How to approach custom field extractions for new source with deployment server
New to Splunk Enterprise. Confused as to what the best approach for configuring multiple field extractions for a new sourcetype in a multihost deployment. Looking for search time extractions on a log...
View ArticleVerify a list of values
Hello everybody (皆おはようございます) I have a new request for all members :) This search : sourcetype=sccm |streamstats count current=t reset_on_change=true by...
View Articlehttp_method is not fetching from PCAP file through splunk strem
Hi I am trying to read pcap file from splunk stream. Everything get fetched except http_method (which should be GET or POST). Please help me on this
View ArticleAMAZON SES SMTP credentials were not working with non-admin splunk account
Hi All, in our environment, we have AMAZON SES configured for the sendemail. If we run a query inline in the search bar getting below error(logged in to GUI using non -admin account)....
View ArticleTA_checkpoint-opseclea - Invalid key in stanza 'management_server_ip'
Hello, First post from a splunk noob so please go easy on me. **Setup:** Splunk 6.5.2 - Centos7(64) - Checkpoint_TA 4.1.0 (build1) Checkpoint R77.30 single management server (smartcentre svr not...
View ArticleWhy Splunk skipps forwarded events?
I created a subscriptions to forward custom application events from workstations to one central server to its "Application" log. I monitor this event log by Splunk, but In Splunk I can see only origin...
View ArticleCheckpoint opsec-LEA - Invalid stanza in...
Hello, Sorry if this is a repost! I wrote a question this morning and it went for moderation and has disappeared from my account. **Setup:** Centos7(64) with pam.i686 and gclibd.i686 - Splunk 6.5.2 -...
View Articlehow to monitor device send out much log unusually?
Dear fellows， i am trying to write a searching string to monitor which of my device send out much log unusually. i think i may try to find out the volume by host by day, then find out the avg_value of...
View ArticleSet queue size for splunktcpin
Hi, How to correct set splunktcpin queue size on indexers? I tried: in server.conf: [queue] maxSize = 2MB in inputs.conf: [splunktcp://9997] queueSize = 4M Restarted indexers, but it doesn't help. I...
View Articlewhy i am seeing inconsistency in events data when searching in splunk ?
Hi All, Recently we have added an customized app to pull the log information from SAP HYBRIS and after pushing this app from DP instance to the host machine and verified the log are getting indexed...
View ArticleHow to copy already indexed data to the new indexer in multisite clustered...
I have two sites in my multisite clustered environment. On site 1, I have 4 indexers, and on site -2 I have 1 indexer. On site 2, I am planning to decommission the current peer node (indexer) and add...
View Articlerex don't work in all cases - _raw greater than 56kb?!
Hi, I'm trying to extract two fields with this rex: Transaction\sID=\"(?P\w*)\".*OperationCode=\"(?P\w*)\" and it works in almost all records but it seems that when the _raw field is greater than 56kb...
View ArticleHow to ignore the logs of my single instance?
I have a single instance in CentOS 7 and I am insteresting to reiceive and analyze logs of my linux server but when I installed the unix app in my single instance I exceeded my licence because I...
View Articlesplunk sdk for .net4.0
hi I have been trying to find splunk sdk for .net 4.0 can someone please help? we can't upgrade our solution to .net 4.5 for various reasons. I did look up quite a while. please help
View ArticleUF indexes CP1251 file twice first time
Hello! I'm trying to pre-filter and forward structured .csv file from Universal Forwarder to Splunk Enterprise server. This file is CP1251 encoded, not UTF-8. I've made a new sourcetype and copied it...
View ArticlePerfmon - how to specify an index at installation time or with CLI ?
Hello Is it possible to specify an index when you install an universal forwarder for perfmon's metrics or after with the CLI ? I don't want to modify directly the .conf file. By default the data are...
View Articlehelp me with error in XML for a dashboard
while i am trying to update<a target="_blank" href="/app/search/user_details_v2?form.field4.earliest=-4h%40m&form.field4.latest=now&form.field3=&earliest=0&latest=">Get User...
View Articlehow to integrate CA APM data to Splunk ?
Hi Team, We have a CA APM plaform where all the servers performance metrics are stored. So now I have to pull this performance metrics from CA APM plaform to Splunk and make it available for all the...
View Articleloginhistory input stopped working on SFDC app
Months after installing this app, the LoginHistory input stopped pulling data. I tried disabling the current input and recreating one from scratch, but nothing is being indexed. Not seeing any...
View ArticleOne of the app is not downloading into deployment server , whereas similar...
I have 3 servers and one of the server's deployment apps is not downloaded into Deployment server and below are the errors that i get in splunkd.log . I did restart t he forwarder and check ther...
View Article