splunk SDK notes

Here’s an annoying one when building a custom splunk search command using the python SDK:

"Error in 'script': Getinfo probe failed for external search command 'testscript'"

This mean you have:

  1. "supports_getinfo = true" set in commands.conf for that particular command
  2. failed to set a docstring for one of the splunk elements within the command.
    1. Check your instances of Option and set doc=""
    2. Set a docstring for the class itself, but you already did that anyhow, didn’t you? 🙂

Another issue that may occur is this one:

[Read More]

Hairpin NAT on Mikrotik v6.19

So, when you have services available to the world through your external address/hostname, it’s nice to be able to access them via that as well. “Hairpinning” or Hairpin NAT is the term for the NAT redirection required to make this work.

Update 14/3/16: It’s been raised to me that it’s best to use split-DNS for this particular example, but it’s designed to be a simple one for documentation purposes. There’s much better ways of solving the problem, but:

  1. you don’t always control DNS,
  2. the service might be entirely IP-based - like IPsec,
  3. the service might have different internal ports to what’s externally facing (and can’t be reconfigured)

Amongst a whole host of other reasons. Just trust me 😉

[Read More]

On winding a watch…

Paul Blackburn - Julio Cortázar from Cronopios and Famas “The Instruction Manual”

(A Spanish Text)

Preamble to the Instructions on How to Wind a Watch

Think of this: When they present you with a watch they are gifting you with a tiny flowering hell, a wreath of roses, a dungeon of air. They aren’t simply wishing the watch on you, and many more, and we hope it will last you, it’s a good brand, Swiss, seventeen rubies; they aren’t just giving you this minute stonecutter which will bind you by the wrist and walk along with you. They are giving you—they don’t know it, it’s terrible that they don’t know it—they are gifting you with a new, fragile, and precarious piece of yourself, something that’s yours but not a part of your body, that you have to strap to your body like your belt, like a tiny, furious bit of something hanging onto your wrist. They gift you with the job of having to wind it every day, an obligation to wind it, so that it goes on being a watch; they gift you with the obsession of looking into jewelry-shop windows to check the exact time, check the radio announcer, check the telephone service. They give you the gift of fear, some­one will steal it from you, it’ll fall on the street and get broken. They give you the gift of your trademark and the assurance that it’s a trademark better than the others, they gift you with the impulse to compare your watch with other watches. They aren’t giving you a watch, you are the gift, they’re giving you yourself for the watch’s birthday.

[Read More]

IE downloading IPSW files as zip?

I had a friend trying to download the IOS 7.1.2 image for his iPhone 4 (which he’d just about bricked installing IOS8 on) and was having a weird issue.

It looks like if the server sends the content-type “application/octet-stream” it’ll try to download it with the extension .zip instead of the original extension. This is because of MIME sniffing, which only reads the first 200 bytes of the file to try and guess - rather than just trusting the server and not being a tool about it.

[Read More]

explorer.exe won’t open – cannot access the …

Getting an error like this one?

Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

  1. Open the registry editor as a local-administrator level account.
  2. Look for the folder {CDCBCFCA-3CDC-436f-A4E2-0E02075250C2} which is under HKEY_CLASSES_ROOT\Wow6432Node<wbr>AppID
  3. There should be an entry matching the following:
    • Name: RunAs
    • Type: String
    • Value: Interactive User
  4. Rename this entry to _RunAs so it doesn’t apply any more. This will likely require you to add permissions to the folder giving you full control.

Voila, it should be working - remember to revert your permissions changes, they’re inconsequential.

[Read More]

What Tarot Card Are You?

You got: The Fool

Don’t take this card the wrong way. The Fool is associated with deep thoughts. You think about everything and form opinions based on all of your gathered evidence. You’ve been around the block, and have occasionally played the fool.

Seems entirely true to me.

The Fool

[Read More]

Wireshark on OSX Mavericks

So, Wireshark in Mavericks doesn’t work terribly well. If you install XQuartz and the Wireshark application then try to run it, it’ll just sit silently mocking you in the Dock.

There’s a few steps. First you want to add it to the Applications menu on XQuartz. Run XQuartz and then right click on the icon, select Applications, then Customize

Add a new item, and fill it out as below. This will allow you to run it from the XQuartz menu in future.

[Read More]

Cascade Shark not detecting new card

So I’m installing a new NIC-CSK-210G in my Cascade Shark 2100. It’d start up fine but the new card wouldn’t detect. The NIC-CSK-4TX-X installed detected fine, but the other one didn’t.

When going to the “Interfaces” screen on the WebUI, I’d get a weird error:

If you waited a few seconds or clicked the “Retry Now” button, it’d log you out and kick you back to the login screen. Ugh.

[Read More]