About eholz1

eholz1

Hello All, I have searched high and low to try to discover why the kvstore process will not start. This system was upgraded from Splunk 8.0, to 8.2, and finally 9.2.1. I have looked in mongod.log and splunkd.log, but do not really see any thing that helps resolve the issue. Is ssl required for this? the - is there a way to set a correct ssl config, or disable it in the server.conf file? Would the failure of the KVstore process affect IOWAIT? I am running on Oracle Linux, ver 7.9 - I am open to any suggestions. Thanks ewholz

eholz1 · ‎12-20-2023

dtbur;rows3 Wow, fast reply. Thanks. The ID gets set when the csv file is written. I have a python program that queries a MySQL database, and writes a "0" as ID if no results are returned from the query. If there is data returned, the ID is taken from query results (i.e ID=34, etc). The csv file is on a remote server. I use the Splunk Universal Forwarder to send the file to splunk. Is there a way to get this file set as an "input lookup" or does the "input lookupo" required the file to be local to the Splunk server? Thanks for quick help. EWHolz

eholz1 · ‎12-20-2023

Hello All, I have a search question. I have a csv file that returnds data. the ID field if there is no data - I want to have a table which shows 4 columns: NAME,STATUS,DATE,ACTION. These come from the csv file header line. If the ID >0 I want to show these columns: DATE-Changed,ID,NAME,DATE_DOWN,ACTION. I have not yet seen how I might do this. What I need, in a sense, it two searches, one when ID=0, and one when ID>0. Any suggestions? Thanks, EWHOLZ

eholz1 · ‎12-20-2023

Hello Members and richgallowy, Thanks for the tip. It has been a while since I have needed to apply my limited "Splunk" skills, I appreciate this suggestion, and will try it out;. Regards, EWHolz

eholz1 · ‎12-19-2023

Hello, I need some help. Icreate a csv file on remote server from a mysql quert. I forward the csv file from the remote server to splunk. I can read the data. The csv file is over written each day, it have have only 1 line of data, or multiple lines of data - it is a list of device that have gon down. If no devices are down, the the file only has the hearder, and data that says: :No Devices Down:" I only want to see data from the file on the day the file is writtern. The challenge I have is to read only the data in the file for that day. The issue is that splunk indexes the data, so splunk retains the data over time, like I want only 1 day info from the file, but splunk has all the data indexed How can I return only the data for the day, not for all data in splunk indes? thanks, EWHolz

eholz1 · ‎12-05-2023

Hello Members, I would like to import/show data in a splunk dashboard. This data is results from a mysql query run by php to create an html page with the results in an html table. Most likely the easiest way to do this would be to write the data to a csv file, and use splunk forwarder to send the data to splunk. The data needs to be checked once a day. I was wondering if there is a way to build a dashboard from the data via the splunk REST api, or import/forward the html page that get created from the mysql query. The query is run on a remote server. I looked at the splunk-sdk-python but its implementation is not user friendly - it requires docker, which I cannot get running for some reason. I am open to any and all suggestions. thanks eholz

eholz1 · ‎08-31-2023

Hello All, I am hoping for some guidance here. I am using Maps+. It seems to be a decent application. There are two things I want to do, ans so far no joy. 1. I want to be able to change the color of the cluster circle. 2. I want to be able to "un-zoom" back to initial state after clicking on a cluster circle. My map show routers and switches, by lat/long that are UP or DOWN. I have no issues with markerType or color or icon style. I would like to change the cluster circle color for devices that are "down". Can I do this? or do I have to use a legacy map type. thanks so much, eholz

eholz1 · ‎08-28-2023

Hello All, I have seen this post (which is helpful) "How to get the on click marker gauge redirect to a dashboard?" I would like to run a search instead of setting a variable on a panel. Is this possible? The javascript writes the value to a $toke$ variable on a second panel. I would like to run a search - the filler gauge does not have an option for a drilldown. Yes - the easy way is to just click the search magnify glass. Thanks, eholz1

eholz1 · ‎08-10-2023

Hello All, I have created a filler gauge for a count of events. I would like to not see the scale on the right side of the gauge, or change the major units to show just 100s. Is this possible - see image below: I have searched to see if I can change this, but have not yet found the answer, thanks as always, eholz1

eholz1 · ‎08-04-2023

Hello richgalloway, Thanks for the reply. At least I know my "logic" is correct! Thanks for the reply, and even answers to my previous posts. I will try your suggested search. The community is a valuable resource. eholz1

eholz1 · ‎08-03-2023

Hello All, I would like some suggestions. I am trying to search the Cisco ASA sourcetype in Splunk for the current users that are logged in to an ASA. I am trying to use "last 24 hours" as the start time range. I am trying to count login message (113004) and compare with logout message (722023). There are other message ids for logout:716002, 113019. It seems that I need the "latest" login. The user can log in and log out - I can get pairs by user for a login/logout. If there is a pair like that I can assume the user is not logged in. The challenge comes with the fact the user can have logged in and out multiple times. My theory is that if a user has more logins that logouts (assuming there is a login later than a log out). this should be a user that is logged on. The trick seems to be finding the latest log in per user, and counting values in the "message_id" field. Any suggestions here? I can check users on the ASA using the "show vpn-session summary" command, but that number almost never matches my searches. I can use any suggestion. Thanks eholz1

eholz1 · ‎07-28-2023

Hello, and Thank you This is what I need. Again I thank you for the information. Eholz1

eholz1 · ‎07-25-2023

Thank you very much for the reply. I will try the search you suggest. Here is a screen shot of one result, which shows the number of events over time. But, starting from left of chart, instead of seeing values like: 7, 12,13,12,9 - I would like to see 7,19,32,41, etc. Thanks Again, will check your suggestion, and get back

eholz1 · ‎07-24-2023

Hello Members, I have seen and used the accum command, but it does not quite give me what I want. I have this search below which gives me a line chart with event count over the time range: index=main sourcetype=cisco:asa host=* message_id=113004 | eval Date=strftime(_time, "%Y-%m-%d %H:%M:%S") | timechart count BY message_id The graph type can be any type. I would like to get an accumulated total for a time period, like 24 hours, OK to count every hour, but show the accumulated count each hour, with the ending total for the time range, i.e. 24hr. Thanks for greate source of help here, eholz1

eholz1 · ‎04-01-2023

got it at last, from another post, use <a href tags, thanks all, eholz1

eholz1 · ‎04-01-2023

Hello gcusello, thanks for the reply, I tried this, but I cannot link from the "Cisco TA" dashboard to my other app/dashboard. Does the dashboard need to be global? eholz1

eholz1 · ‎03-31-2023

Hello All, Is it possible to edit the default navigation menu for one app, to show a dashboard in a different app? Or, is the navigation menu only possible within an app? thanks, eholz1

eholz1 · ‎03-22-2023

Hello Splunkers, Is there a way to add padding or control white space between the single value blocks in the aggregated fields? i.e I have three blocks created in single-value using the trellis viz. This creates three nice blocks, but I would like to increase the white space between them if possible. Or use 3 separate single value viz, and space them with padding, etc. thank you for a great resource, eholz

eholz1 · ‎03-17-2023

Wow, Thanks again for the input. I appreciate it. I will review, and figure out what would be nice to use. thanks for taking the time to do this. eholz1

eholz1 · ‎03-16-2023

One more queston, this works great. Is there a way I can set a static color based on the "title" of the trellis viz? i.e. In_gb is green, Out_gb is blue, etc. Thanks again for an excellent solution. I would like to have a different color for each result (in block mode) thanks again, eholz1

eholz1 · ‎03-16-2023

Wow thanks for fast reply, I will try it out, thanks again, eholz1

eholz1 · ‎03-16-2023

Hello all, I have three individual searches for a single value viz. the value for each viz is a sum of a field. I have bytes, bytes_in, and bytes_out. Each search is | stats sum(bytes) as Total, sum(bytes_in) as In, and sum(bytes_out) as Out So 3 searches for each field, and a single value viz for each field. I have looked at the trellis viz, but it is not much help. My actual spl is using the same formula for each field: index=squid | stats sum(bytes_in) as TotalBytes | eval gigabytes=TotalBytes/1024/1024/1024 | rename gigabytes as "Bytes In" | table "Bytes In" Is there some way to put all three stats commands in the same search, and maybe the trellis can get each calculation? I looked at trying to put each single value in a table 3 column by one row, etc How can this be accomplished. Thanks again, eholz1

eholz1 · ‎03-06-2023

This is excellent, thanks so much. Great forum!!

eholz1 · ‎03-03-2023

Hello Is it possible to style the status_indicator.status_indicator_app in a manner like we can for the "single value" chart? Can code similar to this be used? <html> <style> #test { font-size: 18px !important; font-weight: bold !important; font-color: red; } .single-value .single-result { font-size: 30px !important; } </style> </html> Thanks, eholz1

eholz1 · ‎01-24-2023

Hello manjunathmeti Thanks for the reply. In our case we want to use the cisco TA Network plugin. We are monitoring only logs from cisco devices which do not have UF capability. But, I will consider your suggestion. The NON-root user cannot access any port below 1024 thanks to security features in Splunk and newer Linux distributions. I will look at the links you provided, to double check. But the base problem is: If we want to send logs direct from the cisco device (routers and switches) the logging feature on the ios on these devices ONLY allows the use of port 514 to send data to splunk. The whole idea here is to leverage the Splunk Cisco TA plugin to search and organized data. Thanks, eholz1

Posts	142
Solutions	2
Karma Given	49
Karma Received	5
Member Since	‎03-25-2019

Online Status	Offline
Date Last Visited	yesterday

KVStore process will not start

Apps panel, left side of window - Splunk ver 9.2.1

Stored procedure fails to run Splunk DB connect

Change table columns based on field value

Challenge with splunk forwarder and csv file

Suggestions Please: REST Api, csv,html

Zoom back or out using maps+

Using Splunkbase Maps+

How to run a search from a filler gauge on-click e...

How to hide or change scale values on right side o...

KVStore process will not start

Re: Change table columns based on field value

Change table columns based on field value

Re: Challenge with splunk forwarder and csv file

Challenge with splunk forwarder and csv file

Suggestions Please: REST Api, csv,html

Using Splunkbase Maps+

How to run a search from a filler gauge on-click e...

How to hide or change scale values on right side o...

Re: Searching Cisco ASA sourcetype in Splunk

Searching Cisco ASA sourcetype in Splunk

Re: Create splunk chart from seach with totals ove...

Re: Create splunk chart from seach with totals ove...

Create splunk chart from seach with totals over ti...

Re: Navigate from dashboard in one app to another ...

Re: Navigate from dashboard in one app to another ...

Navigate from dashboard in one app to another dash...

How to add padding between trellis single value bl...

Re: Single Value, trellis, and search

Re: Single Value, trellis, and search

Re: Single Value, trellis, and search

Is there some way to put all three stats commands ...

Re: Use css or html style tags in splunk status in...

Using css or html style tags in Splunk status indi...

Re: Splunk 9.0.2 - Oracle Linux 8.6