About kanam

kanam · ‎03-02-2021

I install Splunk ES v5.3.1 on Enterprise v7.3.7.1, then I want to open "Incident Review". However the page has been loading and doesn't display. I can see the other pages like "Glass Table". Please let me know how to fix.

kanam · ‎02-25-2021

Thank you. I couldn't fine any logs as results of "index=_internal sourcetype=notable_modalert". I guess trigger action isn't worked successfully. However another adaptive action, "Run Phantom Playbook", is running well.

kanam · ‎02-25-2021

I found procedure to install Splunk-TA-ForIndexer and installed. Then both Indexer have notable index. However notable event isn't created.

kanam · ‎02-24-2021

Thank you for support. As you say, one indexer doesn't have notable index. But this one was added after. Can I install some apps needed to use ES manually?

kanam · ‎02-24-2021

Now I enable correlation search, which is set "Notable" and "Run Phantom Playbook" as adaptive action. Then when logs are found, "Run Phantom Playbook" is run normally, but "Notable" doesn't look to be run and "Incident Review" doesn't show anything. I confirm the result of SPL "index=notable", it returns no result. Please help.

kanam · ‎01-13-2021

I verified some in my non-production environment. Then ClusterMaster was broken and hasn't worked, maybe since same time, 2 Indexers have been looked not to be as well. For recovery I tried some, finally both of Indexers can't show web. To up web port and service, I put "#/opt/splunk/bin/splunk set web-port 8000" Indexer replies "Couldn't complete HTTP request: Connection reset by peer" I tried to reboot platform and restart Splunk service and so on, but this isn't resolved. Please help.

kanam · ‎12-14-2020

richgalloway, Thank you for reply. How about when I create new index as same index name? ex) Now I use index "TEST" for ITSI Once I delete it. And I create index "TEST" for ITSI again. Then, will ITSI run well same as before?

kanam · ‎12-13-2020

Now I want to remove one index. However I've already create some service and entity related to the index in ITSI. After removing index once, I'll create new index as same name. Is there some influence for ITSI?

kanam · ‎10-05-2020

I created correlation search and add Notable action as "Adaptive Response Actions". By running search there are some events and actually Activity>Jobs shows events are existing. However "Incident Review" doesn't display any event. #I configure "Throttling" disable by setting "Window duration" as "0".

kanam · ‎05-12-2020

I tried but search.log shows only access log.

kanam · ‎05-11-2020

I've tried to search index=_internal sourcertype=splunkd in both SerchHead and Indexer, but I can't find the target error message.

kanam · ‎05-11-2020

When I search or after running saved search, sometimes error messages are displayed, however activity log shows they have been completed. "Dispatch Command: Unknown error for indexer: xxxx. Search Results might be incomplete! If this occurs frequently, please check on the peer." I want to search how frequently these message are created. Please let me know the way to search. I can't find as below. -index=_internal "dispatch" -index=_internal "incomplete"

kanam · ‎02-10-2020

I'd like to search the status of Incident Review, and have found 2 ways to do it. 1)| inputlookup append=T es_notable_events 2)| inputlookup append=T incident_review_lookup Other than above 2 ways, many person may look to use "| incident_review " for that. Maybe "| incident_review " contains 2)| inputlookup append=T incident_review_lookup. Ideally, I want to display detail information like rule_title,src,user etc. So I guess 1)| inputlookup append=T es_notable_events is better. However I'd like to know the differences between "es_notable_events" and "incident_review_lookup". Best Regards,

Posts	13
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-10-2020

Online Status	Offline
Date Last Visited	‎03-02-2021 08:38 PM

Incident Review page has been loading

Notable event isn't created.

Indexer don't work

influence of removing index for ITSI

Notable events aren't shown in Incident Review

How to search error message

the differences between "es_notable_events" and "i...

Incident Review page has been loading

Re: Notable event isn't created.

Re: Notable event isn't created.

Re: Notable event isn't created.

Notable event isn't created.

Indexer don't work

Re: influence of removing index for ITSI

influence of removing index for ITSI

Notable events aren't shown in Incident Review

Re: How to search error message

Re: How to search error message

How to search error message

the differences between "es_notable_events" and "i...