About alonsocaio

alonsocaio · ‎10-25-2021

Hi @haleyh44, There are several docs from Splunk that can help you to validate your deployment: I suggest you to take a look first at System and Hardware Requirements docs: System Requirements and Reference Hardware Also, there is a complete guide on Splunk validated architectures: Splunk Validated Architectures But mostly important, I would suggest you to first understand your Splunk use case, such as how much data you plan to ingest daily, how many users are going to actively use your Splunk deployment, how many searches and scheduled searches you plan to run daily, and so on. This will help you to size your environment properly.

alonsocaio · ‎10-22-2021

Hi, It worked, thanks for you response!

alonsocaio · ‎10-22-2021

Hi, I need to delete some KV Store Collections, and the only way I have to perform this kind of action is using the REST API, since I'm on Splunk Cloud. When I create KV Store Collections, I use this request, following the docs on Use the Splunk REST API to manage KV Store collections and data in Splunk Cloud Platform or Splunk Enterprise : curl -k -u USER -d name=KV-COLLECTION-NAME https://HOSTNAME.splunkcloud.com:8089/servicesNS/nobody/APP_NAME/storage/collections/config What I would like to know is how can I delete the KV Store Collection using the same approach. Thanks

alonsocaio · ‎10-21-2021

Not so sure, but I guess this query returns only indexes that had used any license on the time range your are searching. If the index didn't receive any data on this time range It won't be returned by the license usage log.

alonsocaio · ‎10-21-2021

Hi @SamHTexas, I am not sure if this is what you are looking for, but take a look at the following query: index="_internal" source="/opt/splunk/var/log/splunk/license_usage.log" type="Usage" | eval GB=b/1024/1024/1024 | bin _time span=1d | stats sum(GB) as A by _time, idx | eventstats max(A) as B by idx | where A=B | dedup A idx | sort idx | table _time,A idx I used your base stats, but changed some of the fields on the main query.

alonsocaio · ‎06-25-2021

Hi @jmatthews, I have not found much information about this errors, but in my case I was able to solve it because the issue was on KMS permissions for the Splunk role I was using for reading the SQS messages / S3 objects.

alonsocaio · ‎04-16-2021

Hi @rseri17 , Maybe you can try the following regex for extracting the fields you need: | rex field=FIELD_NAME "upstream_response_time\\"\:\s\\\"(?<upstream_response_time>[\d\.]+)\\\"" | rex field=FIELD_NAME "connection_requests\\\"\:\s(?<connection_requests>[\d]+)"

alonsocaio · ‎03-29-2021

I was able to solve this issue by setting the dbxquery stanza under local/commands.conf This stanza is commented under default/commands.conf, I had to add this to local so I could revert dbxquery to version 3.2.0 [dbxquery] run_in_preview = false filename = java.path chunked = true command.arg.1 = -Dlogback.configurationFile=../config/command_logback.xml command.arg.2 = -DDBX_COMMAND_LOG_LEVEL=INFO command.arg.3 = -cp command.arg.4 = ../jars/dbxquery.jar command.arg.5 = com.splunk.dbx.command.DbxQueryCommand The solution was found on the following question: Splunk DB connect DBX Query error - Splunk Community

alonsocaio · ‎03-29-2021

Hi, I am trying to run some SQL queries using SQL Explorer on DB Connect app, but It looks like the queries are not finishing. Every query I execute keeps on 20% of completion and does not load any result. Also, all of my inputs that are configured on DB Connect app are working as expected, the issue is happening only when I try configuring new inputs or when I use the SQL Explorer tab. I have already tried to run the queries using different users and browsers, and I have already restarted Splunk service, but the issue is still occurring. Does anyone has ever faced some issue like this one before on Db Connect? Any tips on what can be the cause of this error? Thanks in advance.

alonsocaio · ‎02-26-2021

Hi @Shravs, Have you configured both Mail Log and Message Log inputs? Which is the retry interval you have set to this inputs? Also, could you search for the name of the inputs on your _internal index? It is expected to have some access logs looking for the checkpoint files on the add-on.

alonsocaio · ‎02-16-2021

HI @iherb_0718, How are you deploying the Splunk Stream app to your servers? Are you using a deployment server? If so, you could try removing your server from the server class that deploys this app. I guess this would uninstall the Splunk Stream app from the server.

alonsocaio · ‎02-16-2021

Hi @Gayathrikousi, First thinkg you could take a look is at the Spunk Enterprise Certified Admin test blueprint Splunk-Test-Blueprint-Admin-v.1.1.pdf , this will help you a lot to find which content you need to study to pass the exam. Also, you can find pretty good material at Splunk docs abou administration, but maybe, if you have the opportunity, taking the official Splunk trainings (Splunk Enterprise System Administration and Splunk Enterprise Data Administration), It would be your best choice, since It is a reccomendation for the test. One last tip about this exam is to try all topics from the test blueprint in a lab environment, It will help you a lot to undesrtand the concepts and It will be much easier to remember during the test. Hope this helps you a bit.

alonsocaio · ‎02-16-2021

Hi @faisalshani001, One approach you can try is to export your data using Splunk REST API. Since you need to export the search results, I guess this works for you: Exporting Large Results Sets to CSV | Splunk , and you can export on CSV, JSON or RAW format. Also, I think that using the API is pretty simple, since you can use python requests or event curl to create and export your search. After saving the results into a file, you can upload it to the S3 bucket.

alonsocaio · ‎02-01-2021

Hey @itsmevic, I suggest you to create a role for this specific user and creating an app to place this dashboard. I don't think Splunk supports denying access to apps just using roles, so I guess you will also have to remove permissions from this new created role on every app you have deployed in your instance. You can make some modifications to your dashboard to hide some of Splunk menu bars, such as adding "hideEdit" and "hideSplunkBar" to your form XML: <form hideChrome="false" hideAppBar="false" hideEdit="true" hideSplunkBar="true"> Also, for preventing user to go outside the app using the "open search" option, you can add this to your panel options: <option name="link.openSearch.visible">false</option> <option name="link.openPivot.visible">false</option> I think this would be a good start for segregating access only to one dashboard.

alonsocaio · ‎01-28-2021

Hi, I have set some SQS inputs on Splunk Add-on for AWS, but the following error is occurring: 2021-01-28 13:25:08,541 level=CRITICAL pid=3271 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:268 | datainput="SQS_INPUT" start_time=1611850827, created=1611851108.54 message_id="MESSAGE_ID" ttl=600 job_id=JOB_ID | message="An error occurred while processing the message." Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 247, in _process records = self._parse(message) File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 315, in _parse raise ValueError("Unable to parse message.") ValueError: Unable to parse message. There are two inputs running into this issue, one is using Custom Data Type and the other one is using Cloudfront Access Logs. Also, I have some other SQS inputs that are running with no errors. Does anyone has any hints on how to solve this "Unable to parse message" errors? Thanks

alonsocaio · ‎01-22-2021

Hi @pragycho , this could be used as a generic regex for extracting these fields: \#\w+\:\s(.+)$ If you need a regex for each field, you can try something like this: \#Version\:\s(?<version>.+)$ \#Date\:\s(?<date>.+)$ \#System\:\s(?<system>.+)$ \#Software\:\s(?<software>.+)$

alonsocaio · ‎01-22-2021

Hey @saveriobocca , just confirming, on your first search (Correlation Search) you have renamed sourceIp to SourceIp. Have you tried using "$SourceIp$" instead of "$sourceIp$" on your drilldown search? Field names are case-sensitive, so if the token is generated as SourceIp on the correlation search it needs to be the same way on the drilldown.

alonsocaio · ‎01-12-2021

HI @TheBravoSierra You can try using the strftime function: | eval Completed_On_New = strftime(Completed_On, "%m/%d/%Y")

alonsocaio · ‎11-16-2020

Understood. My suggestion would be to deploy a Heavy Forwarder on DMZ. I guess It would give you more control on inputs, routing and parsing than the Universal Forwarder. But looking at the docs, It seems to be possible to use the Universal Forwarder as intermediate. Here you have a more detailed comparison about the different types of Splunk forwarders (https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Typesofforwarders#Forwarder_comparison)

alonsocaio · ‎11-16-2020

Hi @hethu, Actually you can forward your logs from Heavy Forwarder directly to Splunk Cloud. I guess this would be the recommended architecture for this case. Do you have any network restrictions for communication between your server and Splunk Cloud? If this is the case, maybe you should deploy a Heavy Forwarder instead an Universal Forwarder on DMZ. I have not tested sending logs between two forwarders, but I guess this is possible.

alonsocaio · ‎11-06-2020

HI @santosh_sshanbh, Looking at your initial search I would suggest the following to improve performance: 1 - Using wildcards as prefix is not that efficient (instance=*:). As exposed in the docs "the search must look at every string to determine if the end of the string matches what you specify after the asterisk" (https://docs.splunk.com/Documentation/SCS/current/Search/Wildcards#Avoid_using_wildcards_as_prefixes) 2 - I suggest you to use the "fields" command, so you can restrict your search to use only the fields you need on your results. | fields _time, host, instance, Avg._Disk_Queue_Length

alonsocaio · ‎11-05-2020

Hi @Learner , If I understood your question right, you could use this cron expression to schedule your search to run on the first day of the month at 00:00. 0 0 1 * * You can check a more detailed explanation and test new cron expressions on this site: https://crontab.guru/#0_0_1_*_* But if the report needs to search a period between the 1st day and the 15th day of previous month, your should use the earliest and latest time in your search query (Or select it in your time picker): ...YOUR SEARCH... earliest=-1mon@mon latest=-1mon@mon+1296000

alonsocaio · ‎11-04-2020

Hi @sahiltcs, Are you using the "CrowdStrike Intel Indicator Technical Add-On" to retrieve your threat intel information? If so, (and if you have not been able to collect intel from CS), you can find the full docs explaining how to send data from CS to Splunk here: https://www.crowdstrike.com/wp-content/uploads/2020/07/CrowdStrike-Falcon-Intel-Indicator-Add-on-Guide.pdf I am also checking a way on how to integrate the collected intel data with Splunk ES framework.

alonsocaio · ‎11-03-2020

Hi @u712596, Have you removed the expired license before installing the new one? If not, I would suggest you to remove it. You can do it using CLI. First list all your licenses and identify your expired one: splunk list licenses Then, remove your expired license using its hash: splunk remove licenses LICENSE_HASH After that you can install the new license. I had a similar issue a while ago and this helped solving.

alonsocaio · ‎10-31-2020

Hi @krishna_11 I have tested a simple json file with this sourcetype settings: [test:json] INDEXED_EXTRACTIONS = json SHOULD_LINEMERGE = 0 pulldown_type = 1 And It returned me duplicated values. When I added KV_MODE = None to the sourcetype, It parsed the json correctly. [test:json] INDEXED_EXTRACTIONS = json SHOULD_LINEMERGE = 0 KV_MODE = None pulldown_type = 1 I would suggest you to test using the KV_MODE option to validate if It works for you.

Posts	127
Solutions	19
Karma Given	44
Karma Received	47
Member Since	‎01-02-2019

Online Status	Offline
Date Last Visited	‎02-03-2023 06:51 AM

How can I delete a KV Store Collection using Splun...

DB Connect SQL Explorer Not Working

AWS SQS Input - Unable to parse message

Restrict access to apps based on role

How to implement custom POST actions on a dashboar...

How to use multiple risk object fields on ES Risk ...

Process AWS VPC Flow Logs before indexing.

Roll buckets that are in "Cannot fix search count ...

Could not load lookup=LOOKUP-user_account_control_...

Can I call a Python script from a dashboard and ou...

Re: New deployment need advice/guidance

Re: How can I delete a KV Store Collection using S...

How can I delete a KV Store Collection using Splun...

Re: Splunk License Usage Report - Max license usag...

Re: Splunk License Usage Report - Max license usag...

Re: AWS SQS Input - Unable to parse message

Re: How do I extract a field from my raw stdout lo...

Re: DB Connect SQL Explorer Not Working

DB Connect SQL Explorer Not Working

Re: Issues with “Proofpoint On-demand Email Securi...

Re: disable splunk stream

Re: Question regarding Splunk admin certification

Re: Sending data to AWS S3 from Splunk in Splunk E...

Re: Limited Splunk Access to Only One Dashboard

AWS SQS Input - Unable to parse message

Re: how to read comment line

Re: Splunk ESS | Drilldown notable not work

Re: Change time format

Re: Heavy forwarder

Re: Heavy forwarder

Re: SPL optimization for timechart

Re: cron expression for scheduled report

Re: Setup the Threat feed integration in ES

Re: License activation issue

Re: Duplicate entries in splunk search