About livehybrid

livehybrid

Hi @Schroeder In your restmap.conf have you set stream=true? I'm not sure if this is the only thing you would need to change but it could be a good starting point! https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/configuration-file-reference/9.4.3-configuration-file-reference/restmap.conf#:~:text=persist%22.%0A*%20Default%3A%20false-,stream%20%3D%20%3Cboolean%3E,-*%20Describes%20whether%20or stream = <boolean> * Describes whether or not splunkd sends the payload in the request to the driver in a streaming fashion. * A value of "true" means splunkd sends the payload in the request to the driver in a stream, or multiple sequential requests. * A value of "false" means splunkd sends the payload in the request to the driver as a field of the original request. * Only has effect if the 'scripttype' setting is set to "persist". * Default: false 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @NickEot Can I check - do you not deploy to your HF from a Deployment Server? Ideally HF would be relatively stateless and be rebuildable from a DS if it was to disappear and come back without configuration, however if you're not in a position to do this then you would need to look at a custom app to collect the data you need and index it. I cant find it right now (but I'll keep looking) but I once created a simple app which ran btool and piped the output to a file. You could do something like this as a custom app which could then be configured to send the conf files you are interested in to a file which is configured to be monitored in inputs.conf and ingested to whichever index you need on your indexers. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @tanjiro_rengo It ultimately depends on what configuration file changes you have applied to determine if this is a search-time or index-time change. Index-time changes will not apply retrospectively to existing indexed data. Please could you share you configuration changes and let us know how you are sending this file to Splunk? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @hv64 Can you please confirm if this previously worked, or if this is a new install? I see you arent running on the latest version - it might be worth upgrading to 4.0.0 unless there are any issues you are aware of which could prevent this, this could rule out any previous bugs etc. There are a huge range of things which could be wrong based on this error, the first thing I would try is restarting splunkd incase this resolves it, have you already tried this? I'd also recommend checking out https://splunk.my.site.com/customer/s/article/Splunk-App-for-DB-Connect-Cannot-Communicate-With-Task-Server which has a number of troubleshooting steps, rather than listing them all here! Good luck! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

@kiran_panchavat - this isnt strictly true, @ramiiitnzv What is the reason you're trying to use a dev license with ES? If you are a customer and want to try out using ES then you should speak to your sales account team within Splunk, if you dont know who this is then you can try going via https://www.splunk.com/en_us/talk-to-sales.html. If you are wanting to build apps that integrate with ES then Dev license is probably appropriate, but as others have said, you dont automatically get access the ES app within Splunkbase as this is based on entitlements. Ultimately I think if you need access to ES then its the sales team who can grant access, if you explain to them the reasoning they should be able to find a resolution for you. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @danielbb My understanding on this (and I'd also be pleased if someone can confirm!) is that api_lt and api_et represent the time parameters provided by the user in the time picker or API when running a search, but search_lt and search_et represent the actual earliest and latest time used by Splunk during the search execution. If the user specifies an earliest/latest in the search for example, this would override the time picker values (api_et/api_lt). If not earliest/latest in the search then search_et/lt become api_lt. I dont recall seeing docs around this though so if someone can find any please let me know 🙂 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @meg Please can you confirm the sourcetype that you are using? Also, is this being read directly using a UF and sent to Splunk without going via other systems? Are you ingesting this using the Splunk Add-on for Sysmon for Linux on the UF? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @mbissante Just a follow up on my previous post, the following are for 9.0.9 which was the last 9.0.x release: -------- Linux -------- -- Tarball (TGZ) wget -O splunk-9.0.9-6315942c563f-Linux-x86_64.tgz 'https://download.splunk.com/products/splunk/releases/9.0.9/linux/splunk-9.0.9-6315942c563f-Linux-x86_64.tgz' wget -O splunkforwarder-9.0.9-6315942c563f-Linux-x86_64.tgz 'https://download.splunk.com/products/universalforwarder/releases/9.0.9/linux/splunkforwarder-9.0.9-6315942c563f-Linux-x86_64.tgz' -- Debian (DEB) wget -O splunk-9.0.9-6315942c563f-linux-2.6-amd64.deb 'https://download.splunk.com/products/splunk/releases/9.0.9/linux/splunk-9.0.9-6315942c563f-linux-2.6-amd64.deb' wget -O splunkforwarder-9.0.9-6315942c563f-linux-2.6-amd64.deb 'https://download.splunk.com/products/universalforwarder/releases/9.0.9/linux/splunkforwarder-9.0.9-6315942c563f-linux-2.6-amd64.deb' -- RHEL (RPM) wget -O splunk-9.0.9-6315942c563f.x86_64.rpm 'https://download.splunk.com/products/splunk/releases/9.0.9/linux/splunk-9.0.9-6315942c563f.x86_64.rpm' wget -O splunkforwarder-9.0.9-6315942c563f.x86_64.rpm 'https://download.splunk.com/products/universalforwarder/releases/9.0.9/linux/splunkforwarder-9.0.9-6315942c563f.x86_64.rpm' Kudos to ryanadler for this great tool https://github.com/ryanadler/downloadSplunk 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @mbissante Below are the download links for 9.0.1 if this helps? Splunk Linux Tar file - https://download.splunk.com/products/splunk/releases/9.0.1/linux/splunk-9.0.1-82c987350fde-Linux-x86_64.tgz Splunk Linux rpm file - https://download.splunk.com/products/splunk/releases/9.0.1/linux/splunk-9.0.1-82c987350fde-linux-2.6-x86_64.rpm Splunk Linux Debian file - https://download.splunk.com/products/splunk/releases/9.0.1/linux/splunk-9.0.1-82c987350fde-linux-2.6-amd64.deb Splunk Linux Windows file - https://download.splunk.com/products/splunk/releases/9.0.1/windows/splunk-9.0.1-82c987350fde-x64-release.msi 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @danielbb I suspect the main reason for this is that 9514 is not a Privileged port, ie Splunk can mount it (ports > 1024) without additional permissions. To mount a port <1024 Splunk would require CAP_NET_BIND_SERVICE capability. It is common practice for Splunk to listen to ports higher than 1024 for syslog, and people often prefix 514 with another number. Sometimes you will see multiples such as 7514,8514,9514 to receive traffic from different syslog sources. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @LOP22456 The user (typically splunkfwd) that is created is a standard system user, so will be stored in /etc/passwd with other local users and I dont think a password is set, so its not possible to login with the user. The password would be stored in /etc/shadow if set. Check out https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Installanixuniversalforwarder#:~:text=of%20Splunk%20Enterprise.-,Install%20the%20universal%20forwarder%20on%20Linux,-About%20the%20splunkfwd for more information around this if you havent already seen. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @braxton839 This looks good to me - Check the cluster manager first to ensure that things are in a good shape before offline-ing your indexer. Be aware that with a RF of 2 you can only safely take down a single indexer at a time, and whilst it is down you are at risk of reduced data availability if your other indexers run into any problems. Theres some good reading at https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/9.3/manage-the-indexer-cluster/take-a-peer-offline if it helps, but you may have already seen this. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @danielbb You could start with something like this: index=_audit action=search info=completed search_et!="N/A" | eval time_span=search_lt-search_et | eval time_span_group=case( time_span<3600, "<1hr", time_span>=3600 AND time_span<7200, "1-2hrs", time_span>=7200 AND time_span<43200, "<12hrs", time_span>=43200 AND time_span<86400, "<24hrs", time_span>=86400 AND time_span<259200, "<3days", time_span>=259200 AND time_span<604800, "<7days", time_span>=604800 AND time_span<2592000, "<30days", time_span>=2592000 AND time_span<7776000, "<90days", time_span>=7776000 AND time_span<31536000, "<1year", time_span>=31536000, "more" ) | stats count by time_span_group 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @Pete_ The splunkclouduf.spl app configures secure forwarding to Splunk Cloud; you should not need to modify outputs.conf directly, also, because you're able to see the new forwarders in the Cloud Monitoring Console (CMC) we know that the outputs are established and the new UFs can reach Splunk Cloud. The testing you've done shows the 514 syslog feed arriving at the box, however is Splunk listening on that port? If you run the following can you see that splunkd is listening to the port? sudo netstat -tulnp | grep 514 Are there any logs in $SPLUNK_HOME/var/log/splunk/splunkd.log about binding port 514, any errors etc? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Can you also confirm, is the data coming from a UF? I saw you put that the conf was on the Indexers but if its being sent from a Heavy Forwarder it will need to be there too. Is this a regular monitor:// input? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

@splunklearner Hmm okay, it matches via https://regex101.com/r/ZZw8Lv/1 - must be something else, I'll keep digging. Did chatgpt have any other suggestions!? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @JohnGregg I believe the 400 bad request is being caused by the specific params being sent, Are you able to print any logging to see what the start/end time is being requested? If there is an issue where the start time > now(), start_time = end_time, start_time > end_time or some other invalid timing then it could cause the issue - If you're running in a loop like this then it can be easy to get into these problems without realising. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @splunklearner Could this is an issue with the LINE_BREAKER, try the following which includes a negative lookahead for the date: LINE_BREAKER=([\r\n]+)(?=[A-Z][a-z]{2}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}\s) Can I just check, you said you have the props/transforms on the Indexer, is this data sent from a UF or HF? If its a HF then you'll need to deploy it there too. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @_pravin This isnt really a suitable way to manage your excessive license usage. If your SH are configured to send their internal logs to the Indexers (which they should be) then they will start queueing data, it sounds like this queueing could be slowing down your SHs. I think the best thing to do would be to focus on reducing your license ingest- are there any data sources which are unused or could be trimmed down? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @Kosyay Yes, you can use props/transforms to extract fields from the event. I wouldnt recommend modifying the event at index-time though, as this might break other extractions that exist for this feed, instead you can create new fields for the data you want to extract. I havent validated this with my instance as I dont have WinEventLogs at the moment but you could try something like this: You can extract and rename these fields at index time using props.conf and transforms.conf with appropriate regex. In props.conf, configure a stanza for your sourcetype and reference a transform. In transforms.conf, use regex to capture and rename the two "Account Name" fields. Example configuration: === props.conf === [your_sourcetype] TRANSFORMS-rename_account_names =extract_win_account_names === transforms.conf === [extract_win_account_names] REGEX = Subject:\s+Security ID:.*?Account Name:\s*([^\s]+).*?New Logon:.*?Account Name:\s*([^\s]+) FORMAT = Source_Account_Name::$1 Destination_Account_Name::$2 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

HI @captaincool07 Summary indexing does not natively preserve RBAC at the original index level. If you aggregate data from multiple indexes into a single summary index, users with access to the summary index can see all summarised data, regardless of their original index permissions. This can break your RBAC model if not carefully managed. Index permissions and App permissions are managed separately, so you do have some granular control over who can access the summary. There are different ways to summarise data with Splunk - Check out https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.4/use-data-summaries-to-accelerate-searches/use-summary-indexing-for-increased-search-efficiency for more info on how to achieve this. It does sound like this would be a good candidate for summary indexing, assuming you have already looked to improve the performance of the search (e.g. can you use tstats to search the data, TERM(someString) etc) 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @Simona11 You could try: | timechart span=1d latest("TOTAL DAILY BAGS") as daily_bags, count as total_alarms |stats sum(total_alarms) as total_alarms, sum(daily_bags) as total_bags | makeresults count=8 | streamstats count as row | eval AREA=case(row=1,"1111", row=2,"1111", row=3,"1222", row=4,"1323", row=5,"1323", row=6,"1222", row=7,"1111", row=8,"1323") | eval "ALARM DESCRIPTION"=case(row=1,"TRIGGER", row=2,"TRIGGER", row=3,"FAILURE", row=4,"FAILURE", row=5,"HAC", row=6,"FAILURE", row=7,"FAILURE", row=8,"TRIGGER") | eval "TOTAL DAILY BAGS"=case(row<=5,18600, row>5,33444) | eval TIME=case(row<=5,"2024-03-01", row>5,"2024-02-01") | eval _time=strptime(TIME,"%Y-%m-%d") | timechart span=1d latest("TOTAL DAILY BAGS") as daily_bags, count as total_alarms | stats sum(total_alarms) as total_alarms, sum(daily_bags) as total_bags 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @SN1 Check out Splunk Alerts for Microsoft Teams - https://splunkbase.splunk.com/app/4855 This application provides alert actions for Microsoft Teams messages publication to allow formatted messages publication from Splunk Then create alerts from the searches you have in your dashboards and use the Teams alert action from this app to send to your Microsoft Teams destination. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @splunklearner Try the following: | rex field=requestHeaders "User-Agent: (?<useragent>.*?)(?=\s+\w+-?[\w-]*: )" 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

livehybrid

Hi @questionsdaniel Are you re-running it against the exact same earliest/latest time? Also - the top command can only process the first 50,000 results - so its likely that the first 50,000 events returned from your indexers are different each time (arrive in a different order for example) which is why you see different values. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

Posts	1358
Solutions	188
Karma Given	59
Karma Received	540
Member Since	‎08-15-2013

Online Status	Offline
Date Last Visited	15 hours ago

Issue using Map+ app with _time

Splunk AWS App not populating pricing info for eu-...

Does anybody have a working draw.io Library with S...

Re: reply/response in PersistentServerConnectionAp...

Re: how to backup .conf files from distributed hea...

Re: About Upload File

Re: error on dbx connect : DBX Server is not avail...

Re: Reg to Download of ES

Re: What's the relationship between api_lt/api_et ...

Re: Cannot parse linux logs

Re: Download Splunk Enterprise 9.0

Re: Download Splunk Enterprise 9.0

Re: Why for f5 data we use [UDP://9514] instead of...

Re: Splunk local account SOX compliance

Re: Upgrading hardware on Indexers in cluster (one...

Re: What are the fields in _audit that specify the...

Re: Data not reaching Splunk Cloud after Migrating...

Re: Log formatting not as expected

Re: Log formatting not as expected

Re: Frequent http 400 responses to SignalFlow clie...

Re: Log formatting not as expected

Re: network issues during indexer descovery fail

Re: Modify Security Events for EventCode 4624)

Re: Summary index or any other alternative which a...

Re: SUM & COUNT from a lookup table

Re: alerts

Re: Extraction of a field inside Json data

Re: Sort returning different results?

Are you a member of the Splunk Community?