Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dewald13
dewald13
Path Finder
Member since:
07-24-2012
06-05-2020
Community Statistics
| Posts | 31 |
| Solutions | 2 |
| Karma Given | 5 |
| Karma Received | 7 |
| Member Since | 07-24-2012 |
Activity Feed
- Karma Re: Why am I now getting "SSL configuration issue: invalid CA public key file" from Splunk Supporting Add-on for Active Directory after upgrading ? for jmaple. 06-05-2020 12:48 AM
- Karma Re: Why am I now getting "SSL configuration issue: invalid CA public key file" from Splunk Supporting Add-on for Active Directory after upgrading ? for scottrunyon. 06-05-2020 12:48 AM
- Karma Re: What causes queues on Indexer to block? for Drainy. 06-05-2020 12:46 AM
- Karma Re: User Agent regex for jgedeon120. 06-05-2020 12:46 AM
- Karma Re: Extracting hostname from filename - inputs.conf on UF - host_regex issue for bwooden. 06-05-2020 12:46 AM
- Got Karma for Re: *Simple* daily volume tracking?. 06-05-2020 12:46 AM
- Got Karma for Re: Manually input lookup data on server?. 06-05-2020 12:46 AM
- Got Karma for How do I exclude everything but certain events at my heavy forwarder?. 06-05-2020 12:46 AM
- Got Karma for Re: How do I exclude everything but certain events at my heavy forwarder?. 06-05-2020 12:46 AM
- Got Karma for Re: How do I exclude everything but certain events at my heavy forwarder?. 06-05-2020 12:46 AM
- Got Karma for Extracting hostname from filename - inputs.conf on UF - host_regex issue. 06-05-2020 12:46 AM
- Got Karma for Extracting hostname from filename - inputs.conf on UF - host_regex issue. 06-05-2020 12:46 AM
- Posted Re: Why am I now getting "SSL configuration issue: invalid CA public key file" from Splunk Supporting Add-on for Active Directory after upgrading ? on All Apps and Add-ons. 10-20-2016 06:33 AM
- Posted Re: Not displaying Events list when Searching on Splunk Search. 08-04-2016 11:40 AM
- Posted Re: When will Splunk address the OpenSSL vulnerability issue (CVE-2016-2107; OpenSSL <1.0.2h)? on Splunk Enterprise. 07-13-2016 05:42 AM
- Posted Re: When will Splunk address the OpenSSL vulnerability issue (CVE-2016-2107; OpenSSL <1.0.2h)? on Splunk Enterprise. 07-12-2016 10:59 AM
- Posted Re: Two lookup commands in one search on Splunk Search. 04-23-2013 12:27 PM
- Posted Re: Two lookup commands in one search on Splunk Search. 04-23-2013 09:24 AM
- Posted Re: Two lookup commands in one search on Splunk Search. 04-23-2013 09:00 AM
- Posted Re: Two lookup commands in one search on Splunk Search. 04-23-2013 07:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 |
10-20-2016
06:33 AM
This also worked for me...just added the below in the local ssl.conf;
caCertFile = E:\Splunk\etc\auth\cacert.pem
... View more
08-04-2016
11:40 AM
I have a user with this same issue. Was there ever a solution to this?
... View more
07-13-2016
05:42 AM
I was looking here http://docs.splunk.com/Documentation/Splunk/6.4.2/ReleaseNotes/OpenSSL which states 6.4.2 still has v1.0.2g. But I did install last night and you are correct, it is running 1.0.2h
thanks for the quick response
... View more
07-12-2016
10:59 AM
6.4.2 is now released and looks to still have 1.0.2g.............still not fixed
... View more
04-23-2013
12:27 PM
I am now using the following search, still with no luck..
index=proxysg | lookup bases range as client_ip output base | lookup inosc BASE as base output NOSC
Ideas why its not working?
... View more
04-23-2013
09:24 AM
That makes sense but since my first post, I am now using this search string;
index=proxysg | lookup myfile.csv A as B output C | lookup otherfile.csv D as C output E
So, the output from the first string "C", is being used as the alias for the second string.
Yes/no?
... View more
04-23-2013
07:40 AM
I am only getting the output from the first lookup, "D". It seems like it is ignoring the second lookup all together but there is no way I can test the second lookup by itself since it relies on the output from the first lookup. Make sense??
... View more
04-23-2013
05:42 AM
I am trying to use two lookup commands in one search string. The output of the first lookup command is being used in the second lookup.
index=proxysg | lookup myfile.csv A as B output C | lookup otherfile.csv D as C output E
The output of the first lookup, "C", is being used in the second lookup with a new output from the second lookup file, "E".
Is this even possible?
... View more
04-04-2013
07:01 AM
I am trying to create an "action" field extraction to grab "permitted/denied" from my Cisco device logs. I can get this "(?i)-INGRESS (?P [^ ]+)" to match the majority of the fields but still not 100%. Any help is greatly appreciated!
EXAMPLE LOGS
Apr 4 13:37:55 XXX-gw 28127310: Apr 4 13:39:26.000:%FMANFP-6-IPACCESSLOGP: F0: fman_fp_image: list GLOBAL-INGRESS denied tcp XXX.XX.9.XXX(53165) -> 132.X.X.X(25), 1 packet
Apr 4 13:37:55 XXX-usr-250.grace.ad.XX.XXX 192461: Apr 4 13:39:26:%SEC-6-IPACCESSLOGS: list 15 permitted XX.16.XX.X 1 packet
Apr 4 13:37:55 XXX-sdp 23211: Apr 4 13:39:25.975:%SEC-6-IPACCESSLOGNP: list NTPPEER denied 0 XXX.XX.2.X -> XXX.XXX.X.XX,1 packet
... View more
03-21-2013
12:06 PM
That worked with the "/"
Thanks!
... View more
03-21-2013
09:49 AM
Try this one more time.
"^\/logs\/rsyslog\/bclogs\/(.*)-d{6}[.]log[.]gz"
... View more
03-21-2013
09:39 AM
the site is ripping out the backslashes...
"^\/logs\/rsyslog\/bclogs\/(.*)-\d{6}[.]log[.]gz"
... View more
03-21-2013
07:47 AM
This is the current inputs.conf on the Universal Forwarder
index = proxysg
sourcetype = squid
ignoreOlderThan = 60m
disabled = false
host_regex = /logs/rsyslog/bclogs/(.*)-\d{6}[.]log[.]gz
... View more
03-20-2013
05:06 PM
2 Karma
Having an issue with bluecoat logs that are dropped on a server with a UF. Attempting to extract the hostname with the following:
host_regex = /logs/rsyslog/bclogs/(.*)-\d{6}[.]log[.]gz
Checked this regex in regexr and it works perfectly.
Sample file names - Host format (ABC-G-PXYW-XXX)
/logs/rsyslog/bclogs/ABC-G-PXYW-002-032016.log.gz
/logs/rsyslog/bclogs/AEC-G-PXYW-001-032016.log.gz
/logs/rsyslog/bclogs/ABC-G-PXYW-002-032014.log.gz
/logs/rsyslog/bclogs/DEF-G-PXYW-003-032016.log.gz
The host is coming in set as the name of the log server, rather than the name.
Thoughts?
... View more
02-22-2013
12:59 PM
After troubleshooting with the creator of the TA-browscap app, Dave Shpritz, for two days we finally got it figured out. The final regex ended up being; \s\"(?P<http_user_agent>[^"]+)
The TA-browscap app supplies a lot of very useful information for the pesky user agent strings.
Big thanks to Dave on this one!
... View more
02-22-2013
05:43 AM
That worked perfect using a regex generator online but when I put that into Splunk as a field extraction it does not match anything. Any ideas???
... View more
02-21-2013
06:19 PM
I'm trying to create a regex to match the user agent from the following logs. Beginning with "Mozilla/*" and ending at the end of the UA string. The problem I'm having is that one is so much longer than the other one I cant seem to match them both from " to ". I know these are a pain in the @$$ to deal with but was curious if anyone had any suggestions/insight.
2013-02-21 22:39:29 26 xxx 200 TCP_ACCELERATED 39 373 CONNECT tcp ssl.gstatic.com 443 / - - - - 132.x.xx.134 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E)" OBSERVED "Search Engines/Portals" - 1xx.xx.xx.xxx SG-HTTP-Service
2013-02-21 22:39:29 26 xxx 200 TCP_ACCELERATED 39 373 CONNECT tcp ssl.gstatic.com 443 / - - - - 132.x.xx.134 - "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.79 Safari/537.1" - xxx.x.xxx.xxx SG-HTTP-Service
... View more
02-20-2013
10:06 AM
I dont even think we will be able to do that. Is there anywhere you know of the site I can download it from directly?
... View more
02-20-2013
08:59 AM
1 Karma
We are aware the site is having some issues but either way, we cannot get out of our network and hit it to download what is needed. Is there a way to accomplish this manually??
We have also looked at your TA-browscap app but that is not what we are looking for. We need to break down our user agent strings.
Please advise if there is a workaround.
thanks,
doug
... View more
02-20-2013
08:30 AM
Is there any way to manually input the library to do the lookup command? The network that I am trying to do this on is locked down and my Splunk server cannot hit the website to update the cache.
Any help will be greatly appreciated!
... View more
10-29-2012
08:29 AM
call support. they'll tell you they'll call you back, then not call you back...
... View more
10-03-2012
12:15 PM
1 Karma
In the search app, go to Status > Index activity > Indexing volume.
From there you can select your time frame, indexers to search (all), and what to split it up by. I always do it for the last 24hrs looking at any server and split by index. Like it was stated above, dont include your "_*" indexes or your summary indexes.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
