Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jtrujillo
jtrujillo
Path Finder
Member since:
04-18-2011
06-05-2020
Community Statistics
| Posts | 38 |
| Solutions | 4 |
| Karma Given | 38 |
| Karma Received | 34 |
| Member Since | 04-18-2011 |
Activity Feed
- Got Karma for Re: Can Heat Maps be displayed on a per-column basis?. 06-19-2022 06:00 PM
- Got Karma for Re: Disable THP in AWS (Linux AMI). 10-20-2021 04:20 AM
- Got Karma for Re: Disable THP in AWS (Linux AMI). 09-27-2021 07:19 AM
- Got Karma for Re: Splunk DB Connect 2: How to use dbxquery to take a time field from an external db table and use that as _time for a drop-down time picker?. 06-29-2021 06:24 PM
- Got Karma for Re: Disable THP in AWS (Linux AMI). 01-13-2021 07:57 AM
- Karma Re: Admin BEWARE! (index=* w/ accelerated datamodels) for gjanders. 06-05-2020 12:50 AM
- Got Karma for Admin BEWARE! (index=* w/ accelerated datamodels). 06-05-2020 12:50 AM
- Got Karma for Admin BEWARE! (index=* w/ accelerated datamodels). 06-05-2020 12:50 AM
- Got Karma for Admin BEWARE! (index=* w/ accelerated datamodels). 06-05-2020 12:50 AM
- Got Karma for Admin BEWARE! (index=* w/ accelerated datamodels). 06-05-2020 12:50 AM
- Got Karma for Admin BEWARE! (index=* w/ accelerated datamodels). 06-05-2020 12:50 AM
- Got Karma for Re: How to check if an index exists efficiently?. 06-05-2020 12:50 AM
- Karma Why does enabling Duo in Splunk break local admin login and is there a way around that? for wrangler2x. 06-05-2020 12:49 AM
- Karma Is it possible to display the results of a search in a table visualization with a scroll bar instead of pages of events? for clwizard. 06-05-2020 12:49 AM
- Karma How do you update the OUI data? for ron_ogle. 06-05-2020 12:49 AM
- Karma Re: Add-On for MAC lookup -- target URL results in a 404 for jppasnak. 06-05-2020 12:49 AM
- Karma Fixing 502 errors when front-ending Search Heads with an AWS application load balancer? for akira_splunk. 06-05-2020 12:49 AM
- Karma Re: How can I remove colons in a field value for richgalloway. 06-05-2020 12:48 AM
- Karma Re: REST API and JWT Authentication for pedromvieira. 06-05-2020 12:48 AM
- Karma Splunk Search Log SearchOperator:kv for pkeller. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 5 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-12-2019
08:16 AM
Metric Workspace doesn't seem to show a way to initially limit on index. I now have many metric indices and have duplicate metric names that make it impossible to use the workspace without filtering.
Any ideas?
... View more
03-12-2019
07:29 PM
1 Karma
You can also just head to the GUI (flash timeline search) to use the typeahead feature for dummyproof results. (e.g. type index=p and you get all the indexes that start with a p in which your particular RBAC has access for)
BUT CHECK THIS OUT! ... That doc I linked above shows typeahead being used as a search/api/ish feature that you can utilize for fast recovery of knowledge objects! TIL.
| typeahead prefix=source count=10 index=_internal
... View more
03-12-2019
10:08 AM
5 Karma
This app should be index=f5-* by default rather than index=* . If the default on the iApp side is f5-* .... just use that please.
This is a VERY DANGEROUS app to put into a production environment.
Please be aware that this could negatively impact your environment if installed in a vanilla state.
Owner, I can/will/want to take this down if the app is reconfigured to have a default of index=f5-*
Also, please disable the DM acceleration by default.
... View more
10-23-2018
02:27 PM
To include information about how many concurrent searches per role, user and such. So you can quickly identify if you have "overloaded" roles that may have problems due to size.
Otherwise, great job guys.
... View more
- Tags:
- User Role Checker
09-26-2018
07:52 AM
This worked for me.
... View more
07-11-2018
02:00 PM
The only thing that I am seeing is css stuff that I would rather not mess with.
Hoping there is another option, or custom viz.
Anyone?!
... View more
03-07-2018
03:23 PM
I upvoted this. It should 100% be configurable in the trellis options...
... View more
11-10-2017
09:41 AM
1 Karma
I dont feel that this question has been answered yet. @MuS suggestions may work, but doesnt help in a large environment when things need to be global.
The big question here is why is splunk trying to do sourcetype extracts on a source that has nothing to do with the sourcetype being searched?
... View more
10-03-2017
02:26 PM
I downvoted this post because doesnt eloquently answer the question. not that it doesnt answer the question... just the only thing they needed was:
| eval newmac1=replace (mac,":","")
... View more
06-12-2017
01:43 PM
Are there any updates on this Feature Request? or the request number that we can reference?
... View more
04-26-2017
04:10 PM
I dont want to assume what your environment is... but it sounds like a distributed environment.
If this is the case, set up a single Heavy Forwarder to do the heavy lifting of ingest, send the information to your Index tier, and subsequently your SHC will be able to "see" it.
... View more
04-18-2017
01:01 PM
1 Karma
Well.... we did it, but i don't like it...
The basics, are that you use the mintime and maxtime being cast from the picker into some search with data in it.... convert the time (strftime) and then compare that value to a date field in the DB query...
|dbxquery query=[search index=<some_index_w_data> | head 1 | addinfo | eval mintime=strftime(info_min_time,"%Y-%m-%d %H:%M:%S") | eval maxtime=strftime(info_max_time,"%Y-%m-%d %H:%M:%S") | eval query=IF(info_max_time="+Infinity", "SELECT..........FROM...... WHERE [Open Date & Time] >= ".mintime."
... View more
02-15-2017
10:40 AM
Couple more log tails
LP-$-OSX:splunk $ tail -10 TA-rapid7_nexpose.log
2017-02-15 11:27:06,350 INFO nx_logger:38 - Saving changes made on configuration screen...
2017-02-15 11:27:06,569 INFO nx_logger:38 - Sucessfully retrieved stored config for Nexpose.
2017-02-15 11:27:06,643 INFO nx_logger:38 - Password retrieved.
2017-02-15 11:27:07,637 INFO nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:07,637 INFO nx_logger:38 - Listing the fields for the set up screen...
2017-02-15 11:27:08,843 INFO nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:09,676 INFO nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:09,677 INFO nx_logger:38 - Listing the fields for the set up screen...
2017-02-15 11:27:10,892 INFO nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:11,801 INFO nx_logger:38 - Executing nexpose_setup.py
LP-$-OSX:splunk $ tail -10 rapid7.log
2017-01-30 10:58:40,811 INFO nexpose_setup:34 - Executing nexpose_setup.py
2017-01-30 10:58:41,498 INFO nexpose_setup:34 - Executing nexpose_setup.py
2017-01-30 11:14:15,597 INFO __init__:168 - Using default logging config file: /Applications/Splunk/etc/log.cfg
2017-01-30 11:14:15,601 INFO __init__:206 - Setting logger=splunk level=INFO
2017-01-30 11:14:15,602 INFO __init__:206 - Setting logger=splunk.appserver level=INFO
2017-01-30 11:14:15,603 INFO __init__:206 - Setting logger=splunk.appserver.controllers level=INFO
2017-01-30 11:14:15,603 INFO __init__:206 - Setting logger=splunk.appserver.controllers.proxy level=INFO
2017-01-30 11:14:15,605 INFO __init__:206 - Setting logger=splunk.appserver.lib level=WARN
2017-01-30 11:14:15,605 INFO __init__:206 - Setting logger=splunk.pdfgen level=INFO
2017-01-30 11:14:15,606 INFO setup:29 - Executing setup.py
... View more
02-15-2017
10:28 AM
Here are some more logs from splunkd.log
02-15-2017 11:26:52.160 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.174 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py", line 54, in <module>
02-15-2017 11:26:52.200 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" main()
02-15-2017 11:26:52.205 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py", line 32, in main
02-15-2017 11:26:52.226 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.231 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.264 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" return auth_token,auth_response_body
02-15-2017 11:26:52.286 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.513 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.518 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py", line 41, in <module>
02-15-2017 11:26:52.522 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" main()
02-15-2017 11:26:52.525 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py", line 29, in main
02-15-2017 11:26:52.526 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.527 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.531 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" return auth_token,auth_response_body
02-15-2017 11:26:52.534 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.598 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" Traceback (most recent call last):
02-15-2017 11:26:52.600 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py", line 43, in <module>
02-15-2017 11:26:52.601 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" main()
02-15-2017 11:26:52.603 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py", line 31, in main
02-15-2017 11:26:52.605 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.606 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.607 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" return auth_token,auth_response_body
02-15-2017 11:26:52.609 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.617 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" Traceback (most recent call last):
02-15-2017 11:26:52.628 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py", line 43, in <module>
02-15-2017 11:26:52.629 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" main()
02-15-2017 11:26:52.630 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py", line 31, in main
02-15-2017 11:26:52.632 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.634 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.635 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" return auth_token,auth_response_body
02-15-2017 11:26:52.636 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.699 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.701 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py", line 47, in <module>
02-15-2017 11:26:52.702 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" main()
02-15-2017 11:26:52.703 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py", line 31, in main
02-15-2017 11:26:52.704 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.706 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.709 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" return auth_token,auth_response_body
02-15-2017 11:26:52.743 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
... View more
02-15-2017
10:19 AM
I am seeing this error from the system. I have tested this user, and password combination, and it works fine in Rapid7.
WARNING: Athentication failed for tenant admin and user nexpose_password
Info: No JSON object could be decoded
Here are the contents of my conf files. BTW I am using OSX. ... one thing that stands out is that "password = admin" ... which is definitely not the case.
LP-$-OSX:local $ more nexpose_details.conf
[setupentity]
hostname = https://rapid7-console.usw1.XXX.cloud
import_solution = 1
new_scans_only = 0
password = admin
username = splunk_addon
LP-$-OSX:local $ more passwords.conf
[credential::nexpose_password:]
password = <some hash>==
... View more
11-21-2016
10:43 AM
1 Karma
Sounds like you can set it globally by doing this:
[mi_input://default]
auto_disable = false
... View more
05-17-2016
12:21 PM
4 Karma
Do the following:
index=_internal sourcetype=dbx2 CRITICAL | top action
And i am betting that you will be getting some sort of error about your data.... I am troubleshooting the same thing right now.
For some reason a dbx2 upgrade (2.2.0) is no longer using my epoch timestamps correctly..... its truncating them in a very weird way....
Just as an FYI you will see that your connection is being disabled automatically using the following search
index=_internal sourcetype=dbx2 action=auto_disable_modular_input_due_to_maximum_failed_retries
... View more
05-12-2016
09:02 AM
7 Karma
Here is a way to keep THP turned off even after reboot.
Step1
sudo vi /etc/init.d/disable-transparent-hugepages
Step 2
#!/bin/sh
### BEGIN INIT INFO
# Provides: disable-transparent-hugepages
# Required-Start: $local_fs
# Required-Stop:
# X-Start-Before: mongod mongodb-mms-automation-agent
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Disable Linux transparent huge pages
# Description: Disable Linux transparent huge pages, to improve
# database performance.
### END INIT INFO
case $1 in start)
if [ -d /sys/kernel/mm/transparent_hugepage ]; then
thp_path=/sys/kernel/mm/transparent_hugepage
elif [ -d /sys/kernel/mm/redhat_transparent_hugepage ]; then
thp_path=/sys/kernel/mm/redhat_transparent_hugepage
else
return 0
fi
echo 'never' > ${thp_path}/enabled
echo 'never' > ${thp_path}/defrag
unset thp_path
;;
esac
Step 3
sudo chmod 755 /etc/init.d/disable-transparent-hugepages
Step4
sudo chkconfig --add disable-transparent-hugepages
Reference:
http://serverfault.com/questions/688392/disable-thp-and-thp-defrag-on-centos-7-ec2-instance
... View more
05-12-2016
08:58 AM
How do you disable Transparent Hugepages in an Amazon AWS environment that doesn't support systemctl or systemd?
... View more
03-29-2016
03:22 PM
1 Karma
I am like 99.999% sure its the KML that you are using.
The regions that you have defined are not unique... therefore when there is a mapping from splunk onto the geom it is confused on which area you are talking about.
Just a quick look at your KMZ shows that you have a lot of "avtocod" that are named the same (e.g. 87, 29) and that is the default featureId that you are using. The only reason I know this is because I just had the same issue.
Try using "/Placemark/region" as your Feature Id Element.
... View more
02-18-2016
09:09 AM
Well.... I have no idea what fixed it... Either an OS X update (10.11.3) or a Splunk update (6.3.3) .... But I notice the python is now working again.
... View more
12-07-2015
11:44 AM
Figured it out... the pcap2csv.sh has a char that OS X tshark doesn't like.
"do tshark –r "$f" -T fields -e f"
Notice the dash in front of the "r" is longer than the others... once I replaced that with a regular dash, it started working fine.
Maybe the dev will update in the next version.
... View more
12-07-2015
10:21 AM
I tried using the Unix one and I am getting this:
Capturing on 'Wi-Fi'
tshark: Invalid capture filter "–r SIPphone.pcap -T fields -e frame.time -e tcp.stream -e ip.src -e ip.dst -e _ws.col.Protocol -e tcp.srcport -e tcp.dstport -e tcp.len -e tcp.window_size -e tcp.flags.syn -e tcp.flags.ack -e tcp.flags.push -e tcp.flags.fin -e tcp.flags.reset -e ip.ttl -e _ws.col.Info -e tcp.analysis.ack_rtt -e vlan.id" for interface 'Wi-Fi'.
That string isn't a valid capture filter (illegal token).
See the User's Guide for a description of the capture filter syntax.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
Karma given to
