About KaneKennedyNHSD

KaneKennedyNHSD · ‎07-20-2021

Relatively simple way to perform what you want to accomplish: Start the Splunk service on 8000 as normal and redirect it with iptables sudo iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 8000 sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000 In reality you should get away from port 80 and only present with SSL, you could use nginx to forward port 80 to 443 with a self signed cert. server { listen 80; return 301 https://$host$request_uri; } server { listen 443; server_name www.example.com; ssl_certificate /etc/nginx/cert.crt; ssl_certificate_key /etc/nginx/cert.key; ssl on; location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://localhost:8000; } }

KaneKennedyNHSD · ‎10-08-2018

Hi, Has anyone got this to work correctly? Is it supported or even a valid idea? When an ASG instance is terminated, it comes back with a new IP and hostname. The old server IP remains in the cluster and a manual Splunk remove has to be run and a corresponding Splunk add run for the new IP. We have the Splunk data persisted on a data EBS volume. Presumably, we also need to run a Splunk clean on the newly rebuilt instance before adding it back into the cluster. My brain is telling me that Splunk is still stuck in the physical tin / Splunk cloud world and this is old school thinking not cloud thinking. Would a single larger standalone deployment with the data on an ebs volume be a better solution? How would this scale and be resilient to failure? Sorry for the wall of questions but I have reached the end of my Splunk design abilities and we are waiting on raising an official support request. Cheers, Kane.

KaneKennedyNHSD · ‎09-24-2018

Worked perfectly, Thank you very much.

KaneKennedyNHSD · ‎09-24-2018

Hi, Could anyone help me get further with this please? I have a list of UK post codes in my event data. They will always be in UK postcode format as per this table: Format Example AA9A 9AA EC1A 1BB A9A 9AA W1A 0AX A9 9AA M1 1AE A99 9AA B33 8TH AA9 9AA CR2 6XH AA99 9AA DN55 1PT I have got this far " search "postcode" NOT "{postcode}" | rex field=postcode "(?P\w{2}).*" |stats count by area " And I get area count B1 2 B2 1 B4 1 B5 1 BB 1 BD 2 L1 20 L2 5 I have a lookup table that contains data similar to this and I have a definition that points to the file, outcode, and postcode. B1,B B2,B B3,B B4,B L1,L L2,L L3,L S1,S S2,S S3,S S4,S I can't work out how the change my search to look at the first 1 or 2 characters and replace them if they are in the table so my end result would be: B 5 BB 1 BD 2 L 25 I have tried rex field=postcode "(?P\b[a-zA-Z]{2}[0-9]{1}\b)" |stats count by area however that just broke down the first part into individual stats and only on postcode where the first two characters were alpha BB9, BH8 etc..... Many thanks in advance. Kane.

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-23-2018

Online Status	Offline
Date Last Visited	‎07-20-2021 05:07 AM

Search Head Clusters in Amazon Web Services Auto S...

How do you make a search rex / regex to extract o...

Re: Unable to get Splunk Ent. Web to use Port 80 f...

Search Head Clusters in Amazon Web Services Auto S...

Re: How do you make a search rex / regex to extra...

How do you make a search rex / regex to extract o...