Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Michael
Michael
Contributor
Member since:
04-28-2010
06-05-2020
Community Statistics
| Posts | 134 |
| Solutions | 6 |
| Karma Given | 65 |
| Karma Received | 72 |
| Member Since | 04-28-2010 |
Activity Feed
- Got Karma for Re: Dashboard Permissions. 10-15-2024 03:27 AM
- Got Karma for Re: Rename values extracted into field. 12-14-2023 09:23 AM
- Got Karma for Re: How to enable a new tab opening from within a dashboard?. 11-07-2023 05:18 AM
- Got Karma for Re: How to enable a new tab opening from within a dashboard?. 08-07-2023 11:20 AM
- Got Karma for Re: Add Picture to Dashboard. 06-09-2023 01:38 AM
- Got Karma for Re: Need to regenerate SSL Cert for SplunkWeb. 12-14-2022 05:31 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 09-30-2022 01:39 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 09-30-2022 01:39 AM
- Got Karma for Re: Filter Windows EventCode using blacklist and Whitelist. 12-15-2021 12:26 AM
- Got Karma for Re: join two lookup tables. 10-11-2021 02:08 PM
- Got Karma for Re: How do I do a reverse DNS lookup in Splunk?. 05-26-2021 12:03 PM
- Got Karma for Re: No labels showing in Vertical bar Chart. 04-19-2021 11:47 PM
- Got Karma for Re: KV Store Errors : KV Store changed status to failed. Failed to start KV Store process. Getting KV store errors without using KV store. 03-05-2021 07:02 AM
- Got Karma for Re: Add Picture to Dashboard. 02-26-2021 05:48 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 12-01-2020 10:00 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 11-24-2020 04:05 PM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 09-22-2020 09:15 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 09-22-2020 09:14 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 09-22-2020 08:41 AM
- Got Karma for Re: Add Picture to Dashboard. 09-17-2020 12:55 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
02-03-2020
07:29 AM
Hmm, with due respect (I know a lot of time has passed -- I'm on v 7.3.3), this might have worked before, but not now.
I'm trying to simply expand out the results of a "df -h" from a text'd output file -- and it's being very reluctant...
... View more
12-05-2019
01:20 PM
FYI, I just noticed this with 7.3.1 and 7.3.3 today...
No apps were recently updated, changed, added, removed...
It does not involve a lookup table.
info.csv exists nowhere on in the environment -- and nothing appears to be referring to it...
I'm going push the bundle tomorrow morning using the "max_infocsv_messages = 1000" setting mentioned below. I'll let you know what happens...
... View more
11-07-2019
01:20 PM
I corrected it with generating a new key:
/opt/splunk/bin/splunk createssl server-cert 3072 -d /opt/splunk/etc/auth/ -n server -c {your name here}
restart Splunk
went from:
tail mongod.log
... [main] The provided SSL certificate is expired or not yet valid.
... [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager.cpp 1120
to
tail mongod.log
... Successfully authenticated as principal __system on local
... View more
08-12-2019
09:53 AM
1 Karma
Easy peazy, I needed to include three tables and simply used:
| inputlookup table1.csv | inputlookup append=true table2.csv | inputlookup append=true table3.csv
... View more
06-14-2019
08:37 AM
OMG, that fixed it. That was making me nuts!
That's just silly that it can't handle that fieldname (I even tried "fileinfo.size" and 'fileinfo.size').
Thanks!
... View more
06-14-2019
08:26 AM
Wow, I can't believe this is kicking my butt -- think I need an idiot check... (yes, I know... 😉
I'm trying to do a simple conversion: sizeK=(fileinfo.size/1024) but it's failing. I've done these hundreds of times before, and have it documented in my notes from years ago. Oh, and triple checked it here against multiple examples.
The whole line is simply:
index=suricata event_type=fileinfo| eval sizeK=(fileinfo.size/1024)
It's not creating "sizeK".
When I change to:
| eval sizeK=round(fileinfo.size/1024)
or
| eval sizeK=round(fileinfo.size/1024,2)
I get: "Error in 'eval' command: The arguments to the 'round' function are invalid. "
Even tried:
| eval sizeK=fileinfo.size/1024
Still no workie. Suggestions?
... View more
03-22-2019
11:09 AM
1 Karma
I solved this by generating new key with:
/opt/splunk/bin/splunk createssl server-cert 3072 -d /opt/splunk/etc/auth/ -n server -c {your domain name}
/opt/splunk/bin/splunk restart
... View more
02-07-2019
12:49 PM
1 Karma
That's not a reverse DNS lookup, that's a table lookup.
I think the assumption (and MY question) is that you don't have a csv file...
Question not answered.
... View more
01-17-2019
12:42 PM
Beatus, (hope you're still monitoring this thread...)
I love your solution. Our cluster has hundreds of these sourcetypes-too_small, and they're inconsistent, so any report based on them, or their root sourcetype fails often. It floors me that the sourcetype is pretty much always set to the same thing as the source, then when it fulfills this "too small" check, adds the -too_small to the source (and existing sourcetype name) -- when it would be better to simply leave the sourcetype name the same as source if it can't guess it -- rather than creating a completely new (and wrong) sourcetype. Oh Great Splunkin, are you listening?
So,
I've done the above -- and put them on my heavy forwarders (didn't work) and then put them on my indexers (deployed them in a bundle from my cluster master). But it did not fix the problem.
Would you happen to know if this fix still works -- or ever did?
Forgive my questioning, but so often I see people answering here with "this should fix it..." without ever actually having tried it and experienced it being fixed afterwards...
... View more
10-19-2018
08:47 AM
2 Karma
to actually answer your question, and not give an RTFM answer:
use the target="blank" tag like this:
<a href="https://server:8000/en-US/app/search/search" target="blank"> <b>Search screen</b>
</a>
... View more
04-04-2018
12:53 PM
I inherited a cluster, setup properly, as far as I know. However, am getting the error:
"Bad Request — editTracker failed, reason='WARN: path=/masterlm/usage: Signature mismatch between license slave=//redacted// and this License Master. Please make sure that the pass4SymmKey setting in server.conf, "
when trying to point new systems to the license master.
I know the fix, but I don't know the plain-text pass4SymmKey phrase...
What are my recovery options?
Thanks!
... View more
02-20-2018
09:00 AM
index=main [ search index=main (host=esa1* OR host=esa2*) "possible delivery" | stats count by MID | fields + MID | format] | transaction MID
This will search for the error "possible delivery" on a line, then use the MID field to pivot from and collect all the line events from that exchange.
... View more
02-20-2018
08:57 AM
Since I couldn't find this anywhere, I'm making my own question and answer, to better help the "next guy" who has this question and can't find the answer either.
I wanted a simple query of an error condition in our email logs, then return the grouped log events associated with that exchange. Since email logs are line by line (multiple events) their only connection is the MID.
Answer below:
... View more
01-23-2018
08:32 AM
Can you clarify?
you mean you can just make up a sourcetype (and name it anything like "abciis")...?
Did you have to define "abciis" anywhere?
Did not work, as explained above.
... View more
01-02-2018
11:25 AM
I read the above chain, and yes, Power User will enable users to change permissions and share their dashboards, but the problem is that it also enables way too much capability. For example, the first thing I noticed was that this user (now Power User) can also see all dashboards and indexes -- even if their role includes both Power and User.
It seems the permission model is not applying least-privileged principles...
... View more
12-15-2017
11:58 AM
Also, accessible via the GUI under: Settings, User Interface, Navigation menus... (v7.*)
... View more
12-01-2017
01:50 PM
Note -- looks like my asterisks (*) didn't show up there -- please don't consider that a typo in my config...
... View more
12-01-2017
01:46 PM
Out of our deployement of about 1,000 UF clients, a handful of systems are reporting data to the wrong indexes -- even though they are clearly configured to point to the correct one.
Here's the observations:
Lookup:
Name: daniels
Address: 10.14.108.60
Green_windows Server Class defined as:
10.14.96.*, 10.14.104.*, 10.14.105.*, 10.14.106.*, 10.14.107.*, 10.14.108.* <-- note the 108.*
Red_windows server class:
10.14.120.*, 10.14.121.*, 10.14.112.*, 10.14.12.*
BUT, he's showing up with Red's configurations:
daniels
Apps
Red_base_config, Red_windows
Server Classes
Red_windows
But wait, there's more: he's actually sending logs to two indexes: Red_windows AND Orange_windows... (but not Green's)
Sanity check -- the server class for Orange_windows is configured as:
10.14.40.*, 10.14.56.*, 10.14.72.*, 10.14.62.*, 10.14.78.*, 10.14.64.*, 10.14.13.*
We've confirmed the packages being deployed all point to the correct indexes -- and others in the same range are actually working properly!
Client is a Windows 10 system, if that matters...
Thoughts?
Thanks!
... View more
10-25-2017
07:55 AM
Thank you!
But, not knowing Python, I burnt some cycles on the adding of "local=True" to things already there. To help my next comrade from not falling for this, but sure to use a comma to separate multiple entries in the Configuration parameters. I.E.:
ldapsearch.py:@Configuration(retainsevents=True, local=True)
ldaptestconnection.py:@Configuration(retainsevents=True, local=True)
ldapfetch.py:@Configuration(local=True)
ldapfilter.py:@Configuration(local=True)
ldapgroup.py:@Configuration(local=True)
... View more
10-10-2017
06:32 AM
Same here, in 2017; v 6.5.3.
Have a deployed environment. Have dozens of systems getting a deployment package with regmon.path set with "disabled = 1" and yet they continue to generate millions of entries a day.
Still working the issue...
... View more
06-29-2017
11:08 AM
10 Karma
rsennett is onto it, but here's a simplified version:
The path you put in the code, has nothing to do with reality. Just accept it and go with this in your XML code:
<img src="/static/app/search/images/picture.jpg"/>
And put the image here:
/opt/splunk/etc/apps/search/static/images/picture.jpg
Why this works, I don't know, nor do I care anymore.
...that's another two hours of my life I'll never get back, thanks to incomplete, wrong, and convoluted Splunk Community "answers". Hopefully this will save someone else the trouble.
... View more
06-29-2017
10:48 AM
Wow. I got it to work, and I don't know why.
In my code, I have:
<img src="/static/app/search/images/zg9ac8.jpg"/>
But, my directory structure is:
/opt/splunk/etc/apps/search/static/images/zg9ac8.jpg
Why does this work? Am I only one that thinks this is weird?
No wonder this has been kicking my butt for so long. I stopped trying to understand it, and went with Arkonner's pathing, then removed all the jpgs I had in multiple directories, until I found that combination above.
So, my new questions is: WTF?
... View more
05-30-2017
08:33 AM
1 Karma
Ya, I didn't get that either... I ended up simply using REX:
rex field=mount mode=sed "s/space/Splunk DB location/g"
This takes the value "space" in the mount field (this is a df output) and replaces the word "space" with "Splunk DB location".
... View more
04-18-2017
06:54 AM
Ah, that may be it, the sys-admin for the box is using Salt... when check and get back...
... View more
04-18-2017
06:29 AM
I have three indexers in a cluster. We're in the process of taking them offline, in turn, for updates. They are running 6.5.1, we are updating them to 6.5.3.
So, I go to take the first one offline and the admin password does not work. On a whim, I tried the default "changeme" and it worked! The last time we did an update it went from 6.5.0 to 6.5.1. Those are the facts, but the assumption is that it got reset when updating to 6.5.1...?
I've been using Splunk for a half-dozen years, and never seen it reset it's admin password back to default...
Thoughts? Bug? Or, just another one of those snowflake things at my site that no one else has ever seen? 😉
Michael
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
