Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About apietersen
apietersen
Contributor
Member since:
05-25-2016
03-25-2024
Community Statistics
| Posts | 131 |
| Solutions | 2 |
| Karma Given | 17 |
| Karma Received | 11 |
| Member Since | 05-25-2016 |
Activity Feed
- Posted Re: Sendemail does not work if selected in the Alert config, but sendemail does work! on Alerting. 02-19-2024 08:49 AM
- Posted Re: Sendemail does not work if selected in the Alert config, but sendemail does work! on Alerting. 02-17-2024 06:37 AM
- Posted Re: Sendemail does not work if selected in the Alert config, but sendemail does work! on Alerting. 02-17-2024 04:30 AM
- Posted Re: Sendemail does not work if selected in the Alert config, but sendemail does work! on Alerting. 02-17-2024 04:07 AM
- Posted Sendemail does not work if selected in the Alert config, but sendemail does work! on Alerting. 02-17-2024 01:29 AM
- Got Karma for Re: What is happening in Splunk Enterprise V9.1.0.1 ?. 12-06-2023 02:21 AM
- Posted Re: What is happening in Splunk Enterprise V9.1.0.1 ? on Splunk Enterprise. 12-06-2023 02:14 AM
- Posted Re: What is happening in Splunk Enterprise V9.1.0.1 ? on Splunk Enterprise. 11-21-2023 03:18 AM
- Posted Re: Why am I getting the following error when trying to install the Splunk Add on Builder on a Windows machine? on All Apps and Add-ons. 11-04-2023 11:33 AM
- Got Karma for Re: What is happening in Splunk Enterprise V9.1.0.1 ?. 10-02-2023 08:03 AM
- Posted Re: What is happening in Splunk Enterprise V9.1.0.1 ? on Splunk Enterprise. 09-29-2023 11:18 PM
- Posted Re: How do I disable redirection warning? on Dashboards & Visualizations. 09-14-2023 01:27 AM
- Posted Re: What is happening in Splunk Enterprise V9.1.0.1 ? on Splunk Enterprise. 08-24-2023 03:16 AM
- Posted Re: What is happening in Splunk Enterprise V9.1.0.1 ? on Splunk Enterprise. 08-09-2023 01:18 AM
- Posted Re: What is happening in Splunk Enterprise V9.1.0.1 ? on Splunk Enterprise. 08-07-2023 04:57 AM
- Posted Re: What is happening in Splunk Enterprise V9.1.0.1 ? on Splunk Enterprise. 08-06-2023 10:33 PM
- Karma Re: How do I disable redirection warning? for ITWhisperer. 08-06-2023 05:13 AM
- Posted Re: How to use existing csv date-time fields for earliest and latest in new subsearch? on Splunk Search. 08-06-2023 05:11 AM
- Tagged Re: How to use existing csv date-time fields for earliest and latest in new subsearch? on Splunk Search. 08-06-2023 05:11 AM
- Karma Re: What is happening in Splunk Enterprise V9.1.0.1 ? for isoutamo. 08-06-2023 04:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-19-2024
08:49 AM
Update: Had a session today with O365 support about message in python.log: (posted before) SendAsDenied; ticket@eremote.nl not allowed to send as Splunk_eRemote@uBDC01;" Answer: As discussed on the call, the bounceback (NDR report) you received shows that your office 365 account (ticket@eremote.nl) is not allowed to send email as Splunk_eRemote@uBDC01. This shows that there is a setting in Splunk that is preventing this action. And like I mentioned on the call, from Microsoft 365 perspective, email relayed is allowed and that is why you can send normal email from the application, and it delivers. De 'Splunk_eRemote@uBDC01' comes from the SMTP-server settings in Splunk: Note: 1) We use O365 and some 4-5 months ago we stepped over from a personal account to a shared account (but did not notice the defect in the Alerting_email_function, just last week :-(. As Sendemail was working in Dasboards and in SPL code as expected. 2) We now use a shared mailbox under O365, which means you can not use any Alias. Before we could. 3) Using my personal account (with Alias's) is 2FA and is not possible according to O365 support. 4) Last week tried many things -including different fields A en B, without succes. Also tested it with use of a GMAIL account, no succes either. 5) Yesterday (Sunday) rebooted our W2029 server as part of our weekly maintenance schedule, Today I found out: Note: Field A (username) must be same as SendAS (in the past we used only the word "Splunk" in field B) Also note that keeping the B feidl empty it does a discovery and comes up with "Splunk@uBDC01" so it appears. Now it is working again (in test) with field-A = field-B! (what is de use? apperantly only working in combination with personal-account and proper Alias, I conclude) I will close this post now and thank you for the repsonse PickeRick :-)! AshleyP
... View more
02-17-2024
06:37 AM
I have already send a support request to MS Office365. Hope that they can give a better or more detailed reason then "SendAsDenied; ticket@eremote.nl not allowed to send as Splunk_eRemote@uBDC01;" In the mean time I will follow also my Splunk support-case route... Will post my findings here, later....
... View more
02-17-2024
04:30 AM
Yes it does when using:
| makeresults
| sendemail to="aaa@ccc", from="bbb@eee.nl", subject="Testing Email from Splunk / from: uBDC01", use_ssl=false, use_tls=true
or as form in a Dashboard we use to create a ticket for our customer. Only alerting has stop working recently? BTW: we use OFFICE365 so this should be occuring elsewhere too, do not you think?. And no errors-essaging is showing in Splunk (as user or as admin) when this happens. So you suggest to look in the O365 log of the exchange environment?
... View more
02-17-2024
04:07 AM
Hi PickleRick, Thanks, 1) Yes, I have tried many thing, also by using the opposite condition: alert_condition = search mincount < 7 2) In all the logs I have checked (including sendemail.py, which does not log anything in my opinion) and searched, it is/was successful, status: success, not skipped or otherwise found to be delayed or ??? 3) example spl: index=_* AND alert_actions="email" | stats count by status Output: 42 Success over last 24h 02-17-2024 12:12:17.264 +0100 INFO SavedSplunker - savedsearch_id="nobody;search;Alert_trigger_1v1", search_type="scheduled", search_streaming=0, user="admin", app="search", savedsearch_name="Alert_trigger_1v1", priority=default, status=success, digest_mode=0, durable_cursor=0, scheduled_time=1708168200, window_time=0, dispatch_time=1708168333, run_time=0.142, result_count=1, alert_actions="email", sid="scheduler__admin__search__RMD5ea1ed26b5154d33f_at_1708168200_47", suppressed=0, fired=1, skipped=0, action_time_ms=3528, thread_id="AlertNotifierWorker-0", message="", workload_pool="" So no error message to be found sofar?? What do I miss here. Although I also searched in python.log and I found part of many messages: 2024-02-17 12:32:17,265 +0100 ERROR sendemail:572 - (554, b'5.2.252 SendAsDenied; ticket@eremote.nl not allowed to send as Splunk_eRemote@uBDC01; STOREDRV.Submission.Exception:SendAsDeniedException.MapiExceptionSendAsDenied; Failed to process message due to a permanent exception with message [BeginDiagnosticData]Cannot submit message. ....>> Splunk_eRemote@uBDC01; Splunk_eRemote is a textfield in SMPT-settings. Python code seems to append "@uBDC01" to it (is the hostname of my testserver ???) I can not make any sense out of it (same setting used in past 6 year?!) on our production server Again: Sendemail is working fine, in dashboard-search (form) and when using it for testing by running manual SPL code in searches Any thoughts? regards AshleyP
... View more
02-17-2024
01:29 AM
Created a supportticket: Sendemail does not work if selected and set in the Alert config. But Sendemail function is working OK!? Business Impact: Can not respond on any "System_down/System_offline" situation . Happens not very often but very critical to respond to. Product Version : 9.2.0.1 / I assume that it might not work since Splunk Enterprise v9.1.2 either (not sure) Area: Search/Index - Splunk Enterprise Deployment Type: On Prem / Small instance with only indexer, kV Search-head active OS: Windows 2019 server When did you first notice the issue? Somewhere 1/26/2024 (noticed a system_down situation on dashboard but was not notified by email) Did you make any changes recently?: I upgrade last week to v9.2.0.1 on our test server. Later I found that our production server (v9.1.2) has the same issue Steps Reproduce: You can created an Alert_Trigger_Test: (zie code below) | makeresults | eval ATT=4 | stats max(ATT) as mincount Then test it every 5 minutes (cron-schedule) by: search mincount < 7 ======================Alert Code : in savedsearch.conf (.../search/local) ===================== [Alert_trigger_1v1] action.email = 1 action.email.cc = <your@email_address_2> action.email.include.search = 1 action.email.inline = 1 action.email.priority = 2 action.email.sendresults = 1 action.email.to = <your@email_address_1> action.email.useNSSubject = 1 action.lookup = 0 action.lookup.append = 1 action.lookup.filename = alerttrigger.csv alert.digest_mode = 0 alert.expires = 1h alert.suppress = 0 alert.track = 1 alert_condition = search mincount >7 allow_skew = 5m counttype = custom cron_schedule = */5 * * * * dispatch.earliest_time = -5m dispatch.latest_time = now display.general.type = statistics display.page.search.mode = verbose display.page.search.tab = statistics enableSched = 1 quantity = 0 relation = greater than request.ui_dispatch_app = search request.ui_dispatch_view = search search = | makeresults \ | eval ATT=3\ | stats max(ATT) as mincount =======================END Code =================== Is there any one else suffering from the same issues? regards AshleyP
... View more
Labels
- Labels:
-
alert action
-
alert condition
-
email
12-06-2023
02:14 AM
1 Karma
Did you upgrade to v9.1.2 already? If so, I suggest you create a ticket at support. The replacing was a temp work-around solution for us from v9.1.0.2. On our test server I was curious if this work-around would still work on v9.1.1 - It did not ! So I decide to wait for the release of v9.1.2. After the release I first tested on our test server and had no problem any more with sending email. After some days we upgraded to V9.1.2 on our production machine. Nb. Both our servers are running Windows 2019, and now both are on Splunk Enterprise v9.1.2 without problems so far.
... View more
11-21-2023
03:18 AM
Last week v9.1.2 has been released. (6 nov 2023, I think it was) After installing this version on my test instance (v9.1.1) everytyhing seems to work again including sendemail - no issues found. Great! 👍 After installing this version several days later on our production instance (9.1.0.2) also sendemail was working fine again. Great! 👍 NB. after that I was also able to fix all other issues on our production instance as mentioned before in this post, like: kvstore, secure gateway etc Great! 👍 Many thanks to support- and development team. I am now happy splunking again! 👍👍 😀 I hereby close this post.
... View more
11-04-2023
11:33 AM
Completely ridiculous, at Nov-2023 on Splunk Enterprise v91.1.1 still an issue installing Python for Scientific Computing (for Windows 64-bit), even after change setting upload limit in web.conf as documented # Default is to allow files up to 500MB to be uploaded to the server # change this in local/web.conf if necessary # max_upload_size = 500. max_upload_size = 5000. There was an error processing the upload.Error during app install: failed to extract app from C:\Windows\TEMP\tmpp0s51vp5 to D:\Program Files\Splunk\var\run\splunk\bundle_tmp\f8e20425d3b382c7: The system cannot find the path specified. What do I miss here, how much must be this size be to , what units, or where are the brains of splunk. Splunk Enterprise after v9. 1.x is full of **bleep**.
... View more
09-29-2023
11:18 PM
1 Karma
response from support / development: (last week) and now testing, worked and looks good sofar temporary workaround: --=-=--=-=-=-==-=-sendmail.py-=--=-=-=-=-- Do you have a test instance to check the one parameter? We got an update from the developer team, to check the below parameter, open the file SPLUNK_HOME/etc/apps/search/bin/sendemail.py and you would find (approx line number 1571): clear_password = cli_common.decrypt(encrypted_password, setEnv=True) The setEnv flag needs to be modified from True to False, restart Splunk, and then check if the problem is resolved. Note: Try with your test instance. As the setEnv flag needs to be modified from True to False will be considered a temporary workaround for this issue. In the next release version 9.1.2, It will be fixed completely. -=-=-=-=-=---=-icon-=-=-=-=--= Additionally, the "loading" icon got stuck issue also will be fixed in version 9.1.2. -=-=--=-= regards AP @wskinner @isoutamo
... View more
09-14-2023
01:27 AM
Hi, this worked for me, in file ...etc\system\local\web_feature.conf: [feature:dashboards_csp] enable_dashboards_redirection_restriction = false
... View more
08-24-2023
03:16 AM
Update: support reported the email issue has changed prority from P2 to P3 All other issues mentioned in this post: no solution found yet
... View more
08-09-2023
01:18 AM
Update 09-aug: the second remote zoom on monday 7-aug meeting did not results in any solution sofar unfortunately. All issues are still under investigation by support and developement, so I understand. thanks
... View more
08-07-2023
04:57 AM
Looking back: v9.0.4.x no issues noticed v9.0.5.x noticed KVStore issues v9.1.0.1 noticed all sort of issue including not working 'sendemail' (upgraded as I had hoped/assumed to be fixed) v9.1.0.2 still the same issues + new strange behaviour : only reading 3 columns from any csv file (upgraded as I hoped/assumed to be fixed) Nb. Have a zoom meeting with Splunk support later this afternoon thanks Reminder: running on Windows 2019 standard, Xeon CPU, 16 cores, 64Gb , 2Tb ssd
... View more
08-06-2023
10:33 PM
After the upgrade to v9.1.0.2, last weekend - hoping and assuming some issues were adressed and fixed, as noted in this post, now another issue arised, which make our production-instance even more unreliable. When using an siimple '| inputlookup email.csv' search it only show 3 columns ! On our fresh build test-server with instance v91.0.2 the same serahc produce the correct number of columns. Has somebody experinced this same issue or have a glue why or have a tip. Or what do I miss here? By the way. the sendemail did not work either after upgrade to v91.0.2, after restoring an sendemail.py file from backup v9.0.4 (as I described in this post earlier sendemail was working again, for now. But what is next! 😞 Nb. Sorry, I really think Splunk should pay more attention to testing and quality control before releasing new versions. thanks
... View more
08-06-2023
05:11 AM
Update, finally I succeed by using the subsearch as was mentioned before + creating 3x6=18 daily scheduled reports. (6 machines) Dahboard to split in 2 tables panel... Nb. Unfortunately I was not able to make a historical search all-in-one! Thanks
... View more
08-06-2023
03:36 AM
update: after upgrade to Splunk Enterprise v9.1.0.2 , "sendemail" issue still exist.
... View more
07-31-2023
01:22 PM
Update: Last Friday Spiunk Support responded: problem with "sendemail" was identified as a bug and will be solved in next version. Nb. Just noticed version v9.1.0.2 but there was no mention of/refering to this specific fix. I will wait for next version. Sendemail is still working after restoring the senemail.py form backup v9.0.5
... View more
07-28-2023
05:00 AM
Update: My main problem was not able to send critical Alerts and other message by email any more after upgradding to v9.1.0.1. Finally I was able to solve this by copying the latest 'sendemail.py" from my backup of v9.0.5. into directory: ....\Splunk\etc\apps\search\bin . After that I could send email as before. Note: The "sendemail.py" that I copied from backup seems to be 2 lines longer than the new one installed by v9.1.0.1. Did not investigate it further, what the differences is. Busy to correct temp workarounds and made me and my users happy Splunking again. 🙂 Other issues are still open, but for now no showstoppers. Have send this info also to Splunk support but did not here back from them yet. Thanks
... View more
07-26-2023
03:41 AM
Thanks, I will do. 😀
... View more
- Tags:
- thanks
07-26-2023
03:13 AM
OK I will try: “splunk cmd OpenSSL” instead of just “openssl”. Thanks
... View more
07-26-2023
03:10 AM
Hi Both account belongs to me but have different domains. (and no trust-relation in place) Manual sending is no problem and use this daily. It was working for years now based on O365, it sopped after the upgarde. Besides no messages were received form MS that O365 have changed their relay rules. So for now I suspect something not OK in the Splunk 9.1.0.1 environment. Thanks
... View more
07-25-2023
10:43 PM
Update: Yesterday we had a remote session (Zoom) with Splunk Support. No quick fix found. It needs to be investigated further: Their observations: ------------------ - After upgrading the Splunk version to 9.1.0.1, the sendemail command is not working it is giving some errors on the production instance and test instance. command="sendemail", The email domains of the recipients are not among those on the allowed domain list. while sending mail to: a.pietersen@.... command="sendemail", (530, b'5.7.57 Client not authenticated to send mail. [AS4P195CA0039.EURP195.PROD.OUTLOOK.COM 2023-07-25T10:35:23.523Z 08DB887EFF8B2458]', 'pietersen@i....) while sending mail to: a.pietersen@.... - The top of the screen showed a loading icon as I was reviewing the Server settings for the Email settings. Nothing can be done on the Email settings page. - Additionally, we attempted to restart the UI by accessing the server controls. The loading icon at the top of the page appeared on the server control page as well, indicating the same problem. - Additionally, the Splunk assist page is not working and displays the error message "Error Loading Splunk Assist." - Even though we attempted to restart the search head using the CLI, the errors and issues persisted after the restart. ------------------ Thanks, hope they can find a remedy soon, because I am out of my option for now.
... View more
07-24-2023
07:21 AM
sorry, both on test-server and on production server shows:
... View more
07-24-2023
02:06 AM
On my Test-server, I have copied a fresh server.conf from default directory and changed the license manager field. It is coming up and I can login but but still hangs on endless "loading..." when trying to change something (like restart) Also Assist show an error:
... View more
07-24-2023
01:37 AM
Hi, looked in server.conf: (both test server + production) Sorry , can not find any path or refence to certificates? test-server:
... View more
