Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About harald_leitl
harald_leitl
Path Finder
Member since:
02-20-2012
01-18-2023
Community Statistics
| Posts | 23 |
| Solutions | 1 |
| Karma Given | 6 |
| Karma Received | 7 |
| Member Since | 02-20-2012 |
Activity Feed
- Posted Re: Is there a limitation in the combination of transforms on a source in props.conf? on All Apps and Add-ons. 01-18-2023 12:34 AM
- Karma Re: Is there a limitation in the combination of transforms on a source in props.conf? for yeahnah. 01-18-2023 12:34 AM
- Posted Is there a limitation in the combination of transforms on a source in props.conf? on All Apps and Add-ons. 01-16-2023 06:38 AM
- Tagged Is there a limitation in the combination of transforms on a source in props.conf? on All Apps and Add-ons. 01-16-2023 06:38 AM
- Got Karma for Unable to initialize modular input "relaymodaction" defined in the app "Splunk_SA_CIM". 06-11-2021 01:33 PM
- Got Karma for Unable to initialize modular input "relaymodaction" defined in the app "Splunk_SA_CIM". 04-26-2021 03:35 AM
- Posted Unable to initialize modular input "relaymodaction" defined in the app "Splunk_SA_CIM" on All Apps and Add-ons. 02-13-2021 01:49 AM
- Tagged Unable to initialize modular input "relaymodaction" defined in the app "Splunk_SA_CIM" on All Apps and Add-ons. 02-13-2021 01:49 AM
- Karma Re: Is there a way to count the series of consecutive identical events that are interrupted by another event? for woodcock. 06-05-2020 12:48 AM
- Got Karma for Is there a way to count the series of consecutive identical events that are interrupted by another event?. 06-05-2020 12:48 AM
- Got Karma for Why Windows Event Logs show "Splunk could not get the description for this event. Either ..." in message field in Splunk 6.1.2?. 06-05-2020 12:47 AM
- Got Karma for Why Windows Event Logs show "Splunk could not get the description for this event. Either ..." in message field in Splunk 6.1.2?. 06-05-2020 12:47 AM
- Got Karma for Why Windows Event Logs show "Splunk could not get the description for this event. Either ..." in message field in Splunk 6.1.2?. 06-05-2020 12:47 AM
- Got Karma for Why Windows Event Logs show "Splunk could not get the description for this event. Either ..." in message field in Splunk 6.1.2?. 06-05-2020 12:47 AM
- Karma Re: Multiple Roles inherited from LDAP Group Memberships for dominiquevocat. 06-05-2020 12:46 AM
- Karma Re: colddb on NFS for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: colddb on NFS for jodros. 06-05-2020 12:46 AM
- Posted Re: Is there a way to count the series of consecutive identical events that are interrupted by another event? on Splunk Search. 05-13-2016 01:10 AM
- Posted Re: Is there a way to count the series of consecutive identical events that are interrupted by another event? on Splunk Search. 05-13-2016 01:07 AM
- Posted Re: Is there a way to count the series of consecutive identical events that are interrupted by another event? on Splunk Search. 04-27-2016 12:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 1 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-18-2023
12:34 AM
Hi @yeahnah, That did the trick. It's working now... hosts are renamed and data is rerouted into the correct index. Thanks a lot, cheers
... View more
01-16-2023
06:38 AM
Hi all,
is there a limitation in the combination of transforms on a source in props.conf?
here is what i did and somehow I don't get any result.
Whenever I delete the TRANSFORMS-reroute entry, data is received and hostnames are changed.
Somehow I don't get the source with my regex rerouted to another index.
props.conf:
[source::tcp:514]
TRUNCATE = 64000
TRANSFORMS = newhost1
TRANSFORMS = newhost2
TRANSFORMS-reroute=set-index
transforms.conf
[newhost1]
DEST_KEY = MetaData:Host
REGEX = mymatchinghost1rex
FORMAT = host::myhost1
[newhost2]
DEST_KEY = MetaData:Host
REGEX = mymatchinghost2rex
FORMAT = host::myhost2
[set-index]
DEST_KEY=_MetaData:Index
REGEX= .+mymatchingrex.+
FORMAT=myindex
WRITE_META=true
thanks for your help,
kind regards,
harald
... View more
Labels
- Labels:
-
administration
-
configuration
02-13-2021
01:49 AM
2 Karma
Hello Community, Since Upgrade to 8.1.1 I'm getting following error message on my search head cluster: "Unable to initialize modular input "relaymodaction" defined in the app "Splunk_SA_CIM": Introspecting scheme=relaymodaction: script running failed (exited with code 1)." Does anyone have an idea how to fix that. Thanks, cheers harald
... View more
- Tags:
- app
- Splunk_SA_CIM
Labels
- Labels:
-
troubleshooting
05-13-2016
01:10 AM
Sorry for the late answer.
Here is the solution for version 6.2.4:
|autoregress Event | eval sameAsNext=if(Event=Event_p1,1,0) | streamstats current=t count(eval(sameAsNext=0)) AS sessionID | eventstats count AS inArowCount BY sessionID | search sameAsNext=0 | fields Event inArowCount
... View more
05-13-2016
01:07 AM
I'm using 6.2.4, unfortunately the reset_before available in that version.
... View more
04-27-2016
12:34 AM
as I said I don't want to count the events like:
count(A)|count(B)
5 | 6
what I want is to count the series of identical events that are interrupted by an other event. as described above.
I want a result like:
consecutive Event | count
A | 2
B | 3
A | 1
B | 2
A | 2
B | 1
... View more
04-27-2016
12:28 AM
i'm sorry, but that's not what i'm looking for. I want a result like that:
consecutive Event | count
A | 2 --> first series A seq#1+seq#2 = 2
B | 3 --> first series B seq#3+seq#4+seq#5 = 3
A | 1 --> 2nd series A seq#6 = 1
B | 2 --> 2nd series B seq#7+seq#8 = 2
A | 2 --> 3rd series A seq#9+seq#10=2
B | 1 --> 3rd series B seq#11 = 1
... View more
04-26-2016
11:54 PM
1 Karma
Hello,
Is there a way to count the series of consecutive identical events that are interrupted by another event?
Something like that:
data:
seq#;Event
1;A
2;A
3;B
4;B
5;B
6;A
7;B
8;B
9;A
10;A
11;B
the result should look like:
consecutive Event | count
A | 2
B | 3
A | 1
B | 2
A | 2
B | 1
thx
... View more
01-20-2015
11:12 PM
4 Karma
Hello,
I'm using splunk universal forwarder version 6.1.2 on Windows Servers to index EventLogs. The Events are indexed (indexer version 6.1.2), however the message field contains following message:
Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.
In the Event Viewer on the Windows Server the message field is displayed correctly. I couldn't identify a specific EventID nor Server version, it happens on win server 2003 and also 2008r2. However it seems to happen mostly in Security and Application Log.
If found an article that describes the problem, however it addressed a bug in 4.3.x
http://answers.splunk.com/answers/66436/splunk-could-not-get-the-description-for-this-event-4-3-2-universal-forwarder-server-2008-r2.html
Any ideas or suggestions? Could it be the same bug?
thanks!
... View more
08-08-2014
04:33 AM
Hi,
is it possible to use satellite view in xml "map" element?
thanks!
... View more
05-26-2014
01:32 PM
my bad, was a typo in my question. i do have %d.%m.%y %H:%M:%S configured in my props.conf.
I also tried your TIME_PREFIX regex, didn't work. Somehow Splunk always recognizes the date as date and time as I described above. any other idea? thanks.
... View more
05-26-2014
06:17 AM
Hi,
I have a problem with extracting the timestamp from an csv file.
Somehow Splunk recognizes the DATE as Date and Time.
Here is a sample of my CSV Log file:
123456;textA;08.03.10 07:54:43;textB;textC;textD
Here is the result I get from the search:
08.03.10 08:03:10,000
123456;textA;08.03.10 07:54:43;textB;textC;textD
As you can see date and time is the same.
Here is what I expect to see:
08.03.10 07:54:43,000
123456;textA;08.03.10 07:54:43;textB;textC;textD
My props.conf:
[myCSVsourcetype]
TRANSFORMS-null=setnull
TIME_FORMAT = %d.%m.%y %%H:%M:%S
TIME_PREFIX = ^\d+\;\S+\;
My transforms.conf: (to remove header)
[setnull]
REGEX = ^(.*\n){1}
DEST_KEY = queue
FORMAT = nullQueue
what am I doing wrong?
why does splunk not recognize the time from the log?
using Splunk 6.0.2.
CSV file is created and moved to an indexing directory once a day.
Thanks!
... View more
09-03-2013
02:06 AM
Hi,
Is it possible that multiple indexers (same index) use the same shared NFS directory for colddb?
For example:
indexer1:
indexes.conf
[indexA]
...
coldPath = /NFS/indexA/colddb
...
indexer2:
[indexA]
...
coldPath = /NFS/indexA/colddb
...
OR should it look like:
indexer1:
indexes.conf
[indexA]
...
coldPath = /NFS/indexer1/indexA/colddb
...
indexer2:
[indexA]
...
coldPath = /NFS/indexer2/indexA/colddb
...
thx
... View more
11-30-2012
07:06 AM
The problem was caused by a search filter set on role 'A' in authorize.conf.
here is the solution:
http://splunk-base.splunk.com/answers/57026/multiple-roles-inherited-from-ldap-group-memberships
thx
... View more
11-28-2012
08:02 AM
As explained above, role 'A' is allowed to search through index1;index2;index3 and role 'B' is allowed to search through index2;index4;index5.
I thought, if I assign both roles the user would be capable of searching through index1;index2;index3;index4 and index5.
my search to verify the result:
index=*
The result I got:
Only events from index1;index2;index3 were included in the result.
The result I was looking for:
events from index1;index2;index3;index4 and index5 are shown
... View more
11-28-2012
08:02 AM
I don't think I have a problem with authentication and ldap.
In splunk manager I see that both splunk roles are assigned to the user.
However, it seems the user only gets capabilities of role 'A'.
... View more
11-28-2012
02:17 AM
Hi,
I got following behavior.
An ldap user is member of two roles. (role A = ldap groupA & role B = ldap groupB)
role A has properties set to srchIndexesAllowed = index1;index2;index3
role B has properties set to srchIndexesAllowed = index2;index4;index5
When searching for index=* the user only sees indexes from role A (index1;index2;index3).
In Splunk manager the user has both roles assigned.
What am I doing wrong?
we are currently running on 4.3.3.
thx,
harry
... View more
08-30-2012
01:28 AM
just chanced permissions - unfortunately still the same behavior.
... View more
07-16-2012
05:54 AM
Hi,
Just updated my search heads to 4.3 and now I get following message when trying to create new roles in Splunk manager.
There was an error retrieving the configuration, can not process this page.
You do not have permission to access the configuration for this page.
No difference between LDAP user (with admin privilege) and local Admin user, both receive the same error.
my /opt/splunk/etc/apps/search/metadata/default.meta shows:
....
*[manager/authentication_roles]
access = read : [ admin ], write : [ admin ]*
...
that should be okay.
Any suggestion?
thanks,
harry
... View more
- Tags:
- permissions
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-18-2023
03:58 AM
|
Karma given to
