Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kranzrm
kranzrm
Path Finder
Member since:
05-10-2013
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 1 |
| Karma Given | 36 |
| Karma Received | 0 |
| Member Since | 05-10-2013 |
Activity Feed
- Karma Re: DB Connect Time-Based lookup for jcoates. 06-05-2020 12:49 AM
- Karma Re: Why are AWS ELB Health Checks not working properly after upgrading to Splunk 6.6.0? for basu42002. 06-05-2020 12:48 AM
- Karma Re: Why are AWS ELB Health Checks not working properly after upgrading to Splunk 6.6.0? for vliggio. 06-05-2020 12:48 AM
- Karma Why are AWS ELB Health Checks not working properly after upgrading to Splunk 6.6.0? for eandresen. 06-05-2020 12:48 AM
- Karma How to replicate a Search Head Cluster's KV Store lookup data to an Indexer? for earakam. 06-05-2020 12:48 AM
- Karma How to configure Splunk to index a one line JSON file with 55,000 characters? for khhenderson. 06-05-2020 12:48 AM
- Karma Re: Splunk local account login to splunkweb when SAML authentication is enabled? for suarezry. 06-05-2020 12:48 AM
- Karma Splunk local account login to splunkweb when SAML authentication is enabled? for jeff. 06-05-2020 12:48 AM
- Karma Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible? for rphillips_splk. 06-05-2020 12:48 AM
- Karma How can I have the auto db-lookups in distributed environment? for luhadia_aditya. 06-05-2020 12:47 AM
- Karma Re: After upgrading to Splunk 6.3, why is the Splunk Support for Active Directory connection test failing with "the default configuration stanza for ldap.conf is missing."? for Richfez. 06-05-2020 12:47 AM
- Karma Re: How do I fix my JavaScript cache issue to have my Splunk dashboard use the new js file? for alacercogitatus. 06-05-2020 12:47 AM
- Karma How do I fix my JavaScript cache issue to have my Splunk dashboard use the new js file? for dvg06. 06-05-2020 12:47 AM
- Karma Splunk Cloud - Windows client, not working? for sherod. 06-05-2020 12:47 AM
- Karma Why did email alerts stop sending after upgrading to Splunk 6.1? for EdSabine. 06-05-2020 12:47 AM
- Karma Re: How do I locate the captain on a search head cluster? for jmervine. 06-05-2020 12:47 AM
- Karma Re: Getting the timezone from the operating system for a universal forwarder for TONYBYERS. 06-05-2020 12:47 AM
- Karma Getting the timezone from the operating system for a universal forwarder for TONYBYERS. 06-05-2020 12:47 AM
- Karma Re: How to create field extractions for dynamic csv files from headers that change with each file for woodcock. 06-05-2020 12:47 AM
- Karma How to create field extractions for dynamic csv files from headers that change with each file for OMohi. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
06-01-2018
08:25 AM
jtlittle, can you elaborate? I'm having the same issue and it's not clear to me what you mean.
... View more
10-19-2017
08:43 AM
Is there a way to customize the query? I'm trying to create a time-based lookup with DBConnect. Any suggestions?
Also, The key values are integer time stamps and string IP addresses. Does DBConnect send the parameters as their Splunk data types? Is there a way to specify this? Or, does it make all parameters strings?
... View more
10-19-2017
07:21 AM
The data is rapidly changing (hourly ip to hostname information). I was looking to use an external database due to volume and churn.
... View more
10-19-2017
07:16 AM
I have found a solution to this problem. The database must have ANSI_QUOTES enabled in the sql_mode parameter.
From: https://dev.mysql.com/doc/refman/5.6/en/sql-mode.html#sqlmode_ansi_quotes
ANSI_QUOTES
Treat " as an identifier quote character (like the ` quote character) and not as a string quote character. You can still use ` to quote identifiers with this mode enabled. With ANSI_QUOTES enabled, you cannot use double quotation marks to quote literal strings, because it is interpreted as an identifier.
Relevant StackOverflow Post: https://stackoverflow.com/a/14123649/1440715
For AWS RDS this needs to be set within a parameter group. This cannot be set with the SQL query used on a vanilla MySQL databse. Once the parameter is set (and the group is applied) the database instance needs to be rebooted in order for this setting to take effect.
Working with DB Parameter Groups: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithParamGroups.html
... View more
10-18-2017
07:56 AM
I am passing a time to the lookup. The problem is that the lookup query I define is wrapped in a subselect statement. I cannot find any way to prevent dbxlookup to not wrap my lookup query.
... View more
10-15-2017
01:45 PM
I have successfully installed and configured DBConnect 3.11 on a search-head and I'm able to query and output data to/from an AWS RDS Aurora database.
My problem happens when I try to run a dbxlookup against my data search results.
From: /opt/splunk/var/log/splunk/splunk_app_db_connect_audit_command.2017-10-15.log
2017-10-15 20:01:47.139 2886@splunk-sh1 [main] INFO com.splunk.dbx.connector.logger.AuditLogger - operation= connection_name= stanza_name= state=success sql='SELECT "ip", "dns" FROM (SELECT time, ip, dns FROM `hostip_lookup`.`table_name`) dbxlookup WHERE "ip" IN (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,)'
I ran this query manually and I am not getting the expected results.
SELECT "ip", "dns" FROM (SELECT time, ip, dns FROM `hostip_lookup`.`table_name`) dbxlookup
I expected to see the results from my table, instead I see:
|# ip, dns
|ip, dns
|...<repeated>...
|ip, dns
|ip, dns
It appears that using double quotes for the column names ( SELECT "ip", "dns" FROM ... ) is incorrect. And, instead of returning the record values, it is returning "ip" and "dns" for every record. This is generated by DBConnect and I am only able to change the query in the subselect (within the parenthesis () ).
Taking the quotes away from the column names returns the expected results:
SELECT ip, dns FROM (SELECT time, ip, dns FROM `hostip_lookup`.`table_name`) dbxlookup
Questions to my fellow Splunk Ninjas:
1. Is DBConnect generating incorrect SQL? Or, have I configured something wrong?
2. Is there any way to not wrap my query within parentheses? Or can I change how Splunk is quoting my column names?
... View more
10-13-2017
08:47 PM
Is there any way to create a time-based database lookup with DBConnect 3.11?
I don't see the option within the GUI and can't find a way to customize the lookup SQL query since WHERE field=value appears to be appended to the lookup SQL.
If this can't be done with the GUI, is there a way to do this by creating a stored procedure with the lookup logic and passing the values with the dbxquery command?
This related question referred to an older version of DBConnect.
... View more
10-09-2017
08:50 AM
How would you replicate the kvstore to the indexers? When I run the command .... |lookup kvstore_lookup... the search simply hangs. I only get results when I add local=true to the lookup command. (performing search from a search-head)
... View more
06-03-2017
10:29 PM
Still seeing this problem in 6.5.3 but not for all saved searches. Click on Run for a saved search in a hidden app and get the 404.
... View more
12-14-2015
06:57 AM
I second this. Worries are abound. We just had a DNS server crash and splunk-regmon was using almost 4GB of virtual memory.....
... View more
