Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Elsurion
Elsurion
Communicator
Member since:
02-17-2012
09-20-2021
Community Statistics
| Posts | 67 |
| Solutions | 7 |
| Karma Given | 1 |
| Karma Received | 7 |
| Member Since | 02-17-2012 |
Activity Feed
- Got Karma for Custom Script and python 3.7 gives strange Loglevel Error. 02-24-2021 05:13 AM
- Posted Re: Custom Script and python 3.7 gives strange Loglevel Error on Splunk Dev. 07-17-2020 06:25 AM
- Posted Custom Script and python 3.7 gives strange Loglevel Error on Splunk Dev. 07-17-2020 02:10 AM
- Got Karma for Re: How can I take Backup of My Saved Searches,Macros and Index Data ?. 06-05-2020 12:49 AM
- Got Karma for Re: HTTP event collector client AJAX error "readyState 0, status 0, statusText error". 06-05-2020 12:49 AM
- Got Karma for Re: Splunk Forwarding doesn't forward data. 06-05-2020 12:49 AM
- Got Karma for Re: extract part of a string from the fields. 06-05-2020 12:49 AM
- Got Karma for Re: 【emergency】I can not migrate indexed data. 06-05-2020 12:49 AM
- Got Karma for Re: How to add scripts as data input?. 06-05-2020 12:49 AM
- Karma Re: alert on license usage for dantimola. 06-05-2020 12:46 AM
- Posted Re: How to enable the proxy configuration for this add-on on All Apps and Add-ons. 06-04-2019 05:44 AM
- Posted How to enable the proxy configuration for this add-on on All Apps and Add-ons. 06-03-2019 11:34 PM
- Tagged How to enable the proxy configuration for this add-on on All Apps and Add-ons. 06-03-2019 11:34 PM
- Tagged How to enable the proxy configuration for this add-on on All Apps and Add-ons. 06-03-2019 11:34 PM
- Posted Re: Using DB CONNECT to query data but the value of "where condition" is variable on Splunk Search. 04-04-2018 03:19 AM
- Posted Re: Using DB CONNECT to query data but the value of "where condition" is variable on Splunk Search. 04-04-2018 01:20 AM
- Posted Re: How do i check how much i am exceeding my license limit by? on Installation. 03-27-2018 11:54 PM
- Posted Re: How to get at two fields from a subsearch to the main search results on Splunk Search. 03-23-2018 04:37 AM
- Posted Re: HTTP event collector client AJAX error "readyState 0, status 0, statusText error" on Getting Data In. 03-23-2018 04:15 AM
- Posted Re: How to add scripts as data input? on Getting Data In. 03-23-2018 02:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-17-2020
06:25 AM
Hi I've executed the readyness tool but it had only warnings and not a single blocker. Including the splunklib which should be ready for 3.... That's why i have no clue why the logger breaks. Every other point where the syntax changed yes, but not in the logger.
... View more
07-17-2020
02:10 AM
1 Karma
Hi all I've enabled the python 3.7 Support on my installation, but now my external command won't work anymore, saying i have some syntax error, which i'm not able to find in the binary tree of my command app... And the command works with python 2.7... The message is: ValueError: Unknown level: 'ERROR ; Default: WARNING' The full log is: 07-17-2020 10:12:48.713 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/elasticsplunk/bin/elasticsplunk.py __GETINFO__ eaddr=cluster1 index=testdrive query="state:IL or state=TN and age>22"': Traceback (most recent call last): File "/opt/splunk/etc/apps/elasticsplunk/bin/elasticsplunk.py", line 49, in <module> from splunklib.searchcommands import dispatch, StreamingCommand, GeneratingCommand, Configuration, Option, validators File "/opt/splunk/etc/apps/elasticsplunk/bin/splunklib/searchcommands/__init__.py", line 145, in <module> from .environment import * File "/opt/splunk/etc/apps/elasticsplunk/bin/splunklib/searchcommands/environment.py", line 120, in <module> splunklib_logger, logging_configuration = configure_logging('splunklib') File "/opt/splunk/etc/apps/elasticsplunk/bin/splunklib/searchcommands/environment.py", line 103, in configure_logging fileConfig(filename, {'SPLUNK_HOME': splunk_home}) File "/opt/splunk/lib/python3.7/logging/config.py", line 80, in fileConfig _install_loggers(cp, handlers, disable_existing_loggers) File "/opt/splunk/lib/python3.7/logging/config.py", line 195, in _install_loggers log.setLevel(level) File "/opt/splunk/lib/python3.7/logging/__init__.py", line 1353, in setLevel self.level = _checkLevel(level) File "/opt/splunk/lib/python3.7/logging/__init__.py", line 192, in _checkLevel raise ValueError("Unknown level: %r" % level) ValueError: Unknown level: 'ERROR ; Default: WARNING' 07-17-2020 10:12:48.725 ERROR script - Getinfo probe failed for external search command 'ess'.
... View more
06-04-2019
05:44 AM
Hi jkat
That's too bad.
Regards
Thomas
... View more
06-03-2019
11:34 PM
Hi all
Since i've got a environment behind multible proxies, i need to enable the correct proxy configuration for this add-on.
How can i do this? I've seen no hint how to do this.
And a system wide proxy configuration is not an option, since there are other services with different high-traffic configurations running, which don't need to be routed trough a proxy configuration.
Actual i'm not able to connect to the Azure Cloud:
ConnectionError: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /xxx-xxx-xxx-xxx-xxx/oauth2/token?api-version=1.0 (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known',))
... View more
04-04-2018
03:19 AM
The only way you could do this, is to create a custom script, where you can handle your SQL. But you have to manage the SQL handling by yourself.
Normally i'm using a rising column for DB Input or i'm reading the whole table.
The Documentation is here:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Search/Writeasearchcommand
Example:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Search/Customsearchcommandshape
Here a stub i'm using, stored in etc/apps/<app>/bin :
#!/usr/bin/python
__doc__ = '''
Ein Konverter fuer die base36 Konversion im Splunk Stream
'''
import sys, splunk.Intersplunk
#splunk_home = os.getenv('SPLUNK_HOME')
#if not splunk_home:
# raise ConfigError('Environment variable SPLUNK_HOME must be set. Run: source ~/bin/setSplunkEnv')
# Start script
#***************************************************************
if __name__ == '__main__':
#Get the arguments from search
#(isgetinfo, sys.argv) = splunk.Intersplunk.isGetInfo(sys.argv)
#if len(sys.argv) != 2:
# splunk.Intersplunk.parseError("Usage | ctmbase36 __EXECUTE__ <field>")
#thefield=sys.argv[1]
reader=splunk.Intersplunk.readResults(None,None,True)
for row in reader:
#print "Inputvalue"
value=int(row['ORDERNO'])
#print value
# Here your SQL Function
convert = base36encode(value)
#print convert
# Set a value
row['orderid'] = convert
splunk.Intersplunk.outputResults(reader)
#
# EOF
#
To call this script then within the SQL you need a commands.conf
#
# Commands.conf for the base36 convert
#
[ctmbase36]
type = python
filename = ctm_base36.py
local = true
stderr_dest = message
supports_getinfo = false
#
# EOF
#
in the SPL the call would be like this then:
| eval ORDERNO=00a2doz
| ctmbase36
... View more
04-04-2018
01:20 AM
You can use the SPL for the DBX for that Usecase:
| dbxquery query="select jobno, orderno, applgroup, nodegrp, failcount, order_time from cmr_ajf_jobs where endrun > '20180404000000'" connection="testsystem"
When you feeding the SPL via Dashboard then you can use the $value$ substitution in the search.
... View more
03-27-2018
11:54 PM
Hello
You might try this search, you say you can run searches only on _internal, then it should work. Just take a 30day Timeframe.
index=_internal source=*license* type="Usage"
| fields st, idx, h, b, _time
| bucket _time span=1d
| stats sum(b) as bytes by _time
| eval gb=round(bytes/1024/1024/1024,3)
| table _time gb
| rename gb as GB/day
... View more
03-23-2018
04:37 AM
Just to be sure, the DstIP and dest have the same format (IPv4 vs DNS vs IPv6) and they share both the same source?
Not that the vm index useses internal-IPs and the ids index the external-IPs.
What i saw is, that you doing the lookup on the dns only for the Windows Index and only in your second join, the first is without lookup.
... View more
03-23-2018
04:15 AM
1 Karma
Well you should add your source to the copied section, then it would not be a problem.
This has to do with the respect of the original writer...
http://www.uticaod.com/x1177024386/Internet-Etiquette-10-Rules-of-Netiquette
Rule 2
... View more
03-23-2018
01:58 AM
1 Karma
It seems to me, that you don't have enabled the script itself. Have you configured an inputs.conf in the local folder of your search App?
And have you an entry in the inputs.conf like this? (modified for windows support):
splunk@monsterine ✓ 09:53 $ cat inputs.conf
[script://.\bin\cfgpull_srv.py]
disabled = false
index = main
interval = 60
source = cfgpull_srv.py
sourcetype = cfgpull_srv_stdout
... View more
02-19-2018
04:55 AM
Hi all
I have a functional heavy forwarder on a systems, now i want a second heavy forwarder on the same system. I'd like to test some limiting features in the actual data stream. I cannot move it to another place, since i need some data throughput, which i don't have in any other non productive environment. And before i setup a new system, i like to take and utilize some installed hardware.
The setup of the second heavyforwarder worked well, including the binding of the second inputport as well the other second ports.
The port is open but the Universal Forwarder isn't able to open a stable connection to the second heavy forwarder.
This is the outputs.conf
splunk@mysystem:default $ cat outputs.conf
[tcpout]
# do not index locally
indexAndForward = false
# forward all loca indexes
forwardedindex.filter.disable = true
useACK = true
defaultGroup = splunk
[tcpout:splunk]
server = splunk-indexer01:9997
[tcpout:splunk-hfw]
server = splunk-hfw:9997
[tcpout:splunk-sink]
server = splunk-hfw:9996
The connection tests worked as well.
splunk@mysystem:default $ telnet splunk-hfw 9996
Trying <someip>...
Connected to splunk-hfw.
Escape character is '^]'.
^C
splunk@mysystem:default $
In the spunkd.log on either system i don't see anything which hitting me to the problem i have here...
On the UFW i'm getting time-outs
02-19-2018 13:42:00.425 +0100 WARN TcpOutputProc - Cooked connection to ip=<hfwip>:9996 timed out
02-19-2018 13:42:00.425 +0100 WARN TcpOutputProc - Cooked connection to ip=<hfwip>:9996 timed out
On the HFW i'm getting broken links, but i don't know why.
02-19-2018 13:42:16.849 +0100 ERROR TcpInputProc - Error encountered for connection from src=<ufw>:51891. Broken pipe
Traffic on the normal :9997 Port works without any issue
Anyone has any hint for the problem?
... View more
02-14-2018
11:03 PM
For the Windows part, i'd take in account how long they will be around. When only a few months then this can be your path, when longer then i'd upgrade the windows ufw as well, to have a clean environment.
... View more
02-14-2018
10:52 PM
You have to disable the SSLv3 Support on the Forwarder in the local/server.conf .
[sslConfig]
sslKeysfilePassword = <your_password>
sslVersions=*,-ssl2,-ssl3
cipherSuite = TLSv1.2:!eNULL:!aNULL
Then it should work again.
... View more
02-14-2018
02:08 AM
One thing ist the part with the SSL:
An indexer that is version 6.6 or later, including 7.0, can receive data from a forwarder that is version 4.3 or later, including 7.0, after you change the SSL/TLS version and cipher suite on the indexer.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Compatibilitybetweenforwardersandindexers
You have to change the SSLv3 Support to nil in Forwarders older then 6.4.0, after the POODLE Problem.
Since you have to change your setting, why not first upgrade your forwarders? I have UFW 7 which connects to a 6.6 Indexer.
... View more
02-11-2018
04:47 AM
Is the Output with the many Ports from your System?
At least this one is showing something on the 514 port.
Curious is that you don't get any plain foreign Adress and a State.
Like this one here:
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 0.0.0.0:5514 0.0.0.0:*
It is taken by my Linux System.
I assume now that's the format it should be then under Windows, so you're basically open to the whole world with the 0.0.0.0:* (any:5514 from any:any), the any is basically every interface you have in your pc.
And i don't have any active Syslog Input into Splunk> at the moment.
When i just take the netstat -p UDP Output, then it sais that you don't have any connection up and running on the 514
One thing that i could suggest to check if the port is open, is with netcat (dunno if available for Windows)
13:44 elsurion@monsterine ✓ ~ $ nc -v -u -z -w 3 monsterine 4414
13:44 elsurion@monsterine ✓ ~ $ echo $?
1
13:44 elsurion@monsterine ✓ ~ $ nc -v -u -z -w 3 monsterine 5514
Connection to monsterine 5514 port [udp/*] succeeded!
13:44 elsurion@monsterine ✓ ~ $ echo $?
0
13:44 elsurion@monsterine ✓ ~ $
When it will work, ok.
When it still don't work, take another port > 1024 for this syslog input if your router supports it. Normaly it should be no problem setting up a listener on 514, but under Windows i don't know.
... View more
02-08-2018
12:26 AM
You have stored the props.conf/transforms.conf under <sample_app_1>/default or <sample_app_1>/local ?
these are the search paths of splunk where to look for these files.
... View more
02-05-2018
10:50 PM
As long as this user is able to bind this port yes.
I don't know how Windows keeps track on the used ports but under Linux you'll need to be a higher privileged user to use any port under 1024. I'm using my own set of ports, since my user splunk is not privileged, That i can read normal syslog stuff i'm mapping the port 514 to a high port like 5514.
Most devices are able to use other ports then the 514, just as a side note.
Under Linux you could check if the udp port is listening this way
netstat -uanc | grep 514
Under Windows it could be this command
netstat -p UDP
Also wireshark is also a valid option 🙂 udp.port == 514 ,there you can drive into the datastream. But you have to be a high priv user, since you have to bind the whole network device.
... View more
02-05-2018
10:32 AM
Ok remove all disabled = 1 in your inputs.conf, or at least by the [udp://514] input
disabled = 1 > means that this monitor/script is disabled and will be ignored.
also for the test if it will work, use index=main after the check you can use again the index=homemonitor since this index isn't installed by default.
For the rest define always a destination index with index = , that way you will find your data more easely
... View more
02-05-2018
05:12 AM
Also don't forget to clear your web browser cache.
This helps most time when everything is reloaded but the code isn't showing up.
... View more
02-05-2018
04:54 AM
You are collecting data from the udp port? Just enabling on OS Level is not enough.
Check if you have an entry under Data Inputs -> UDP or check the inputs.conf file in (probably) etc/app/search/local
Entry should look alike:
[udp://514]
connection_host = dns
index = main
sourcetype = syslog
And check it with
index=main sourcetype=syslog
If any event shows up.
When nothing shows up, and you can send testevents from your router, trigger them to check their existents with all-time
If still nothing shows up, check the router log and on the commandline with netstat if the port ist open and a process is listening on it.
... View more
02-02-2018
06:22 AM
Is this a normal logfile which will contain Section 1 and Section 2 more then once?
e.g.
Section 1 --> Section 2 --> Section 1 --> Section 2 --> Section 1?
If yes you can forward your Data to a so called Heavy Forwarder. Which is a full installation of Splunk>. On this instance you can filter your data before you index it.
https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Deployaheavyforwarder
As example a stip of lines containing a special keyword.
Setup for transforms.conf
[setnull]
REGEX = \s;\sDefault\s;\s
DEST_KEY = queue
FORMAT = nullQueue
Setup for props.conf
[mysourcetype]
TRANSFORMS-null= setnull
To get this thing working, we should know now how the ignored part can be selected for deletion.
... View more
02-02-2018
01:47 AM
I hardly doubt that splunk will send the data to both tcp destinations but to ensure that he's taking only one add
_TCP_ROUTING=<tcpout_destination>
to your inputs.conf
With this way you are going to tell which path the data has to take.
Also why are you using the Syslogport for Splunk> Data Indexing?
... View more
02-02-2018
01:28 AM
You are sorting in the subsearch not in den main search, try an do the sort in the main search.
To get a formated search in Splunk> just hit Ctrl+F in the inputbox for formatting.
index="sharepoint_capacity"
| fields - _raw
| fields "Resource Name" "Capacity End Date" "Capacity Start Date" EID FTE "Project Name" ID
| stats count by "Resource Name" FTE "Project Name"
| rename FTE as Allocation
| join
[ search index="sharepoint_capacity"
| eval epoch_end=strptime('Capacity End Date',"%m/%d/%Y"), epoch_start=strptime('Capacity Start Date',"%m/%d/%Y"), between=mvrange(epoch_start,epoch_end,"1d")
| mvexpand between
| eval _time=between
| stats values(FTE) as alloc by "Resource Name" FTE "Project Name" _time
| eval months=strftime(_time,"%B %d %Y")
| xyseries "Resource Name" months alloc
| transpose 0 header_field="Resource Name"
| rename column as Month
| eval getmonth=strptime(Month,"%B %d %Y")
| transpose 0 header_field=Month
| rename column as "Resource Name"]
| sort getmonth
| fields - count
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-20-2021
09:51 AM
|
