Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About laurie_gellatly
laurie_gellatly
Communicator
Member since:
11-05-2013
03-07-2021
Community Statistics
| Posts | 56 |
| Solutions | 1 |
| Karma Given | 8 |
| Karma Received | 8 |
| Member Since | 11-05-2013 |
Activity Feed
- Posted Re: Office365 - Azure Audit certificate failure (Red Hat with Proxy) issue on All Apps and Add-ons. 03-07-2021 04:13 PM
- Karma Re: Office365 - Azure Audit certificate failure (Red Hat with Proxy) issue for abalogh_splunk. 03-07-2021 04:13 PM
- Got Karma for Re: Get all of our code in to source control to clone from Git?. 06-05-2020 12:50 AM
- Got Karma for Re: Generating statistics from combined fields using rex. 06-05-2020 12:50 AM
- Got Karma for Re: How do I write a regex for a date with the time zone, and why i am not able to extract the following field?. 06-05-2020 12:50 AM
- Karma Re: Splunk KV store does not start for mikaelbje. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect 2: How do I enter a WHERE clause with a rising_column in the GUI? for bchoi_splunk. 06-05-2020 12:47 AM
- Got Karma for Splunk DB Connect 2: How do I enter a WHERE clause with a rising_column in the GUI?. 06-05-2020 12:47 AM
- Got Karma for Splunk DB Connect 2: How do I enter a WHERE clause with a rising_column in the GUI?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect 2: How do I enter a WHERE clause with a rising_column in the GUI?. 06-05-2020 12:47 AM
- Got Karma for Enterprise Security: For each ES rule to work, which CIM tags and fields are required and which fields are optional?. 06-05-2020 12:47 AM
- Karma What data sources does Splunk for Enterprise Security require? for lesterw. 06-05-2020 12:46 AM
- Karma Re: Splunk Forwarder Connection Refused from Splunk Indexer for BP9906. 06-05-2020 12:46 AM
- Karma Re: Set a field with a constant value for marcoscala. 06-05-2020 12:46 AM
- Karma Re: TA for IIS that follows the Common Information Model for sjohnson_splunk. 06-05-2020 12:46 AM
- Got Karma for Re: prediction in splnuk. 06-05-2020 12:46 AM
- Karma Feature Request: troubleshooting/debugging for field extraction config files for Justin_Grant. 06-05-2020 12:45 AM
- Posted Re: Splunk Add-on Builder REST API Test Error - Content purported to be compressed with default but failed to decompress on All Apps and Add-ons. 03-28-2020 04:03 AM
- Posted Re: Splunk Add-on Builder REST API - Passing Global Account values to REST URL on All Apps and Add-ons. 03-28-2020 03:54 AM
- Posted How to avoid SplunkCloud manual check delays for python logging on Splunk Dev. 03-28-2020 12:16 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 |
03-07-2021
04:13 PM
This fixed the problem that I was facing. Thanks for posting.
... View more
03-28-2020
04:03 AM
This appears to be telling you that the result being returned is compressed but it can't be deflated.
Are you setting anything in the request that says you accept a compressed result?
... View more
03-28-2020
03:54 AM
Looks like the URL is wrong.
I would expect a URL of https://MyFortigate.somewhere/api.... and not the global_account.username
... View more
03-28-2020
12:16 AM
I have python code in several apps that I need to deploy in SplunkCloud. I'd like to log error conditions. As these apps need to be deployed/updated regularly, I want to directly upload them and NOT have them trigger delays for manual vetting by SplunkCloud. Documentation suggests that SPLUNK_HOME/var/log//.log should be acceptable However, even with this, appinspect tells me " logging.FileHandler could be used to receive data from outside or log data to outside."
How do I setup python logging to avoid delays with manual checks going into SplunkCloud?
... View more
Labels
- Labels:
-
python
04-07-2019
09:28 PM
Turns out that doing the btool with --debug was a good idea. Thanks.
... View more
04-03-2019
12:12 AM
As I don’t have access to the uf I sent it a run once batch file that does a dir of etc/apps and sends the output to be indexed
... View more
04-02-2019
09:25 PM
Hi,
I've taken on an existing Splunk environment that has had some non-standard things happen to it.
In the process of bringing it back to standard I found that some data was appearing in the default index 'main'.
First thing I found was that apps existed on the UF that the Deployment Server didn't know about and they were sending some of this data. I've fixed that but still data is arriving in main.
When I check on any host UF that is appearing in main, there are no enabled inputs.
The only sourcetypes appearing in main are:
ActiveDirectory
Perfmon:Available Memory
Perfmon:CPU Load
Perfmon:Free Disk Space
Perfmon:Network Interface
WinEventLog:Application
WinEventLog:Security
WinEventLog:System
so it looks like windows apps running somewhere, that the DS does not know about, are setting the host field for the incoming data.
How can I find the actual forwarder so I can stop these logs?
Thanks ...Laurie:{)
... View more
11-25-2018
04:33 PM
Could it be that the MIB requires a 'parent' MIB that it connects onto?
There might be an enterprise MIB and then your specific MIB required.
... View more
11-25-2018
04:21 PM
1 Karma
^\d{2}\s\w{3}\s\d{4}\s(\d{2}:\d{2}:\d{2})\s\(\w{3}\s(\+|-)\d{4}\)
as you should really allow for the time zone to be negative
Not sure why you want the hours,minutes and seconds to be captured?
... View more
11-22-2018
12:52 PM
Hi Gerald,
Has your question been answered? I'm unsure if you need any additional assistance now.
Changing your code to:
index=wineventlog EventCode=4688
| lookup mcafee_assets.csv ip as $IpOrHost$ OUTPUT nt_host as Computer
| eval Computer=coalesce(Computer,$IpOrHost$)
| search Computer="what ever the value that Compuetr is after the lookup resolves from ip to nt_host"
| table _time Caller_User_Name Computer NewProcessName CommandLine
Should get you what you need. $IpOrHost$ is the token from the user input.
...Laurie:{)
... View more
11-21-2018
07:00 PM
Take the user input, try to translate the IP to host and if that fails then keep the original.
| eval IpOrHost="10.1.1.1"
| lookup host2ip.csv ipaddr as IpOrHost OUTPUT host as Computer
| eval Computer=coalesce(Computer,IpOrHost)
Assuming the csv has 'host' and 'ipaddr' columns
If it could not be translated (a hostname or unknown IP) then 'Computer' becomes the input value.
If an IP is given that is known then 'Computer' becomes the associated host from the lookup.
Was this the piece you were missing?
...Laurie:{)
... View more
11-21-2018
06:38 PM
Looks like it might be a CHARSET issue.
Have you set CHARSET in props.conf for this sourcetype?
Could it be UTF-16?
I've seen a similar problem (though I think the BOM was different) when dealing with Splunk conf files under windows.
I had to force the encoding when opening the files in Python.
...Laurie:{)
... View more
11-21-2018
06:20 PM
1 Karma
| makeresults
| eval _raw="<reply><result><sessiondId>1</sessiondId><resultChecks><resultCheck><personId/><address><street>streetName</street></address><outCome>01</outCome></resultCheck><resultCheck><personId/><address><street>streetName</street></address><outCome>01</outCome></resultCheck><resultCheck><personId/><code>UNKOWN</code><address><street>streetName</street></address><outCome>02</outCome></resultCheck><resultCheck><personId/><code>KNOWN</code><address><street>streetName</street></address><outCome>01</outCome></resultCheck><information><record><recordCode>1</recordCode><recordText>recordText</recordText></record></information></resultChecks></result></reply>"
| rex max_match=0 field=_raw mode=sed "s/Id\/><ad/Id\/><code>NA<\/code><ad/g"
| rex max_match=0 field=_raw "code>(?<CodeOut>.*?)<\/outCome"
| rex max_match=0 field=CodeOut mode=sed "s/<\/code.*Come>/:/"
| mvexpand CodeOut
| stats count by CodeOut
...Laurie:{)
... View more
11-21-2018
04:52 PM
1 Karma
Google is your friend!
https://www.function1.com/2017/09/using-git-to-manage-splunk
https://answers.splunk.com/answers/312571/best-way-to-use-git-for-source-version-control-wit.html
https://answers.splunk.com/answers/542531/splunk-bitbucket-integration.html
... View more
11-21-2018
04:45 PM
Letting any non-root owned script run with root privileges - not a good idea from a security perspective (you're already running Splunk as non-root so this would be a backward step IMHO).
A lesser evil would be to allow /bin/ping to be run by a non-root user.
https://stackoverflow.com/questions/37512291/how-is-ping-for-non-root-user-implemented-on-linux-distros
You'll then need to wrap that into a script to replace pingstatus.
...Laurie:{)
... View more
11-21-2018
04:04 PM
When you do that on Linux you then need to chown -R splunk:splunk $SPLUNK_HOME
In other words, you give ownership of all the splunk files in all the subdirectories of Splunk back to the 'splunk' user (the user that should be running Splunk). Suggest you will have a similar fix in Windows.
Google suggested "takeown /f <some-file-or-folder> /r" as an equivalent.
splunk stop
takeown .... to give the correct user ownership
as the user that should be running splunk: start splunk
...Laurie:{)
... View more
11-21-2018
03:52 PM
Try this (assuming that 'timestamp' field is actually extracted):
index="your_index"
| strcat timestamp ";" latitude ";" longitude latv
| eventstats values(latv) as latv by vehicle_vin
| where trip_start_time=trip_start_time
| mvexpand latv
| rex field=latv "(?<timestmp>[^;]*);(?<latitude>[^;]*);(?<longitude>.*)"
| eval ts = strptime(timestmp,"%Y-%m-%dT%H:%M:%S")
| eval trip_start_time = strptime(trip_start_time ,"%Y-%m-%dT%H:%M:%S")
| eval trip_end_time = strptime(trip_end_time ,"%Y-%m-%dT%H:%M:%S")
| where ts>=trip_start_time AND ts <=trip_end_time
| table trip_distance_km trip_start_time ts trip_end_time vehicle_vin latitude
The evals would not be needed if the timestamps are already able to be numerically compared.
If you need to keep additional fields from the coordinate events then add them to the strcat and the rex lines.
...Laurie:{)
... View more
11-20-2018
02:04 PM
It looks like there are additional values that must be used to correlate the events?
Is the 'id' field shown sufficient to associate Set B with Set A data or field 'vehicle_vin' or a combination of both?
The sample data you provided would not correlate any values as the time for Set B data is not within any of Set A event time ranges. The second event, the end_time is before the start_time??? Guess you hand generated this?
Are you trying to achieve an association of the lat/long with the start and end times? Is that the goal?
... View more
11-19-2018
06:22 PM
Have you tried testing the upload of the CSV via the GUI?
Use your props settings to check they are doing what you expect.
... View more
11-19-2018
06:11 PM
Could you post some sample data from the index?
index=theindex sourcetype=trip_meta OR sourcetype=trip_coords
So you're saying that _time for the coords is > starttime and < endtime for the trip_meta event (or events)?
... View more
11-19-2018
03:11 PM
This is the complete source when you 'edit/source'.
...Laurie:{)
... View more
11-19-2018
03:10 PM
Try this:
<form>
<init>
<set token="indx">*</set>
</init>
<label>License Galore</label>
<description>all you ever wanted to know about license use</description>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true" token="time">
<label>Time picker</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="radio" token="resetTokens" searchWhenChanged="true">
<label></label>
<choice value="reset">Reset Inputs</choice>
<choice value="retain">Retain</choice>
<default>retain</default>
<change>
<condition value="reset">
<set token="indx">*</set>
<set token="resetTokens">retain</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<title>Index size</title>
<chart>
<title>Index sizes over time</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage | eval MB = b/1024/1024 | timechart span=1d useother=0 sum(MB) by idx | rename idx as Index, sum(MB) as Megabyte | sort – Megabyte</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleY.text">MB</option>
<option name="charting.chart">area</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="indx">$click.name2$</set>
<set token="form.resetTokens">retain</set>
</drilldown>
</chart>
</panel>
<panel>
<title>Sourcetype size</title>
<chart id="detail" depends="$indx$">
<title>Sourcetype detail for $indx$ index</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage idx=$indx$ | eval MB = b/1024/1024 | timechart span=1d useother=0 sum(MB) by st | rename st as SourceType, sum(MB) as Megabyte | sort – Megabyte</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">MB</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form>
... View more
11-19-2018
01:36 PM
You checked you have set the input for 514 with udp:514 or tcp:514 so that it matches what the appliance is sending?
Checked the index it's being sent to is correct and already exists?
Setting up a syslog receiver to catch the events is a more robust solution as it does not stop/start with Splunk restarts.
...Laurie:{)
... View more
11-19-2018
01:07 PM
Merge - could mean several things.
search index=index1 OR index=index2 | stats count by sourcetype
will do a form of merging but I suspect that's not really what you want?
...Laurie:{)
... View more
11-19-2018
12:55 PM
And remember it won't fix what you've already ingested into the index. Only new ingestions will be altered!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-07-2021
07:34 PM
|
Karma from
Karma given to
