Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
Siegfried Puchbauer's Discussions
Scripted Input - How to configure interval for one-shot data streams?
1 Reply
Hi ninjas ;-)I have a quite tricky question and I'm wondering if this is a bug with the script handling of splunk. I have a scripted input (which is a python script) that opens a tcp server socket…Continue
Tags: python, scripted-input
Started this discussion. Last reply by Michael Wilde Dec 22, 2009.
Siegfried Puchbauer's Page
Gifts Received
Siegfried Puchbauer has not received any gifts yet
Latest Activity
Siegfried Puchbauer replied to Patrick Swackhammer's discussion 'Regex For Identifying IP Addresses (To Extract Field)'
Try this one:
(?\d+\.\d+\.\d+\.\d+)\(\d+\) \-> (?\d+\.\d+\.\d+\.\d+)\(\d+\)
it should extract the first ip as "src_ip" and the second one as "dest_ip"
Cheers, Siegfried
Michael Wilde replied to Siegfried Puchbauer's discussion 'Scripted Input - How to configure interval for one-shot data streams?'
We've got some data generators we use (internally for demos) as scripted inputs. For example, i have one that generates data for F5's Application Security Manager, so we can demo/develop the F5 app. Its entry in inputs.conf looks like…
Scripted Input - How to configure interval for one-shot data streams?
Hi ninjas ;-)I have a quite tricky question and I'm wondering if this is a bug with the script handling of splunk. I have a scripted input (which is a python script) that opens a tcp server socket (listens on a tcp port). The script generates events and sends them to stdout. The problem is when I restart splunk or disable the scripted input via the manager the python script keeps running. I've tried to configure all interval settings that made sence IMO (-1, 0 and 1) but none of them worked.…See More
Discussion posted by Siegfried Puchbauer
Michael Wilde left a comment for Siegfried Puchbauer
Sigfried..
Thanks for joining Splunk Ninja. Ask hard questions, we'll try to answer. Suggest videos, we'll try to shoot them... contribute if you can.
Michael Wilde
Splunk Ninja
Profile Information
- Are you an existing splunk user?
- Licensed
- What do you do for your day job?
- IT Consultant
- Web / Blog Address
- http://siegfried.puchbauer.com/
Comment Wall (1 comment)
- At 12:06pm on December 17, 2009,
Michael Wilde said…
- Sigfried..
Thanks for joining Splunk Ninja. Ask hard questions, we'll try to answer. Suggest videos, we'll try to shoot them... contribute if you can.
Michael Wilde
Splunk Ninja
© 2012 Created by Michael Wilde.
