 12:50 AM
- Got Karma for Perfmon:Memory missing from search head. 06-05-2020 12:49 AM
- Got Karma for Re: Perfmon:Memory missing from search head. 06-05-2020 12:49 AM
- Got Karma for In summary indexing, why does the sitimechart gives different results than the timechart?. 06-05-2020 12:49 AM
- Got Karma for Re: In summary indexing, why does the sitimechart gives different results than the timechart?. 06-05-2020 12:49 AM
- Posted Re: After Updating the Add-on for Windows receive error "Could not load lookup=LOOKUP-app4_for_windows_security" on All Apps and Add-ons. 12-04-2019 11:36 AM
- Posted Re: Index has split into two. How can I merge the new index back into the old? on Getting Data In. 11-25-2019 01:02 PM
- Posted Re: Index has split into two. How can I merge the new index back into the old? on Getting Data In. 11-15-2019 11:23 AM
- Posted Re: Index has split into two. How can I merge the new index back into the old? on Getting Data In. 11-15-2019 11:22 AM
- Posted Index has split into two. How can I merge the new index back into the old? on Getting Data In. 11-12-2019 01:35 PM
- Tagged Index has split into two. How can I merge the new index back into the old? on Getting Data In. 11-12-2019 01:35 PM
- Tagged Index has split into two. How can I merge the new index back into the old? on Getting Data In. 11-12-2019 01:35 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
08-07-2020
08:04 AM
Ignore my last post! I see now that you already answered this in a previous comment.
... View more
08-07-2020
08:00 AM
How did you generate your webhook URL? I'm having trouble understanding the format you provided - https://<webhookName>:<portdefined>. My webhook name is "teams_webhook" and the port i chose was 443. Using your provided format, the webhook looks like https://teams_webhook:443 but this isn't a valid URL. I also tried https://<publicip>:443/teams_webhook but this also fails. Later in your post you describe getting a webhook via https, hostname, port; but this also would only work if your hostname is publicly accessible. Any sugggestions?
... View more
08-07-2020
07:19 AM
This worked. Setting localhost in web.conf and restarting splunkd service stopped web console from being accessible remotely, but is still accessible locally. server.socket_host = localhost
... View more
08-06-2020
05:06 AM
Unfortunately Microsoft does not provide an IP range to whitelist for the Teams app.
... View more
08-05-2020
07:08 AM
I need 443 to be open for a webhook required for functionality of Microsoft Teams Addon for Splunk - (https://splunkbase.splunk.com/app/4994/#/overview), so because of this I can't limit all 443 connections to local only. I checked web.conf configuration options (https://docs.splunk.com/Documentation/ITSI/4.5.0/Configure/web.conf) and I don't see an option to limit the splunk web connections to local only. Is this possible?
... View more
08-04-2020
12:42 PM
I want to stop all remote logins to a Splunk server. To do this, I added the following to /etc/system/local/server.conf (as documented in https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Serverconf😞
allowRemoteLogin = never
After restarting Splunk, web console is still accessible remotely. I also commented out the following in /etc/system/default/server.conf, to rule out a conflict, but issue persists:
# allowRemoteLogin=requireSetPassword
What am I missing?
... View more
- Tags:
- server.conf
Labels
- Labels:
-
access control
-
authentication
-
login
12-04-2019
11:36 AM
1 Karma
This resolved the issue for me.
... View more
11-25-2019
01:02 PM
Update: Moving the hot & warm buckets from the new index location back to the old AND coping the .manifest bucket info from the new to old .manifest worked.
... View more
11-15-2019
11:23 AM
Would there be any issue with doing this in reverse? Moving new index buckets to old index location? The old index location format is the correct one.
... View more
11-15-2019
11:22 AM
The second index is 40Gb in size. Would the collect command be feasible to move this much data?
... View more
11-12-2019
01:35 PM
During the upgrade process for Splunk TA for Windows, the perfmon index location was moved. This resulted in two data locations - one with year of data and another with the last two weeks.
Searches for index=perfmon now only return results from events indexed in the new location.
I'd like to move the data from the new location back into the original location so everything is located within the single perfmon index & location. Is this possible?
... View more
10-22-2018
11:18 AM
SoS is discontinued and no longer supported. Is there an alternative query that can be run now?
My apologies if I should have posted this in a new question.
... View more
08-22-2018
04:19 PM
1 Karma
After working with Splunk Support, I found the solution.
There is a default app created by splunk - Splunk_TA_microsoft_ad
Although all the inputs used in this app were disabled, the app itself was enabled in the app.conf. This was overriding our setup in a custom perfmon app.
Changes made to resolve:
.../etc/apps/Splunk_TA_microsoft_ad/local/app.conf
[install]
state = disabled
Restarted Splunk. Issue is now resolved.
... View more
06-19-2018
11:22 AM
Added the stanza and restarted splunk on the search head. Unfortunately it did not resolve the problem. Search head memory counters are still missing.
... View more
06-19-2018
06:38 AM
Hi soumyasaha,
The stanza you provided has disabled = 1, is that correct? Wouldn't that disable that input?
... View more
06-18-2018
05:33 AM
1 Karma
Tested this morning with no issues. Thanks again!
... View more
06-17-2018
12:12 PM
Thank you for the in-depth explanation! This is very helpful. I will review and test it out.
... View more
06-17-2018
09:25 AM
Here's the statistics tab for both, with the same timestamp. The CPU avg usage of 1.02% is what I'm looking to timechart. That value is not present in the sitimechart statistic results:
timechart:
_time UW2SERVER01
2018-06-17 09:00 1.0268111210652904
sitimechart:
_time host psrsvd_ct_cpu_load_percent psrsvd_gc psrsvd_nc_cpu_load_percent psrsvd_sm_cpu_load_percent psrsvd_v psrsvd_vt_cpu_load_percent
2018-06-17 09:00 UW2SERVER01 75 2243 75 80.72541951731340000000000 1 23
... View more
06-17-2018
09:05 AM
Hi dwaddle, maybe I'm misunderstanding your request, but I included both searches above.
index=perfmon host="UW2*" | sitimechart span=1h avg(cpu_load_percent) by host
^ to create summary index
index=summary host="UW2*" | timechart span=1h avg(cpu_load_percent) by host
^ to pull from summary
... View more
06-16-2018
03:02 PM
1 Karma
I'm trying to timechart memory usage on my search head, but for some reason it's not collecting data. Specifically, memory counters. Other perfmon counters (such as cpu and disk) are available. Checked inputs.conf and verified settings match other servers that are correctly sending memory counter data to the indexers:
[perfmon://Memory]
counters = Page Faults/sec; Available Bytes; Pages/sec; Page Reads/sec; Page Writes/sec
disabled = 0
interval = 10
object = Memory
useEnglishOnly=true
index = perfmon
I have run lodctr and tested the counter in Performance Monitor on the server itself, so I know the counter works locally. Where else can I look for a fault?
EDIT:
To clarify- all other counters configured in inputs.conf are working.
perfmon://Memory is working on other servers it's deployed on. Search Head is the only server where the memory counter is missing from search results.
... View more
06-16-2018
04:25 AM
1 Karma
Hello,
I'm attempting to use summary indexing to store the following search that shows timechart average cpu usage for a group of servers:
index=perfmon host="UW2*" | timechart span=1h avg(cpu_load_percent) by host
It looks like this:
When I try to use summary indexing to save this search as a report using sitimechart, the results are completely different:
index=perfmon host="UW2*" | sitimechart span=1h avg(cpu_load_percent) by host
It looks like timechart and sitimechart behave differently. Why is this? How can I get the same results from sitimechart that I get with timechart?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-12-2020
04:59 PM
|
