About akanno

akanno · ‎05-25-2016

thank you for your reply , jkat54. It was very helpful for me.

akanno · ‎05-17-2016

I want to run CLI search command in a batch file on Windows OS. I hardcode username and password in the batch file because Splunk requires authentication. However, hardcoding password in the batch file is unfavorable because security reasons. So, I want to run a CLI search command in a batch file without hardcoding the password. Could you tell me the best practices that run CLI search command in a batch file?

akanno · ‎02-17-2016

Hi All. I want to extract fields from the following log data. headerName=Host, Connection, Accept, headerValue=splunk.com, keep-alive, text/html I want to extract fields like this. Host=splunk.com Connection=keep-alive Accept=text/html So I set following in props and transforms props.conf [MY_SYSLOG] REPORT-a = SAMPLE_1,SAMPLE_2,SAMPLE_3 transforms.conf [SAMPLE_1] CLEAN_KEYS = 0 FORMAT = $1::$4 REGEX = headerName=(\w+),\s(\w+),\s(\w+),\sheaderValue=(.*?),\s(.*?),\s(.*) [SAMPLE_2] CLEAN_KEYS = 0 FORMAT = $2::$5 REGEX = headerName=(\w+),\s(\w+),\s(\w+),\sheaderValue=(.*?),\s(.*?),\s(.*) [SAMPLE_3] CLEAN_KEYS = 0 FORMAT = $3::$6 REGEX = headerName=(\w+),\s(\w+),\s(\w+),\sheaderValue=(.*?),\s(.*?),\s(.*) This setting extracted fields for part log message, but didn't extract fields for the following log message. headerName=Host, Connection, Accept, Referer, headerValue=splunk.com, keep-alive, text/html, http://google.com Is there good solution? Thank you for your help.

akanno · ‎02-02-2016

BTW I'm currently updating the Add-On anyway so this would be a good 'fixing' 😉 I'm looking forward to your update.

akanno · ‎02-02-2016

When I changed following in myldap.py , I fixed this problem. befor result_set = result_set + result_data # append result data to the set after #result_set = result_set + result_data # append result data to the set result_set = result_data

akanno · ‎02-02-2016

Hi,all. I am using the Add-on for LDAP: When I search the following: | ldap attrs="cn" ldap_filter="cn=*" sizelimit=1 I get following results. cn | dn Manager | cn=Manager,dc=example,dc=com When I search the following: | ldap attrs="cn" ldap_filter="cn=*" sizelimit=2 I get the following results: cn | dn Manager | cn=Manager,dc=example,dc=com Manager | cn=Manager,dc=example,dc=com system | cn=system,ou=Group,dc=example,dc=com When I search the following: | ldap attrs="cn" ldap_filter="cn=*" sizelimit=3 I get following results: cn | dn Manager | cn=Manager,dc=example,dc=com Manager | cn=Manager,dc=example,dc=com system | cn=system,ou=Group,dc=example,dc=com Manager | cn=Manager,dc=example,dc=com system | cn=system,ou=Group,dc=example,dc=com Takahiko Takeda | uid=takahiko.takeda,ou=People,dc=example,dc=com I want to get following results. Can I get it? cn | dn Manager | cn=Manager,dc=example,dc=com system | cn=system,ou=Group,dc=example,dc=com Takahiko Takeda | uid=takahiko.takeda,ou=People,dc=example,dc=com

akanno · ‎01-26-2016

Thank you for reply. Sorry I still had not read the documentation. When I fixed dependency, this app have worked. Thank you very much !

akanno · ‎01-26-2016

Thank you very much for reply, MuS. I've tried to use this app but met following error messages as a search result. command="ldap", : LDAP modul load failed! myldap.py.log 2016-01-26 18:37:55,744 INFO myldap:55 - setting modul path... 2016-01-26 18:37:55,744 INFO myldap:57 - modul path: /opt/splunk/etc/apps/TA-LDAP/bin/ldap 2016-01-26 18:37:55,744 INFO myldap:58 - loading ldap modul... 2016-01-26 18:37:55,759 ERROR myldap:63 - ERROR: LDAP modul load failed with error /lib64/libc.so.6: version `GLIBC_2.14' not found (required by /opt/splunk/etc/apps/TA-LDAP/bin/ldap/ldap/libssl.so.10)! My Splunk server is CentOS 6.5 fineal version. Will I need to install any other modules to use this app ?

akanno · ‎01-25-2016

Hello Splunkers, I wanna use SA-ldapsearch to get data from openldap server, employee information, etc.. However I got following error messages and failed. SA-ldapsearch.log 2016-01-25 18:00:23,891, Level=ERROR, Pid=4221, File=search_command.py, Line=282, Abnormal exit: LDAPInvalidDNSyntaxResult - 34 - invalidDNSyntax - None - invalid DN - searchResDone - None ldaplog Jan 25 18:00:23 host slapd[3888]: conn=2 op=0 ENTRY dn="" Jan 25 18:00:23 host slapd[3888]: conn=2 op=1 ENTRY dn="cn=subschema" Jan 25 18:00:23 host slapd[3888]: conn=2 op=3 ENTRY dn="" Jan 25 18:00:23 host slapd[3888]: do_search: invalid dn (c) Can we use SA-ldapsearch for this purpose ? or not ? If anyone know the use case like this, please let me know. Thank you for your help.

akanno · ‎11-10-2015

Thank you for reply exix. I see that I cannot index an event from "10/1/1970" Thank you.

akanno · ‎11-10-2015

Hi all. Say I want to index an event from "10/1/1970", but the max value of 「MAX_DAYS_AGO is 10951. So, I cannot index the event of "10/1/1970", because the event of "10/1/1970" is older than 10951 days. How can I index an event from more than 10951 days ago? thanks.

akanno · ‎10-29-2015

Do you use the transpose command like following? index=_internal | stats count by sourcetype | transpose 7 you can use eval command and chart command instead of using the transpose command try this search index=_internal | stats count by sourcetype | eval a=if(sourcetype="mongod","test1",a) | eval a=if(sourcetype="scheduler","test2",a) | eval a=if(sourcetype="splunk_web_access","test3",a) | eval a=if(sourcetype="splunk_web_service","test4",a) | eval a=if(sourcetype="splunkd","test5",a) | eval a=if(sourcetype="splunkd_access","test6",a) | eval a=if(sourcetype="splunkd_ui_access","test7",a) | eval column="percent" | chart values(count) by column,a

akanno · ‎09-30-2015

You can set it from [visualization] >> [format] >> [color] in Splunk version 6.3

akanno · ‎09-28-2015

First , a universal forwarder send the data to 10.10.10.1:9997. 30 second later , a universal forwarder send the data to 10.10.10.2:9996. 30 second later , a universal forwarder send the data to 10.10.10.3:9995. 30 second later , a universal forwarder send the data to 10.10.10.1:9997. In short , every 30 seconds, a universal forwarder will switch to another receiver. for more information http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Setuploadbalancingd

akanno · ‎09-28-2015

You can use 「rest」 command. | rest /services/saved/searches try this command on splunk search form.

akanno · ‎09-17-2015

Hi all. I want to connect a Search Head to an Indexer via Proxy Server like so: Search Head <===> Proxy Server <====> Indexer I'm setting the following on the Search Head server: http_proxy=172.31.48.51:8089 https_proxy=172.31.48.51:8089 Therefore, the Search Head was able to connect to the internet (e.g apps.splunk.com) via Proxy Server. Search Head <===> Proxy Server <====> internet(e.g apps.splunk.com) But the Search Head has connected directly to the Indexer. I want to connect the search head to the indexer via Proxy Server! Can I connect a search head to an indexer via proxy server?

akanno · ‎08-26-2015

anupjishnu,thank you for your reply. my css is overridden by default css as you said. so I add setting of 「!important」 to my css. thank you very much!

akanno · ‎08-23-2015

Hi all. I want to change a style of a drop-down button, so I am setting the CSS following. css .btn,.select2-container { background: #3498db; ....... ....... } But, the style of the drop-down button has changed to following. In short, I want to change a style like "TimeRangePicker" in the above picture. What is the selector I should set? How do I change a style of the drop-down button?

akanno · ‎07-01-2015

jcoates ♦,Thank you for your reply. It seem I can't get fields of Company and Department but I can get some fields. I want to get fields of Company and Department.

akanno · ‎06-29-2015

Hi,all I want to get fields of Company and Department of Active Directory with ldapsearch command. I tried following search command. | ldapsearch search="(&(objectclass=user)(!(objectClass=computer)))" I got some fields (e.g mail,telephoneNumber,sAMAccountName), but I didn't get fields of Company and Department. Can I get fields of Company and Department with ldapsearch command? thank you for your help.

akanno · ‎01-05-2015

dolivasoh,Thank you for your response. I have tried outputting the field as "index=test | lookup test ip output unit | table _time,unit,ip". However , I don't get "unit" field.

akanno · ‎01-04-2015

Results when I search in "index=test | table _time,ip" are following. results _time ip 2014-12-09 18:00:01 192.168.150.81 2014-12-09 18:00:01 192.168.150.81 2014-12-09 18:00:01 192.168.150.6 If lookup correctly works , results when I search "index=test | lookup test ip | table _time,unit,ip" are like following. results _time unit ip 2014-12-09 18:00:01 B部 192.168.150.81 2014-12-09 18:00:01 B部 192.168.150.81 2014-12-09 18:00:01 A部 192.168.150.6 However , I don't get the above results. why can't I get the above result? Results I get are following results _time unit ip 2014-12-09 18:00:01 192.168.150.81 2014-12-09 18:00:01 192.168.150.81 2014-12-09 18:00:01 192.168.150.6

akanno · ‎12-25-2014

Thank you for your help. I will use LDAP or AD.

akanno · ‎12-21-2014

Hi,splunk community. I'm now considering user management. I want to create user who can only do user management without administrative right. Therefore, I created a new user, and I added "edit_user" and "edit_role" to Capabilities of this user. It looks like I created the user who do user management without administrative right. However, this user can create user who have administrative right. That really doesn't have any meaning. is there a way to prevent to create user who have administrative right?

akanno · ‎12-10-2014

Hi,sumanth_isac your props.conf [your_sourcetype] REPORT-AutoHeader = AutoHeader-my_sourcetype your transforms.conf [AutoHeader-my_sourcetype] DELIMS = ” ” FIELDS = “field１”,”field２”,”field３”, … For more information, see below link http://splunkblog.vccorp.net/?p=428

Posts	46
Solutions	3
Karma Given	10
Karma Received	11
Member Since	‎01-29-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to manage password when running a CLI search c...

How do I edit my transforms.conf to properly extra...

Add-on for LDAP: Why am I getting duplicate entrie...

Can I use SA-ldapsearch to openldap ?

How can I index an event older than 10951 days if ...

How to connect a Search Head to an Indexer via Pro...

Can I change a style of a drop-down button?

How to search fields of Company and Department in ...

How to create user who can create user without adm...

How to use time-base-lookup?

Re: How to manage password when running a CLI sear...

How to manage password when running a CLI search c...

How do I edit my transforms.conf to properly extra...

Re: Add-on for LDAP: Why am I getting duplicate en...

Re: Add-on for LDAP: Why am I getting duplicate en...

Add-on for LDAP: Why am I getting duplicate entrie...

Re: Can I use SA-ldapsearch to openldap ?

Re: Can I use SA-ldapsearch to openldap ?

Can I use SA-ldapsearch to openldap ?

Re: How can I index an event older than 10951 days...

How can I index an event older than 10951 days if ...

Re: how to rename column name based on condition

Re: Why does one search properly color the text of...

Re: How does universal forwarder load balancing wo...

Re: How to use the Splunk REST API in a browser?

How to connect a Search Head to an Indexer via Pro...

Re: Can I change a style of a drop-down button?

Can I change a style of a drop-down button?

Re: How to search fields of Company and Department...

How to search fields of Company and Department in ...

Re: How to use time-base-lookup?

Re: How to use time-base-lookup?

Re: How to create user who can create user without...

How to create user who can create user without adm...

Re: How to extract field for the data with spaces