About hgehrts_splunk

hgehrts_splunk · ‎01-10-2022

Hi all! Wir wollen uns mal wieder treffen... es geht leider nach wie vor nur virtuell. Schade natürlich. Aber ich tippe mal, dass so einige Themen zusammengekommen sind, über die es sich lohnt mal zu sprechen. Ich werde gleich noch den Termin mit ins Portal stellen... geht los ab 16 Uhr am 20.1.22. Patrick wollte mal kurz darüber sprechen, wie ihr diese hands-on Schulungen "Splunk4Rookies" auch selbst durchführen könnt. Sebastian und ich wollen euch gerne ein bisschen SAP und Splunk zeigen... also z.B. das SAP4SI... also das ITSI Content Pack für SAP. Wenn noch Zeit ist, zeig ich noch die Splunk IMT Integration. Gibt's noch mehr Sachen, die Euch interessieren? so long, und bis Donnerstag! Henning

gbansode · ‎11-29-2021

If its in English, I will be able to understand

hgehrts_splunk · ‎12-03-2020

sooo... hier nun ein paar Gedanken dazu. Ich hab mich mit meinen Kollegen dazu mal ausgetauscht. Generell ist es so, dass man GDI (get your data in) normalerweise nicht in Cloud macht sondern auf Forwardern, die in der eigenen Infrastruktur deployed sind. Bei Heavy Forwardern (die mit UI, bei denen alle Daten an einen Indexer Layer wie z.B. bei Splunk Cloud) ist es genauso: man installiert sie in der eignen Infrastruktur z.B. um mit DB Connect aus lokalen Datenbanken was rauszuholen und dann in den Indexing Layer zu schicken. Aber: es gibt eben auch Modular Inputs im Cloud Umfeld, wo APIs abgepollt werden... z.B . beim AWS addon oder beim GCP Addon (wobei Datensenken, bei denen die Sachen an Splunk geschickt werden immer besser sind btw). Fuer solche Zwecke gibt's Neuerdings de IDM. Den Inputs Data Manager. Das Ganze ist hier vorgestellt worden: https://www.splunk.com/en_us/blog/platform/introducing-inputs-data-manager-on-splunk-cloud.html Ist also Bestandteil vom Splunk Cloud Offering.. also Splunk SaaS. Falls ihr dann TA's darauf laufen lassen wolltet., muesstet ihr damit durch's App Vetting. Dabei gibt's dann aber 2-3 Sachen zu beachten: - Die app sollte aufgeteilt werden: was muss in den IDM (der eigenen HFW), was muss auf den Indexer und was muss auf den Search Head (Cluster)? Paketiert danach. - gibt nur die Teile ins App Vetting, die ihr in Cloud braucht. Wenn ihr den Datensammler in einer selber gehosteten VPC laufen laesst, braucht ihr kein App Vetting fuer diese Paket. - Benutzt AppInspect um zu checken, ob die Pakete Cloud-kompatibel sind... ABER benutzt die API Version, die ist immer aktuell: https://dev.splunk.com/enterprise/docs/developapps/testvalidate/appinspect/cloudvettingguidelines/vetappsandaddons#Prepare-your-app-or-add-on-for-cloud-vetting Hier ist der Aufruf der dazu aus der Doku: curl -X POST \ -H "Authorization: bearer <token>" \ -H "Cache-Control: no-cache" \ -F "app_package=@\"app_path/app_filename.tgz\"" \ -F "included_tags=cloud" \ --url "https://appinspect.splunk.com/v1/app/validate"

hgehrts_splunk · ‎12-03-2020

Hallo zusammen gestern kam beim .conf20 update die Frage auf, ob es Möglichkeiten gibt, das Splunk Gateway fuer die Mobil Apps und Apple TV etc im 'eigenen Herrschaftsbereich' laufen zu lassen... auch das gleiche wie beim Thema Search History: es gibt einen Eintrag auf Splunk Ideas dazu, der es in die Top5 geschafft hat (weil viele Votes drauf sind... Wink mit dem Zaunpfahl): https://ideas.splunk.com/ideas/CONNID-I-1 In den Kommentaren findet sich auch ein Link auf die Beta-Tester Seite... in der Mitte findet ihr auch den Aufruf zum Mitmachen beim Beta-Test: https://www.splunk.com/en_us/software/pre-releases.html Das war auch Thema waehrend der Mobile Experience Session auf der .conf20 (Slide 5): https://conf.splunk.com/files/2020/slides/PLA1403B.pdf Also: wird kommen... wie weiss ich nicht, wann weiss ich auch nicht... aber es werden schon beta Tester gesucht. Dann mal los 😉

salvadormadi · ‎12-02-2020

This is what I see on debug mode for the processing of the API response: 2020-12-02 13:48:29,640 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=std_output, code_line_no=187 | [stanza_name="SPLKTEST"] Writing events to stdout finished. 2020-12-02 13:48:29,638 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=engine.py, func_name=_on_post_process, code_line_no=170 | [stanza_name="SPLKTEST"] Got 2 tasks need to be executed after process 2020-12-02 13:48:29,638 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=models.py, func_name=calculate, code_line_no=243 | [stanza_name="SPLKTEST"] Calculated result: False 2020-12-02 13:48:29,637 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=json_path, code_line_no=98 | [stanza_name="SPLKTEST"] Got 1 elements extracted with JSONPATH expression "$" 2020-12-02 13:48:29,623 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=json_path, code_line_no=80 | [stanza_name="SPLKTEST"] source expected is a JSON, not <class 'str'>. Attempt to convert it to JSON 2020-12-02 13:48:29,622 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=_parse_json, code_line_no=199 | [stanza_name="SPLKTEST"] Try to extract JSON from source with JSONPATH expression: $, 2020-12-02 13:48:29,622 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=models.py, func_name=calculate, code_line_no=238 | [stanza_name="SPLKTEST"] Calculating condition with method: [json_empty], input size: [2] 2020-12-02 13:48:27,791 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=engine.py, func_name=_on_pre_process, code_line_no=154 | [stanza_name="SPLKTEST"] Got 0 tasks need be executed before process

hgehrts_splunk · ‎11-19-2020

Ich hoffe ihr habt alle die E-Mail bekommen? Wir treffen uns am 2.12. um 16 Uhr. Webex link ist in dem Event auf usergroup.splunk.com!

hgehrts_splunk · ‎11-19-2020

Hallo zusammen! Die usergroup Plattform wurde erneuert. Wir haben jetzt auch ein Forum ueber die community! Gruss, Henning

rashi83 · ‎08-03-2020

Hi Karthika, Thanks for getting back - there is no space after 27389 . I added few more numbers to it like this "1.3.6.1.4.1.27389.1.2" and still seeing same error . 2020-08-03 16:30:02,884 ERROR Execution failed: Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\modular_alert.py", line 542, in execute return self.run(cleaned_params, payload) File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\netcool_custom_modular_alert.py", line 85, in run (str(enterpriseSNMP_SpecificObjectID)+'.8', rfc1902.OctetString(str(splunksearch))) File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\pysnmp\entity\rfc3413\oneliner\ntforg.py", line 173, in sendNotification **kwargs): File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\pysnmp\hlapi\asyncore\sync\ntforg.py", line 114, in sendNotification lookupMib=options.get('lookupMib', True)) File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\pysnmp\hlapi\asyncore\ntforg.py", line 145, in sendNotification vbProcessor.makeVarBinds(snmpEngine, varBinds), File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\pysnmp\hlapi\varbinds.py", line 51, in makeVarBinds varBinds.resolveWithMib(mibViewController) File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\pysnmp\smi\rfc1902.py", line 1130, in resolveWithMib self.__objectIdentity.resolveWithMib(mibViewController) File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\pysnmp\smi\rfc1902.py", line 399, in resolveWithMib tuple(self.__args[0].split('.')) File "C:\Program Files\Splunk\etc\apps\netcool_custom_modular_alert\bin\pysnmp\smi\view.py", line 210, in getNodeNameByOid (modName, nodeName, self) NoSuchObjectError: NoSuchObjectError({'str': "Can't resolve node name ::('1', '3', '6', '1', '4', '1', '27389', '1', '2', '(blank)') at <pysnmp.smi.view.MibViewController instance at 0x0000001E4D9C9748>"})

romattos · ‎03-11-2020

Hi Giuseppe. Yes . I want to send to IBM Netcool Omnibus. Is it possible? Do you have more details? Thanks!!

hgehrts_splunk · ‎10-25-2019

ok found the issue: delete cookies of that site

hgehrts_splunk · ‎03-12-2019

I was just asked for this... Can you add some examples on netflow and baselining?

hgehrts_splunk · ‎02-13-2019

to be more clear: it seems like the inputs.txt commands do not work with our latest nexus switch version. This is what we've got: header_str": "Cisco Nexus Operating System (NX-OS) Software\nTAC support: ...", "bios_ver_str": "07.64", "kickstart_ver_str": "7.0(3)I7(5a)", "bios_cmpl_time": "05/17/2018", "kick_file_name": "bootflash:///nxos.7.0.3.I7.5a.bin", "kick_cmpl_time": " 10/12/2018 19:00:00", "kick_tmstmp": "10/13/2018 05:16:04", "chassis_id": "Nexus9000 93180YC-EX chassis", "cpu_name": "Intel(R) Xeon(R) CPU @ 1.80GHz", when we use the commands from the inputs.txt, we get errors in the nexus web UI: { "ins_api": { "version": "1.0", "type": "cli_show", "chunk": "0", "sid": "1", "input": "show hostname,nxhostname", "output_format": "json" } } result in: { "ins_api": { "type": "cli_show", "version": "1.0", "sid": "eoc", "outputs": { "output": { "clierror": "% Invalid command\n", "input": "show hostname,nxhostname", "msg": "Input CLI command error", "code": "400" } } } }

fverdi · ‎02-05-2019

To officially request a feature, submit a P4 Enhancement Request ticket: http://www.splunk.com/index.php/submit_issue

mtroianovskyi · ‎01-09-2019

In order to verify that the SAP user is granted all the necessary permissions, check the following. Using a browser, navigate to the SAP ODATA service URL like http(s)://your-solman-host:port/sap/opu/odata/sap/AI_SYSMON_OVERVIEW_SRV/SystemListSet?$format=xml - the browser will prompt for username/password (HTTP basic auth). Use the SAP user that is supposed to be used in Splunk. In case if you see a valid XML response starting with <feed ...> tag, then the permissions are correct. In case if you get HTTP 403 Forbidden, then the permissions are incorrect and additional configuration is required on SAP side. The most straightforward way to get started in a DEV environment is to assign SAP_ALL role to the user within SAP. However, this is a security risk since this grants all SAP capabilities (not just the ones related to ODATA service access). So this approach must not be used for production. For production setup, check the fine grained authorization object setup Authorization Objects Overview. Also check section Front-End Server and Back-End Server: Assign OData Service Authorizations to Users in App Implementation: Monitor Systems In case if for some reason the user still can not access the ODATA service, use the SU53 transaction on SAP side to troubleshoot the failed authorization check.

hgehrts_splunk · ‎09-19-2018

Hi What do you mean by "support"? Are you looking after how to monitor Ambari? Or how to splunk a Hadoop Cluster through Ambari? Ambari is an Management Tool for hadoop. You could compare it with an element manger: it allows you to install, configure and monitor Hadoop Cluster. The monitoring portion is quite open, it allows you to send the metrics data into a file system (where you could pick up the data via forwarder) or you use the REST API (and the Splunk Addon Builder) to pull the data into Splunk. The logs can be integrated with a forwarder: https://ambari.apache.org/1.2.1/installing-hadoop-using-ambari/content/ambari-chap5-1.html There are more options... but what is it what you want to achieve? Of course you could just splunk everything.

hgehrts_splunk · ‎06-07-2018

Yes, check your path and packages: 0509-022 Cannot load module /usr/lib/libcrypto.so tells you that the forwarder needs this library in the $LD_LIBRARY_PATH and if it cannot find it, it won't start. Btw: this is common on lots of *nixes, linux binaries have similar prerequisites... not only with Splunk binaries. I wonder why your libcrypto.so is missing. Either it's not on the system (try find) or your AIX Admin did not provide you the correct path to it.

fman82 · ‎05-28-2020

You could consume data from Kafka via a Splunk search without indexing the data by proxying through Lenses.io (It's a secure access layer for Apache Kafka which avoids you have to point directly to Kafka brokers and managing ACLs). See: https://lenses.io/blog/2020/05/new-kafka-governance-approval-flows-app-topology/

trangtriqc · ‎05-20-2020

I am having the same problem but I don't know how to get chat id of a channel. Anyone can help me?

Richfez · ‎08-24-2017

There are a handful of ways. In addition to jeffland's answer above, you could also... ... | transaction maxspan=1m User | search duration>X That will group events with the same User (and not separated by more than 1 minute - adjust that) into a "set" of events. You then have a duration, eventcount, and other information. More performance (especially in a distributed environment) can be had by converting that to a stats command. ... | stats max(_time) as Latest min(_time) as Earliest BY User | eval duration=Latest-Earliest | search duration>X You'll like need a bit more list(fieldname) or 'values(fieldname)` in the stats command to get all your information out, but know it's possible. 🙂 Links to docs on stats and the functions stats supports, and finally transaction.

croyal_splunk · ‎11-28-2016

Hi - SAP's OpenU15 Cross development platform is not tested or supported. Supported platforms are listed here.

alevy · ‎02-14-2017

Hi Henning, Thank you for the information, we will make sure that our next release is cloud vetted as well as certified. Best Adam

lestat1760 · ‎10-10-2016

i had the same issue. i have resolved it by installing splunk on a remote server in order to have a public IP instead of localhost. After the authentication, it can redirect and return the token code and to your SPLUNK server.

kierencrossland · ‎02-22-2016

Here's a sample query to get data from the ITCAM Agent for WebSphere Applications using the itmsoap search command. The timefield parameter is used to tell Splunk to use that field to set the time of the search results. | itmsoap tems=your_tems timefield=SDATE_TIME sql="SELECT SDATE_TIME,SERVER_NAM,STATUS,PID,STDATE_TIM,WAS_NNAM,WAS_CNAM FROM KYN.KYNAPSST AT ('your_rtems') WHERE SYSTEM.PARMA('NODELIST','Primary:your_target_host:KYNA', 25)" I prefer to use the dashboard data interface though as it's a lot less hassle. the equivalent cmd: |itmdash earliest=now latest=now tems=your_tems datasource=TMSAgent.%IBM.STATIC186 dataset=MetricGroup.KYNAPSST sourcetoken=Primary:your_target_host:KYNA The advantages being that this command will use the timerange from the Splunk search if you remove earliest=now latest=now , and it doesn't need to be told which time field to use.

amljohnson · ‎11-18-2015

Yeah the previews showed up for me eventually too - it seems like a strange sporadic bug. I'm still not seeing any results even with the OUTPUTNEW command. Support hasn't found a fix for this yet for me, it seems like this may have shipped prematurely?

naisanza · ‎04-01-2016

Also, related: https://answers.splunk.com/answers/223476/unable-to-connect-to-mongodb-with-hunk-through-hun.html

Posts	44
Solutions	1
Karma Given	9
Karma Received	8
Member Since	‎07-06-2015

Online Status	Offline
Date Last Visited	‎10-24-2023 07:39 AM

nächstes user group meeting Donnerstag 20.1.22 näc...

Thema App Vetting fuer Cloud aus dem User Group Tr...

Themen von gestern: Gateway for Splunk Connected E...

next user group meeting in english oder deutsch?

Nächstes Treffen angekündigt: Mittwoch 2.12. virtu...

Guuuude!

can't get it to work, says "Splunk cannot authenti...

can we have some netflow examples? And Baselining ...

example for inputs.txt

In the Send results as Excel Add-on, could you add...

nächstes user group meeting Donnerstag 20.1.22 näc...

Re: next user group meeting in english oder deutsc...

Thema App Vetting fuer Cloud aus dem User Group Tr...

Themen von gestern: Gateway for Splunk Connected E...

Re: size limit on REST response?

Nächstes Treffen angekündigt: Mittwoch 2.12. virtu...

Guuuude!

Re: Sending SNMP from Splunk to Netcool

Re: How send splunk alerts to netcool?

Re: can't get it to work, says "Splunk cannot auth...

can we have some netflow examples? And Baselining ...

Re: example for inputs.txt

Re: In the Send results as Excel Add-on, could you...

Re: what are the requirements on the SAP Side?

Re: Does Splunk enterprise support Apache Ambari? ...

Re: Unable to start Splunk universal forwarder on ...

Re: How to consume messages from kafka topic using...

Re: Telegram Alert Action: Where do you get a "cha...

Re: Calculate time difference between events for d...

Re: Splunk MINT: Is it possible to use MINT SDK wi...

Re: Is the new Mimecast for Splunk app supported o...

Re: Why am I unable to add cloud services account ...

Re: Does the ITM6 App for Splunk also work for ITC...

Re: After intalling Splunk DB Connect 2.0.6 on our...

Re: Hunk App for MongoDB: Why can't I connect to M...