Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dannyze
dannyze
Explorer
Member since:
06-30-2017
03-14-2023
Community Statistics
| Posts | 27 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 06-30-2017 |
Activity Feed
- Karma Re: What is the best and most efficient way to write alert for index with no events? for woodcock. 01-12-2021 05:51 PM
- Karma Re: help with using table and stats to produce query output for dwaddle. 12-09-2020 10:00 AM
- Posted Re: Python SDK Oneshot on Splunk Dev. 09-10-2020 04:42 PM
- Posted Re: Python SDK Oneshot on Splunk Dev. 08-31-2020 03:50 PM
- Posted Python SDK Oneshot on Splunk Dev. 08-30-2020 07:26 PM
- Posted Re: TIME_FORMAT in props is not working on Getting Data In. 07-27-2020 04:24 PM
- Karma Re: Question on matching event time and index time for richgalloway. 07-27-2020 10:58 AM
- Posted Question on matching event time and index time on Splunk Cloud Platform. 07-27-2020 10:18 AM
- Karma Re: What would be the right approach to rerurn results when a unique field value is seen with several if another field value? for xavierashe. 06-05-2020 12:51 AM
- Posted Re: Not being able to forward data from Windows UF to Splunkcloud on Deployment Architecture. 04-23-2020 09:59 PM
- Posted Not being able to forward data from Windows UF to Splunkcloud on Deployment Architecture. 04-23-2020 05:46 PM
- Tagged Not being able to forward data from Windows UF to Splunkcloud on Deployment Architecture. 04-23-2020 05:46 PM
- Tagged Not being able to forward data from Windows UF to Splunkcloud on Deployment Architecture. 04-23-2020 05:46 PM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf on Installation. 04-23-2020 03:50 PM
- Posted Re: What would be the right approach to rerurn results when a unique field value is seen with several if another field value? on Splunk Dev. 03-13-2020 02:44 PM
- Posted Re: What would be the right approach to rerurn results when a unique field value is seen with several if another field value? on Splunk Dev. 03-12-2020 03:44 PM
- Posted Re: What would be the right approach to rerurn results when a unique field value is seen with several if another field value? on Splunk Dev. 03-12-2020 11:00 AM
- Posted What would be the right approach to rerurn results when a unique field value is seen with several if another field value? on Splunk Dev. 03-11-2020 07:14 PM
- Tagged What would be the right approach to rerurn results when a unique field value is seen with several if another field value? on Splunk Dev. 03-11-2020 07:14 PM
- Posted Re: How would I go about having an alert fire at a given threshold ? on Alerting. 02-27-2020 11:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-10-2020
04:42 PM
Thank you going through the documentation it seems like this would be it. However I am not getting any output. Are there more details about this API that can help int his use case?
... View more
08-31-2020
03:50 PM
Thank you going through the documentation it seems like this would be it. However I am not getting any output. Are there more details about this API that can help here? The following is the snippet that would perform listing of the saved search password = knox_auth(SPLUNK_PASSWORD)
service = client.connect(host=HOST, port=PORT, username=USERNAME,
password=password, basic=True, app=APP)
# return service
# Retrieve a search
savedsearch = service.saved_searches["Saved Search"]
job = savedsearch.dispatch()
print(job.results()) Thank You
... View more
08-30-2020
07:26 PM
Working with the Python SDK, and my end goal is to fetch logs over a given time. For now I'm trying to output saved searches and then later will move on to the logs. Referencing the docs, this is close to what I want to do, minus the delete portion https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.5/client.html?highlight=saved%20searches#splunklib.client.SavedSearches Something like for saved_search in saved_searches.iter(pagesize=10):
print(saved_search) but not getting any output, any ideas on where to go? For clarity using the oneshot method, and want to output saved search results.
... View more
07-27-2020
04:24 PM
for reference, I put the props in UF and it is working fine now. Thanks Does this mean the directory of $SPLUNK_HOME/SplunkUniversalForwarder/default or something else?
... View more
07-27-2020
10:18 AM
Hi all, I am pulling events in alerts and seeing a gap between _time and _indextime. Around 535 seconds average difference. I have 2 questions 1) What is the best practice approach to match these field values to each other? So have the results of _time = _indextime 2) Is this time delay a sign of other things to investigate in the pipeline? Per this post https://community.splunk.com/t5/Getting-Data-In/Time-difference-practical-values-between-event-time-and-index/m-p/312606#M58588 this is a rather significant time difference.
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
04-23-2020
09:59 PM
I am using UF version 8.0.2 and Splunk cloud is version 7.2.9
Noted here, an X in a cell indicates
that this version of forwarder can
send event data to the corresponding
version of indexer.
https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/Compatibilitybetweenforwardersandindexers
According to the docs, it should be compatible
... View more
04-23-2020
05:46 PM
I am having trouble forwarding data to Splunk cloud from a Windows host. Previously, Linux deployments gave no issues.
Seeing the following error, which I have researched and have not come to any conclusions.
TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead
The cert path itself looks good until further down the splunkd.log where the unix convention of forward slashes causes another error.
ERROR SSLCommon - Can't read certificate file C:\Program Files\SplunkUniversalForwarder\etc/apps/app/default/app_server.pem errno=33558530 error:02001d23562:system library:fopen:No such file or directory
Would like to know ways this has been solved before. Thank you
... View more
Labels
- Labels:
-
Linux
-
universal forwarder
-
Windows
04-23-2020
03:50 PM
Checking in on this as I'm receiving the same error. Deploying splunk cloud on linux showed no issues, but on a windows host am receiving the same
TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.
Any pointers are welcome.
Thank You
... View more
03-13-2020
02:44 PM
After testing it out, it is returning on a single process_name value given the threshold.
So instead of returning results where one user is seen with many process_name values it groups a user with any process_name value
Hopefully this came across clearly
Thank you
... View more
03-12-2020
03:44 PM
Yes this works!
I just added a count
| stats count values(process_name) by user
... View more
03-12-2020
11:00 AM
Field of process_name
So one useraccount with many processes accessed , process_name being many different values
... View more
03-11-2020
07:14 PM
For example
index=active_directory | eventstats count by useraccount | search count=1
The above returning events for a unique field value of useraccount. What I am looking for is events with a unique user account grouped with several of another field value. Have tried transaction command to no avail.
Pointing in the right direction is greatly appreciated.
... View more
- Tags:
- splunk-cloud
02-27-2020
09:44 AM
How would I go about having an alert set at a given threshold ?
When I run the following, I sometimes get incomplete results in the stats table due to not every field meeting the number 6
index=_internal AND NOT email="blank@domain.com"
| stats count by email, Message, client.ipAddress, geographical.city
| where count>6
| sort -count
When I try the following, I get an alert for 6 total events with no threshold criteria met.
Trigger Condition:
Number of Results is > 6.
Desired outcome would be a criteria of the set threshold met and only when it is met. For example, an alert to fire on the 'count' of a given event occurring 6 times
Appreciate any tips in advance
... View more
- Tags:
- alerts
02-23-2020
03:01 PM
Thank you, was looking more for a way to do it with built-in capabilities
... View more
02-19-2020
11:11 PM
What is the best and most efficient way to write alert for index with no events?
I have the following
index=_internal earliest=60m | where count=0
or
| metadata type=sources index=* | eval flatline=round((now()-recentTime)/60,0)
Thank You
... View more
- Tags:
- splunk
02-19-2020
11:03 PM
As mentioned you can also schedule from a Dashboard itself if this fits your use case.
After a Dashboard has been created Edit > Schedule > Email To
... View more
10-17-2017
09:34 PM
Yes, I wanted to confirm time range picker was a built in option thank you
... View more
10-15-2017
10:46 PM
For clarification on second half of my question, I've had problems on running saved reports and having to adjust settings. Does this mean it does not run a fresh search?
... View more
07-23-2017
01:34 PM
Thank you, this was the output
authType = Splunk
passwordHashAlgorithm = SHA512-crypt
[cacheTiming]
getUserInfoTTL = 10s
getUsersTTL = 10s
userLoginTTL = 0
[secrets]
filename =
namespace = splunk
... View more
07-23-2017
01:18 PM
So once I get to the btool file in the bin, what would I need to do?
... View more
07-22-2017
05:07 PM
jkat54
I believe I renamed the right file. Renamed passwd to passwd.back, a new file was then generated passwd. Did the restart and it won't allow me access. What could the symbolic link be you mentioned?
... View more
07-22-2017
03:34 PM
Hello all,
I am having problems logging into Enterprise. I've tried my username and password, admin and changeme after moving the opt/splunk/etc/ passwd file and renaming it. Still won't work. If there's any better way to reset to allow login, i'd appreciate it. It was working just fine yesterday.
Thank You
... View more
- Tags:
- splunk-enterprise
07-16-2017
10:49 PM
HI there,
I am using the latest Splunk version on a Mac OS X 10.2. Once it works, would I be only be able to use this for this specific computer?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-14-2023
08:01 PM
|
