Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About a238574
a238574
Path Finder
Member since:
02-06-2018
06-05-2020
Community Statistics
| Posts | 40 |
| Solutions | 5 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 02-06-2018 |
Activity Feed
- Karma Re: How to populate a dropdown from records inside a single JSON event? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: Can you shift one line of a multiline chart? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: Modify search time based on dropdown selection for niketn. 06-05-2020 12:49 AM
- Karma Re: Can you position a text input on a dashboard between vertical stacked panels? for nryabykh. 06-05-2020 12:49 AM
- Got Karma for Can you have a token inside a token?. 06-05-2020 12:49 AM
- Posted Re: After upgrade to 7.3.1 file upload is stopping after 80 events on Getting Data In. 09-27-2019 08:12 AM
- Posted After upgrade to 7.3.1 file upload is stopping after 80 events on Getting Data In. 09-27-2019 08:11 AM
- Posted Re: using a $variable$ in the output of a mapped search on Splunk Search. 09-17-2019 06:45 AM
- Posted using a $variable$ in the output of a mapped search on Splunk Search. 09-17-2019 05:49 AM
- Tagged using a $variable$ in the output of a mapped search on Splunk Search. 09-17-2019 05:49 AM
- Posted Re: search/subsearch using json array on Splunk Search. 09-17-2019 05:23 AM
- Posted search/subsearch using json array on Splunk Search. 09-16-2019 11:16 AM
- Posted Re: Single index on indexer not getting new data. Other indexes are. on Deployment Architecture. 09-10-2019 09:38 AM
- Posted Single index on indexer not getting new data. Other indexes are. on Deployment Architecture. 09-10-2019 06:02 AM
- Posted Re: Issue with stats count with multiple fields on Splunk Search. 07-26-2019 08:37 AM
- Posted Re: Issue with stats count with multiple fields on Splunk Search. 07-26-2019 05:37 AM
- Posted Issue with stats count with multiple fields on Splunk Search. 07-25-2019 05:55 AM
- Posted splunk add-on for aws cloudtrail - issue trying to filter cloudtrail data on All Apps and Add-ons. 03-27-2019 11:10 AM
- Posted Re: Can you help me with an Issue building a Splunk cluster? on Deployment Architecture. 03-07-2019 08:17 AM
- Posted Re: Can you help me with an Issue building a Splunk cluster? on Deployment Architecture. 03-01-2019 05:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-27-2019
08:12 AM
upgraded from 6.6
... View more
09-27-2019
08:11 AM
I have a file monitor running on my heavy forwarder and after my upgrade to 7.3.1 it is only loading the 1st 80 events.. there are over 600 events in the file and this worked fine prior to the upgrade. I am thinking there is an update to a config file somewhere that is limiting the upload.
... View more
- Tags:
- splunk-enterprise
09-17-2019
06:45 AM
Found the answer... eval was the key
index=events eventName="testevent" | spath output=acctid path="requestParameters.items{}.acctid" | stats list(acctid) as acctid by eventID | mvexpand acctid| | map search="search index=acctlist Id=$acctid$ | stats count | where count=0 | eval eventID=$eventID$ | stats list(count) by eventID"
... View more
09-17-2019
05:49 AM
I am running a search that gets a list of accounts, multiple records that can have multiple accounts in each event. I need to find all accounts that are not valid. what I have so far produces results but I cant figure out how to get the $acctid$ in the output. Right now I just get 2 records in the stats page show a 0 for each one but no way to show the content of the $acctid$. I have manually checked and the number is correct I have 2 bad accounts.
Basic search is
index=events eventName="testevent" | spath output=acctid path="requestParameters.items{}.acctid" | stats list(acctid) as acctid by eventID | mvexpand acctid| | map search="search index=acctlist Id=$acctid$ | stats count | where count=0"
The 1st half of the search produces
eventID acctid
15326ca3-d4ce-421f-aa07-457fcc7c5df1 12345678
8b99fa14-fa4f-4cd2-8d5e-4d9244b5e027 04341234568
8b99fa14-fa4f-4cd2-8d5e-4d9244b5e027 34491234568
9d807652-8b16-4a1a-a985-236c8409b73c 12345678
c5e8b181-4440-4af3-8687-805522ab67e8 04341234568
e539d095-8664-4c68-99ba-1ef1329ec78d 34491234568
ebf27592-2741-4093-b035-eaf3d1ecc4ee 04341234568
I know the 1st and 4th entry are bad accounts and the map command produces 2 results but just shows the zero from the count. How do I get the contents of either the acctid or eventId in the results
count
0
0
... View more
09-17-2019
05:23 AM
I was able to get my query to work using the map function and mvexpand
... View more
09-16-2019
11:16 AM
I have logs being stored in json that shows accounts being given access to data. I need to validate that the accts are valid. I am trying to run a subsearch that will get the list of accounts(userId) from the logged event and validate against a list of known accts. I was planning on using a search/subsearch structure but I am having issues getting the acct list(userId) out of the json structure
json strusture -
eventID: 4321-4321-4321-1234
requestParameters: { [-]
attributeType: CREATE_VOLUME_PERMISSION
createVolumePermission: { [-]
add: { [-]
items: [ [-]
{ [-]
userId: 1234567889
}
{ [-]
userId: 0987654321
}
]
}
}
Ideally I would like to pass the eventId and userId to the main search for each userId and report those details if the acct is not found in my list of known accts
... View more
- Tags:
- splunk-enterprise
09-10-2019
09:38 AM
Found my issue... the indexer in question had been moved to a new IP but the config change had not been updated on the HF
... View more
09-10-2019
06:02 AM
I have a splunk cluster with 3 indexers. I have a non replicated index that for some reason has stopped getting new data on one of the indexers. Other indexes on the same node are getting data. What can I look for to figure out why this index on the one node is not getting new data. The data is coming from a pair of Heavy Forwarders which is my 1st target to check but not sure where to look.
... View more
- Tags:
- splunk-enterprise
07-26-2019
05:37 AM
Did some more testing trying to figure out why the count was increasing and my results got worse. I made a simple search looking to produce a set of results where the field I count by should equal the number of events...
index=x accountid=123456789 | stats count by accountid
The search returns 936 events but the count is 1248.... how does it get to 1248 from 936 events
... View more
07-25-2019
05:55 AM
I am using the stats count function to get a count of unique events. as part of the list I am want to show additional fields in the Statistics output. When I run my fairly simple query and use |stats count by field1 the numbers look correct. When I use | stats count by field1,field2,field3,field4 The count seems to increase more for each field I add but the strange thing is that the number of Statistics in the results does not change. For my real query I get 990 events and 142 entries on the Statistics tab for every search no matter how many fields I use in the stats count but the count for each statistic in the list grows every time I add a field.
... View more
- Tags:
- splunk-enterprise
03-27-2019
11:10 AM
We currently are using SQS-Based S3 data input to get our cloudtrail data in splunk enterprise. It works fine. The only issue is that it cannot, like the cloudtrail data input, filter out by either selecting to drop read-only events or use blacklists. I have tried switch to using the cloudtrail data input but when I do there seems to be an issue getting data from the S3 bucket that I can't identify. The SQS queue is getting cleared out but I am getting no data from the S3 bucket. This is running with no filtering turned on. I have unchecked the default option to filter read-only events.
I see log entries like below in the data input log but no data makes it to splunk. If I switch back to the SQS-Based S3 data input it works fine
2019-03-27 14:07:12,502 level=INFO pid=2539 tid=Thread-4 logger=splunk_ta_aws.modinputs.cloudtrail.aws_cloudtrail_data_loader pos=aws_cloudtrail_sqs_collector.py:_collect:132 | | message="Pulled 1195 messages from SQS"
Not sure where to look to trace the issue
... View more
- Tags:
- splunk-enterprise
03-07-2019
08:17 AM
Found the issue. I had copied the rhel firewall rules from another splunk env that had modified the replication port from 9887 to 8080. Once I fixed the rules the index issues were automatically fixed.
... View more
03-01-2019
05:10 AM
The steps are the same for each node except for the cluster config command
... View more
03-01-2019
05:07 AM
Its got 4 nodes 1 for each function 2 indexer peers, 1 master, and 1 dedicated search head
... View more
02-28-2019
11:46 AM
I manage a couple of small Splunk clusters, and for the 1st time, I need to build one form scratch. I am testing in our sandbox environment, but when I bring the cluster up, I end up with index issues that can't seem to be resolved.
cannot fix up search factor as bucket is not serviceable
Cannot fix search count as the bucket hasn't rolled yet.
The above messages show up for every bucket in the _audit and _internal indexes. The build is a fairly simple one: 2 indexer peers, 1 master, and 1 dedicated search head
1- It's RHEL based
2- Install the rpm, 7.0.3 is the version I am playing with
3 - Set the firewall rules to allow the traffic
4 - /opt/splunk/bin/splunk enable boot-start -user root --accept-license
5 - /opt/splunk/bin/splunk start --accept-license
For the master I run - /opt/splunk/bin/splunk edit cluster-config -mode master -replication_factor 2 -search_factor 2 -secret xxx -cluster_label test
For the indexer peers - /opt/splunk/bin/splunk edit cluster-config -mode slave -master_uri https://xx.xxx.xx.xx:8089 -replication_port 9887 -secret xxx
For the Search head - /opt/splunk/bin/splunk edit cluster-config -mode searchhead -master_uri https://xx.x.xxx.xx:8089 -secret xxx
Restart Splunk on the master, then configure the other nodes and restart Splunk.
Not sure what I am missing or doing wrong.
... View more
10-04-2018
07:45 AM
I had read somewhere that it might not replicate existing buckets. Is there a way to get those buckets replicated
... View more
10-04-2018
06:56 AM
I inherited a Splunk cluster that has some custom indexes that were created without setting repFactor=auto. Is it safe for me to update the config and push out the modified config for the impacted indexes?
... View more
09-06-2018
04:04 AM
When I try and restart one of my indexers after an OS upgrade I am seeing the following messages. My 2 other indexers are up and running. How do I fix this. I found one articale where they talk about fixing the offending buckets but don't say how and I am not positive this is the same issue
09-06-2018 06:37:17.576 -0400 ERROR DatabaseDirectoryManager - idx=main bid=main~392~F18EA0F4-48F1-4D8C-8209-5B40F
0B66E1E bucket=392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E Detected directory manually copied into its database, caus
ing id conflicts [path1='/opt/splunk/var/lib/splunk/defaultdb/db/rb_1535649215_1535592644_392_F18EA0F4-48F1-4D8C-8
209-5B40F0B66E1E' path2='/opt/splunk/var/lib/splunk/defaultdb/db/392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E'].
09-06-2018 06:37:17.579 -0400 ERROR IndexerService - Error intializing IndexerService: idx=main bid=main~392~F18EA
0F4-48F1-4D8C-8209-5B40F0B66E1E bucket=392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E Detected directory manually copied
into its database, causing id conflicts [path1='/opt/splunk/var/lib/splunk/defaultdb/db/rb_1535649215_1535592644_
392_F18EA0F4-48F1-4D8C-8209-5B40F0B66E1E' path2='/opt/splunk/var/lib/splunk/defaultdb/db/392_F18EA0F4-48F1-4D8C-82
09-5B40F0B66E1E'].
09-06-2018 06:37:17.584 -0400 FATAL IndexerService - One or more indexes could not be initialized. Cannot disable
indexes on a clustering slave.
... View more
07-05-2018
11:35 AM
Found my answer. It was being delivered via a sqs s3 queue and there was an issue with an assigned iam role affecting one of the heavy forwarders. I single sqs-s3 input stream was not able to keep up with the traffic. Once we fixed the iam role assignment 2 input streams were able to drain the queue and the time delay went away
... View more
06-29-2018
10:50 AM
I checked all the servers... Time and timezone all appear to be set correctly
... View more
06-29-2018
06:44 AM
We have a couple of splunk envs running is aws. We rehydrated(deployed a new AMI) one of the env last week and this week I have run into a strange issue with the timing of indexed data. Before the rehydrate data was indexed typically within 5-10 mins of the eventtime. Now it appears that exactly one hour has been added to the time it takes to get the data indexed. I am at a loss to explain this??? The events are being forwarded from cloudtrail. No cloudtrail changes have occurred .
Here is a sample of events prior the env rehydration (getting a new AMI)
e_time i_time
06/20/18 08:27:18 06/20/18 08:31:40
06/20/18 08:27:03 06/20/18 08:31:40
06/20/18 08:26:48 06/20/18 08:31:40
06/20/18 08:26:32 06/20/18 08:31:40
06/20/18 05:00:14 06/20/18 05:11:13
06/20/18 04:37:59 06/20/18 04:49:45
06/20/18 03:01:46 06/20/18 03:09:51
06/20/18 02:58:34 06/20/18 03:09:51
06/20/18 03:25:55 06/20/18 03:31:40
06/20/18 03:25:39 06/20/18 03:31:40
06/20/18 03:25:36 06/20/18 03:31:40
06/20/18 03:25:21 06/20/18 03:31:40
06/20/18 03:25:20 06/20/18 03:31:40
06/20/18 00:47:21 06/20/18 00:59:58
06/19/18 23:43:47 06/19/18 23:51:38
06/19/18 23:43:31 06/19/18 23:51:38
06/19/18 23:43:31 06/19/18 23:51:38
06/19/18 21:00:13 06/19/18 21:07:14
06/19/18 20:59:58 06/19/18 21:07:14
06/19/18 20:59:43 06/19/18 21:07:14
06/19/18 20:59:28 06/19/18 21:07:14
06/19/18 20:59:27 06/19/18 21:07:14
06/19/18 19:42:55 06/19/18 19:47:33
After you can see the one hour delay
e_time i_time
06/29/18 06:32:10 06/29/18 07:35:49
06/29/18 06:29:23 06/29/18 07:35:49
06/29/18 06:28:48 06/29/18 07:35:49
06/29/18 06:28:38 06/29/18 07:35:49
06/29/18 06:28:26 06/29/18 07:35:49
06/29/18 05:40:20 06/29/18 06:46:07
06/29/18 05:40:05 06/29/18 06:46:07
06/29/18 05:39:50 06/29/18 06:46:07
06/29/18 05:39:34 06/29/18 06:46:07
... View more
- Tags:
- splunk-enterprise
04-27-2018
06:21 AM
Does anyone know of a good tutorial for using the summary index. I have a number of daily stats that I would like to collect so that historical charts don't have to calc the stats every time they are produced
... View more
- Tags:
- splunk-enterprise
04-18-2018
06:41 AM
Ok this has to be easy but for some reason I cant figure it out. I have a query that produces two sets of stats
23 5
45 7
19 2
I would like to see these numbers in a line chart as 2 lines with a single data point for each number. When I try to select line chart for the visualization by default it tries to pick the 1st set of numbers as the x axis. How do you just tell to graph the numbers
... View more
- Tags:
- splunk-enterprise
04-13-2018
03:59 AM
The +5d does the trick.. it moves the lines to have the proper relationship. I have 2 items to fix for the graph to look correct. With the shift the 1st 5 days of the modified line is flat. The other issue is since I am playing with the date I think it would be better if I could hide the x-axis label and not show the date.
... View more
