About eden881

eden881 · ‎04-30-2020

Thank you for the answer! Unfortunately I was looking for a way to achieve this via Splunk's components only, as those are already deployed on our servers.

eden881 · ‎11-21-2019

Thank you for the answer, but this method is extremely inconvenient as it requires a lot of effort and time to issue a single command. I'm looking for a semi-interactive way to make use of my existing Splunk deployment to perform simple management tasks in my environment, without the need to fully connect to the server.

eden881 · ‎11-20-2019

When I run splunk cmd , I can execute any external system command using Splunk's context. I want to combine that with the -uri parameter to be able to send remote commands to Universal Forwarders. However the cmd engine treats -uri as a part of the command itself, for example: splunk cmd dir -uri https://uf_hostname:8089 dir: cannot access https\://uf_hostname\:8089: No such file or directory How can I send the command to a remote Splunk instance?

eden881 · ‎11-20-2019

Eventually I tried it out myself, and found out that the [default] stanza only affects the inputs in it's specific app.

eden881 · ‎11-20-2019

I think this is incorrect, as I tried it and found out that [default] only affects the inputs in the specific app...

eden881 · ‎11-13-2019

I have an app with a long list of inputs. I want to set them to go to a specific index (let's say index = my_index ). I can achieve this by placing index = my_index under the [default] stanza in the app. However, will this affect other apps on the forwarder with their inputs set to default? I deploy this app with a Deployment Server to several UFs.

eden881 · ‎11-13-2019

Thanks! It works well.

eden881 · ‎09-22-2019

Hi, I need to perform a search on forwarder data from the _internal index, but I need to exclude my indexers from that search. I know I can get the indexers list by many ways, for example: index=_internal source="*metrics.log" group=instance instance_roles="*indexer*" | table host | dedup host But how can I use the list to dynamically exclude the hosts from my other _internal search?

eden881 · ‎09-19-2019

Splunk 7.3.1.1 is now released.

eden881 · ‎09-13-2019

I need the installation RPM of Splunk 7.3.1 specifically, in order to be version-compatible with another 7.3.1 instance that I already have. However, the official download page only gives me 7.3.0 now. In the older releases page, I can only find versions 7.2.x and below. Where did 7.3.1 go? I can't seem to find any information about critical issues with 7.3.1 which requires reverting back to 7.3.0...

eden881 · ‎09-03-2019

Thank you! It worked well.

eden881 · ‎09-02-2019

I have a custom alert action that I wrote using the manual on the documentation: https://docs.splunk.com/Documentation/Splunk/7.3.1/AdvancedDev/ModAlertsIntro I need to import a Python module (boto3) into my action's script. How can I do that? Where and how do I install the module?

eden881 · ‎04-29-2018

I run Splunk Enterprise in a distributed cluster architecture, in an offline environment that is completely disconnected from the internet. I need to browse the Splunk documentation while in this offline environment. To do that conveniently, I want to run a web server (preferably a container) that will serve an offline version of the Splunk documentation website. If I can also change the redirects from Splunk Enterprise to point at my private server, that would be even better. How can I achieve this?

Posts	13
Solutions	1
Karma Given	11
Karma Received	8
Member Since	‎04-29-2018

Online Status	Offline
Date Last Visited	‎09-09-2021 05:25 PM

Execute a command through the CLI on a remote syst...

Set a default index for all INPUTS within a specif...

Search _internal for metrics from non-indexer inst...

Where did Splunk 7.3.1 go?

Use a Python module in a custom alert action

On-Premises documentation server

Re: Execute a command through the CLI on a remote ...

Re: Execute a command through the CLI on a remote ...

Execute a command through the CLI on a remote syst...

Re: Set a default index for all INPUTS within a sp...

Re: Set a default index for all INPUTS within a sp...

Set a default index for all INPUTS within a specif...

Re: Search _internal for metrics from non-indexer ...

Search _internal for metrics from non-indexer inst...

Re: Where did Splunk 7.3.1 go?

Where did Splunk 7.3.1 go?

Re: Use a Python module in a custom alert action

Use a Python module in a custom alert action

On-Premises documentation server