Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Splunk Answers
- :
- About JAvnaim
JAvnaim
Explorer
Member since:
04-29-2019
05-15-2023
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 04-29-2019 |
Activity Feed
- Posted Re: Error adding External Splunk Enterprise Instance to SOAR on Splunk SOAR (f.k.a. Phantom). 05-15-2023 06:26 AM
- Karma Re: Error adding External Splunk Enterprise Instance to SOAR for phanTom. 05-15-2023 06:26 AM
- Posted Error adding External Splunk Enterprise Instance to SOAR on Splunk SOAR (f.k.a. Phantom). 05-14-2023 10:35 PM
- Posted Re: Unforseen Error during upgrade from enterprise 8.2.9 to 9.0.4.1 on Splunk Enterprise. 05-14-2023 04:02 PM
- Posted Unforseen Error during upgrade from enterprise 8.2.9 to 9.0.4.1? on Splunk Enterprise. 05-14-2023 09:15 AM
- Posted Re: Can I Remove The 'splunk>' Label From Embedded Reports on Dashboards & Visualizations. 09-14-2021 06:49 AM
- Posted Re: Can I Remove The 'splunk>' Label From Embedded Reports on Dashboards & Visualizations. 09-13-2021 08:03 PM
- Karma Re: Help creating a table that shows unique events from last 24hrs, that have not occurred within the last 30days for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Dynamic value display in the Panel Title for russellliss. 06-05-2020 12:47 AM
- Posted Re: Help creating a table that shows unique events from last 24hrs, that have not occurred within the last 30days on Splunk Search. 12-02-2019 01:41 PM
- Posted Help creating a table that shows unique events from last 24hrs, that have not occurred within the last 30days on Splunk Search. 12-02-2019 11:58 AM
- Tagged Help creating a table that shows unique events from last 24hrs, that have not occurred within the last 30days on Splunk Search. 12-02-2019 11:58 AM
- Tagged Help creating a table that shows unique events from last 24hrs, that have not occurred within the last 30days on Splunk Search. 12-02-2019 11:58 AM
- Tagged Help creating a table that shows unique events from last 24hrs, that have not occurred within the last 30days on Splunk Search. 12-02-2019 11:58 AM
- Tagged Help creating a table that shows unique events from last 24hrs, that have not occurred within the last 30days on Splunk Search. 12-02-2019 11:58 AM
- Posted Re: Dashboard PDF email failing on Splunk Search. 04-29-2019 07:30 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
05-15-2023
06:26 AM
Thanks @phanTom for the quick reply! Your response made perfect sense to me; however I have validated: I was able to log into Splunk Enterprise as phantomdelete As phantomdelete, I was able to "delete" events (using "| delete" in a search) - is there another way I should be testing to delete events? Validate the events are no longer shown in the search Logged back into SOAR and after pressing "Test Connection", the same error as noted above is shown. Thinking there was something wrong with the phantomdelete user, I removed the account from Splunk Enterprise and recreated it (using a different name). Oddly enough, after recreating it, and testing it again in SOAR, I am greeted with "Test Successful"! So weird, but now my SOAR and Splunk Enterprise appear connected. Thanks for your help!
... View more
05-14-2023
10:35 PM
Hello, I am attempting to add an External Splunk Enterprise Instance to SOAR and receive the following error when I click "Test connection": I am running Splunk Enterprise On-Prem v8.2.9, Splunk App for SOAR 1.0.41, and SOAR (Unprivileged, On-prem) v6.0.0.114895. What's interesting is I can see the events be created in Splunk Enterprise in the phantom_action_run index: Does anyone happen to know what the (not very descriptive) error "status" means? Whats also interesting is none of my hosts are named "Splunk", so wondering where the error is pulling that hostname from? Thanks ahead of time for your help! ~J
... View more
Labels
- Labels:
-
configuration
-
installation
05-14-2023
04:02 PM
I did not; I reverted back to 8.2.9 and restored the config back up. All is well now. Eventually will need to upgrade to 9x though.
... View more
05-14-2023
09:15 AM
Hello All,
I receive the following error after starting Splunk enterprise for the first time after an upgrade from 8.2.9 to 9.0.4.1 ; otherwise no other problem seen prior:
Exception: <class 'UnicodeDecodeError'>, Value: 'utf-8' codec can't decode byte 0xff in position 0: invalid start byte
Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1212, in main parseAndRun(argsList) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1067, in parseAndRun retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 293, in call return self.func(args, fromCLI) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/control_api.py", line 35, in wrapperFunc return func(dictCopy, fromCLI) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/_internal.py", line 189, in firstTimeRun migration.autoMigrate(args[ARG_LOGFILE], isDryRun) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 3379, in autoMigrate migrate_add_default_dashboard_xml_version_1_1(dryRun) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 3131, in migrate_add_default_dashboard_xml_version_1_1 dashboard_contents = f.read() File "/opt/splunk/lib/python3.7/codecs.py", line 322, in decode (result, consumed) = self._buffer_decode(data, self.errors, final) UnicodeDecodeError: 'utf-8' codec can't decode byte 0xff in position 0: invalid start byte
Any help would / pointers would be appreciated!
~J
... View more
Labels
- Labels:
-
upgrade
-
using Splunk Enterprise
09-14-2021
06:49 AM
I've searched and have not found anything. I found how to remove the logo from the PDF reports, which does not apply to embedded reports though. I also think I could simply remove (or replace with a blank file) the actual logo on the server, but not sure that is the best approach either.
... View more
09-13-2021
08:03 PM
Hey @Lane , I have this same problem/question. Did you ever figure it out? ~J
... View more
12-02-2019
01:41 PM
This worked great; thank you!
... View more
12-02-2019
11:58 AM
Hello,
I have an index with ALPR (license plate) data. I'd like to create a table, that shows unique plates detected within the last 24hrs, that were not previously detected within the last 30 days. I tried using the search below, however, it's not returning the desired results.
I think it's because I have not indicated which field to search on (in this case, it would be Plate).
Any help would be greatly appreciated. Thanks!
index="alpr_logs" source="http:openalpr" Is_Parked=False earliest=-1d latest=now NOT [search index="alpr_logs" source="http:openalpr" Is_Parked=False earliest=-30d latest=-1d] | table Plate Region Color Make Model Year
... View more
04-29-2019
07:30 AM
Hello,
I have the same issue, which appears to be introduced in 7.2.6, as email PDF delivery was working prior to upgrade.
I'd like to try the workaround, however am slightly confused as where to find the sendemail.py version from Splunk 7.2.0 ? Do I need install 7.2.0 and extract sendemail.py or is there an archive somewhere I could pull it from?
Thanks for your help!
Jordan
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-15-2023
11:00 AM
|
