Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Apps and Add-ons
- :
- About las
las
Contributor
Member since:
12-05-2011
03-14-2024
Community Statistics
| Posts | 136 |
| Solutions | 13 |
| Karma Given | 47 |
| Karma Received | 24 |
| Member Since | 05-12-2011 |
Activity Feed
- Karma Re: Why the ErrorCode 5 when trying to forward Sysmon logs (unable to subscribe)? for mawni. 03-07-2024 01:17 AM
- Posted Re: Splunk Secure Gateway Connect to SAML IdP on All Apps and Add-ons. 11-15-2023 06:38 AM
- Karma Re: Anybody knows about {@fieldname} in a join for gcusello. 10-17-2023 11:37 PM
- Posted Splunk Secure Gateway Connect to SAML IdP on All Apps and Add-ons. 07-25-2023 05:04 AM
- Tagged Splunk Secure Gateway Connect to SAML IdP on All Apps and Add-ons. 07-25-2023 05:04 AM
- Tagged Splunk Secure Gateway Connect to SAML IdP on All Apps and Add-ons. 07-25-2023 05:04 AM
- Karma Re: Where should the kvstore be deployed in a distributed Splunk environment for jwelch_splunk. 11-15-2022 04:43 AM
- Karma Re: Automatically deploy a local app to search head for isoutamo. 02-09-2022 04:46 AM
- Karma Re: After creating a custom visualization, why am I getting error "Failed to load source for Radial Meter visualization" in Splunk Web? for timpopxpop. 01-30-2022 10:40 PM
- Got Karma for Re: After upgrading to Splunk 6.3.0, why am I getting the following Mongod errors?. 09-06-2021 03:09 AM
- Got Karma for Re: Can a Index Cluster master use it self for forwarding data to the Cluster peers?. 10-24-2020 09:20 PM
- Got Karma for Re: Can a Index Cluster master use it self for forwarding data to the Cluster peers?. 10-23-2020 05:40 AM
- Got Karma for Re: Can a Index Cluster master use it self for forwarding data to the Cluster peers?. 10-23-2020 05:40 AM
- Got Karma for Can a Index Cluster master use it self for forwarding data to the Cluster peers?. 10-23-2020 05:40 AM
- Karma Re: Has anyone indexed Azure Devops audit log? for jscraig2006. 06-05-2020 12:51 AM
- Karma When will Splunk Enterprise 8.0.1 be released? for isbjorn. 06-05-2020 12:50 AM
- Karma Re: Event: Show source loading .... for chrisitanmoleck. 06-05-2020 12:50 AM
- Karma Re: Event: Show source loading .... for chrisitanmoleck. 06-05-2020 12:50 AM
- Karma Event: Show source loading .... for chrisitanmoleck. 06-05-2020 12:50 AM
- Karma Re: Dependency on Oracle java? for harsmarvania57. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
11-15-2023
06:38 AM
This was solved with the help of PS. On the Application API in AzureAD add the User.read.All of type Application to the configured permissions. Remember to add all the users that needs to access Splunk to the Enterprise Application
... View more
07-25-2023
05:04 AM
Hi.
I'm using Splunk Enterprise 9.0.4 on-Prem.
The Search head has been set up with AzureAD as IdP and normal user login functions as expected.
I tried to connect the Splunk Mobile App to my search head, but it complains that "SAML needs to be set up for Connected Experiences before devices can be registered", so I log on as administrator, and navigate to "SAML Configuration" in Splunk Secure Gateway. Here it states, that I need to connect to a SAML IdP, and when I look at Okta or Azure it states this: "To use Okta or Azure, use a provided authentication script to establish a persistent connection."
Now it seems that there should be a provided script, that I can use in my SAML configuration, I just can't find anywhere, where it states wich script it is.
Hopefully someone is less blind than me, and can point me in the right direction.
Kind regards
/las
... View more
Labels
- Labels:
-
administration
-
configuration
04-17-2019
01:37 AM
Hi.
I can't see a download for windows on the openJDK page referenced in the doc. Do you know if OpenJDK is just supported on Linux?
Kind regards
las
... View more
04-17-2019
01:29 AM
I forgot to mention, the Splunk installation is on Windows, and I can't find an OpenJDK for Windows Binary download.
I did find AdoptOpenJDK, but that is not supportet.
... View more
04-17-2019
01:17 AM
Hi.
With Oracles new licensing policy for java, does anybody know if the Splunk DB Connect can use another Java?
Kind regards
las
... View more
03-28-2019
06:50 AM
Sometimes it helps to try to do the request instead of just looking, at the logs.
I was missing the list_storage_passwords capability in the roles.
... View more
03-27-2019
11:48 PM
Hi.
I'm on a windows system.
It is spot on, that the 'user' making the call to passwords/username stored in Splunk_TA_snow is unable to get the correct creds. The user making the call gets a HTTP returncode 403, when they try to call /servicesNS/nobody/Splunk_TA_snow/storage/passwords/
So Splunk is preventing the 'user' from getting the passwords. I don't think that is done by ACLs on the filesystem.
Kind regards
... View more
03-25-2019
08:24 AM
No, no proxy.
For me it looks like the alert-script is requesting the credentials to Service-now from the Splunk-ta-snow app with the searchs user, and gets a http request denied.
Kind regards
Lars
... View more
03-25-2019
07:22 AM
Yes, the ServiceNow integration is installed and configured.
The problem is not on the ServiceNow side, it is on the Splunk side.
This is URL that has the problem:
GET /servicesNS/nobody/Splunk_TA_snow/storage/passwords/https%5C%3A%252F%252Fservicenow instance%3Adummy%3A
Called with https://127.0.0.1:8089, as the host
... View more
03-25-2019
02:27 AM
Hi.
I've tried to create an incident in Service-Now using Splunk add on for Servicenow.
This failed when it tried to get the password to Service-Now.
127.0.0.1 - user [23/Mar/2019:05:02:53.239 +0100] "GET /servicesNS/nobody/Splunk_TA_snow/storage/passwords/https%5C%3A%252F%252Fservicenow instance%3Adummy%3A HTTP/1.0" 403 228 - - - 0ms
How do I make this URL available, so it is possible to create incidents?
Kind regards
Lars Søndergaard
... View more
04-03-2018
03:27 AM
Hi.
I'm hoping you can help me, I'm trying to access a REST API with oauth2 Bearer Token, and need to set grant_type=password.
When I'm doing it in OAUTH 2 Token Refresh properties I get the following error:
Exception performing request: prepare_token_request() got multiple values for keyword argument 'grant_type'
If I need to set this property how do I do it?
Kind regards
las
... View more
06-09-2017
03:20 PM
Hi mmodestino.
Our primary browsers are IE 11, I have tried looking for plugins, but have so far been unsuccessful, so any hint in that direction would be great.
Kind regards
Lars
... View more
06-09-2017
05:10 AM
Hi mmodestino.
I do the monitoring on workstations, and do not have access to the servers.
Kind regards
Lars
... View more
06-09-2017
01:05 AM
Hi.
Thanks for the info.
Your example is on the TCP protocol, and I'm unsure if it is possible to match a HTTP request/response to the count and time_taken in the TCP protocol, or there might take multiple TCP requests.
My ultimate goal is to capture the user experience as closely as possible, thats why I have deployed the UF on workstations, where the user are working. If at all possible I would rather have a log from the browser, that told me how log it took to build the page - but I haven't found that yet. I can directly use the HTTP stream when SSL is not employed.
Kind regards
Lars
... View more
06-06-2017
07:28 AM
Hi.
I have deployed Splunk_TA_Stream to all the workstations, and was wondering if it is at all possible to get certain fields when the transport is HTTPS, logically I think it should be possible, as the only fields I'm interested in are as follows:
dest_ip:
dest_port:
endtime:
site:
status:
sum(bytes_in):
sum(bytes_out):
sum(time_taken):
timestamp:
uri_path:
The only one I can see might give some troubles are status, the rest is routing information or calculated fields, but I might be mistaken.
Any help is much appreciated.
Kind regards
Lars
... View more
03-09-2017
06:04 AM
In the latest version of Splunk App for Windows, the Django framework is discontinued, so it is not possible to see the searches in the normal conf files.
Kind regards
Las
... View more
09-27-2016
07:06 AM
I was notified that Splunk 6.5.0 was released, and decided to upgrade my sandbox.
I have Splunk App for Windows Infrastructure 1.3.0 installed, and after the Splunk upgrade it doesn't load table views in the app.
Have anybody else tried this yet, and if you have, did you have to tweak the installation?
Kind regards
las
... View more
08-09-2016
11:19 PM
Thanks, that was my guess too, but it is good to have it confirmed.
... View more
08-09-2016
06:36 AM
Hi.
I guess I might allready know the answer, but just to be sure.
Is it possible to deploy Splunk_TA_Stream on an Universal Forwarder running on a 32 bit windows 7 machine and get some data?
Kind regards
las
... View more
10-29-2015
12:24 AM
1 Karma
Would it be possible for you, to share your app?
That way others might benefit, and won't have to start from scratch.
kind regards
... View more
03-13-2015
12:17 PM
I agree with your notion, that it doesn't work, personally I considered using an eventstats, and still join the three types together.
What is more important is, that the query I pasted in the original question is used in the html, that is shipped with the app, so hopefully the guys working on Splunk app for windows infrastructure will see the post, so it might be corrected in the future, and until then its a head up, that Host Information might be incorrect in some cases.
... View more
03-13-2015
02:57 AM
Hi.
On windows machines with 2 or more cpu slots, the hostmon will return an event pr. slot. as seen by the following screenshot:
The problem is the way the search handles this, as it just makes a dedup by host:
{% searchmanager
id="computer-and-processor"
search='eventtype=hostmon_windows Type=OperatingSystem host="$Host$" | dedup host | eval OSArchitecture=Architecture | join host [search eventtype=hostmon_windows Type=Computer host="$Host$" | dedup host | eval ComputerManufacturer=Manufacturer] | join host [search eventtype=hostmon_windows Type=Processor host="$Host$" | dedup host]'|token_safe
autostart=False
%}
This will result in a grand total of 8 cores, not the 32, that actually is on the host.
kind regards
las
... View more
06-25-2014
06:34 AM
Hi.
I've installed Splunk App for Windows Infrastructure and do have some problems with the performance dashboard.
The counters for everything but CPU is not filled. I have enabled all counters for the server:
Hukommelse (Total Counters = 35)
Logisk disk (Total Counters = 23)
Netværksgrænseflade (Total Counters = 12)
Processor (Total Counters = 13)
I have a feeling the problem, might be due to the fact, that my server is set up as Danish, and the app has a problem with this.
How do I get a look, at the search populating the counters?
... View more
11-23-2012
04:28 AM
I admit I have used limited time on this app so far but a quick question anyway.
When I have multiple failed logins from an IP, is it possible to get the usernames, that where used for these attempted logins?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-14-2024
08:09 AM
|
Karma given to
