Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sjaworski
sjaworski
Communicator
Member since:
04-18-2013
06-05-2020
Community Statistics
| Posts | 42 |
| Solutions | 8 |
| Karma Given | 34 |
| Karma Received | 40 |
| Member Since | 04-18-2013 |
Activity Feed
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 03-23-2023 04:43 PM
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 09-23-2020 07:18 AM
- Karma Re: Should you specify or not specify the index in your search? for ChrisG. 06-05-2020 12:48 AM
- Karma Re: Splunk Software - Release Code Names for ChrisG. 06-05-2020 12:48 AM
- Karma Splunk Software - Release Code Names for JeremeyWise. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I not getting data from the Splunk App for Stream using a universal forwarder with my current configuration?. 06-05-2020 12:48 AM
- Got Karma for Re: embedding a youtube video in a splunk dashboard. 06-05-2020 12:48 AM
- Got Karma for Re: embedding a youtube video in a splunk dashboard. 06-05-2020 12:48 AM
- Karma Re: Monitoring logons of domain users (EventCode 4624) for lmyrefelt. 06-05-2020 12:47 AM
- Karma Re: Determine which ldap groups are mapped to roles within Splunk for cpetterborg. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
01-20-2017
01:01 PM
Thanks for the thoughts. Always good to double check.
... View more
01-20-2017
12:37 PM
There's no guarantee there will be a perl or python interpreter on the destination systems.
... View more
01-20-2017
12:05 PM
I have two scripted inputs, one bash script for Linux and one batch script for Windows. Both scripts are written to read a static configuration file and output the data for Splunk to ingest. Both scripts work without issue.
Should I deploy both script inputs in the same app? As you know the bash script will not run on Windows and batch script will not run on LInux. Besides the error I get in the splunkd.log, is there anything I should worry about with the scripts executing on the wrong OS architecture?
... View more
01-12-2017
09:51 AM
Thanks for the help jkat54. The \ still will not dump the quotes. But you got me and my team thinking. We found a solution, check it out. 🙂
... View more
01-12-2017
09:49 AM
We found a way to remove the quotes with a macro, check out the answer. 🙂
... View more
01-12-2017
09:48 AM
9 Karma
A big thanks to my Splunk partner in crime C.F. We were able to solve this issue by calling a macro. The quotes are removed from the lookup returned value when inserted into a macro.
We can successfully add searches to a lookup table and loop thru each search with the map command. Here is how we did it.
First: Create your lookup table with a list of searches to execute. In our case we used lookup editor and named the field "check". Create your csv file however you want.
check, Description
index=_internal sourcetype=splunkd component=WatchedFile | stats earliest(_time) as firstime latest(_time) as lasttime count by component log_level, Internal WatchFile Check
index=_internal sourcetype=splunkd component=TcpOutputProc | stats earliest(_time) as firstime latest(_time) as lasttime count by component log_level, Internal TcpOutPutProc Check
Second: Create a macro. Give the macro a name with a value of 1. The search will just be a name surrounded by $'s and a single argument. The search defined in the lookup table will be passed to this macro.
Third: Create the search that calls the lookup table and passes the results to the macro with the map command.
The lookup table is called. Only the check field is outputted because there no reason to also pass the description field. The description field is for the admins to remember what the search is looking for.
The map command is called, which includes the macro and the output from the lookup table is inserted into the required variable. Don't forget about the backticks when calling a macro.
|inputlookup internalchecks.csv | fields + check | map search="search `internalcheck($check$)`" maxsearches=100
The Results. The job inspector shows how each search was expanded by the macro.
All my users have to do now for is add searches to the lookup table with out modifying the search. The idea behind this search is to perform validation checks against data in Splunk. Does X field have Y value? Or does X field have the correct length and numeric output? Sometimes a search with large amounts of appends, ANDs, ORs, NOTs can be cumbersome to maintain.
Would you rather maintain a lookup table with a small search or the search below? By looping thru the lookup table, we avoid appending and sub-searches.
index=_internal sourcetype=splunkd component=WatchedFile | stats earliest(_time) as firstime latest(_time) as lasttime count by component log_level | append [search index=_internal sourcetype=splunkd component=TcpOutputProc | stats earliest(_time) as firstime latest(_time) as lasttime count by component log_level]
... View more
01-10-2017
12:59 PM
3 Karma
I am trying to store a list of searches in a lookup table and then pass each search to the map command.
|inputlookup storedsearches.csv | fields + main | map search="search index=myindex sourcetype=mysourcetype $main$"
The storedsearches.csv contains commands such as |stats count by App and |stats count by User . The idea is to have Splunk loop thru the base search in the map command and then execute each stats command. I can accomplish this with the append command but I do not want to worry about max results and search timeouts. Plus I do not want to have to edit the search every time I add or remove a stat command or some other check. I would rather update a lookup table.
This almost works. The problem is how Splunk passes the value to the map command. If there are any spaces or special characters in the lookup table, Splunk automatically adds quotes to the pipeline. If I use a single word with letters or numbers, the quotes are not added.
This is the error I receive.
'index=myindex sourcetype=mysourcetype "|stats count by Application"'
As you can see, the quotes are causing Splunk to not interpret the stats command.
I tried creating a macro and stored the macro name in the lookup table. However, map does not seem to interpret the back-ticks to call the macro.
Any ideas on how to instruct Splunk not to add the quotes?
... View more
07-29-2016
08:51 AM
Thanks for the links ChrisG[Splunk]
... View more
07-29-2016
08:50 AM
When I think in terms of flexibility and time, there may be a need in the future to change an index name. There could be a multitude of reasons to justify the change. A new index name better describes what data is contained in the index, someone does not like the name of the index, a new app uses different indexes, or the we will fix it before production mentality. Of course hindsight is 20/20 and there could always be better planning.
Easily after a year there could be hundreds of saved searches/dashboards/etc for a specific index. The Splunk admin would then need to go into each search and change the index name. After thinking about it now, I could also use a search macro and instruct people to use the macro to call the index. Then in the future if an index ever changes, I would just have update the macro to reflect the new index.
... View more
07-29-2016
07:44 AM
What are everyone's thoughts on whether you should or should not specify the index in your search? Is sourcetype=value sufficient to reduce which indexes Splunk will search? Or will all indexes based on your role configuration still be searched even if sourcetype=value only exists in one index?
... View more
07-18-2016
09:39 AM
Can you share your search? Sanitize what you need to for security.
... View more
07-17-2016
06:00 AM
2 Karma
Give this a try. It appears Splunk does not support the allowfullscreen tag provided by default in the You Tube link. You need to give it a value.
Not supported by Splunk
<iframe width="420" height="315" src="https://www.youtube.com/embed/tAGnKpE4NCI" frameborder="0" allowfullscreen></iframe>
My modification seems to work.
<iframe width="420" height="315" src="https://www.youtube.com/embed/tAGnKpE4NCI" frameborder="0" allowfullscreen="0" ></iframe>
Note: You can remove the allowfullscreen tag all together. That is up to you.
Here is an example dashboard. All I did was create a basic Simple XML dashboard. Created a row and inserted the HTML tag and iframe. Please enjoy the music from one of my favorite bands. 🙂
<form>
<label>Iframe Imbed</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="token_time">
<label>Select Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<html>
<iframe width="420" height="315" src="https://www.youtube.com/embed/tAGnKpE4NCI" frameborder="0" allowfullscreen="0" > </iframe>
</html>
</row>
<row>
<panel>
<table>
<title>Top Sourcetype</title>
<search>
<query>index=_internal | top sourcetype</query>
<earliest>$token_time.earliest$</earliest>
<latest>$token_time.latest$</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</form>
... View more
07-16-2016
09:39 AM
You do no need to start the streamfwd.exe by itself. Splunk will automatically start it when UF restarts.
Execute C:\Program Files\SplunkUniversalForwarder\bin\ splunk restart
If that does not work, on your Splunk search head start reviewing the splunkd.log of the windows 7 host. Search index=_internal host=win-orba5mjh4bm stream start reviewing the log. It may give an indication of what is going on.
Or you can grep (find on Windows) find /I "stream" splunkd.log locally on the win 7 host in c:/program files/splunkuniversalforwarder/var/log/splunk/
Also, check out the streamfwd.log.
... View more
07-16-2016
09:09 AM
Have you restarted the UF since installing the Stream TA in /etc/apps?
... View more
07-16-2016
08:42 AM
My suggestion would be to enter HTTPS_PROXY = myhost.myco.us:8080 in splunk-launch.conf. Do not use a username and password. Reach out to the administrator's of your proxy server and ask if they can white-list the IP address of your Splunk server making the request. A good proxy should be able to allow only access to specific domains and/or URLS for a specific source IP address (your Splunk server), since you will be bypassing the proxy's authentication module. Open a ticket with Splunk to verify if they do or do not support authenticated proxies. Maybe a feature request is required.
... View more
07-16-2016
08:30 AM
What does your monitor stanza in your inputs.conf file look like?
... View more
07-16-2016
08:25 AM
1 Karma
On Windows, Start Task Manager, Select Processes and make sure the Universal Forwarder splunkd.exe and Stream streamfwd.exe is running as System. If it's running as system you should be good.
Make sure the Splunk Stream app is install on your search head, unless your indexer is also your search head. This is where you will configure Splunk Stream on what to collect. The stream app on the UF will receive it's configuration from the search head.
Run the btool command form the Splunk bin directory, splunk btool inputs list streamfwd
By default Splunk stream logs to the main index. Maybe search index=main It's possible you search is not searching the main index by default.
... View more
07-16-2016
06:47 AM
Check out this doc for uploading data via Splunk Web. This can help you create the proper .conf files. Then you can modiy the .conf files by hand if you want to make addtional specifc changes Splunk Web does not account for.
http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Uploaddata
Also review this doc about extracting data with headers. You may want to consider adding headers to your CSV file.
http://docs.splunk.com/Documentation/Splunk/6.2.10/Data/Extractfieldsfromfileheadersatindextime
Doc on Null Queue
http://docs.splunk.com/Documentation/Splunk/6.4.2/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues
... View more
02-11-2016
10:14 AM
2 Karma
My organization is successfully using estreamer Version 2.2.1, build 172 with Cisco/Sourcefire 6.0.0 (build 1005). As documented in the release notes, pulling connection events can be hours behind. We had the same delays with Cisco/Sourcefire 5.x. All other estreamer events are pulled in a timely fashion. I do not know if there is a roadmap for official v6 support. You can trying contacting the author of the app.
... View more
12-17-2015
11:05 AM
eStreamer does not appear to have its own clean up process. Maybe you can add something to the Perl script.
... View more
12-07-2015
10:49 AM
The reason why the eStreamer dashboard fails to populate is because the heavy forwarder is not a search head.
You will need to install the eStreamer app on a search head for the dashboards to populate. However, I would think the eStreamer app is installed on the search head because of the field alias mappings for Enterprise Security. Check to see if the eStreamer app is set not to be visible. Maybe the installer choose to use the Firesight TA instead.
*Warning
I do not know if the eStreamer app will interfere with Enterprise Security on your current search head. My organization has yet to purchase ES. Maybe setup a test search head instance and install eStreamer there.
*
End Warning
... View more
12-04-2015
05:44 AM
Is your search head and indexer the same instance?
... View more
11-27-2015
05:01 PM
Thank you for the direction, the solution I came up with is below.
... View more
11-27-2015
05:00 PM
Thank you for the direction, the solution I came up with is below.
... View more
11-27-2015
04:59 PM
3 Karma
Here is the solution I came up with.
Since estreamer has to run on Linux, I used logrotate to rotate the files.
Create file estreamer in /etc/logrotate.d/
Add this configuration.
/opt/splunk/etc/apps/eStreamer/log/estreamer.log.* {
missingok
rotate 7
daily
compress
postrotate
/bin/kill -HUP `cat /opt/splunk/etc/apps/eStreamer/bin/estreamer_client.pid 2> /dev/null` 2> /dev/null || true
endscript
}
To force a rotation immediately and troubleshoot any issues, execute logrotate -vf /etc/logrotate.d/estreamer
Next the inputs.conf needs to be adjusted.
Copy the inputs.conf file to the local directory of the eStreamer app if it does not exist.
Edit the inputs.conf file and instruct Splunk to blacklist the gz files created by logrotate.
[monitor://$SPLUNK_HOME/etc/apps/eStreamer/log]
disabled = 0
source = eStreamer
sourcetype = eStreamer
index = estreamer
crcSalt = <SOURCE>
#Add Blacklist not to collect GZ files
blacklist = estreamer.log.\d{10}.\d{1}.gz
Verify Splunk is only monitoring the active estreamer files. Execute, /opt/splunk/bin/splunk list monitor | grep estreamer
[splunky@splkcollector local]# /opt/splunk/bin/splunk list monitor | grep estreamer
/opt/splunk/etc/apps/eStreamer/log/estreamer.log.1448663187
/opt/splunk/etc/apps/eStreamer/log/estreamer.log.1448663245
😛
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
