Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About guimilare
guimilare
Communicator
Member since:
07-24-2015
06-05-2020
Community Statistics
| Posts | 87 |
| Solutions | 6 |
| Karma Given | 2 |
| Karma Received | 21 |
| Member Since | 07-24-2015 |
Activity Feed
- Got Karma for Is it possible to drilldown from an Status Indicator icon?. 11-18-2020 10:24 PM
- Karma Re: Outliers Viz not loading for niketn. 06-05-2020 12:49 AM
- Got Karma for Is it possible to do a lookup based on IF statement?. 06-05-2020 12:49 AM
- Got Karma for Re: KV Store failing at SHC. 06-05-2020 12:48 AM
- Got Karma for KV Store failing at SHC. 06-05-2020 12:48 AM
- Got Karma for KV Store failing at SHC. 06-05-2020 12:48 AM
- Got Karma for Re: Forwarder Management not listing all clients. 06-05-2020 12:48 AM
- Got Karma for Image Overlay with Icons based on value. 06-05-2020 12:48 AM
- Got Karma for After upgrading Search Head Cluster from 6.3.1 to 6.5.1, how do I resolve multiple "No such file or directory" errors?. 06-05-2020 12:48 AM
- Got Karma for After upgrading Search Head Cluster from 6.3.1 to 6.5.1, how do I resolve multiple "No such file or directory" errors?. 06-05-2020 12:48 AM
- Got Karma for Re: How to index a SOAP response using REST API Modular Input?. 06-05-2020 12:48 AM
- Got Karma for Re: How to change Status Indicator size. 06-05-2020 12:48 AM
- Karma Re: Error in SunOS : SUNW_1.22.6 not found for yannK. 06-05-2020 12:47 AM
- Got Karma for How to customize bar chart colors based on the values?. 06-05-2020 12:47 AM
- Got Karma for Re: LDAP authentication not working on Splunk version 6.3.1. 06-05-2020 12:47 AM
- Got Karma for LDAP authentication not working on Splunk version 6.3.1. 06-05-2020 12:47 AM
- Got Karma for Splunk DB Connect 2: Why am I getting error "Cannot get a connection, pool error Timeout waiting for idle object"?. 06-05-2020 12:47 AM
- Got Karma for How to customize bar chart colors based on the values?. 06-05-2020 12:47 AM
- Got Karma for How to extract fields from a JSON file from Google Analytics API using spath or other options?. 06-05-2020 12:47 AM
- Got Karma for Splunk DB Connect 2: Why am I getting error "Cannot get a connection, pool error Timeout waiting for idle object"?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 0 |
08-28-2018
07:39 AM
Hello Splunkers.
Today I saw a curious issue after receiveing a splunk alert os low disk space (lower than 10%).
In the Monitoring console, I can see why the alert was fired:
However, when I go to SSH and do a df -h , this is the result I get:
This would give a 20% free space in disk and the alarm would not be fired.
Any thoughts why this difference between Monitoring Console and SSH is happening?
regards,
GMA
... View more
08-21-2018
11:33 AM
I ended up creating a shell script that creates a dump from IdM and it is indexed in Splunk.
For my needs, it worked.
... View more
08-21-2018
11:29 AM
Hi, niketnilay,
after upgrading splunk to version 7.1, I was able to use Outliers Chart .
Thanks.
... View more
08-21-2018
11:25 AM
So, here is the roadmap to correctly install cx_Oracle:
The first task is installing the Oracle client.
It is important that the client version is 11.2.
In higher versions, the cx_Oracle connector does not work correctly.
1) From the http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html page, download the following executables:
instantclient-basic-linux.x64-11.2.0.4.0.zip
instantclient-sqlplus-linux.x64-11.2.0.4.0.zip
instantclient-sdk-linux.x64-11.2.0.4.0.zip
2) In the /opt/splunk folder, unzip the files
3) Configure oracle env:
vim /etc/profile.d/oracle.sh
#! / bin / bash
LD_LIBRARY_PATH = "/usr/lib/oracle/11.2/client64/lib:${LD_LIBRARY_PATH}"
export LD_LIBRARY_PATH
TNS_ADMIN = "/etc/oracle"
export TNS_ADMIN
ORACLE_HOME = "/usr/lib oracle/11.2/client64/lib"
export ORACLE_HOME
4) Environment variables:
source /etc/profile.d/oracle.sh
5) Copy or create the tnsnames.ora:
touch /etc/oracle/tnsnames.ora
6) Create symbolic link to ORACLE_HOME to avoid the "can not locate Oracle include files" error:
mkdir /usr/lib/oracle/11.2/client64/lib/sdk
ln -s /usr/include/oracle/11.2/client64 /usr/lib/oracle/11.2/client64/lib/sdk/include
The next step is to install the cx_Oracle connector.
Download cx_Oracle version 5.1.2 from https://sourceforge.net/projects/cx-oracle/files/5.1.2/cx_Oracle-5.1.2-11g-py26-1.x86_64.rpm/download and install the RPM.
It is possible that when importing the cx_Oracle library, the following error occurs:
Traceback (most recent call last):
import cx_Oracle
ImportError: libclntsh.so.11.1: Can not open shared object file: No such file or directory
To bypass this, create the following symbolic links (the paths to the files may change depending on the environment and where the files were extracted. Run find / -name lib * .so * to find the correct path):
/usr/lib64/libclntsh.so.11.1 → /usr/lib/oracle/11.2/client64/lib/libclntsh.so.11.1
/usr/lib64/libnnz11.so → /usr/lib/oracle/11.2/client64/lib/libnnz11.so
/usr/lib64/libocci.so.11.1 → /usr/lib/oracle/11.2/client64/lib/libocci.so.11.1
/usr/lib64/libociei.so → /usr/lib/oracle/11.2/client64/lib/libociei.so
/usr/lib64/libsqlplusic.so → /usr/lib/oracle/11.2/client64/lib/libsqlplusic.so
/usr/lib64/libsqlplus.so → /usr/lib/oracle/11.2/client64/lib/libsqlplus.so
Now the environment is ready. To test, simply execute the commands below:
[splunk @ splunktest-01 ~] $ python
Python 2.6.6 (r266: 84292, Sep 4 2013, 07:46:00)
[GCC 4.4.7 20120313 (Red Hat 4.4.7-3)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import cx_Oracle
>>>
If no error are displayed, the environment is correctly set up.
... View more
06-07-2018
08:14 AM
Hello Splunkers.
I have a data model that contains a multi value field, called acao.
Looking at the data model, I have the following:
When I run the following query: | tstats count(DM.acao) from datamodel="My_DataModel" , the result is 2.
However, I want it to count all occurrences, resulting in 8 (1 P and 7 X's).
How can I do this?
Thanks.
Best Regards,
GMA
... View more
06-06-2018
08:09 AM
Hi niketnilay,
Yes, I've done it already, but no luck.
Actually, the viz only works inside the Showcase dashboard.
If click "Open in Search", the viz fails to load.
... View more
05-23-2018
06:29 AM
Hello Splunkers.
I've downloaded the Splunk Machine Learning Toolkit.
In Detect Numeric Outliers Showcase, I can successfully create a search, detect the outliers and see the "Data and outliers" graph.
However, when I try to do this in another dashboard (or even inside the Search dashboard in the Machine Learning App), I get the following error:
Failed to load source for Outliers Chart visualization.
Any ideas why I can't load the viz?
Regards, GMA
... View more
04-19-2018
07:46 AM
Hello Splunkers.
I wrote two python scripts to use in my environment as scripted-lookups: one of them makes a query in an Oracle database, while the other do some math checks.
The second works perfectly, but not the first.
I noticed that the problem with the first script resides on cx_Oracle module.
When I run my script with pure python, I can import the module:
When I run with the splunk python, I get the following error:
Has anyone ever experienced this?
Can you tell me step by step how to get around this problem?
Thanks in advance!
Regards, GMA
... View more
02-07-2018
10:51 AM
Hello Splunkers.
I have an Indexer Clusters with 2 members (IDX1 and IDX2).
We need to add another 2 indexers to the cluster.
The Indexer Cluster is in version 6.5.0.
The are 2 other machines (they will be IDX3 and IDX4) running the same splunk version, but their Trial License expired a long time ago and were never added to Indexer Cluster or set as Slave License servers.
I've changed the license on IDX3 and IDX4 to Free License and restarted splunkd.
But when trying to configure IDX3 and IDX4 to be slaves of a Master License, I get the following message:
Bad Request - editTracker failed, reason=WARN: path=/masterlm/usage: Signature mismatch between license slave=XX.XXX.XXX.XXX and this License Master. Please make sure that the pass4SymmKey setting in server.conf, under [general], is the same for the License Master and all its slaves from ip=XX.XXX.XXX.XXX
I've copied the pass4SymmKey from Master License to IDX3 and IDX4 but no luck.
Any ideas what I can do?
Or should I reinstall Splunk on these machines?
Regards,
GMA
... View more
01-31-2018
10:43 AM
Thanks elliotproebstel!
There was an error in my python script.
Everything is working now!
... View more
01-31-2018
10:42 AM
Thanks niketnilay.
What I needed was to verify the last digit based on the 11 digits before.
However, this is a great solution to validate numbers.
... View more
01-31-2018
08:06 AM
Hi elliotproebstel,
I'm trying to do as sugested (and it really seems the right direction), but was unable to do so.
I wrote a script in python to receive the number and return the validation.
In CLI, it works:
/opt/splunk/bin/python ver_check_digit.py 1644432
cardid,status
1644432,False
However, when I run the search in SH, I get the following error:
Script for lookup table 'ver_check_digit' returned error code 1. Results my be incorrect.
Here is my python script:
#!/usr/bin/env python
import csv
import sys
import socket
def ver_check_digit(value):
int_value = int(value)
str_value = str(int_value)
count = 1
total_sum = 0
while count < len(str_value):
count = count + 1
extracted_digit = str_value[-count]
extracted_digit = int(extracted_digit)
if count % 2 == 0:
extracted_digit = extracted_digit * 2
if extracted_digit > 9:
extracted_digit = extracted_digit - 9
total_sum = total_sum + extracted_digit
check_digit = (total_sum * 9) % 10
if str(check_digit) == str_value[-1]:
return True
else:
return False
def main():
cardidfield = sys.argv[1]
status = ver_check_digit(cardidfield)
myList = [cardidfield,status]
myString = ",".join(map(str, myList))
print "cardid,status"
print myString
main()
Any ideas why this is happening?
... View more
01-29-2018
07:49 AM
Hello Splunkers.
Can a dashboard run a python script?
My scenario is: the user have a text input field to write a 12 digit number.
The last digit is a check-digit, and it assures that the user will perform a search on a valid 12 digit number.
However, the only way I can check the number is by a python script.
The script receives the number, does so maths to garantee that the number is correct and returns True or False.
So, what I need is: when the user inserts the number in the text input field and click on "Submit", the python script receives the number and return True or False so I can work with the number in the searches.
Is it feasible?
Thanks in advance.
Regards, GMA
... View more
- Tags:
- splunk-enterprise
01-24-2018
09:54 AM
Thanks! Exactly what I needed!
... View more
01-24-2018
08:52 AM
I'll use a second field called "Action" (that's a code, and can be multivalue) and get the action description using the lookup.
Both S and A actionTypes have similar codes (e.g: A1, A2, A3). That's why I need to separate the lookups.
... View more
01-24-2018
08:43 AM
1 Karma
Hello Splunkers,
here is my scenario:
I have a field actionType that can assume two values: "S" or "A".
Based on actionType value, I need to do a lookup in different lookup tables.
For example, if actionType is "S", I have to do a lookup with S_actions.csv table; if it is "A", I have to do a lookup with A_actions.csv table.
My first idea was using an if statement, but I was unable to do so.
Any Ideas?
Thank in advance!
... View more
- Tags:
- splunk-enterprise
07-04-2017
08:07 AM
1 Karma
Fixed it.
The UF certificate was expired.
When upgrading the UF I received the following messages:
_It seems that the Splunk default certificates are being used. If certificate validation is turned on using the default certificates (not-recommended), this may result in loss of communication in mixed-version Splunk environments after upgrade.
"/opt/splunkforwarder/etc/auth/ca.pem": certificate renewed
"/opt/splunkforwarder/etc/auth/cacert.pem": certificate renewed
"/opt/splunkforwarder/etc/auth/server.pem": certificate renewed_
After that, the clients were listed again in the Forwarder Management.
... View more
06-29-2017
01:31 PM
1 Karma
06-29-2017 18:00:07.014 +0000 ERROR KVStoreBulletinBoardManager - KV Store changed status to failed. Failed to establish communication with KVStore. See splunkd.log for details.
06-29-2017 18:06:04.242 +0000 WARN SHPConfReplicationBookmarkFromKVStore - writeSHCStateToStateStore: failed to write SHC state to KVstore:
... View more
06-29-2017
11:31 AM
This is the result:
$ splunk btool deploymentclient list --debug
/opt/splunkforwarder/etc/system/local/deploymentclient.conf [target-broker:deploymentServer]
/opt/splunkforwarder/etc/system/local/deploymentclient.conf targetUri = 10.217.XX.XXX:8089
The IP is correct, this is the DS IP.
... View more
06-29-2017
11:19 AM
Yes, I can telnet from UF to DS on port 8089
... View more
06-29-2017
11:05 AM
The hosts that are not listed in Forwarder Management, the result I get from the search index=_internal HttpPubSubConnection is:
06-29-2017 18:01:00.075 +0000 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr: 06-29-2017
18:01:00.075 +0000 INFO > HttpPubSubConnection - Could not obtain connection, will retry after=79 seconds.
... View more
06-29-2017
07:18 AM
2 Karma
Hi all.
We are running an environment with a SHC.
After upgrading to v6.6.1, the SH started showing the following message:
"KV Store changed status to failed. Failed to establish communication with KVStore. See splunkd.log for details."
Any ideas what may be the problem?
regards,
GMA
... View more
06-29-2017
06:52 AM
Hello splunkers.
We have about 50 clients registered at our Forwarder Management.
However, since a couple days ago, only 18 of them are listed in the Forwarder Management.
The command $SPLUNK_HOME/bin/splunk list deploy-clients return the same 18 clients.
However, I can see data from the other 32 forwarders beeing indexed at Splunk.
As a test, I ran the following command $SPLUNK_HOME/bin/splunk set deploy-poll IP:8089 -auth user:passwd in one of the clients that is not listed in Forwarder Management, received the the Configuration updated message and restarted it.
However, the client is still not listed on Forwarder Management, and I need to push new apps to it.
Any ideas?
Regards,
GMA
... View more
03-30-2017
11:46 AM
Hi somesoni2, it worked perfectly!! Thank you very much!
Our team is evaluating both event breaking methods to determinate wich on of them will give us simpler SPL searches.
Thank you both somesoni2 and cpetterborg for your answers! They helped a lot!
... View more
03-30-2017
10:32 AM
That's correct
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
