Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tawollen
tawollen
Path Finder
Member since:
07-21-2010
06-05-2020
Community Statistics
| Posts | 37 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 23 |
| Member Since | 07-21-2010 |
Activity Feed
- Got Karma for Export limit in 5.x. 06-05-2020 12:46 AM
- Got Karma for Re: Scripted authentication (radius) not re-authenticating when new browser loaded. 06-05-2020 12:45 AM
- Got Karma for slow distributed search (DistributedBundleReplicationManager ?). 06-05-2020 12:45 AM
- Got Karma for Permissions scheduled searches. 06-05-2020 12:45 AM
- Got Karma for Permissions scheduled searches. 06-05-2020 12:45 AM
- Got Karma for events not deleting with | delete. 06-05-2020 12:45 AM
- Got Karma for events not deleting with | delete. 06-05-2020 12:45 AM
- Got Karma for events not deleting with | delete. 06-05-2020 12:45 AM
- Got Karma for events not deleting with | delete. 06-05-2020 12:45 AM
- Got Karma for events not deleting with | delete. 06-05-2020 12:45 AM
- Got Karma for Splunk not re-authenticating when browser re-loaded. 06-05-2020 12:45 AM
- Got Karma for Splunk not re-authenticating when browser re-loaded. 06-05-2020 12:45 AM
- Got Karma for SSL Certificate questions (wildcard, Web, Search Head). 06-05-2020 12:45 AM
- Got Karma for Several SSO issues ( user issues & logout page). 06-05-2020 12:45 AM
- Got Karma for Several SSO issues ( user issues & logout page). 06-05-2020 12:45 AM
- Got Karma for Several SSO issues ( user issues & logout page). 06-05-2020 12:45 AM
- Got Karma for Report on all values of fields.. 06-05-2020 12:45 AM
- Got Karma for Report on all values of fields.. 06-05-2020 12:45 AM
- Got Karma for Report on all values of fields.. 06-05-2020 12:45 AM
- Got Karma for Report on all values of fields.. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 4 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 5 | |||
| 0 |
10-31-2017
09:17 AM
I have a table like this that is generated by a | stats values(value1) values(value2) values(value3) values(value4) by host
host col1 col2 col3 col4
host1 20 30 50 100
host2 20 25 50 90
host3 40 50 50 100
host4 40 55 50 100
What I am trying to get is a count of each of the values that are in "col1", etc
col1 col2 col3 col4
20 - 2 30-1 50-4 100-3
40 - 2 25-1 90-1
50-1
55-1
It doesn't need to be exactly that format, (e.g 20-2) but I want to know how many values of 20 and 40 are in value1,etc.
... View more
10-17-2016
10:21 AM
@splunkit, if you ~DO~ use KVStore?
... View more
10-10-2016
04:41 PM
That seemed to work until we configured the queue. Now getting the following errors. Not sure if it is related to the non-standard Java or something else.
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: java.lang.ClassNotFoundException:
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.lang.Class.forName0(Native Method)
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at java.lang.Class.forName(Class.java:270)
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at com.sun.naming.internal.VersionHelper12.loadClass(VersionHelper12.java:72)
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at com.sun.naming.internal.VersionHelper12.loadClass(VersionHelper12.java:61)
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:671)
10-10-2016 16:33:58.785 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" ... 5 more
... View more
10-10-2016
03:34 PM
Get the following errors when trying to start Splunk with the JMS Messaging Modular input.
10-10-2016 14:58:25.178 -0700 INFO SpecFiles - Found external scheme definition for stanza "jms://" with 32 parameters: jndi_initialcontext_factory, jndi_provider_url, jndi_user, jndi_pass, destination_user, destination_pass, jms_connection_factory_name, durable, index_message_properties, index_message_header, message_selector, strip_newlines, init_mode, local_init_mode_resource_factory_impl, local_init_mode_resource_factory_params, message_handler_impl, message_handler_params, client_id, user_jndi_properties, browse_queue_only, browse_frequency, browse_mode, jvm_system_properties, output_type, hec_port, hec_poolsize, hec_token, hec_https, hec_batch_mode, hec_max_batch_size_bytes, hec_max_batch_size_events, hec_max_inactive_time_before_batch_flush
10-10-2016 14:58:25.281 -0700 ERROR ModularInputs - Introspecting scheme=jms: script running failed (exited with code 1).
10-10-2016 14:58:25.281 -0700 ERROR ModularInputs - Unable to initialize modular input "jms" defined inside the app "jms_ta": Introspecting scheme=jms: script running failed (exited with code 1).
... View more
04-19-2016
07:46 AM
This should help you. Duo currently broken for anything > 6.2, here is a fix..
https://answers.splunk.com/answers/318889/duo-security-broken-in-splunk-63.html
... View more
06-18-2015
06:53 PM
I ran into the same problem. The only ODBC driver that Splunk has includes Microsoft binaries. I am just starting to learn Tableau, so not sure if there are other alternatives with OSX.
https://splunkbase.splunk.com/app/1606/#
... View more
01-17-2014
01:24 PM
Interesting trick I did was to flip what you are sorting for, so instead of row at top and col down the side, you put row down the side and col at top then do a | transpose
I had to do this to get time correct, wanted a result | chart count by date_wday,date_hour limit=24, but sorted wrong.
doing this seemed to work
result | chart count by date_hour,date_wday useother=f | table sunday monday tuesday wednesday thursday friday saturday | transpose 24
not pretty, but worked.
... View more
02-13-2013
10:52 AM
1 Karma
I have a 2 search heads distributed to the same servers. I run a search: index=X sourcetype=Y | table A B C
The search completes with 317,000 results.
On 4.3.4 when I do an "unlimited" export (to CSV) I get all 317,000 results
5.0.2 only 50,000 results in the "unlimited" export.
Is there a new limit to "unlimited"?
... View more
- Tags:
- export
04-04-2011
09:04 PM
This looks similar to the following post: http://answers.splunk.com/questions/10946/authorizationfailed-http-403-when-clicking-on-the-link-in-an-alert-email
It sounds like it was fixed in 4.1.6, we are running 4.2 I wonder if it broke again?
... View more
04-04-2011
08:41 PM
2 Karma
I have a user that is scheduling a saved search and has results get sent to multiple users. When the users click on the link included in the email they get prompted to log into splunk and immediately. get a 403 error "AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; None"
If they just log into splunk and run the search, they get results fine. They have the same roles as the person creating the search. Are the saved search results only accessible by the owner of the search? As admin I can see them of course.
... View more
01-26-2011
02:34 PM
4 Karma
I am trying to get a list of all fields values in our splunk server, but not a table..
A table would work, except that each line is unique for all fields in the line.
I want something that just lists all fields
e.g. * | table host os user would give me
host1 windows user1
host1 windows user2
host1 windows user3
host2 windows user1
host2 windows user2
host2 windows user4 (etc) giving 10,000+ results
What I am trying to get is a list that looks more like this:
host1 windows user1
host2 unix user2
host3 as400 user3
host4 user4
host5
host6
this list should only list each host once, each OS once, each user once.
Searching through the docs, I didn't see anything that would work.
thanks
... View more
12-31-2010
03:30 PM
We have some lookups, nothing that big, at least not in the app I am using, there might be something in one of the other apps.
... View more
12-30-2010
05:00 PM
What about if I want to make sure that Success comes before Failure? (bad example for login), but there is something else I am looking at where the order matters
... View more
12-30-2010
03:14 AM
1 Karma
I tried looking for something like this in answers and splunk docs and may not be using the right keywords.
Is there a way that I can do a search to find something like a failed login followed by a successful login within 10 minutes by a single user?
I was thinking about buckets, but I don't think that will work since I want to look 10 minutes after a specific event (login failure).
Conversely, I assume if I can find a way to do that, then I can find a way to also search for something like x not preceded by y (e.g. someone tries to log into one server without doing a virus scan 1st)
Thanks
... View more
- Tags:
- search
- transactions
12-21-2010
05:05 PM
Was this ever addressed? I need to do the same thing.
... View more
12-16-2010
09:20 PM
Here is something else that might work.
| lookup mytable.csv input | eval output if(isnull(output),"default value", output)
This looks up a field in the lookup, if the field is not there, then it will put output as "default value"
... View more
12-01-2010
11:59 PM
1 Karma
We have 2 search heads, one is a lab box, so lower performance 4 way 8gig ram, but very few people use it. The other is a 16 way box. Our primary search head does no indexing locally at all, the lab box does some, (10,000 events/day). For some reason, the lab box seems REAL slow when doing searches, system load/memory is all good.
The only thing I have found in the logs is the following:
From Lab box
12-01-2010 23:48:57.669 WARN DistributedBundleReplicationManager - bundle replication to 8 peer(s) took too long (227349ms), bundle file size=143900KB
From production:
12-01-2010 19:29:16.536 WARN DistributedBundleReplicationManager - bundle replication to 10 peer(s) took too long (10474ms), bundle file size=4130KB
I can't find any real reference to DistributedBundleReplicationManager in any documentation. The 'bundle replication" is taking a lot longer, and I am wondering if the "bundle file size" is making the one system slower than the other.
Any thoughts?
... View more
- Tags:
- distributed-search
11-16-2010
08:07 PM
The best answer I have seen so far is
http://answers.splunk.com/questions/481/search-for-inactive-splunk-users
We are going to put a feature request for this and several other 'user admin' improvements.
... View more
11-03-2010
06:10 PM
I am getting fields that include files that a) are not in the whitelist, b) have not been deleted (or changed)
The fschange part of the stanza is now:
[fschange:/opt/splunk/etc/system/local]
index = test
fullEvent = true
filters = configs,terminal-blacklist
recurse = true
pollPeriod=60
delayInMills = 1000
Wed Nov 3 18:00:01 2010 action=delete, path="/opt/splunk/etc/system/local/web.conf-taw"
Wed Nov 3 18:00:01 2010 action=delete, path="/opt/splunk/etc/system/local/transforms.conf.bak"
Wed Nov 3 18:00:01 2010 action=delete, path="/opt/splunk/etc/system/local/props.conf.bak"
... View more
11-02-2010
03:43 PM
We just left the data in the index and for future tests where we will be deleting data on a regular basis have created a 'test' index. With the test index we can run "./splunk clean eventdata test" that will clean that index completely so we can re-test an import. Having to do a csv export/import is more effort than we wanted to do. I am still not sure why splunk has issues causing errors when deleting (hiding) some data from an index with the | delete.
... View more
10-27-2010
04:53 PM
I removed regex4, and that seemed to fix the issue with blacklisted files getting indexed (authentication is a directory I have under system/local). I may just have to do multiple fschange stanzas
When I removed all filters, Splunk indexed "README" file, that showed up all in one event and with the sourcetype=misc_text.
So, it seems that if the sourcetype is csv-*, or *_too_small, it won't put it all in one event.
... View more
10-25-2010
02:17 PM
I have a few issues when trying to use fschange.
even though fullEvent = true & sendEventMaxSize = -1, I am still getting one line per event/file.
even though I have souretype = changed_files, I am getting other sourcetypes. (I get csv-2 for CSV files, conf-too_small, etc). I do get changed_files when source=fschangemonitor, but not when I look for the changes to the files themselves
Even though I have whitelist/blacklist, I am still getting files that are not listed in whitelist (e.g. path="/opt/splunk/etc/system/local/.inputs.conf.swp or web.conf.old")
trying to monitor /opt/splunk/etc/system/local & /opt/splunk/etc/system/local/authentication with one directory.
I have reviewed the following pages, and they seem to contradict each other in the format for placement of options and stanza order.
http://www.splunk.com/base/Documentation/latest/AppManagement/Configurationmonitoring
http://www.splunk.com/base/Documentation/latest/Admin/Monitorchangestoyourfilesystem
[fschange:/opt/splunk/etc/system/local]
sourcetype = changed_files
index = test
filters = configs,terminal-blacklist
recurse = true
followLinks = false
signedaudit = false
pollPeriod=30
fullEvent = true
sendEventMaxSize = -1
delayInMills = 1000
[filter:whitelist:configs]
regex1 = \.conf$
regex2 = \.py$
regex3 = \.csv$
regex4 = authentication
[filter:blacklist:terminal-blacklist]
regex1 = .?
... View more
- Tags:
- fschange
10-06-2010
03:15 PM
Interesting thing I found is that I had tried sending these events in as different sourcetypes, so the events (300,000) have been in Splunk as both "Type1" and "Type2".. When I do the | delete on Type2 I get the same errors. It turns out it looks like it the same 43 events will not delete out of either sourcetype.
This was a CSV file that was indexed, and the data source CSV file doesn't look strange for those lines that won't delete.
... View more
