Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunk0
splunk0
Path Finder
Member since:
01-25-2012
04-26-2021
Community Statistics
| Posts | 16 |
| Solutions | 2 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 01-25-2012 |
Activity Feed
- Posted Re: dbconnect results as a subquery on Splunk Search. 04-26-2021 06:13 AM
- Karma Re: Splunk App For VMware. DCN. avoid collecting some data for ivanreis. 06-05-2020 12:50 AM
- Got Karma for Any plans to update Splunk Add-on for VMWare to be compatible with Splunk 8.0?. 06-05-2020 12:50 AM
- Karma Re: Nothing gets indexed for unknown reason for splunker12er. 06-05-2020 12:49 AM
- Posted Re: Application is disabled: Splunk_TA_ontap on All Apps and Add-ons. 11-12-2019 03:45 AM
- Posted Re: Application is disabled: Splunk_TA_ontap on All Apps and Add-ons. 11-11-2019 08:57 PM
- Posted Application is disabled: Splunk_TA_ontap on All Apps and Add-ons. 11-11-2019 02:54 PM
- Tagged Application is disabled: Splunk_TA_ontap on All Apps and Add-ons. 11-11-2019 02:54 PM
- Tagged Application is disabled: Splunk_TA_ontap on All Apps and Add-ons. 11-11-2019 02:54 PM
- Posted Any plans to update Splunk Add-on for VMWare to be compatible with Splunk 8.0? on All Apps and Add-ons. 10-27-2019 02:06 PM
- Tagged Any plans to update Splunk Add-on for VMWare to be compatible with Splunk 8.0? on All Apps and Add-ons. 10-27-2019 02:06 PM
- Tagged Any plans to update Splunk Add-on for VMWare to be compatible with Splunk 8.0? on All Apps and Add-ons. 10-27-2019 02:06 PM
- Posted Re: Splunk App For VMware. DCN. avoid collecting some data on All Apps and Add-ons. 10-07-2019 03:14 PM
- Posted Splunk App For VMware. DCN. avoid collecting some data on All Apps and Add-ons. 10-07-2019 01:38 PM
- Tagged Splunk App For VMware. DCN. avoid collecting some data on All Apps and Add-ons. 10-07-2019 01:38 PM
- Tagged Splunk App For VMware. DCN. avoid collecting some data on All Apps and Add-ons. 10-07-2019 01:38 PM
- Tagged Splunk App For VMware. DCN. avoid collecting some data on All Apps and Add-ons. 10-07-2019 01:38 PM
- Posted VMware performance collection without Splunk for VMware App on All Apps and Add-ons. 10-07-2019 01:28 AM
- Tagged VMware performance collection without Splunk for VMware App on All Apps and Add-ons. 10-07-2019 01:28 AM
- Tagged VMware performance collection without Splunk for VMware App on All Apps and Add-ons. 10-07-2019 01:28 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-26-2021
06:13 AM
OK, got it to work like so: index=someindex action=someaction |join event_city_id_field [|dbxquery query="select city_id from Cities where Country="USA" connection="SQLserver" | rename city_id as event_city_id_field| fields event_city_id_field]
I needed to add the join directive + replace "search" with "|" Really appreciate your help!
... View more
11-12-2019
03:45 AM
The error was because the app in the heavy forwarder (the DCN) is disabled by default. Need to enable it.
... View more
11-11-2019
08:57 PM
7.3.2
The same DCN is used for vmware collection just fine btw.
... View more
11-11-2019
02:54 PM
Getting this error when trying to set netapp add on.
Any idea?
2019-11-11 22:47:30,339 ERROR [ta_ontap_collection_scheduler://nidhogg] Problem with hydra scheduler ta_ontap_collection_scheduler://nidhogg:
[HTTP 404] https://splunkDCN01.lab.loc:8089/servicesNS/nobody/Splunk_TA_ontap/data/inputs/ta_ontap_collection_worker; [{'text': 'Application is disabled: Splunk_TA_ontap', 'code': None, 'type': 'ERROR'}]
Traceback (most recent call last):
File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 2108, in run
self.node_manifest = self.establishNodeManifest()
File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 2035, in establishNodeManifest
metadata_dict=self.metadata_dict, worker_input_name=self.worker_input_name)
File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 826, in __init__
self.heads_list = self.establishHeads()
File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 1176, in establishHeads
sessionKey=self.session_key, hostPath=self.node_path)
File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 137, in getEntities
atomFeed = _getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs)
File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 230, in _getEntitiesAtomFeed
serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 550, in simpleRequest
raise splunk.ResourceNotFound(uri, extendedMessages=extractMessages(body))
ResourceNotFound: [HTTP 404] https://splunkDCN01.lab.loc:8089/servicesNS/nobody/Splunk_TA_ontap/data/inputs/ta_ontap_collection_worker; [{'text': 'Application is disabled: Splunk_TA_ontap', 'code': None, 'type': 'ERROR'}]
... View more
10-27-2019
02:06 PM
1 Karma
It is currently broken (python) on 8.0.
... View more
10-07-2019
03:14 PM
As I wrote in the post, the black.white list is for specific counters, not whole type like vmware:perf:disk for host
... View more
10-07-2019
01:38 PM
Is there a way to not collect a whole sourcetype?
I do not wish to collect vmware:perf:datastore, vmware:perf:disk maybe more.
AFAIK, adding to "VM Metric Blacklist" will only not index specific metrics within a group, but not the whole group.
... View more
10-07-2019
01:28 AM
I am interested in collecting performance metrics from my VCSA but cannot pay for the Splunk App for VMware.
Is there a way tom simply collect using Splunk Add ON/ Splunk OVA etc and send to my indexer as raw data?
I will create my own dashboards using this raw data.
I am not sure which component I install where.
I have a standalone searchhead/indexer
Deployed a Splunk OVA
Went to splunk_ova_ip:8000 then to splunk add on app
configured a single DCN
There is a section on that page to configure a vcenter server.
I tried configuring one here but not sure what the VC Splunk Forwarder is.
I tired the URI of this OVA but that doesnt work.
What do I need to install on my searchead/indexer?
How do I instruct the DCN to start collecting data?
How do I tell it to send to my indexer?
Thanks in advance.
... View more
04-18-2018
01:40 AM
I eventually just deleted all and installed from the Wen Interface. It works fine.
... View more
04-18-2018
01:40 AM
I eventually just deleted all and installed from the Wen Interface. It works fine.
... View more
03-25-2018
02:06 PM
I just followed this guide:
https://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Troubleshoot
The logs in the original post are from splunk_ta_checkpoint-opseclea_modinput.log
just continues with the same type of message:
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2601 :INFO: - purged nID aID
countless of times but nothing gets logged to index=opsec
The beginning of the file shows: get_pkxld_path: cpshared_filename failed
Maybe that is an indecation for something?
Does it matter if its standalone or not? I don't think it matters.
... View more
03-25-2018
07:37 AM
All I see in the log is:
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles code_line_no:2506 :INFO: Successfully create opsec environment
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles code_line_no:2535 :INFO: Successfully initialize client/server-pair
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles code_line_no:2553 :INFO: Successfully create session
[ 161687680][25 Mar 14:30:54] get_pkxld_path: cpshared_filename failed
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2596 :INFO: lea_get_first_file_info returned 4
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2597 :INFO: Available FW-1 Logfiles
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2601 :INFO: - purged nID 1399793794 aID 1399793794
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2601 :INFO: - purged nID 1399814080 aID 1399814080
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2601 :INFO: - purged nID 1399829518 aID 1399829518
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2601 :INFO: - purged nID 1399841761 aID 1399841761
log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2601 :INFO: - purged nID 1399852792 aID 1399852792
... View more
- Tags:
- opsec-lea
09-08-2015
02:33 AM
small fix for the example query (same result set):
host=guac sourcetype="syslog" | rex field=_raw "guacd[(?\d+)]" | rex field=_raw "connected-listener: id=\"(?.+)\" email=" | rex field=_raw "Connection ID is \"(?.+)\"" | search "5b629c6f-4b1a-410a-9382-53d694c23972" OR guacd=10734 | table _time _raw guacd connection_id
... View more
09-08-2015
02:25 AM
Hi,
Best way for me to explain is by example.
example search:
host=*guac* sourcetype="syslog" | rex field=_raw "guacd\[(?<guacd>\d+)\]" | rex field=_raw "connected-listener: id=\"(?<connection_id>.+)\" email=" | search "5b629c6f-4b1a-410a-9382-53d694c23972" OR guacd=10734
I added the last search filter just for clarity to get a small result set.
Example result set:
Whenever I get a string like "Error writing data to socket", I want to append the email to that result which can be found if correlated with the guacd field and then with the connection_id field
Not sure how to do it.
Any idea?
... View more
04-06-2015
01:31 PM
I'm trying to implement this for oauth:
https://github.com/bitly/google_auth_proxy
Before using that, I tried simple proxying with nginx.
Here is my nginx config which does not work:
server {
listen 443 default ssl;
server_name splunk.mydomain.com;
ssl on;
ssl_certificate /etc/nginx/ssl/wild.mydomain.com.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
add_header Strict-Transport-Security max-age=1209600;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
proxy_pass http://10.13.5.29:8000/;
}
That doesn't work and seem to direct back to http://splunk.mydomain.com
This is my apache config which works:
<VirtualHost *:80>
ServerName splunk.mydomain.com
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
ProxyPreserveHost On
ProxyPass /cgi-bin !
ProxyPass / http://10.13.5.29:8000/ retry=0
ProxyPassReverse / http://10.13.5.29:8000/ retry=0
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
This is my web.conf file:
[settings]
enableSplunkWebSSL = 0
tools.sessions.timeout = 4320
enable_autocomplete_login = True
tools.proxy.on = True
SSOMode = permissive
tools.proxy.base = http://10.13.5.29:8000
Using splunk 5
Anything I'm doing wrong?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-26-2021
09:37 AM
|
