Hi there, I installed SA-ldapsearch as decsribed in the docs on the search head in my distributed environment. When I run a simple ldapsearch, everything works just fine. Now I want to query stuff from my indexers and feed the results into ldapfetch (idea: find windows groups in a log and use ldapfetch to find the members of that group). Search head and indexers run on different machines. I get the following errors from my indexers: [map]: [PRDS0052] External search command 'ldapfetch' returned error code 1. Script output = " ERROR The default configuration stanza for ldap.conf is missing. " [map]: [PRDS0053] External search command 'ldapfetch' returned error code 1. Script output = " ERROR The default configuration stanza for ldap.conf is missing. " How can I prevent the ldap command from run on the indexers? For the lookup command, there is a "local" attribute. I cannot find sth like that in ldapfetch. Any idea? Best, Bernd ... View more

Hi there, I'm reading events from an MS SQL database using output.format=mkv. Unfortunately field extraction does not work coorectly as some values are truncated at white spaces. Sample event: 2014-11-27 13:05:08 ERROR_CATEGORY_ID=1 ERROR_CATEGORY_CODE=acc_score_call ERROR_CATEGORY_DESCRIPTION=Account Score WebService Call ERROR_TIME=1417089908.600 ERROR_NUMBER=500 ERROR_MESSAGE=CIS SSL connection timeout ERROR_PROCEDURE= EXECUTION_CONTEXT= ERROR_SEVERITY=1 ERROR_STATE= ERROR_LINE= DATE_CREATED=1417090213.657 Field extraction extracts for ERROR_MESSAGE and ERROR_CATEGORY_DESCRIPTION the following values: ERROR_MESSAGE CIS ERROR_CATEGORY_DESCRIPTION Account As you can see, the value is truncated at the first blank. How can we fix this? We notice this behaviour with dbx 1.1.3 as well as with 1.1.5. Thanks for your help. Regards, Bernd ... View more

Hi there, I'm trying to monitor log files in zip archives, that contain additional data files, which I mustn't monitor. How can a I specify whitelist/blacklist for files contained in a zip archive? I tried using whitelist in inputs.conf stanza, but that whitelist causes splunk to ignore the zip file completely. Any help appreciated. Regards, Bernd ... View more

Hi there, I'm reading files with fixed width fields into splunk. For extraction and masking of dedicated fields I need to adresse sth like "character 56 to 78". This generally works fine with regex. Unfortunately the file contains some special characters like german umlauts or null chars, which are escaped with \xDC or \x00. As the number of special chars varies from line to line this escape mechanism destroys the fixed width contraint. How can I prevent the escaping? Alternatively, how can I make splunk to do an escaping that maintains the fixed width constraint (that is, replace one char with exactly one other). It would be nice to avoid using a custom preprocessor. Regards, Bernd ... View more

Hi there, we have an issue regarding timestamps of events from cisco ISE. Events come via syslog/UDP in the following form: Jun 5 12:57:45 10.128.12.20 Jun 5 12:57:41 PRDO0001 CISE_Failed_Attempts 0000011272 1 0 2014-06-05 12:57:41.504 +01:00 0008339654 5400 NOTICE Failed-Attempt: Authentication failed, blabla blabla lots of other stuff The event timestamp that is extracted by splunk is Jun 5 12:57:45 - I guess that is the time the event was received via udp. The correct timestamp would be 2014-06-05 12:57:41.504 The ISE app delivers a props.conf with the following settings: [Cisco:ISE:Syslog] SHOULD_LINEMERGE = false DATETIME_CONFIG = /etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml TIME_PREFIX = \d\s\d\s TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N %Z and [syslog] TRANSFORMS-cisco-ise = cisco-ise-sourcetyper DATETIME_CONFIG = /etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml MAX_TIMESTAMP_LOOKAHEAD = 300 The XML-file contains this (no xml allowed here, so just parts of it): ;define name="_datetimeCiscoISE" extract="year, month, day, hour, minute, second, subsecond, zone"; !-- Target TimeFormat: 2014-01-09 22:33:35.123 +00:00 -- ;text;;![CDATA[(\d\d\d\d)-(\d\d)-(\d\d)\s(\d{2}):(\d{2}):(\d{2}).(\d{3})\s(\S+)\s]];;/text All of this is out-of-the-box ISE app stuff, we changed nothing there. So for me this looks like everything is configured the right way - nevertheless the timestamp is not extracted correctly. As I just understand about half of this config I would be very grateful for any help regarding this. Best, Bernd ... View more

Hi there, I struggled quite a time to make db-connect work with my splunk 6.0.3 installation. Error Message in dbx.log is attached. I solved the issue with replacing JRE8 with JRE7. I guess there is some issue with different encryption ciphers used in JRE7/8. As I couldn't find anything on this issue maybe this note is helpful to others. Regards, Bernd ..................... 2014-05-16 09:05:12.994 dbx5589:ERROR:DatabaseList - Error fetching database catalogs: java.sql.SQLException: Network error IOException: Connection reset java.sql.SQLException: Network error IOException: Connection reset at net.sourceforge.jtds.jdbc.ConnectionJDBC2.<init>(ConnectionJDBC2.java:417) at net.sourceforge.jtds.jdbc.ConnectionJDBC3.<init>(ConnectionJDBC3.java:50) at net.sourceforge.jtds.jdbc.Driver.connect(Driver.java:185) at java.sql.DriverManager.getConnection(Unknown Source) at java.sql.DriverManager.getConnection(Unknown Source) at com.splunk.dbx.sql.type.impl.AbstractDatabaseType.connect(AbstractDatabaseType.java:138) at com.splunk.dbx.sql.type.impl.MicrosoftSqlServer.connect(MicrosoftSqlServer.java:85) at com.splunk.dbx.sql.type.impl.AbstractJtdsDatabaseType.listCatalogs(AbstractJtdsDatabaseType.java:48) at com.splunk.dbx.info.DatabaseList.invoke(DatabaseList.java:34) at com.splunk.bridge.session.BridgeSession.call(BridgeSession.java:92) at com.splunk.bridge.session.BridgeSession.call(BridgeSession.java:30) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang.Thread.run(Unknown Source) Caused by: java.net.SocketException: Connection reset at java.net.SocketInputStream.read(Unknown Source) at java.net.SocketInputStream.read(Unknown Source) at net.sourceforge.jtds.ssl.TdsTlsInputStream.readFully(TdsTlsInputStream.java:131) at net.sourceforge.jtds.ssl.TdsTlsInputStream.primeBuffer(TdsTlsInputStream.java:100) at net.sourceforge.jtds.ssl.TdsTlsInputStream.read(TdsTlsInputStream.java:78) at sun.security.ssl.InputRecord.readFully(Unknown Source) at sun.security.ssl.InputRecord.read(Unknown Source) at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at net.sourceforge.jtds.ssl.SocketFactories$TdsTlsSocketFactory.createSocket(SocketFactories.java:101) at net.sourceforge.jtds.jdbc.SharedSocket.enableEncryption(SharedSocket.java:346) at net.sourceforge.jtds.jdbc.TdsCore.negotiateSSL(TdsCore.java:548) at net.sourceforge.jtds.jdbc.ConnectionJDBC2.<init>(ConnectionJDBC2.java:346) ... 14 more 2014-05-16 09:05:13.010 dbx5589:INFO:BridgeSession - Caught Exit exception: JavaBridgeExitException{status=-1} 2014-05-16 09:05:13.010 dbx5589:INFO:BridgeSession - Execution finished in duration=341388 ms with status=-1 ... View more

Hi there, I'm trying to monitor the output of a batch job with splunk. The problem is that logging is poorly implemented and I need some sophisticated splunk (?) to meet my requirements. The job writes errors to a log file. Together with the error message it states the line of the input file where the error occured. The input file can be splunked as well. To be able to handle the error the guys in business department need the error message as well as the corresponding line in the input file. I can extract the message with the line number from the job's log file. How can I extract the correct line from the input file? So far I tried to parse each line of the input file as a different event and getting the nth one using streamstats. Unfortunately the result stream doesnt maintain the correct order of the lines. Any ideas about how I could extract the nth line of the file? Regards, Bernd ... View more