Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About whrg
whrg
Motivator
Member since:
11-29-2018
03-19-2024
Community Statistics
| Posts | 313 |
| Solutions | 73 |
| Karma Given | 94 |
| Karma Received | 108 |
| Member Since | 11-29-2018 |
Activity Feed
- Got Karma for How to prevent automatic translation of input labels?. 03-06-2024 12:09 AM
- Posted Re: KVStore is not ready. Token auth system will not work. on Splunk Enterprise. 03-05-2024 04:48 AM
- Posted KVStore is not ready. Token auth system will not work. on Splunk Enterprise. 02-29-2024 04:26 AM
- Got Karma for Re: How can I automate the downloading of universal forwarder?. 01-10-2024 09:12 AM
- Got Karma for Re: How come our Splunk 6.5 REST API calls with curl command are not working?. 01-24-2023 05:45 AM
- Got Karma for Re: Can you help me identify when end time overlaps start time for the following events?. 12-11-2022 04:24 PM
- Posted How to prevent automatic translation of input labels? on Dashboards & Visualizations. 12-07-2022 12:25 AM
- Got Karma for Re: What is crc_Salt = means and in which case its used?. 10-03-2022 03:01 AM
- Got Karma for Re: How can I automate the downloading of universal forwarder?. 08-17-2022 02:14 PM
- Got Karma for Re: What is crc_Salt = means and in which case its used?. 09-14-2021 08:01 AM
- Posted Re: table command without changing sort order on Splunk Search. 08-30-2021 01:20 AM
- Got Karma for Re: How can I find out what the deployment errors are?. 08-25-2021 06:27 AM
- Got Karma for Re: How to get the runtime of a dashboard?. 08-18-2021 11:14 AM
- Karma Re: How to append values from a field to all values of a multivalued field? for woodcock. 04-29-2021 05:53 AM
- Posted Re: table command without changing sort order on Splunk Search. 04-29-2021 01:12 AM
- Posted Re: table command without changing sort order on Splunk Search. 04-29-2021 01:00 AM
- Posted Re: table command without changing sort order on Splunk Search. 04-28-2021 02:11 AM
- Posted table command without changing sort order on Splunk Search. 04-28-2021 01:55 AM
- Posted Re: FormatMessage was unable to decode error (193), (0xc1) on Getting Data In. 04-20-2021 01:44 AM
- Got Karma for Re: How can I find out what the deployment errors are?. 03-22-2021 08:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 13 | |||
| 1 | |||
| 0 |
03-05-2024
04:48 AM
I found the solution which I came across here: https://community.splunk.com/t5/Security/How-do-I-renew-an-expired-Splunk-Certificate/m-p/389701 Turns out, the Splunk certificate was expired. This is how I checked: $ openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem
notAfter=Feb 27 13:56:21 2024 GMT To get a new certificate, I removed the old certificate and restarted Splunk (a new certificate will be created when Splunk starts): $ mv /opt/splunk/etc/auth/server.pem /opt/splunk/etc/auth/server.pem.backup Now Settings > Tokens is working again.
... View more
02-29-2024
04:26 AM
When I navigate to Settings > Tokens, I get this error message: KVStore is not ready. Token auth system will not work. Splunk logs shows this: ERROR JsonWebToken [233289 TcpChannelThread] - KVStore is not ready. Token auth system will not work.
ERROR KVStoreConfigurationProvider [233052 KVStoreConfigurationThread] - Failed to start mongod on first attempt reason=KVStore service will not start because kvstore process terminated
ERROR KVStoreBulletinBoardManager [233053 MongodLogThread] - KV Store changed status to failed. KVStore process terminated.. How can this be fixed?
... View more
Labels
- Labels:
-
administration
12-07-2022
12:25 AM
1 Karma
Hello,
I noticed that Splunk automatically translates input labels based on the user's locale. Dashboards with English labels are translated to German when the user locale is de-DE.
Here is an example:
<form version="1.1">
<label>Test</label>
<fieldset submitButton="false">
<input type="text" token="From">
<label>From</label>
</input>
<input type="text" token="To">
<label>To</label>
</input>
</fieldset>
</form>
en-US:
de-DE:
Not only is the translation unwanted, the translation is also wrong. (In this context, "to" should be translated to "für" or "an".)
Is it possible to disable this kind of behavior?
I found two other posts. The solutions were 1) change each input field individually (https://community.splunk.com/t5/Dashboards-Visualizations/How-to-prevent-translation-of-labels-and-input-fields-in/m-p/537380) and 2) change the user locale to English (https://community.splunk.com/t5/Dashboards-Visualizations/How-to-avoid-translation-on-input-field-in-a-dashboard/td-p/477152). However, I would prefer a global setting to disable automatic translations.
... View more
Labels
- Labels:
-
dashboard
08-30-2021
01:20 AM
I noticed that the sort order is kept when using streamstats. This "feature" is undocumented though. index=_* earliest=-15m latest=now | streamstats count | table _time,host,index
... View more
04-29-2021
01:12 AM
I created a new request on Splunk Ideas for this issue: https://ideas.splunk.com/ideas/EID-I-958 If anyone else feels bothered by this, please upvote the idea.
... View more
04-29-2021
01:00 AM
Interestingly enough, the sort order is preserved when doing a dashboard table visualisation with the fields command. However, this approach has two drawbacks: 1) I have to use a seconds fields command to remove the _raw field: | fields - _raw 2) A drilldown (clicking on the magnifying glass below the panel) will not show a table
... View more
04-28-2021
02:11 AM
I tried, but I want the events to be displayed in tabular format.
... View more
04-28-2021
01:55 AM
Hello all, I would like to use the table command without changing the order of events. To give an example: When searching for "index=_* earliest=-15m latest=now", the first displayed event has the current time and the last displayed event is 15 minutes in the past. Now when searching for "index=_* earliest=-15m latest=now | table _time,host,index" the events are resorted. _time is no longer descending (or ascending). I tried "index=_* earliest=-15m latest=now | table _time,host,index | sort 0 -_time". But that does not work 100% because some events have the same timestamp. So my question is: Can I use the table command (or some other command to form a table based on a given set of columns) without changing the sort oder?
... View more
Labels
- Labels:
-
table
04-20-2021
01:44 AM
I just had the same error message: 04-20-2021 10:31:06.770 +0200 ERROR ExecProcessor - Couldn't start command ""C:\Program Files\SplunkUniversalForwarder\etc\apps\myapp\bin\myscript.ps1"": FormatMessage was unable to decode error (193), (0xc1) I had a deployment app which consisted of a ps1 file and this inputs.conf: [script://.\bin\myscript.ps1]
index = myindex
schedule = */15 * * * *
crcSalt = <SOURCE> I could not find out why this error message appeared. However, I found this article: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdatawithPowerShellscripts I removed the ps1 file and created this inputs.conf instead: [powershell://MyPSInput01]
index = myindex
script = Get-ADDomainController -Filter * | Select-Object -Property Domain,Name,HostName,IPv4Address,OperatingSystem,Enabled
schedule = */15 * * * *
crcSalt = <SOURCE> This solved my issue. I don't know if this works for more complex scripts than my one-liner. Using the powershell input works surprisingly well: Before that I used "ConvertTo-Csv" as part of the PowerShell command to convert the PowerShell output to CSV before indexing. Using the powershell input, I do not need to specify the sourcetype and Splunk handles the log format automatically.
... View more
01-06-2021
11:52 PM
I encountered the very same error. I was following this guide: https://www.splunk.com/en_us/blog/tips-and-tricks/write-your-own-search-language.html What I noticed was that this guide is from 2008. Newer version of Splunk already have a built-in "shape" command. This one is defined in etc/system/default/searchbnf.conf: [shape-command]
syntax = shape <field> (maxvalues=<int>)? (maxresolution=<int>)?
shortdesc = Produces a symbolic 'shape' attribute describing the shape of a numeric multivalued field. Apparently, the built-in shape command takes precedence over your custom shape command when running a search. So I suggest rename your "shape" command to "shape2" or something else.
... View more
12-08-2020
12:46 AM
I was having the same issue: Moving the "index" field to the selected field list for all users. I was testing various config files and settings. This is the one which solved the issue for me: /opt/splunk/etc/apps/myapp/default/ui-prefs.conf
[default]
display.events.fields = ["host","index","source","sourcetype"] (system/local/ui-prefs.conf should work as well.) Now it is important to note that if a user had already changed his selected fields prior to this change, then the user preferences ( /opt/splunk/etc/users/your_user/search/local/ui-prefs.conf) will override the global setting above and thus the "index" field might not display under selected fields. Regardless, it will work for newly created users and users who haven't changed their selected fields yet.
... View more
05-29-2020
08:17 AM
1 Karma
I believe your best option is to modify the app bar via the XML file under Settings / User interface / Navigation menus.
There you can add links to your dashboards for quick navigation.
Have a look at this article: https://dev.splunk.com/enterprise/docs/developapps/addnavsplunkapp/
... View more
05-29-2020
06:41 AM
2 Karma
To answer my own question, I found that the REST endpoint /services/search/jobs contains a lot of useful information.
Searching for rest /services/search/jobs will list all past Splunk searches (similar to the Activity/Jobs view). I found that a search from a dasboard will have the "provenance" field like this: UI:Dashboard:sample_simple_dashboard. So I can extract the name of a dashboard for all dashboard searches.
One difficulty in determining the runtime of a dashboard is that there is no clear endtime. A user can select various inputs and time windows on a dashboard which will continuously trigger new searches.
Luckely, there is the "published" field which tells when a search was triggered. So I can group together dashboard searches based on the "published" field.
This is the search i created:
| rest /services/search/jobs
| rename dispatchState as Status eai:acl.app as App title as Search author as User runDuration as Runtime published as Published id as ID provenance as Provenance
| rex field=Provenance "UI:Dashboard:(?<Dashboard>.+)" | search Dashboard=*
| rex field=ID "(?<JobId>[^//]*)$"
| table App,Dashboard,User,Published,Runtime,Status
| stats sum(Runtime) as Runtime count as searches values(Status) as Status by App,Dashboard,User,Published
| eval Status=mvjoin(mvsort(mvdedup(split(mvjoin(Status,","),","))),",")
| eval Runtime=round(Runtime,1)
| sort 0 -Published
... View more
05-22-2020
01:48 AM
1 Karma
Hello,
I want to find out which dashboards take a long time to load. So I would like to have a table which shows the runtimes/searchtimes for all dashboards being opened by any user.
It should look something like this:
time dashboard user runtime (in seconds)
2020-05-22 10:02:00 sample_dashboard admin 15
2020-05-22 10:01:00 sample_dashboard admin 20
2020-05-22 10:00:00 sample_dashboard2 user 5
I found two answers from 2016 and 2017 which do not work. (The first one returns empty and the second one lists searches instead of dashboards.) https://answers.splunk.com/answers/425215/how-can-i-measure-the-dashboard-load-time.html https://answers.splunk.com/answers/488539/how-to-write-a-search-to-find-out-the-average-dash.html
Can anybody help?
... View more
Labels
- Labels:
-
other
03-23-2020
11:20 AM
Do you want to ingest data from a Splunk instance?
Check out the Splunk App for Phantom:
https://splunkbase.splunk.com/app/3411/
Under details, you will find a link to the documentation. It includes the chapter "Event Forwarding".
When you install this app, you will get new Phantom-related trigger actions like "Run Playbook in Phantom". This way, when a Splunk alert gets triggered, it will send the events to Phantom and run a specified playbook.
... View more
03-23-2020
10:52 AM
Try this:
| stats values(user)
You can combine it with the distinct count like this
| stats values(user) as users dc(user) as usercount
Alternatively:
| stats count by user
... View more
01-17-2020
03:21 AM
@romainbouajila I edited my answer. Have a look at the screenshot and the new props.conf.
... View more
01-16-2020
12:09 AM
Hello @romainbouajila,
This article Configure event line breaking goes into detail on how line breaking works.
The dates in your logs (a space character at the beginning of each line? and no year/month/day) look peculiar. You will need to set the timestamp extraction manually. The rest should work fine. By default, SHOULD_LINEMERGE and BREAK_ONLY_BEFORE_DATE are set to true.
Screenshot: https://ibb.co/JCtK7hw
This is the props.conf:
[log_name]
category = Custom
pulldown_type = true
DATETIME_CONFIG =
NO_BINARY_CHECK = true
TIME_PREFIX = \s*
TIME_FORMAT = %H:%M:%S,%3N
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true
... View more
11-21-2019
03:02 AM
2 Karma
Use this search to find out what the deployment errors are: index=_internal sourcetype=splunkd record (New OR Updating) result=Fail | head 100 I copied this answer from here: https://answers.splunk.com/answers/323460/forwarder-management-troubleshooting-client-errors.html#answer-560485
... View more
11-21-2019
02:55 AM
This answer greatly helped, thanks.
... View more
11-01-2019
01:42 AM
Hello @akki2428, use back slashes to escape special characters:
| makeresults | eval _raw="record failed (state error) for ID x1IoGPTIBP"
| rex field=_raw "record failed \(state error\) for ID (?<id1>\w+)"
| table id1
... View more
10-24-2019
04:27 AM
The search command's syntax is FIELD=VALUE. So |search id1=id2 will filter for the field id1 containing the string "id2".
You want to use where instead of seach. where evaluates boolean expressions. Try: |where id1==id2
This should also work:
| regex _raw="record has not been created for id (\w{10}),\1 in DB"
... View more
10-23-2019
06:38 PM
@akki2428 The search query above using makeresults creates only one record for testing purposes. Your search should be something like this:
index=yourindex sourcetype=...
| regex _raw="record has not been created for id \w{10},\w{10} in DB"
If that does not work, perhaps you could post some other records.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-19-2024
02:45 PM
|
Karma from
