Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Esky73
Esky73
Builder
Member since:
05-16-2016
Online
Community Statistics
| Posts | 176 |
| Solutions | 6 |
| Karma Given | 58 |
| Karma Received | 22 |
| Member Since | 05-16-2016 |
Activity Feed
- Posted Re: Edit CSV file sent through sendemail command on Splunk Search. 02-26-2024 07:52 PM
- Posted Re: Why doesn't my Ingest Action work? on Getting Data In. 02-25-2024 03:45 PM
- Posted Re: ingest_eval lookup not working on Getting Data In. 02-13-2024 10:10 PM
- Posted Re: Live data from Appdynamics to splunk on Splunk IT Service Intelligence. 02-09-2024 10:58 PM
- Posted Creating a line graph with positive and negative values in line graph at right angles (not connecting at angles) on Dashboards & Visualizations. 11-21-2023 08:46 PM
- Tagged Creating a line graph with positive and negative values in line graph at right angles (not connecting at angles) on Dashboards & Visualizations. 11-21-2023 08:46 PM
- Posted Adding input via URL link to ITSI Infrastructure Overview dimension search on Splunk IT Service Intelligence. 11-01-2023 07:01 PM
- Got Karma for Re: How would I build a table of all metrics and their dimensions in splunk. 08-21-2023 09:40 PM
- Posted PSConsole error running powershell script from TA-Exchange-Mailbox bin directory on All Apps and Add-ons. 07-27-2023 09:31 PM
- Posted Help with Logic when a multivalue field appears: How to utilise lookup? on Splunk Search. 05-18-2022 07:04 AM
- Karma Re: list of adhoc kpis via REST ? for shandr. 04-11-2022 09:58 PM
- Posted Re: Cyberark Logs - Line Breaking doesn't work on All Apps and Add-ons. 05-03-2021 06:12 PM
- Karma Re: How to check if an HEC is up or not before posting any data to it? for spavin. 04-29-2021 06:01 PM
- Posted Re: Is it possible to use wildcards in sourcetype props.conf stanzas on Getting Data In. 04-26-2021 04:45 PM
- Karma Re: Tricky behavior of escaping backslash in regex for FrankVl. 04-15-2021 08:31 PM
- Posted Where can I find a list of adhoc kpis via REST ? on Splunk IT Service Intelligence. 04-06-2021 04:40 AM
- Posted syslog events not sent to Splunk on All Apps and Add-ons. 01-28-2021 05:40 AM
- Posted Re: db_connect : SQL explorer runs query OK - however creating input fails with error on All Apps and Add-ons. 08-03-2020 10:00 PM
- Posted db_connect : SQL explorer runs query OK - however creating input fails with error on All Apps and Add-ons. 08-03-2020 09:05 PM
- Posted Re: Trouble to Create New Input in DB Connect for stored procedure using temp table. MS SQL Server on All Apps and Add-ons. 07-29-2020 06:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-26-2024
07:52 PM
Came looking for an answer to this as well - seems there has been an idea for this for some time now .. https://ideas.splunk.com/ideas/EID-I-717
... View more
02-25-2024
03:45 PM
Do you need to deploy to indexers (as well) ? when there is an intermediary HF ? All my config is on a HF
... View more
02-09-2024
10:58 PM
Why specifically in CSV format? You can bring appdynamics data into splunk with the splunk addon for appdynamics. And add the itsi content pack for APM to give you kpis and services Details here: https://docs.splunk.com/Documentation/CPAPM/1.1.0/CP/About
... View more
11-21-2023
08:46 PM
25/10/2023 6000 31/10/2023 0 6/11/2023 2500 6/11/2023 500 12/11/2023 -7800 16/11/2023 500 i have a table and i'm trying to create a line chart that starts at 6000, then has a straight line until it hits the date 6/11/2023 at which point it adds a line 90 degrees and goes up to 8500 and so on .. going up at 90 degrees and down at 90 degrees for the negative values keeping the current total thanks,
... View more
- Tags:
- timeline
11-01-2023
07:01 PM
Hi All .. is there a way to add dimensions to the URL that posts into the "Search Entity Dimensions" search in the ITSI Infrastructure Overview dashboard? eg : "service_name" and "department" Ideally want to link from a dashboard into a Focused by dimensions list of entities for example: https://itsi-blah.splunkcloud.com/en-GB/app/itsi/entity_overview?countPerPage=20&earlie[…]w&page=1&refreshInterval=-1&sortTypeBy=entities_count... & <my dimensions>
... View more
Labels
07-27-2023
09:31 PM
Seeing the following error when running powershell script both manually and as splunk shown below - anyone got any pointers please? All the scripts in the TA fail in this manner c:\Program Files\SplunkUniversalForwarder\bin>splunk cmd "c:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-Mailbox\bin\exchangepowershell.cmd" v15 get-databasestats_2013.ps1
-PSConsoleFile : The term '-PSConsoleFile' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ -PSConsoleFile \bin\exshell.psc1 -command . 'c:\Program Files\SplunkU ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (-PSConsoleFile:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
... View more
- Tags:
- TA-Exchange-Mailbox
Labels
- Labels:
-
administration
05-18-2022
07:04 AM
I have some events coming in that use a lookup to resolve to an action eg :
Block,block,not sent = blocked
tagged, delivered, logged = delivered
Occasionally a multivalue field appears such as :
Tagged
Logged
OR
Tagged
Block
the Logic should be :
Tagged Logged = delivered
Tagged Block = Block
Trying to figure out how to add this logic to utilise the lookup.
Played around with nomv which creates a single value field but adds a \n so the value becomes : Tagged\nLogged
But then i need to do do a sedcmd to remove the \n and then add the result to the lookup to resolve the desired action.
Is there a better approach in this scenario ?
thx
... View more
- Tags:
- logic
- multivalue
Labels
- Labels:
-
field extraction
-
fields
05-03-2021
06:12 PM
did you ever fix this?
... View more
04-26-2021
04:45 PM
This is still working in 8.1x But also please vote for an official method for wildcarding sourcertypes : https://ideas.splunk.com/ideas/E-I-11
... View more
04-06-2021
04:40 AM
i can obtain my base search kpi's via the following rest search :
| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_base_search report_as=text
but is it possible to list any adhoc searches in itsi ?
... View more
Labels
- Labels:
-
using ITSI
01-28-2021
05:40 AM
trying out SC4S - not seeing my syslog come through to Splunk Installed all running docker - no firewalls or selinux syslog hitting server running sc4s : tcpdump -i eth0 dst port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:24:24.962899 IP x.x.x.x.bob.com.38897 > 197-202-166-108-dedicated.multacom.com.syslog: SYSLOG local0.warning, length: 273 docker seems to be running fine - i receive HEC TEST EVENT's and startup events in splunk : sc4s version=v1.47.3 sc4s logs : [root@bob system]# docker logs SC4S
'/etc/syslog-ng/local_config/destinations/README.md' -> '/etc/syslog-ng/conf.d/local/config/destinations/README.md'
'/etc/syslog-ng/local_config/filters/README.md' -> '/etc/syslog-ng/conf.d/local/config/filters/README.md'
'/etc/syslog-ng/local_config/filters/example.conf' -> '/etc/syslog-ng/conf.d/local/config/filters/example.conf'
'/etc/syslog-ng/local_config/log_paths/README.md' -> '/etc/syslog-ng/conf.d/local/config/log_paths/README.md'
'/etc/syslog-ng/local_config/log_paths/lp-example.conf.tmpl' -> '/etc/syslog-ng/conf.d/local/config/log_paths/lp-example.conf.tmpl'
'/etc/syslog-ng/local_config/sources/README.md' -> '/etc/syslog-ng/conf.d/local/config/sources/README.md'
SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful; checking indexes...
SC4S_ENV_CHECK_INDEX: Checking email {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epav {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epintel {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking epintelexit {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking fireeye {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking infraops {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking main {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netauth {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netdlp {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netdns {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netfw {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netids {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netipam {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netops {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netproxy {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking netwaf {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking osnix {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking oswin {"text":"Success","code":0}
SC4S_ENV_CHECK_INDEX: Checking oswinsec {"text":"Success","code":0}
syslog-ng checking config
sc4s version=v1.47.3
starting goss
starting syslog-ng
... View more
Labels
- Labels:
-
troubleshooting
08-03-2020
10:00 PM
I'll answer my own question which may help others seeing this error .. Note: Inputs only support SQL queries such as "select...from...where", not DDL such as "create table..."
... View more
08-03-2020
09:05 PM
i have a provided SQL query which runs fine in the data lab and SQL explorer and provides an output i want to use - however when i create the input the steps work up until the last point when to select "finish" the input then gives an error. There was an error processing your request. It has been logged (ID edb0cdb547c4f5d8). Looking at the _internal index the error is: 020-08-04 13:44:44.975 +1000 [dw-59 - POST /api/inputs] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: edb0cdb547c4f5d8
java.lang.RuntimeException: java.lang.NullPointerException
at com.splunk.dbx.server.util.ResultSetMetaDataUtil.isTableHavingSameNameColumns(ResultSetMetaDataUtil.java:117)
at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.create(InputServiceImpl.java:136)
at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.create(InputServiceImpl.java:38)
at com.splunk.dbx.server.api.resource.InputResource.createInput(InputResource.java:97)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161)
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102)
at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267)
at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
at org.glassfish.jersey.internal.Errors.process(Errors.java:267)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317)
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305)
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154)
at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:473)
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:427)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:388)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:341)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:228)
at io.dropwizard.jetty.NonblockingServletHolder.handle(NonblockingServletHolder.java:49)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1650)
at io.dropwizard.servlets.ThreadNameFilter.doFilter(ThreadNameFilter.java:34)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.handle(AllowedMethodsFilter.java:45)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.doFilter(AllowedMethodsFilter.java:39)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at com.splunk.dbx.server.api.filter.ResponseHeaderFilter.doFilter(ResponseHeaderFilter.java:30)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:241)
at io.dropwizard.jetty.RoutingHandler.handle(RoutingHandler.java:52)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:455)
at io.dropwizard.jetty.BiDiGzipHandler.handle(BiDiGzipHandler.java:68)
at org.eclipse.jetty.server.handler.RequestLogHandler.handle(RequestLogHandler.java:56)
at org.eclipse.jetty.server.handler.StatisticsHandler.handle(StatisticsHandler.java:169)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
at org.eclipse.jetty.server.Server.handle(Server.java:561)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:334)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:104)
at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:247)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:140)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:243)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:679)
at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:597)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.NullPointerException: null
at com.splunk.dbx.server.util.ResultSetMetaDataUtil.isTableHavingSameNameColumns(ResultSetMetaDataUtil.java:106)
... 67 common frames omitted
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
07-29-2020
06:37 AM
If the query is successful in SQL explorer - have you tried manually adding the query to the db_connect inputs.conf ? OK from the docs .. Note: Inputs only support SQL queries such as "select...from...where", not DDL such as "create table..." No DDL cmds
... View more
- Tags:
- ve you
03-19-2020
04:16 PM
... and doesn't work on metric indexes
but thx - worked for event idx's
... View more
03-18-2020
07:42 PM
2 Karma
try :
| mcatalog values(_dims) WHERE "index"="*" GROUPBY metric_name index host
| rename values(_dims) AS dimensions
| table metric_name dimensions index host
... View more
03-08-2020
07:20 AM
you timechart should work ok on the timeTaken field ?
| makeresults count=1
| eval data="2020-02-12 17:50:15.228 INFO 1 --- [io-8080-exec-45] c.m.v.c.RequestInterceptor : {\"logType\":\"RESPONS\",\"traceId\":\"03927a51-23d6-4530-a0e6-112b6d4b5539\",\"timestamp\":\"Feb 12, 2020 5:50:15 PM\",\"requestMethod\":\"GET\",\"requestUrl\":\"http://my.url\",\"responseStatus\":500,\"timeTaken\":28}\""
| rex field=data "^([^{]+)(?P<json>.+})\"$"
| spath input=json
... View more
11-24-2019
09:56 PM
I have installed ITSI on a standalone box (4.3.1) - which also installs SAI (+add-on)
I can discover a host and it appears in SAI using the discovery + deploy UF method - but that can't really be used for a deployment plan.
I've deployed a windows TA via the DS and the metrics are sent to the em_metrics index and i can search the metrics from the Metric browser (metric workspace \ Analyser) - but the host does not appear in SAI
Any Ideas ?
ta.
... View more
11-06-2019
10:29 PM
Error Scheduled Successful Failed FieldB FieldC FieldD
10 100 500 5 String String String
Desired output is above :
I would like a table showing a count of the statuses in Field A - as column headers (Errors, Successful, failed etc) inline with fields B > D
How to bring this together ?
i have tried with transpose=header_field=FieldA and also played with xyseries - but unsuccessful so far.
thx
... View more
- Tags:
- splunk-enterprise
10-30-2019
08:38 PM
1 Karma
nice work .. ahem .. .conf19 🙂
... View more
10-22-2019
03:20 PM
Thanks Jason
... View more
10-21-2019
06:22 PM
Does this pull the same metrics from Event hubs as Azure_monitor ?
Activity log, ?
Diagnostic ?
Metrics, ?
thanks.
... View more
Contact Me
| Online Status |
Online
|
| Date Last Visited |
an hour ago
|
Karma from
