About mibrahim8

mibrahim8 · ‎09-07-2021

Hello, Here is a link [ https://mk-datalab.blogspot.com/2021/09/splunk-hf-advanced-data-routing-cloning.html ] of an Article that reference Splunk Documentation and emphasize on the above way in more details and more data routing & cloning scenarios. Please check ! and feedback me ! Thanks, Mohamed Khalil

mibrahim8 · ‎01-06-2020

Hello, How I can hide the dashboard input filters parameters that are being shown in the URL Address bar? That's for security purposes, as it does not allow someone to get the input fields id. And, as the URL exceeds 255 characters, it's not allowing us to open the searches in a new tab. So the URL should be showing only the app name and the dashboard name that is being used and the rest of the parameters that are being passed of the filter values used showed be removed. Thank You Best Regards, Mohamed Ayman

mibrahim8 · ‎08-02-2019

In Server.conf change the parameter below to * to enable all the connections please check the details in the following link https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Serverconf crossOriginSharingPolicy = ... * List of the HTTP Origins for which to return Access-Control-Allow-* (CORS) headers. * These headers tell browsers that web applications are trusted at those sites to make requests to the REST interface. * The origin is passed as a URL without a path component (for example "https://app.example.com:8000"). * This setting can take a list of acceptable origins, separated by spaces and/or commas. * Each origin can also contain wildcards for any part. Examples: ://app.example.com: (either HTTP or HTTPS on any port) https://.example.com (any host under example.com, including example.com itself) * An address can be prefixed with a '!' to negate the match, with the first matching origin taking precedence. For example, "!://evil.example.com:* ://.example.com:" to not avoid matching one host in a domain * A single "" can also be used to match all origins * No default.

mibrahim8 · ‎07-17-2019

"services/search/jobs/" Splunk endpoint is replying “Unauthorized” (HTTP 401) due to the presence of the “Origin”/”Referer” parameter in the header request. To best integrate the browser/client all to Splunk, can we allow all or specific origin header or remove this restriction? it works fine for doing it with a linux curl. But even by adding the “Origin” header parameter and it won’t work. Basically, for using the front-end, we need the splunk endpoint to allow the origin header from a specific or all orginis.

mibrahim8 · ‎04-02-2018

The Stand alone splunk instance is totally separated from the indexer cluster. So, the exactly needed to migrate the indexed data in this separated splunk standalone instance to the indexer cluster. But the topic mentioned in the Doc.s is to change the directory of the indexed data in the same indexer.

mibrahim8 · ‎04-02-2018

We have a Indexer Cluster And Search Head Cluster. We need to send all data in a standalone Splunk instance to the indexer cluster without merging this instance in the indexer cluster.

mibrahim8 · ‎09-25-2017

Yes, It's SSL Related and it works now after using [ list_settings ] capability. Thank You.

mibrahim8 · ‎09-25-2017

Having a user with a power role that includes schedule_search capability. And When I'm trying to schedule a dashboard to be send as pdf using schedule pdf delivery feature i got this error [ Sending the test email failed: command="sendemail", 'rootCAPath' while sending mail to: < my email > ]. I didnt face this issue using splunk 6.5.1 before upgrading to splunk 6.6.3. I tried to test the feature using an admin role and it's working fine. But, For power role it's not working. I found in the documentation that the user should have the roles [ schedule_search ] and [ admin_all_objeccts : only if the mail host requires login credentials ] and i dont have this requirement for login. Even i tested it and also didnt work with the admin_all_objects role. Another thing to consider that am using a search head cluster. Documentation Link : [ http://docs.splunk.com/Documentation/Splunk/6.6.3/Report/Schedulereports ]

Posts	8
Solutions	1
Karma Given	3
Karma Received	2
Member Since	‎09-25-2017

Online Status	Offline
Date Last Visited	‎12-24-2021 11:53 AM

How to hide dashboard parameters in URL Address Ba...

Splunk Rest Request using browser - Unauthorized b...

How to forward indexed data to another splunk inde...

Splunk Enterprise 6.6.3 Scheduled PDF Delivery For...

Re: Cloning Data on a Heavy Forwarder

How to hide dashboard parameters in URL Address Ba...

Re: Splunk Rest Request using browser - Unauthoriz...

Splunk Rest Request using browser - Unauthorized b...

Re: How to forward indexed data to another splunk ...

How to forward indexed data to another splunk inde...

Re: Splunk Enterprise 6.6.3 Scheduled PDF Delivery...

Splunk Enterprise 6.6.3 Scheduled PDF Delivery For...