Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Sahr_Lebbie
Sahr_Lebbie
Path Finder
Member since:
05-04-2018
04-29-2022
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 47 |
| Karma Received | 3 |
| Member Since | 05-04-2018 |
Activity Feed
- Got Karma for Re: Rolling restart hung on "Reassigning primaries". 07-04-2023 11:16 PM
- Karma Re: Can you help me with my [Smartstore] and bucket deletion query? for rbal_splunk. 04-29-2022 08:11 AM
- Posted Re: why is /opt/splunk/var/run/splunk/cluster/search-buckets filling up my disk? on Deployment Architecture. 03-30-2022 06:33 PM
- Karma Re: why is /opt/splunk/var/run/splunk/cluster/search-buckets filling up my disk? for dxu_splunk. 03-30-2022 06:25 PM
- Posted Re: Rolling restart hung on "Reassigning primaries" on Splunk Enterprise. 03-30-2022 06:02 PM
- Tagged Re: Rolling restart hung on "Reassigning primaries" on Splunk Enterprise. 03-30-2022 06:02 PM
- Karma Re: Rolling restart hung on "Reassigning primaries" for isoutamo. 03-30-2022 06:01 PM
- Posted Re: Splunk Add-on for VMware: Is installation of Splunk OVA for VMware optional or required? on All Apps and Add-ons. 08-11-2021 07:07 AM
- Karma Re: Splunk Add-on for VMware: Is installation of Splunk OVA for VMware optional or required? for bparekh_splunk. 08-11-2021 07:06 AM
- Posted Re: [Smartstore] How to deal with Multi-site - when sites are in different AWS region? on Knowledge Management. 07-05-2021 09:16 PM
- Karma Re: [Smartstore] How to deal with Multi-site - when sites are in different AWS region? for rbal_splunk. 07-05-2021 08:58 PM
- Karma Re: Can I add python modules to the Splunk environment? for rlacher1. 01-06-2021 10:05 PM
- Got Karma for Add-on for LDAP. 10-20-2020 01:39 AM
- Got Karma for Re: Add-on for LDAP. 10-20-2020 01:39 AM
- Posted Re: Add-on for LDAP on All Apps and Add-ons. 10-20-2020 01:09 AM
- Posted Add-on for LDAP on All Apps and Add-ons. 10-20-2020 01:03 AM
- Tagged Add-on for LDAP on All Apps and Add-ons. 10-20-2020 01:03 AM
- Tagged Add-on for LDAP on All Apps and Add-ons. 10-20-2020 01:03 AM
- Tagged Add-on for LDAP on All Apps and Add-ons. 10-20-2020 01:03 AM
- Posted Re: Newly created LDAP group not accepting created roles on Security. 09-10-2020 09:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 |
03-30-2022
06:33 PM
Anyone else facing same issues in 8.2.4. Will check with support and see.
... View more
03-30-2022
06:02 PM
1 Karma
This is how I solved this as well.
... View more
- Tags:
- is is h
08-11-2021
07:07 AM
Adding to bparekh_splunk's answer. Here is the Doc to do manual. https://docs.splunk.com/Documentation/OVAVMW/4.0.3/OVADCNVMW/InstalltheSplunkOVAforVMWare
... View more
07-05-2021
09:16 PM
@rbal_splunk, thanks for this post, I had a scenario based question. If the goal/intent is to proof out disaster recovery. In the very unlikely scenario an entire AWS region were to belly up, what would your approach be to ensure failover? Let's say for a single site cluster that uses S3 replication from Region A to Region B. What would be a recommended process to failover to the replicated S3 bucket in Region B?
... View more
10-20-2020
01:09 AM
1 Karma
https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/Deploysecurepasswordsacrossmultipleservers Assuming I can just encrypt via this method. Will test
... View more
10-20-2020
01:03 AM
1 Karma
Is there a way to mask/hash/encrypt the password with use of the Deployer for this TA? https://splunkbase.splunk.com/app/1852/
... View more
Labels
- Labels:
-
administration
-
configuration
09-10-2020
09:42 PM
Did you ever get a response for this?
... View more
07-21-2020
08:31 AM
@jkat54is right, recently ran into this issue trying to summarize data from a shared peer. I needed to enable forwarding. In my case, just pushed out our forwarding app from the DS. This allowed the stash created to be forwarded to the indexing layer. Now collect works wonderfully. @ramarcsighthopefully you have yours solved now 🙂
... View more
04-09-2020
08:58 AM
Here is a plug and play dashboard I am experimenting with if someone wants to try something quickly.
Data Investigation Dashboard
<input type="time" token="time" searchWhenChanged="true">
<label>Select Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="radio" token="variance" searchWhenChanged="true">
<label>Time Differnce Variance</label>
<choice value="|search dataTimeMissing=*">Seconds</choice>
<choice value="|eval dataTimeMissing=dataTimeMissing/60">Minutes</choice>
<choice value="|eval dataTimeMissing=dataTimeMissing/3600">Hours</choice>
<choice value="|eval dataTimeMissing=dataTimeMissing/86400">Days</choice>
<default>|search dataTimeMissing=*</default>
<initialValue>|search dataTimeMissing=*</initialValue>
</input>
<panel>
<html>
<center>
<h1>SOC Data Investigation Dashboard</h1>
<p>This dashboard is used to anlayze the flow of data into Splunk and measure the cosistency of data ingestion. Please pay attention to the time difference as it can be in seconds, minutes, hours, or days.</p>
</center>
</html>
</panel>
<panel>
<title>Data Investigation Dashboard</title>
<table>
<search>
<query>|metadata type=sourcetypes index=* |eval timeNow=now() |eval dataTimeMissing=timeNow - recentTime |convert ctime(recentTime) ctime(timeNow) ctime(firstTime) |fields sourcetype totalCount firstTime recentTime timeNow dataTimeMissing |sort - dataTimeMissing $variance$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<refresh>2m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<format type="color" field="dataTimeMissing">
<colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
<scale type="minMidMax"></scale>
</format>
</table>
</panel>
... View more
03-24-2020
01:56 PM
Great answer @rbal_splunk
Definitely took time to answer this in depth.
Appreciated,
... View more
12-04-2019
07:16 AM
Weird, ran into this issue with palo_alto add-on after pushing a shcluster bundle and forcing a SH restart.
The pan_traps index was not able to be found. I just created the macro myself since and made it global but just weird how this issue appeared after the app was working fine before.
... View more
11-22-2019
05:52 PM
That was going to be my suggestion(crcSalt). How did it work out for you?
When you say renamed, were there new log file names being created or were files moving to a new directory and the same log file being appended to but just new logs?
... View more
10-23-2019
03:16 PM
Keldrig2, What search are you running?
And are you wanting to see the values from the field based on the interesting fields or are you okay with looking at all the results in a table format?
... View more
08-10-2019
04:20 PM
Really Late....
Is this still an issue for you?
It seems to be a networking issue for many others(outside of Splunk included) from researching this issue. It spans multiple different applications and 90% of similar issues seem to relay that it's a networking issue. The fact that you're able to connect and get inconsistent errors like this also indicates that it's likely networking issue.
Other questions would be is this the only UF affected?
... View more
04-29-2019
09:32 PM
Hey @niketnilay, not sure what I ended up doing with this issue honestly but I did bypass it.
Any thoughts on creating a link-type that states forwarding instead of just searching, clustering, or licensing?
... View more
04-29-2019
09:08 AM
@hellosandeep123, i've wondered the same but I don't think so unless you edits the JS directly.
... View more
11-28-2018
11:21 AM
I have tried to add it to a panel separately but seems to error out vs when it's in it's own separate dashboard(works perfectly). I used the same exact code. Just wondering if anyone experienced the same issues.
... View more
10-20-2018
12:44 AM
Hi Mdwecht,
Were you able to discover how to restore backed up data?
... View more
07-31-2018
07:06 AM
Hi Jonathan,
All I seem to see are these events in the TA's logs but no events in Splunk. Do you have any suggestions on testing further? I am on Spunk 7.0.2 and I did notice your comments from the post above.
2018-07-26 18:40:59,029 INFO nx_logger:38 - Saving changes made on configuration screen...
2018-07-26 18:40:59,114 INFO nx_logger:38 - Sucessfully retrieved stored config for Nexpose.
2018-07-26 18:40:59,125 INFO nx_logger:38 - Password retrieved.
2018-07-26 18:40:59,246 INFO nx_logger:38 - Executing nexpose_setup.py
2018-07-26 18:40:59,246 INFO nx_logger:38 - Listing the fields for the set up screen...
2018-07-26 18:40:59,432 INFO nx_logger:38 - Executing nexpose_setup.py
2018-07-26 18:40:59,527 INFO nx_logger:38 - Executing nexpose_setup.py
2018-07-26 18:40:59,528 INFO nx_logger:38 - Listing the fields for the set up screen...
2018-07-26 18:40:59,711 INFO nx_logger:38 - Executing nexpose_setup.py
2018-07-26 18:40:59,807 INFO nx_logger:38 - Executing nexpose_setup.py
2018-07-28 04:00:00,167 INFO nx_logger:38 - Retrieving password
2018-07-28 04:00:00,245 INFO nx_logger:38 - Loading Splunk password response
2018-07-28 04:00:00,245 INFO nx_logger:38 - Parsing Splunk password response
2018-07-28 05:10:00,166 INFO nx_logger:38 - Retrieving password
2018-07-28 05:10:00,240 INFO nx_logger:38 - Loading Splunk password response
2018-07-28 05:10:00,240 INFO nx_logger:38 - Parsing Splunk password response
2018-07-29 04:00:00,170 INFO nx_logger:38 - Retrieving password
2018-07-29 04:00:00,245 INFO nx_logger:38 - Loading Splunk password response
2018-07-29 04:00:00,245 INFO nx_logger:38 - Parsing Splunk password response
2018-07-29 05:10:00,163 INFO nx_logger:38 - Retrieving password
2018-07-29 05:10:00,238 INFO nx_logger:38 - Loading Splunk password response
2018-07-29 05:10:00,238 INFO nx_logger:38 - Parsing Splunk password response
2018-07-30 04:00:00,532 INFO nx_logger:38 - Retrieving password
2018-07-30 04:00:00,680 INFO nx_logger:38 - Loading Splunk password response
2018-07-30 04:00:00,680 INFO nx_logger:38 - Parsing Splunk password response
2018-07-30 05:10:00,477 INFO nx_logger:38 - Retrieving password
2018-07-30 05:10:00,640 INFO nx_logger:38 - Loading Splunk password response
2018-07-30 05:10:00,640 INFO nx_logger:38 - Parsing Splunk password response
2018-07-31 04:00:00,258 INFO nx_logger:38 - Retrieving password
2018-07-31 04:00:00,331 INFO nx_logger:38 - Loading Splunk password response
2018-07-31 04:00:00,332 INFO nx_logger:38 - Parsing Splunk password response
2018-07-31 05:10:00,182 INFO nx_logger:38 - Retrieving password
2018-07-31 05:10:00,257 INFO nx_logger:38 - Loading Splunk password response
2018-07-31 05:10:00,257 INFO nx_logger:38 - Parsing Splunk password response
... View more
06-29-2018
09:36 PM
I actually did the same thing and increased the timeout to like 90 seconds and also decreased the number of rows being pulled back. This worked really quickly.
Playing with the mod inputs--aka remove and restore did not help as an FYI but that may have just been my scenario.
... View more
06-14-2018
09:38 AM
Forwarders script is identified as missing in the MS-o365 logs but the script is there in $SPLUNK_HOME/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin and also the permissions are accurate.
splunk_ta_ms_o365_rh_server_forwarders.py
This same error occurs for other scripts as well.
We started investigating when we saw a huge drop in events from the TA. We still see events but they are drastically cut.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-29-2022
11:32 AM
|
Karma given to
