About SwatiApte

SwatiApte · ‎04-28-2017

Hi jkat54, just a final question I had about this while setting it all up... Our understanding is that we can have indexers receive data from some forwarders over SSL port (let us say 9998) and from some forwarders over standard TCP port (say 9997). The question is once we set up SSL, it wont automatically apply to all existing forwarders where SSL is not set up and that they will continue to function as is.

SwatiApte · ‎04-26-2017

Thanks jkat54 for the response. For point no.1, I understand now that we can set up 1 cert for all indexers or 1 per indexer and you have specified the choice is upto us. But are there any standard/best practices that we can look at to decide what choice to make ? For point no. 4, is that a limitation within Splunk at the moment ? I will need to explore if we can use self-signed certificates along with Org CA certs to communicate with indexers.

SwatiApte · ‎04-25-2017

We have a distributed Splunk set up with SHC and Indexer Clustering enabled. Communication between a user browser and the SHC members is encrypted using TLS and Certificates. We are now trying to set up Universal forwarders on the source systems to acquire the data. I have been trying to read some material around this and came across few very useful links such as: https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf However, I still have the following questions and if you could provide some pointers around this, it will be very helpful: 1. From the documentation it appears that we need to generate one Server certificate per Indexer (assume we have 6 in our cluster) and enable SSL in the inputs.conf file pointing to the server/ca certs... On the forwarders though, should we have one certificate per forwarder (assume we have 10 UFs) or one common certificate across all of them ? 2. On the Forwarder's outputs.conf we need to set the sslCommonNameToCheck attribute to match the indexer server's certificate common name. What is the purpose of this attribute ? Why do we not have something similar on the indexer side ? 3. If 10 separate applications are forwarding data to our indexers - is our understanding correct that we just need to enable SSL on the indexer once with the certificate generated as per point 1 above and use "same" forwarder certificate across all forwarders or have 1 certificate per app ? 4. If we manage the Forwarders configurations via Deployment Server, is it a good practice to enable SSL for this communication as well ? Can we distribute the certificates automatically to forwarders this way and will the password get encrypted in such a case as we would be pushing app specific folders?

SwatiApte · ‎11-29-2015

Hi Luke, I have downloaded and installed the latest version (2.0.2) of the Lookup Editor App. I found two issues with it that I want to inform about: The Apps list is not available in the "App" Filter on the "Lookups" Dashboard. Also, none of the Lookups created in different Apps, are listed on this Dashboard. The permissions for the Lookups is Global, so ideally they should have been listed here. The KVStore created, is listed however. While Editing a KVStore, there is no "Save" button available to save the changes. Could you please let me know if they are valid issues, or is there some problem with my Splunk instance itself, like some setting that I might be missing?

SwatiApte · ‎10-23-2015

Hi, Have you been able to fix this issue? I am facing a similar issue.

SwatiApte · ‎10-13-2015

Hi, When I added the above mentioned code in Python 2.7 search.py, and restarted splunk, the Web service did not start at all. The command prompt was stuck at "Waiting for the web service to be available". As soon as I removed the added three lines, it started working. Could you please let me know if there is any other way of doing the same, or whether the code is placed in the correct place.

SwatiApte · ‎09-07-2015

Thanks for the reply Tom 🙂 However, these are workarounds, and might not be convenient for the end Users of the Application. Is there a way of providing the encoding from the code itself?

SwatiApte · ‎09-06-2015

Hi, I have an "Amount" Column in a Statistical Table on a Dashboard. The values in this field have a Euro symbol added before the actual Amount, For eg. €4,000, €25,000 etc. It appears fine on the Dashboard, but on exporting it in a CSV, I found that the € symbol appears as "â‚¬". The Amount column when extracted into a CSV, and opened using MS Excel, gives results like: â‚¬4,000 â‚¬25,000 Please note that opening the CSV File in Notepad, shows the € as expected. I have tried using the Codes like "€" And "€" as well, but none of them worked. Could you please let me know of any workaround to get the Euro symbol properly when opening the exported CSV using MS Excel. Thanks and regards, Swati

SwatiApte · ‎06-24-2015

We want to represent the status of 10 stages within a process on a Dashboard, along with the ability to drill-down to the details of each of the stages on the same Dashboard. But instead of just showing the Status of the stages in the form of a Statistical table, we want to show a Process Flow Diagram consisting of a component for each of the 10 stages, over which the Status of each stage would be superimposed. We do not want to represent them as 10 single-value components (running a search for each of these). Let us assume that we have the status for these stages derived and they are present in a kv store. Is there any way we could achieve this - reading the status of these stages and representing them as status icons on a single flow diagram?

SwatiApte · ‎06-24-2015

Hi, Could you please let me know if you had any luck with this problem. We have a similar need and would be great if someone can provide a solution or provide pointers for this.

SwatiApte · ‎06-24-2015

Hi, We want to represent two Criticality Zones for an attribute on a Chart. Based on a Critical Threshold Series (we are calling it a Series because the values of Critical Threshold varies all throughout the Day), there should be two Criticality Zones on the Chart: Normal Zone - The entire area below the Critical Threshold Series should be Normal Zone (denoted by a Green colour) Critical Zone - The entire area above the Critical Threshold Series should be Critical Zone (denoted by a Red colour) To handle the above mentioned scenario, we want to set the Background Colour of the Chart to Red, and super-impose the Green Zone on it. We tried setting the Background Colour using the charting.backgroundColor option, but that colours the entire Chart component (including Legends and Labels), instead of just the actual Charting area. Could you please let us know how to set the Background Colour for just the Chart Area.

SwatiApte · ‎06-22-2015

Hi, Further to this, we created a simple java program that connects to the database and prints a single record. We executed this program from both our local Development system and on the Integration Testing server. We used a simple resultSet.getTimeStamp function on the result. We noticed that both the systems are returning the same value for each of the datetime attributes. Ex: "2015-06-18 09:48:35.0" The issue is only when we execute the query from DBConnect, where it seems to convert the results returned into epoch format and that is where it seems to be adding an hour. Even when we use DBConnect, the results are fine when we apply the to_char function on the datetime attribute. For. e.g, select update_time, to_char(update_time,'dd-mon-yyyy hh24:mi:ss') from tablename returns the string representation of the attribute perfectly fine, but adds one hour to the first column (epoch format) and this addition is only happening on the integration server. Regards Swati

SwatiApte · ‎06-18-2015

Hi, In our data source (an application log file), we have multiple datetime attributes (say update_time, order_time, delivery_time in that order). When Splunk indexes this data, it is automatically taking order_time which is appearing first in the log as the event timestamp and indexing accordingly which is fine. However the other datetime attributes are being read as Strings and not as datetime attributes. We are having to convert them using the convert function before applying certain calculations such as finding the time taken between delivery and ordering. Another issue is that these values do not have the timezone component, so if a user changes the user level timezone setting, these values do not get changed as they are treated as text. Is there a way to let Splunk treat them as datetime attributes and convert them to epoch during indexing itself ?

SwatiApte · ‎06-11-2015

But both the servers are on BST, and both are set to Default Time Zones, then why the difference in results?

SwatiApte · ‎06-10-2015

Hi, We are using DBConnect version 1.1.6 to fetch data from an Oracle Database. We have a huge amount of data present in the Database table, let's say past 1 year's data. When Splunk executes the SQL query for the first time, it fetches ALL the past 1 year's data and indexes within Splunk. But we want to be able to restrict the data, to fetch and index only a subset of the entire data, let's say past 1 week's data. Also, if we want to apply a filter condition while fetching the data, for eg. adding a 'where' clause to the query (this will have to be added within the curly braces along with the Rising Column condition), this where condition does not apply to the data fetched by the query that Splunk executes for the first time. Could you please suggest a way of restricting the data, based on the timestamp, or based on a certain 'where' clause.

SwatiApte · ‎06-10-2015

Hi, The data that we fetch from a database has multiple time based columns (one in UTC, and the rest in BST). Our Splunk server is on BST. We are running Splunk 6.1.5 and DBC 1.1.6. We initially thought of converting the UTC based column using the oracle timezone cast function and get it as per BST. But then since we specified this as our rising column, it wasn’t picking data for the past 1 hour as the CAST function it by an hour. We then tried to make an entry in the props.conf to specify that our data is in UTC. Now the column that was in UTC is being indexed as expected and is showing the converted value on our dashboard. However all the other time columns have still got the BST values. We want to understand if specifying the TZ value applies only to the indexed column or for all columns in the event message ?

SwatiApte · ‎06-10-2015

Hi, Our Forwarder and Indexer is the same Splunk instance.

SwatiApte · ‎06-10-2015

Hi, On both of these servers, we have a single instance of Splunk that does the data capturing, indexing and searching. We do not have separate instances for Forwarders, the TZ configuration would not have been overridden is what I feel.

SwatiApte · ‎06-10-2015

Hi, The timezone preference is set to Default in both the servers.

SwatiApte · ‎06-10-2015

The DBConnect version is 1.1.6 on both the servers.

SwatiApte · ‎06-09-2015

Hi, I am using DBConnect to fetch two timestamps from an Oracle database table, let's call them TS1 and TS2, having the following values (TS1 is the time used for indexing the data, whereas TS2 is the Rising Column😞 **TS1 TS2 02-JUN-2015 06:05:16 02-JUN-2015 10:21:14** On my local Development system (a Windows system with Splunk version 6.2), the above data is indexed as it is, i.e. TS1 = 02-JUN-2015 06:05:16, TS2 = 02-JUN-2015 10:21:14 However, on an Integration Testing Server (a Linux server with Splunk version 6.1.5), the same data is indexed as: TS1 = 02-JUN-2015 06:05:16, TS2 = 02-JUN-2015 **11:21:14** As we can see, only TS2 is off by 1 hour on the Linux server. I am not sure why there is this difference between the way Splunk is indexing the Data. I have not made any props.conf changes to any of these two servers related to Time Zone configurations. The Windows server is running on UTC with Daylight Saving Time enabled, and the Linux server is in BST. Could someone please let me know what could be the reason behind this behaviour of the Linux server (Splunk version 6.1.5).

SwatiApte · ‎06-09-2015

Hi, As per a Business requirement, we want to be able to automatically delete all Alerts triggered on the previous Business Day, at the start of each Business Day. For eg. at the start of the current day, let us say 9th June 00:01:00, we want to delete all the triggered alerts triggered between 8th June 00:00:00 to 8th June 23:59:59. Could you please let us know if this could be the correct way of doing it? The following query works, but we do not know the impact it could have, or if it is correct to use it. index=_audit earliest=-1d@d latest=@d action=alert_fired ss_app= | delete

SwatiApte · ‎05-29-2015

Hi Luke, I was trying to explore for options of comparing and identifying the lookup changes using a Splunk search query. However I have had no luck so far. Do you think there would be a way to compare the 2 versions in a splunk search query and capture the modified information or do we need to rely on external tools to do the comparison ? Our requirement is to show the changes within a splunk dashboard itself detailing the time, user and the change. Regards Swati

SwatiApte · ‎05-29-2015

Hi, We have a Business requirement to trigger alerts based on certain conditions, and list them on the Triggered Alerts page. We are not taking any other action like sending an Email or running a script. hence the only way a User can know that an alert has been triggered, would be via the Triggered Alerts page. This page however, does not get refreshed by itself. So unless the Users refresh this page manually, they wouldn't know that an Alert has been raised and something needs to be looked into immediately. Is there any way we can schedule the Triggered Alerts page to refresh automatically, at a set frequency?

SwatiApte · ‎05-21-2015

Thanks Luke!

Posts	39
Solutions	0
Karma Given	2
Karma Received	7
Member Since	‎01-20-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Setting up SSL in a Distributed deployment

Why is the Euro Symbol (€) not appearing properly ...

How to represent a Process Flow Diagram on a Splun...

How to set the Background Color of a Chart?

How to configure Splunk to convert multiple dateti...

DBConnect - Is there a way to limit first-time dat...

Does TZ value specified in props.conf apply only t...

Why is the same timestamp getting indexed differen...

Is there a way of automatically refreshing the Tri...

How to get the Audit for Lookup files modification...

Re: Setting up SSL in a Distributed deployment

Re: Setting up SSL in a Distributed deployment

Setting up SSL in a Distributed deployment

Re: Lookup File Editor with Search Head Clustering...

Re: How to make sure hidden dashboard panels do no...

Re: how to export csv with BOM ?

Re: Why is the Euro Symbol (€) not appearing prope...

Why is the Euro Symbol (€) not appearing properly ...

How to represent a Process Flow Diagram on a Splun...

Re: How to set max y-axis value to a number derive...

How to set the Background Color of a Chart?

Re: Why is the same timestamp getting indexed diff...

How to configure Splunk to convert multiple dateti...

Re: Why is the same timestamp getting indexed diff...

DBConnect - Is there a way to limit first-time dat...

Does TZ value specified in props.conf apply only t...

Re: Why is the same timestamp getting indexed diff...

Re: Why is the same timestamp getting indexed diff...

Re: Why is the same timestamp getting indexed diff...

Re: Why is the same timestamp getting indexed diff...

Why is the same timestamp getting indexed differen...

Re: To reset/delete the alerts at configurable tim...

Re: How to get the Audit for Lookup files modifica...

Is there a way of automatically refreshing the Tri...

Re: How to get the Audit for Lookup files modifica...