Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About davebo1896
davebo1896
Communicator
Member since:
04-20-2015
06-05-2020
Community Statistics
| Posts | 74 |
| Solutions | 7 |
| Karma Given | 44 |
| Karma Received | 16 |
| Member Since | 04-20-2015 |
Activity Feed
- Karma Re: What are the best practices to create a local configuration file? for jeffland. 06-05-2020 12:50 AM
- Karma What are the best practice searches for application monitoring? for sloshburch. 06-05-2020 12:50 AM
- Karma Re: What are the best practice searches for application monitoring? for sloshburch. 06-05-2020 12:50 AM
- Karma Re: What are the best practice searches for application lifecycle & release analytics? for sloshburch. 06-05-2020 12:50 AM
- Karma Splunk Mobile Beta for jchapell. 06-05-2020 12:50 AM
- Karma Re: Splunk Mobile Beta for jchapell. 06-05-2020 12:50 AM
- Karma Re: What are the best practices for Onboarding new machine data to ensure APM KPIs are captured and measured? for sloshburch. 06-05-2020 12:50 AM
- Karma Azure Monitor Add-on For Splunk: Why are Inputs configured correctly but no data is being indexed? for bcootes. 06-05-2020 12:50 AM
- Karma Input settings for Microsoft Office 365 Reporting Add-on for Splunk for becksyboy. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk Mobile Beta. 06-05-2020 12:50 AM
- Karma Re: Microsoft Office 365 Reporting Add-on for Splunk: Data got indexed only .I cant see the latest message traces . Not sure whats wrong with the add-on for becksyboy. 06-05-2020 12:49 AM
- Karma Custom drilldown search not working for tmontney. 06-05-2020 12:49 AM
- Karma Re: Custom drilldown search not working for niketn. 06-05-2020 12:49 AM
- Karma Microsoft Office 365 Reporting Add-on for Splunk: HTTP Request Error 400 for scannon4. 06-05-2020 12:49 AM
- Karma Re: How to revert "splunk apply shcluster-bundle" changes from deployer and what is master node for SH Cluster? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: Regex Processor CPU Profiling per Sourcetype” under "DMC -> Indexing -> Indexing Performance:Instances" is not populating any data. for mbagali_splunk. 06-05-2020 12:49 AM
- Karma Microsoft Office 365 Reporting Add-on for Splunk: Data got indexed only .I cant see the latest message traces . Not sure whats wrong with the add-on for Nadhiyaa. 06-05-2020 12:49 AM
- Karma Regex Processor CPU Profiling per Sourcetype” under "DMC -> Indexing -> Indexing Performance:Instances" is not populating any data. for khusain_splunk. 06-05-2020 12:49 AM
- Got Karma for Re: Custom drilldown search not working. 06-05-2020 12:49 AM
- Got Karma for Re: task config has no interval. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
03-27-2019
08:51 AM
That is very helpful, thank you.
I've been thinking about trying to open up the conversation, moving away from just working through the data sources they are presenting to asking "What business decisions will you be making with this data?" This, in order to prompt more of a conversation about performance indicators and possibly bringing in associated data in order to tell more of a story. Less "This is a log I need to find things in it", More "Here is information that affects the business".
So yes, craft the Use Case, but spin it to get a deeper understanding of possibilities.
... View more
03-12-2019
02:30 PM
perhaps because "tag" is a reserved field in Splunk?
... View more
03-11-2019
12:34 PM
Often when users want to bring their machine data into Splunk, they just want access to their logs so they don't have to (or are not allowed to) grep through them from the command line.
What are the best practices to drive the data onboarding interview process toward having these users identify the KPI metrics that can be obtained from the data?
... View more
- Tags:
- best-practice
01-17-2019
02:31 PM
1 Karma
%2525 in simplexml is a workaround (as of 7.2.3)
You can also replace % with %25 in the UI editing view
... View more
01-07-2019
12:49 PM
1 Karma
That Doc link is redirecting to the Docs home page. Is it publicly viewable?
... View more
12-12-2018
10:34 AM
How is the event type 'cisco_ios-routing' defined? I don't see it in the app.
... View more
10-17-2018
07:34 AM
The question was correctly answered by somesoni2, albeit not questioner's the desired outcome. The karma points offered should have been awarded.
... View more
05-11-2018
07:05 AM
1 Karma
It appears the problem is caused by the ordering of the configs
(and the UI does not put them in the correct order)
The stanza has to be configured in the order listed in the documentation:
[<input_stanza_name>]
account = <value>
subscription_id = <value>
start_time = <value>
index = <value>
interval = <value>
... View more
04-17-2018
12:25 PM
Thanks @deepashri_123,
I had assumed the GUI would add that as it created them. It had not. I manually updated each section with an interval, then restarted.
Unfortunately, still getting the error and not getting data.
... View more
04-16-2018
01:38 PM
Not getting and Azure Audit logs after setup. We are on-prem. Any ideas?
Seeing this error in the logs:
2018-04-16 20:30:20,975 +0000 log_level=ERROR, pid=17164, tid=MainThread, file=ta_mod_input.py, func_name=main, code_line_no=199 | Microsoft Cloudservices Azure Audit task encounter exception
Traceback (most recent call last):
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_mod_input.py", line 196, in main
config_cls=configer_cls, log_suffix=log_suffix)
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_mod_input.py", line 111, in run
tconfig = tc.create_ta_config(settings, config_cls or tc.TaConfig, log_suffix)
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 203, in create_ta_config
return config_cls(meta_config, settings, stanza_name, log_suffix)
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 31, in __init__
self._load_task_configs()
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 60, in _load_task_configs
self._divide_settings)
File "/app/install/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunktamscs/splunktaucclib/data_collection/ta_config.py", line 80, in _generate_task_configs
assert task_config.get(c.interval), "task config has no interval " \
AssertionError: task config has no interval field
... View more
03-07-2018
07:48 AM
Improved:
MV_ADD = 1
REGEX = (,\s|\,)?((?<_KEY_1>[A-Za-z-\s\d]+)=(?<_VAL_1>[^,]+(?!\,)))(,\s|\,)?
But still not complete
... View more
02-28-2018
07:13 AM
I created a transform to get rid of the backslashes in the values as mentioned in this bugreport:
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc36977
Thought I'd throw it out here in case anyone needs it:
MV_ADD = 1
REGEX = (,\s|\\,)?(?<_KEY_1>[A-Za-z\-\s]+)=(?<_VAL_1>([^(,\s|\\,)]|\s)*)(,\s|\\,)?
... View more
02-09-2018
11:13 AM
Mea Culpa,
As regards the defaultIndexes ...
The app does make use of eventtypes.conf , allowing relatively easy insertion of a specific index.
copy eventtypes.conf to local and add the index to the search.
... View more
02-08-2018
07:45 AM
Found it.
The instructions are in the README.txt inside the tar.
Install the TA on your indexers for the ingest props.conf.
Optionally create an index for this data if you prefer that over default
Install the TA on a Heavy forwarder or search head ( I'm not sure if this will work in a SHC, probably best to avoid that )
Create a new Data Input via the GUI.
From the README.txt:
There is no specific configuration required to get the app running. However, you will need to connect the arrays as data inputs. Please >use the following steps to connect an array
Go to Settings -> Data Inputs
Click "PureStorage Array Rest API"
Click "New"
Fill out the array name, IP address, username, and password (readonly access required)
Change the "Interval" within "More settings" if desired.
Note: More settings can also be used to set the index, if you configured a custom index
Install the PureStorage-App on your search head(s), add the custom index to allowedIndexes and defaultIndexes for the appropriate role.
If you don't want this in defaultIndexes, you'll have to customize the app with a macro defining your custom index and update all dashboards and eventtypes to use the macro.
Also, review the permissions, it defaults to wide-open access
[]
access = read : [ * ], write : [ * ]
... View more
02-06-2018
09:52 AM
Not a lot of info on how to configure this.
Do you have any documentation?
The app installs as "visible", but there are no setup pages installed.
I see a README/inputs.conf.spec, but that doesn't look like it is going to encrypt the password.
There is also no index specification in the inputs.conf.spec , and looking at the associated app, it looks like I'm going to have to add in a macro to all the dashboards to specify an index, so you don't sweep over every allowed index for every configured query. The inputs.conf.spec also doesn't have a frequency setting.
This doesn't seem ready-for-prime-time. Am I missing something?
... View more
01-30-2018
07:26 AM
Make your parsing more efficient by explicitly setting timestamp and linemerge in the props.conf on the indexers
example:
TIME_FORMAT = %d.%m.%Y %H:%M:%S.%3N
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 23
LINE_BREAKER = ([\r\n]+)(?:\d{2}.\d{2}.\d{4}\s\d{2}:\d{2}:\d{2}.\d{3}\s*\w+*)
SHOULD_LINEMERGE = false
... View more
01-09-2018
07:33 AM
Will there be an update for 7.x ?
Are there any known reasons why the current version will not work with 7.x ?
... View more
- Tags:
- Fire Brigade
08-09-2017
01:15 PM
TBH I would make a lousy maintainer for this. There are just a few tweaks I need in order to get rid of the clear text password, and there are some references to unreleased enhancements in the Answers here that looked interesting. I'll just go it alone with what is available.
Seems a bit odd that a "community supported" app is not available to the community.
... View more
08-08-2017
07:04 AM
https://github.com/firebus/splunk-jira says "I am no longer maintaining this app. The version in this repository is older than the newest version available at http://apps.splunk.com/app/1438/. "
Where is the source currently stored? It needs some work, would be great if we could send in some PRs.
... View more
- Tags:
- Add-on for JIRA
06-07-2017
12:55 PM
1 Karma
The performance degradation we experienced (queues backing up) with 6.5.x had to be addressed in two ways
1) better disk i/o - we are running on VMs with a SAN backend, we dedicated hot/warm buckets to flash
2) datestamp parsing - every sourcetype has to have explicit LINE_BREAKER defined in props.conf on the indexers and heavy forwarders:
[my_sourcetype]
# example time: 2017-06-05T21:10:49.519+0000
TIME_FORMAT = %Y-%m-%dT%H:%M:%S\.%3N%z
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)(?:\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}(\+\-)\d{4}\s)
SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD = 28
ANNOTATE_PUNCT = false
... View more
03-20-2017
11:27 AM
I don't know which instance I am on, in a Search Head Cluster.
... View more
03-20-2017
10:21 AM
How would I know which instance that was?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
