About bharrell

bharrell · ‎08-31-2022

I have a sourcetype which contains raw SNMP data which looks like this (port definitions for network switches): timestamp=1661975375 IF-MIB::ifAlias.1 = "ServerA Port 1" timestamp=1661975375 IF-MIB::ifDescr.1 = "Unit: 1 Slot: 0 Port: 1 Gigabit - Level" timestamp=1661975375 IF-MIB::ifAlias.53 = "ServerA Port 2" timestamp=1661975375 IF-MIB::ifDescr.53 = "Unit: 2 Slot: 0 Port: 1 Gigabit - Level" timestamp=1661971775 IF-MIB::ifAlias.626 = "ServerA LAG" timestamp=1661971775 IF-MIB::ifDescr.626 = " Link Aggregate 1" I want to generate fields when this data is ingested into Splunk. I do not want to do this during search. (So probably using transforms.conf and regex). I think there’s ways to do this with Python as well, but I don’t have the experience or time to go down that path. The result of the above 6 rows of example data would have the following fields for each line respectively: Alias=1, Description=”ServerA Port 1” Alias=1, Unit=1, Port=1 Alias=53, Description=”ServerA Port 2” Alias=53, Unit=2, Port=1 Alias=626, Description=”ServerA LAG” Alias=626, Lag=1 I can build field extractions or a manual regex to do one of these lines individually, but not all together. I also wonder if pure regex is the way to go here as it seems like it would take many "steps" with this many parameters. Would really appreciate the help from someone with the knowledge and experience of using transforms to get this done. 🙂 Thank you in advance for solutions or recommendations.

bharrell · ‎07-31-2020

I would also like to know what's recommended. Are people really installing Splunk Universal Forwarder on every endpoint? Thanks.

bharrell · ‎09-12-2017

Ran into this error today. In my case, I had the CSV file open in Excel - causing a write lock.

bharrell · ‎06-15-2016

Thank you for the responses - The root problem here was that Splunk Light Trial does not automatically turn into Splunk Free. So when the trial on Splunk Light ends, it basically goes into non-compliance and locks itself out. So it is an overage - but the limit is 0 - so after any data comes in - lockdown mode. The only way to fix this is to wait 30 days (I think it's that long) - or contact support and get a reset-license-violation license key. They provided this to me. Then I had to run this at the command line to get Splunk into free mode: (for Windows I had to first CD to C:\Program Files\Splunk\bin) splunk edit licenser-groups Lite_Free -is_active 1 Not a straightforward process - but they were nice enough to help me get the free version running. You would think there would a a button on the license page to simply fix this. But since it's free I won't complain! I appreciate having this powerful tool for free.

bharrell · ‎06-02-2016

It won't let me post screenshots here - I'm out of Karma for the day... and I can't paste the text output because it's too long. Is there not a better place we can chat back and forth?

bharrell · ‎06-02-2016

I did download and install the latest version yesterday after the license didn't work. It made no difference. All I know is that In my environment, I followed the instructions, did a straightforward install of SplunkLight, used it successfully, the trial expired, and attempted to convert to free mode... and it does not work because of a license error. Seems like a license error should be pretty easy to diagnose/repair.

bharrell · ‎06-02-2016

I have screenshots to share- but I'm apparently only allowed 2 posts per day. This is ridiculous. What upgrade option? You mean not free? I'm still considering it when my trial ran out. I was under the impression that Splunk was free for a very small environment - like mine. It's a bit concerning that right out of the gate it flat out doesn't work.

bharrell · ‎06-02-2016

Thanks. Narrowing it down to 1 log file vs. a directory full of log files is helpful. There are very few ERROR matches - none with anything close to "internal" nearby. Here are all the entries from the splunkd.log file today: 06-02-2016 00:00:00.287 -0500 INFO LMStackMgr - should rollover=true because _lastRolloverTime=1464757200 lastRolloverDay=1464757200 snappedNow=1464843600 06-02-2016 00:00:00.287 -0500 INFO LMStackMgr - finished rollover, new lastRolloverTime=1464843600 06-02-2016 00:00:28.287 -0500 INFO LMSlaveInfo - Detected that masterTimeFromSlave(Wed Jun 01 23:59:28 2016) < lastRolloverTime(Thu Jun 02 00:00:00 2016), meaning that the master has already rolled over. Ignore slave persisted usage. 06-02-2016 00:16:07.602 -0500 INFO WatchedFile - Will begin reading at offset=0 for file='C:\Program Files\Splunk\var\log\splunk\audit.log'. 06-02-2016 03:15:58.350 -0500 INFO BucketMover - will attempt to freeze: candidate='C:\Program Files\Splunk\var\lib\splunk\_introspection\db\db_1463645744_1463042039_3' because frozenTimePeriodInSecs=1209600 is exceeded by the difference between now=1464855358 and latest=1463645744 06-02-2016 03:15:58.366 -0500 INFO DatabaseDirectoryManager - idx=_introspection Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_introspection\db', pendingBucketUpdates=0 . Reason='Removing bucket, bid=_introspection~3~7DC151F2-F7FF-4C9F-9D41-FF45B6DA353D' 06-02-2016 03:15:58.491 -0500 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='C:\Program Files\Splunk\var\lib\splunk\_introspection\db\db_1463645744_1463042039_3' 06-02-2016 03:15:59.288 -0500 INFO DatabaseDirectoryManager - idx=_introspection Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_introspection\db', pendingBucketUpdates=0 . Reason=' frozen_buckets' 06-02-2016 06:59:42.116 -0500 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='C:\Program Files\Splunk\var\log\splunk\metrics.log'. 06-02-2016 06:59:42.116 -0500 INFO WatchedFile - Will begin reading at offset=0 for file='C:\Program Files\Splunk\var\log\splunk\metrics.log'. 06-02-2016 06:59:42.163 -0500 INFO WatchedFile - Will begin reading at offset=24991320 for file='C:\Program Files\Splunk\var\log\splunk\metrics.log.1'.

bharrell · ‎06-02-2016

Thanks. My searches show a handful of errors in a few different log files. However, they are all before this licensing problem, and seem unrelated to licensing. So - I don't see any errors in any log files that seem related to licensing. Is there a particular log file that would be helpful to analyze?

bharrell · ‎06-02-2016

I need to keep this thread alive! I really want to get Splunk working again. If anyone has any suggestions I would greatly appreciate it!!

bharrell · ‎06-01-2016

How do I check for errors in the Windows version?

bharrell · ‎06-01-2016

Thanks for the responses. I did restart Splunk after switching to free mode. I also rebooted the server for good measure (twice!) I am running on Windows. But here are the outputs of the commands from the CLI: splunk list licenser-groups Enterprise is_active:0 stack_ids: Forwarder is_active:0 stack_ids: forwarder Free is_active:0 stack_ids: free Lite is_active:0 stack_ids: lite Lite_Free is_active:1 stack_ids: lite_free splunk list licenser-pools auto_generated_pool_forwarder description:auto_generated_pool_forwarder effective_quota:1048576 quota:MAX slaves: stack_id:forwarder used_bytes:0 auto_generated_pool_free description:auto_generated_pool_free effective_quota:524288000 quota:MAX slaves: stack_id:free used_bytes:0 auto_generated_pool_lite description:auto_generated_pool_lite effective_quota:0 quota:MAX slaves: stack_id:lite used_bytes:0 auto_generated_pool_lite_free description:auto_generated_pool_lite_free effective_quota:511705088 quota:MAX slaves: stack_id:lite_free used_bytes:49634610 In regards to the error log, what is the best way to review this in Windows?

bharrell · ‎05-31-2016

I was using SplunkLight in trial mode and the license expired. I'm only collecting syslog from a few small devices well under <100MB/day. So we're talking a very small environment here. I received a message upon logon that the license expired. I clicked a message to convert to free mode, and now I seem to be locked out of any searches because of license violations. I don't understand the license violation because the free version has 500MB/day - and I'm a fraction of that. Here's a screenshot of the licensing page. How do I fix this? Thanks in advance.

bharrell · ‎04-29-2016

I have a simple table showing the dropped links on my switches: this is generated by the following search: DellEvent="Link Down:*" | table DellEvent host Now I want to show the top links that are down, which I can do with either of these searches: DellEvent="Link Down:*" | top DellEvent DellEvent="Link Down:*" | table DellEvent host | top DellEvent Which provides this table: But I have a problem that I can't see the host. I need to learn how to add additional fields to the chart. I've tried these searches (plus many more) and none of these provide me with what I need: DellEvent="Link Down:*" | table DellEvent host | stats count by DellEvent DellEvent="Link Down:*" | stats count by DellEvent DellEvent="Link Down:*"| table DellEvent host | top DellEvent I would like to know how to add the host field onto this chart. 1. One solution would be to concatenate the host with the event, and then simply count by that concatenated field. Can someone please provide a sample search that would concatenate these two fields and then count each values? 2. I would also like a non-concatenated solution. Is there a way to include the host field in the information when I hover the mouse over the bar? Hovering currently displays the fields DellEvent and count as seen in the screenshot. I'm brand new to Splunk and appreciate the help. 3. Is there an online cookbook of Splunk queries with numerous examples? I have a similar book for SQL queries that I can't live without! So far I have not found a great online Splunk query resource in an example-based format. Thanks.

bharrell · ‎04-27-2016

Thanks. This looks like exactly what I need. Before I posted this I did numerous searches for this info and couldn't find it. There was plenty of very confusing info about conf file precedence though! Any links that explain the configuration of the forwarder in simple examples would also be appreciated.

bharrell · ‎04-27-2016

Brand new to Splunk. Installed the universal forwarder on a Windows Server and see the logs populating on my Splunk Light server. I want to re-configure the forwarder to not include performance monitoring (which I selected on install.) Where is the conf file that I need to edit? I see documentation that points to conf files located here: C:\Program Files\SplunkUniversalForwarder\etc\system\local But I don't see any data relating to which logs and performance monitoring is being forwarded here.

Posts	16
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎04-27-2016

Online Status	Offline
Date Last Visited	‎02-02-2023 12:53 PM

Should I use Custom transform or RegEx for my sear...

License Expired

How do I add additional fields to my table?

What configuration file do I need to edit on a Win...

Should I use Custom transform or RegEx for my sear...

Re: Forwarding logs from Windows Event Collector

Re: 'outputlookup' command: Could not write to fil...

Re: License Expired

Re: License Expired

Re: License Expired

Re: License Expired

Re: License Expired

Re: License Expired

Re: License Expired

Re: License Expired

Re: License Expired

License Expired

How do I add additional fields to my table?

Re: What configuration file do I need to edit on a...

What configuration file do I need to edit on a Win...