Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mbachhav
mbachhav
Path Finder
Member since:
05-28-2020
01-10-2023
Community Statistics
| Posts | 23 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 5 |
| Member Since | 05-28-2020 |
Activity Feed
- Got Karma for How to fix failure in app-inspect | check_for_supported_tls?. 06-13-2023 06:41 AM
- Got Karma for How to resolve check_hostname requires server_hostname in Splunk 9?. 03-30-2023 09:49 AM
- Got Karma for How to fix failure in app-inspect | check_for_supported_tls?. 01-16-2023 09:07 PM
- Posted How to fix failure in app-inspect | check_for_supported_tls on Splunk Dev. 01-09-2023 07:52 PM
- Posted How to fix failure in app-inspect | check_for_supported_tls? on All Apps and Add-ons. 01-09-2023 09:07 AM
- Posted How to resolve check_hostname requires server_hostname in Splunk 9? on Splunk Enterprise. 07-28-2022 02:43 AM
- Posted Re: TA is working on Splunk cloud classic but on Splunk cloud victoria on All Apps and Add-ons. 12-23-2021 08:25 PM
- Posted TA is working on Splunk cloud classic but on Splunk cloud victoria on All Apps and Add-ons. 12-23-2021 12:01 AM
- Tagged TA is working on Splunk cloud classic but on Splunk cloud victoria on All Apps and Add-ons. 12-23-2021 12:01 AM
- Tagged TA is working on Splunk cloud classic but on Splunk cloud victoria on All Apps and Add-ons. 12-23-2021 12:01 AM
- Posted Re: Need help on the splunk.entity.getEntities on Splunk Dev. 10-21-2021 12:21 AM
- Posted Need help on the splunk.entity.getEntities on Splunk Dev. 10-05-2021 09:30 PM
- Tagged Need help on the splunk.entity.getEntities on Splunk Dev. 10-05-2021 09:30 PM
- Tagged Need help on the splunk.entity.getEntities on Splunk Dev. 10-05-2021 09:30 PM
- Tagged Need help on the splunk.entity.getEntities on Splunk Dev. 10-05-2021 09:30 PM
- Tagged Need help on the splunk.entity.getEntities on Splunk Dev. 10-05-2021 09:30 PM
- Posted Re: Need help with a regex for line_breaker in props.conf on Splunk Search. 10-05-2021 12:30 AM
- Posted Re: Need help with a regex for line_breaker in props.conf on Splunk Search. 09-27-2021 08:43 AM
- Posted Re: Need help with a regex for line_breaker in props.conf on Splunk Search. 09-27-2021 08:37 AM
- Posted Re: Need help with a regex for line_breaker in props.conf on Splunk Search. 09-27-2021 08:27 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
01-09-2023
07:52 PM
Splunk app inspect reports the "check_for_supported_tls" failure with the description as - If you are using requests.post to talk to your own infra with non-public PKI, make sure you bundle your own CA certs as part of your app and pass the path into requests.post as an arg. I am using verify: false in the request.post() method and getting the above error in the app inspect tool.
... View more
01-09-2023
09:07 AM
2 Karma
Splunk app inspect reports the "check_for_supported_tls" failure with the description as -
If you are using requests.post to talk to your own infra with non-public PKI, make sure you bundle your own CA certs as part of your app and pass the path into requests.post as an arg.
I am using verify: false in the request.post() method and getting the above error in the app inspect tool.
... View more
Labels
- Labels:
-
configuration
-
development
07-28-2022
02:43 AM
1 Karma
I am getting an error "check_hostname requires server_hostname" with Splunk 9 when using request.post() with proxy with https . How to resolve this error?
... View more
Labels
- Labels:
-
development
12-23-2021
08:25 PM
@richgalloway - I already checked the error log but forgot to mention it in the original message. Error is not related to our TA. Error - 2021-12-14 04:21:04,321 ERROR [61b81bb0087fb0701c5810] error:335 - Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 628, in respond
self._do_respond(path_info)
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 687, in _do_respond
response.body = self.handler()
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/lib/encoding.py", line 219, in __call__
self.body = self.oldhandler(*args, **kwargs)
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/htmlinjectiontoolfactory.py", line 75, in wrapper
resp = handler(*args, **kwargs)
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpdispatch.py", line 54, in __call__
return self.callable(*self.args, **self.kwargs)
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 383, in default
return route.target(self, **kw)
File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-1208>", line 2, in render
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 40, in rundecs
return fn(*a, **kw)
File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-1206>", line 2, in render
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 118, in check
return fn(self, *a, **kw)
File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-1205>", line 2, in render
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 166, in validate_ip
return fn(self, *a, **kw)
File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-1204>", line 2, in render
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 245, in preform_sso_check
return fn(self, *a, **kw)
File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-1203>", line 2, in render
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 284, in check_login
return fn(self, *a, **kw)
File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-1202>", line 2, in render
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 304, in handle_exceptions
return fn(self, *a, **kw)
File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-1197>", line 2, in render
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 359, in apply_cache_headers
response = fn(self, *a, **kw)
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 1052, in render
supported_themes = appObj.get('supported_themes') or ''
AttributeError: 'NoneType' object has no attribute 'get'
... View more
12-23-2021
12:01 AM
Our TA is cloud vetted on Splunkbase. Our TA is working on the Splunk cloud Classic version whereas the same TA is throwing the below error while accessing the setup page on the Splunk cloud Victoria version. Please let me know how to identify the root cause and resolve the error. Thanks in advance.
... View more
Labels
- Labels:
-
installation
-
upgrade
10-21-2021
12:21 AM
@kamlesh_vaghela , Yes, a user has capabilities to access passwords and access to list_storage_passwords and admin_all_objects capabilities.
... View more
10-05-2021
09:30 PM
We have TA for Splunk and are using Splunk's internal library(splunk.entity) to fetch the credentials from passwords.conf file using the below code. On some Splunk enterprise instances below code is working properly and returning username and clear password. But on some Splunk enterprise instances and Splunk cloud, it has been observed that the value of ['eai:acl']['app'] is Null due to which exception has been raised by the code. We would like to know why some Splunk instances return the Null value for ['eai:acl']['app']. Code - import splunk.entity as entity myapp = 'APP-NAME' realm = 'APP-NAME-Api' try: entities = entity.getEntities(['admin', 'passwords'], namespace=myapp, owner='nobody', sessionKey=session_key) except Exception as e: raise Exception("Could not get %s credentials from Splunk. Error: %s" % (myapp, str(e))) for i, c in list(entities.items()): if c['eai:acl']['app'] == myapp and c['realm'] == realm: return c['username'], c['clear_password'] raise Exception("No credentials found.") We also tried with the below CURL command but the field ['eai:acl']['app'] is missing in the response. curl -k -u <splunk_username>:<splunk_password> https://<host>:8089/services/storage/passwords
... View more
10-05-2021
12:30 AM
Problem has been solved with below stanza - [stanza name] TIMESTAMP_FIELDS=dateTime LINE_BREAKER=(\<DETECTION\s) SHOULD_LINEMERGE=true NO_BINARY_CHECK=true TZ=UTC CHARSET=UTF-8 KV_MODE=xml MAX_EVENTS=50000 TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ
... View more
09-27-2021
08:43 AM
Apologies. First I tried with BREAK_ONLY_BEFORE=\<DETECTION\> but it didn't work hence I tried line_breaker.
... View more
09-27-2021
08:37 AM
Below is my props.conf file - [stanza] TIMESTAMP_FIELDS=dateTime LINE_BREAKER =\<DETECTION\> SHOULD_LINEMERGE=true NO_BINARY_CHECK=true TZ=UTC CHARSET=UTF-8 KV_MODE=xml MAX_EVENTS=50000 TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ
... View more
09-27-2021
08:27 AM
@aasabatini, I tried the suggested option but it's not working as expected. Data is split into multiple events.
... View more
09-27-2021
07:07 AM
Hi, Need help with regex for LINE_BREAKER attribute in props.conf. I have the below data and wanted it as a single event in Splunk. Currently, <RESULTS> data splits into multiple events. I would like to send the entire <DETECTION> tag as a single event. Can someone help me provide the right LINE_BREAKER pattern to be used? <DETECTION>
<ID>231</ID>
<TYPE>Information</TYPE>
<SEVERITY>1</SEVERITY>
<RESULTS>Line 1 :
field 1 : value1
field 2: value2</RESULTS>
<STATUS>NEW</STATUS>
</DETECTION>
... View more
06-23-2021
02:33 AM
I have developed the setup page of my TA using setupview. On Splunk instance, I have installed my TA and other TAs also. I am fetching storage credentials of my TA's "password.conf" file using Splunk JS SDK's storagePasswords. But this returns storage credentials of "password.conf" from other TAs that are installed on Splunk instance. How to get storage credentials of only my TA's "password.conf" file using Splunk JS SDK's storagePasswords?
... View more
03-16-2021
03:51 AM
I have used Splunk setup view as a replacement of setup.xml. For this, I have used Splunk JS SDK. I have a password field on the setup page. JS SDK saves the encrypted password in the 'local/FILENAME.conf' file. This JS SDK internally calls Splunk API. The password API(https://{HOST_NAME}/en-US/splunkd/__raw/servicesNS/nobody/{TA_NAME}/storage/passwords?count=0&output_mode=json) response returns both plain password & encrypted password. How to avoid plain password in Splunk's password API response? Thanks in advance.
... View more
03-04-2021
05:34 AM
I have used Splunk setup view as a replacement of setup.xml. For this, I have used Splunk JS SDK. I have a password field on the setup page. JS SDK saves the encrypted password in the 'local/FILENAME.conf' file. This JS SDK internally calls Splunk API. The password API(https://{HOST_NAME}/en-US/splunkd/__raw/servicesNS/nobody/{TA_NAME}/storage/passwords?count=0&output_mode=json) response returns both plain password & encrypted password. How to avoid plain password in Splunk's password API response? Thanks in advance.
... View more
Labels
- Labels:
-
configuration
-
development
-
other
11-24-2020
09:25 PM
1 Karma
We are using the TA in Splunk Cloud. As the TA is installed on the Splunk IDM, we notice that when we try to create any input, we are unable to select the custom index we created in the indexer. Is there a feature that allows us to select our custom index by dropdown?
... View more
Labels
- Labels:
-
other
10-21-2020
09:13 AM
@richgalloway , Thanks for your reply. I don't want to deploy an add-on on search heads. Can you share the documentation link/steps for setting up scheduled saved searches from Splunk UI?
... View more
10-21-2020
06:48 AM
Hi, I have a clustered environment (Search Head Cluster with 1 Forwarder, 3 SHs, and 2 Indexers). I have deployed a custom-built app on the Forwarder. I would like to set schedule saved searches on Search Head. How to achieve this from Splunk UI? Or Is there any other way than Splunk UI?
... View more
Labels
- Labels:
-
saved search
-
scheduled search
10-05-2020
03:34 AM
Hi, Is there any way to replicate the lookup table(KV store/CSV) from Forwarder to indexer/SearchHeads?
... View more
10-01-2020
08:07 AM
Hi, I have a clustered environment (Search Head Cluster with 1 Forwarder, 3 SHs, and 2 Indexers). I have deployed a custom-built app on the Forwarder and 3 SHs. I have created a KV Store lookup with a custom-built app on the Forwarder and set replicate = true in collections.conf as mentioned in https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles. I wish to replicate KV Store lookup from forwarder to indexer/SearchHeads but KV Store lookup isn't replicating there. Let me know how to achieve this. Thanks in advance.
... View more
09-11-2020
05:34 AM
We are using a clustered environment with indexers, search-heads, a deployer, and a heavy forwarder (all running on the same Splunk Enterprise version). We are setting up TA on a heavy forwarder which generates a CSV file(lookup table). We would like to auto copy/replicate a CSV file from heavy forwarder to search-heads/indexer. Let me know how to achieve this? Thanks in advance.
... View more
Labels
- Labels:
-
CSV
-
heavy forwarder
-
indexer
06-04-2020
06:47 AM
Hi lknecht,
This code creates "local/setup_view_example.conf" file.
How to fetch the stored values from setup_view_example.conf file and display them in setup_view form when user opens setup form next time?
Also, How to show default value for input type if custom value for it is not available in "local/setup_view_example.conf" file?
Thanks in advance.
... View more
05-28-2020
04:15 AM
Event is not getting logged into the Splunk. I checked the splunkd.log file and found below warning -
WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "bound".
Is anyone familiar with this issue?
Any help would be appreciated. Thanks in advance!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-10-2023
01:24 AM
|
