About pwu_splunk

pwu_splunk · ‎02-04-2022

We've moved this to internal discussion. Search "Alpha Kilo India" on Slack.

pwu_splunk · ‎01-28-2022

Unfortunately, this is in an app that's already been upgraded to jQuery 3.6.0. My guess is that there's some library in the app that uses copy-and-paste jQuery code without having it as an explicit dependency, and I don't really know how to figure out which offending library that is. Also, the search strings aren't one-to-one with the offending strings, and I don't have visibility into the translation. Technically, as a Splunk employee, I can get access, but I'm filing this here to help non-Splunkers.

pwu_splunk · ‎01-28-2022

I'm trying to address the new "check_for_vulnerable_javascript_library_usage" check in AppInspect as it's required for apps to run in Splunk Cloud after February. However, I get results like: 3rd party CORS request may execute parseHTML() executes scripts in event handlers jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Regex in its jQuery.htmlPrefilter sometimes may introduce XSS Regex in its jQuery.htmlPrefilter sometimes may introduce XSS which doesn't really tell me how to proceed. Is there a way I can figure out what's actually causing these errors?

pwu_splunk · ‎01-08-2020

The specific location of the collectd.log may vary by distro, but the information should be in the collectd.log on Machine 2.

pwu_splunk · ‎01-07-2020

Is the data arriving at Machine 1? If you search index=_internal host=${Machine 2} or | mcatalog values(metric_name) WHERE host=${Machine 2} AND index=em_metrics , do you see data?

pwu_splunk · ‎01-06-2020

Does the splunkd.log from the UF say anything about whether the data is successfully sending to Machine 1?

pwu_splunk · ‎12-06-2019

What do you see when you run | mcatalog values(host) WHERE `sai_metrics_indexes` AND metric_name=Processor.* OR metric_name=processor.* in Search?

pwu_splunk · ‎11-06-2019

Which volume did you add the parameter to?

pwu_splunk · ‎10-23-2019

There's a parameter in indexes.conf that addresses this (maxVolumeDataSizeMB). https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Indexesconf

pwu_splunk · ‎09-05-2019

SII was a product that acted as a simplified version of SAI + Splunk Enterprise. It lacked features like access to Search & Reporting and more granular control of Splunk for users who didn't want to jump right into the complexity of Splunk Enterprise. Most importantly, it's a deprecated product. Going forward, users should use SAI to receive the latest features and updates. SAI works for both physical and virtual environments. How your resources are displayed depends on how you send data from entities to SAI. For example, based on your configuration, you can discover an AWS server as a standalone Linux server, as part of a larger AWS infrastructure, or as both. As of version 1.4.0, SAI has no support for integrating with VMware directly. However, this may change in the next major release. 😉 Stay tuned. See above. Splunk App for VMware and Splunk App for Infrastructure have different features. They're more complimentary rather than one being strictly better than the other.

pwu_splunk · ‎07-23-2019

Just a very belated update: This was fixed as part of version 1.2.2. Thanks for the reporting and debugging!

pwu_splunk · ‎07-23-2019

SII can monitor any supported technology [1], regardless of how it's actually being run under-the-hood. You can monitor physical hosts, virtual machines, Docker containers, and more. [1] https://docs.splunk.com/Documentation/Infrastructure/latest/Admin/AddData

pwu_splunk · ‎05-31-2019

If you want an inside look at the sausage-making factory, it's something we made in React for SAI. It's React code that uses REST endpoints for entity and dimension information. Unfortunately, I don't think it's available for you to use on a Splunk dashboard.

pwu_splunk · ‎05-31-2019

I'm not sure I understand the problem exactly. Where are you creating this dropdown and for what purpose?

pwu_splunk · ‎05-31-2019

I'm not sure I understand the problem exactly. Where are you creating this dropdown and for what purpose?

pwu_splunk · ‎05-22-2019

REGEX = (\Quser:\E(?<user>.*?)[\Q,\E\Q]\E]) I still suspect this format is incorrect. See the link on how to format Splunk regexes and the table inside on valid characters. I've only seen standard-form regexes in Splunk.

pwu_splunk · ‎05-21-2019

One issue I notice is that "REGEX = (\Qu:\E(?.*?)[\Q,\E\Q]\E])" doesn't look like a correct regex format in Splunk. See: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/AboutSplunkregularexpressions Edit: Even looking at it as the "\Q\E" flavor of Regex, I don't see where the "u:" is coming from.

pwu_splunk · ‎04-15-2019

Yes, it's possible to have Splunk Enterprise and Splunk Insights for Infrastructure on the same machine. In case you're not aware already, there's an app version of Splunk Insights for Infrastructure (Splunk App for Infrastructure) for use with Splunk Enterprise.

pwu_splunk · ‎04-08-2019

Yes, it's possible to run both Collectd (the metrics collector) and the Universal Forwarder on the same machine. In fact, that's the default agent configuration for Unix and OSX machines.

pwu_splunk · ‎01-24-2019

If you're referring to metric collection, when you click on the Add Data page, there will be a set of tabs on the left that lists the different types of client machines that you can collect from. Each tab has further information on how to collect data from that machine type. For further information, you can refer to this link [1]. If you're referring to the service concept in Splunk (e.g. [2]), SII does not support this at this time... If you're referring to OS services / processes, you can refer to vishaltaneja07011993's answer. [1] https://docs.splunk.com/Documentation/InfraApp/1.2.2/Admin/AddData [2] https://docs.splunk.com/Documentation/ITSI/4.1.0/Configure/CreateService

pwu_splunk · ‎01-02-2019

Out of curiosity, is there a reason you're adding EC2 entities via an installation script and not the AWS tab in Splunk Insights for Infrastructure? The AWS tab sets everything up via your AWS account, and this is the recommended method of collecting data from EC2.

pwu_splunk · ‎12-06-2018

How many entities do you have? How many entities are you adding at a time?

pwu_splunk · ‎10-22-2018

I think running the script with the wrong parameters the first time may have screwed something up. I don't know what's going on, but I'd suggest uninstalling the SplunkUniversalForwarder from the target machine (and making sure that C:\Program Files (x86)\SplunkUniversalForwarder no longer exists) and retrying the installation snippet.

pwu_splunk · ‎10-12-2018

This is a known issue that will be fixed in our 1.2.1 release. Sorry for the inconvenience.

pwu_splunk · ‎10-11-2018

"So shall I change the IP address to 192.168.4.144 on the clipboard code and try once? " Yes, try that. "And I got the original error code after I added the IP of the host to be monitored." The field is "Monitoring machine (Specify the hostname or IP address of the machine you want to send data to)". This is not supposed to be the IP address of the machine that is to be monitored but the machine that is doing the monitoring [1]. [1] In most cases, this is the machine that has SAI/SII installed. The exception is with SAI installed on a distributed Splunk deployment.

Posts	33
Solutions	6
Karma Given	39
Karma Received	11
Member Since	‎03-13-2018

Online Status	Offline
Date Last Visited	‎02-15-2022 10:30 PM

How do I address "check_for_vulnerable_javascript_...

Re: How do I address "check_for_vulnerable_javascr...

Re: How do I address "check_for_vulnerable_javascr...

How do I address "check_for_vulnerable_javascript_...

Re: Entities not displayed in Splunk App for Infra...

Re: Entities not displayed in Splunk App for Infra...

Re: Entities not displayed in Splunk App for Infra...

Re: No hosts showing in SAI

Re: Reduce the 200G limit in data collection in SI...

Re: Reduce the 200G limit in data collection in SI...

Re: What is the difference between Splunk Insights...

Re: [Bug Report - Reported To Devs] If You Are Hav...

Re: Is "Splunk Insights for Infrastructure" able t...

Re: How to create a dropdown with a list of select...

Re: How to create a dropdown with a list of select...

Re: How to create a dropdown with a list of select...

Re: How to extract custom dimension from metrics i...

Re: How to extract custom dimension from metrics i...

Re: Can we have Insights for Infrastructure and Fr...

Re: Collector and universal forwarder on same mach...

Re: I have Splunk app for infrastructure installed...

Re: Missing required arguments - SPLUNK_URL. howev...

Re: Splunk App for Infrastructure Interface slowne...

Re: Not able to add windows host in insight for in...

Re: em_send_email error

Re: Not able to add windows host in insight for in...