About sanju2408de

sanju2408de · ‎03-26-2024

Many thanks for your suggestion, we have not tried this federated search as of now, let us give it a try and see if it works.

sanju2408de · ‎03-24-2024

We have Splunk Enterprise installed in almost 6 different regions(APAC/AUS/LATAM/EMEA/NA/LA) worldwide and now we are looking for feasibility check for implementing :- a. Single Triage Dashboard which can be deployed in one region and can be accessing data coming from all these 6 regions. b. I understand that looking at the current setup we can't access Splunk data from one region to other region. However, is there a possibility through API calls or any other method that we can access other region Splunk data? Kindly assist us on this topic if anybody can help.

sanju2408de · ‎09-30-2022

Hello, We are in process of upgrading our Splunk Infrastructure from ver 7.x to 8.x. Before migration, we are stuck in the functionality testing of Alert manager ver 3.08 on Splunk Enterprise 8.1.4 (Dev env). We are seeing that the alerts which gets triggered with Alert Manager ver 3.08, are not getting converted from "New" status to "auto_assigned". We have checked the configurations and logs, we couldn't find anything which can give us the clarity on this issue. Kindly help us in this issue, if you can provide alternate way to find out the root cause of this. Note: I am attaching logs from the Dev environment where there is no log entry of "Set status of incident <id> to auto_assigned".

sanju2408de · ‎05-09-2022

Hello, I am looking for a help here, this is a very weird issue that I am facing. I have a requirement to monitor Event ID 4624 and 4625 from a specific set (10) of servers. I have used following inputs.conf, but instead of receiving these specific events data, i am receiving some other event codes such 4670, 4719, 4742, 4738 etc. I have tried almost all possible ways, but unable to understand what's really happening here. [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 # only index events with these event IDs. whitelist = 4624, 4625 index = wineventlog sourcetype = xyz renderXml=false

sanju2408de · ‎03-14-2022

@richgalloway Thanks so much for your help, this actually worked. We had few more fields to extract from the same email and i used the same regex patterns as you have provided. It perfectly worked. Many Thanks again for your help.

sanju2408de · ‎03-13-2022

I am facing challenges while extracting the data from emails, using the Microsoft O365 email add on. I want to extract the "Requested for" and "Finished" for which respective values are "ABC.ITGLOBAL@XYZ.com" and "Fri, Mar 11 2022 15:09:29 GMT+00:00". I have tried Regex101 site and could successfully test a Regex pattern as below for matching the value for "Requested for" but the same pattern doesn't work in Splunk. (?i) for\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\w+\-\w+:\w+\-\w+\"\>(?P<Requested_For>\S+)(?=\<\/td) I need help here to sort this out, please if anyone can share their thoughts here. Finished</td><td class="" style="vertical-align:top; padding:10px 4px; border-bottom:solid #eaeaea 1px; text-align:left; white-space:normal; width:99%; word-break:break-word">Fri, Mar 11 2022 15:09:29 GMT+00:00</td></tr><tr><td class="" style="vertical-align:top; padding:10px 4px; border-bottom:solid #eaeaea 1px; text-align:left; white-space:nowrap; font-weight:600; min-width:130px">Requested for</td><td class="" style="vertical-align:top; padding:10px 4px; border-bottom:solid #eaeaea 1px; text-align:left; white-space:normal; width:99%; word-break:break-word">ABC.ITGLOBAL@XYZ.com</td></tr><tr><td class=""

sanju2408de · ‎02-13-2022

Did you get solution for this issue? I am also facing similar issue wherein it gives below error and no emails are getting ingested into Splunk. 2022-02-14 06:28:02,998 ERROR pid=21464 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/ta_microsoft_o365_email_add_on_for_splunk/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/o365_email.py", line 136, in collect_events input_module.collect_events(self, ew) File "/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/input_module_o365_email.py", line 182, in collect_events messages.append(messages_response['value']) KeyError: 'value'

sanju2408de · ‎12-23-2020

We are looking for 32-bit version of Splunk UF agent for Debian OS, which we did not find in the Splunk portal. Is there any binary for the same or if there is any way we can monitor 32-bit Debian OS performance counters? Please suggest or provide the link to download binaries.

sanju2408de · ‎05-11-2020

I am trying to connect to few of the MSSQL DB instances wherein the Force Encryption is enabled (set to true) and if I try to create DB connection through Splunk DB Connect Version: 20.02.3.0 Build 1, it gives me error as *"I/O Error: DB server closed connection."* While checking this issue on Splunk Answers portal, I have gone through similar question with title *"Splunk DB Connect 2: Why am I unable to connect to MSSQL with encryption?"*. But even though I set the connection parameters same as mentioned in that link, it doesn't work. After following this, I am getting error as *"This driver is not configured for integrated authentication. ClientConnectionId:bc701e78-0062-4bb6-af77-7b6d4238a340"* Here is the DB Connection input which I am using:- [DB_Connection] connection_type = generic_mssql_with_windows_auth jdbcURLFormat= jdbc:sqlserver://:/;useCursors=true;domain=;integratedSecurity=true;encrypt=true;trustServerCertificate=true disabled = 0 identity = localTimezoneConversionEnabled = false port = 1600 readonly = true database = master host = abc.com Please can someone assist me on this, as I am not able to find any other option to establish connection to the encrypted DB instances.

Posts	9
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎05-11-2020

Online Status	Offline
Date Last Visited	‎03-27-2024 06:40 AM

Need help on creating a Single Triage dashboard wh...

Splunk Alert Manager - Not assigning status of the...

Unable to receive Windows Event ID 4624 and 4625 d...

Microsoft O365 add-on: How to extract data from em...

Need 32-bit Universal Forwarder for Debian OS

I am unable to establish DB connection to MSSQL DB...

Re: Need help on creating a Single Triage dashboar...