About joshk2005

joshk2005 · ‎02-01-2016

That is perfect and did the job exactly as I would expect. Thank you!

joshk2005 · ‎02-01-2016

We have an application that imports its events into the Windows Event Log, and I am trying to forward those into Splunk. I've created the inputs.conf for the log [WinEventLog://RightFax]. The events are not showing up in Splunk. What more do I have to configure to start seeing these specific events?

joshk2005 · ‎09-16-2015

The issue is that the servers themselves are read-only, not the account access. They use provisioning to deploy the app servers, creating a master then spinning the read-only servers from there. We have 100's of those servers deployed. Wasn't sure if anyone else had deployed widely in a large Citrix environment like that.

joshk2005 · ‎09-16-2015

I have installed the Template app, and have information coming in from the ZDC, XML, and licensing servers. The issue I have revolves around capturing user and session data. Our Citrix environment from a session server standpoint is almost entirely read-only. What is the best way to capture information in this case, if it is even possible?

joshk2005 · ‎08-31-2015

I found the source of the issue. The "lookup_host_farm.csv" was actually named "lookup_host_farm_staging.csv" and I'm not sure why the difference. When I looked in the props.conf of course I saw the references but it was actually in the transforms.conf where it was pointing to "lookup_host_farm.csv". Once I changed the name I no longer received the errors.

joshk2005 · ‎08-28-2015

We upgraded from the legacy Splunk for Citrix XenApp and obviously replaced it with Templates for Citrix XenApp. Was there a change in the TAs from one to the other? Just not sure why I couldn't drop in the upgrade and have things work better. I've had to modify some of the sources for the searches to work in some cases, including the manual build/rebuild. Even after doing that I had still gotten the error messages when running searches (from all apps not just Citrix apps) that it couldn't find "farmHosts" even though there is a file named "lookup_host_farm.csv".

joshk2005 · ‎08-28-2015

I installed the Template for Citrix XenApp app yesterday and have a few immediate issues. The first thing is that now all of my searches, regardless of what app, were looking for a "farmHosts" file that doesn't exist and spitting out a mess of errors during the searches. I had to comment out most of the props.conf file to resolve the issues, specifically: [WMI:Services] REPORT-DisplayName = extra_service_display_name LOOKUP-WMI:Services Host Farm Lookup = farmHosts host AS host OUTPUTNEW FarmName AS FarmName LOOKUP-WMI:Services Service Group Lookup = serviceGroups Name as Name OUTPUTNEW ServiceGroup AS ServiceGroup [(?::){0}PerfmonMk:*] LOOKUP-PerfmonMK Host Farm Lookup = farmHosts host AS host OUTPUTNEW FarmName AS FarmName [(?::){0}WinEventLog:*] LOOKUP-WinEventLog Host Farm Lookup = farmHosts host AS host OUTPUTNEW FarmName AS FarmName [(?::){0}xenapp:*:installedsoftware] LOOKUP-Installed Software Host Farm Lookup = farmHosts host AS host OUTPUTNEW FarmName AS FarmName Can anyone give me some insight on this "farmHosts" that it is trying to reference that seems to not exist?

joshk2005 · ‎03-13-2015

That is great! Definitely answers the question of what to alert off of. The other part of the question though is a search to find the phonehome time of specific hosts, or any hosts in general. At this point I'm basically starting from scratch on this functionality. I've found a phonehome search but it doesn't distinguish the actual hosts, just when the deployment server/indexers get phonehome'd to.

joshk2005 · ‎03-12-2015

I understand how to actually set up an alert, but I'm having trouble figuring out how to format a search to alert off of. Basically I want to set up an alert for when our important clients fail to phone home after X amount of time, such as our domain controllers. Anyone give me a hand? We are using Splunk 6.1.

joshk2005 · ‎02-24-2015

We are currently running Splunk 6.1. We have pooled search heads, dual indexers, a deployment server, syslog server, and a wmi forwarder. So for #1, by logging into the forwarder I can see how each individual forwarder is set up remotely? That is extremely helpful. 2, One of the questions that has come up is that we want to begin adding more forwarders in our environment, but trying to determine what we already have coming in and even how to add them, it seems via the GUI in Splunk I cannot configure them. As I understand it we actually have to modify the server.conf file directly to configure on the receiving end.

joshk2005 · ‎02-23-2015

Recently I've been handed the administration of the Splunk application as the person who had architect and deployed our installation left the company. I understand and am functional when searching, dashboards, etc, but when it comes to forwarder configuration and understanding what data is coming in I'm slightly lost. Basically I have two main questions: 1. How do I determine how a forwarder is configured on a unit that is already deployed. 2. How can I understand what data is coming in? It is felt that we are using more of our license than we have expected and want to tone back some of the data that is being captured, but first we need to understand where it is coming from. Our installation is mostly on Linux, which does nothing to help my understanding, but we are monitoring an almost entirely Windows environment. If anyone can point me to some good documentation that may answer these questions I would appreciate it. Also having trouble with the Splunk-On-Splunk application, when I try to access it it tells me to install sideview utils, which are already installed.

joshk2005 · ‎01-19-2015

We sporadically have had issues where the forwarder service stops working due to the need to clear locks on the client. Is there a good search string that we could use to alert off of when specific forwarders stop working? We are specifically looking to ensure that our domain controllers do not stop forwarding data (for long) due to the forwarder service not running.

joshk2005 · ‎01-14-2015

We are defining some of our patching requirements for servers that don't have patch definitions and am looking for information on patch recommendations for both Windows Server 2008 R2 and RHEL 6. Just want to make sure we can fully patch without issues or if there are known patch issues.

joshk2005 · ‎10-30-2014

I have just been handed the Splunk application for our organization. I've been asked to work with our security team to create some audit ability that can monitor changes to sensitive groups, changes to privileged accounts, changes to GPO's, all servers accessed by specific user in last x days, all changes that a given user has made in AD in x days, etc. We are still defining what we want audited with Splunk, but I just wondered if anyone have a group of security audits already in place that can make some recommendations.

Posts	14
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎10-30-2014

Online Status	Offline
Date Last Visited	‎06-15-2021 08:26 AM

Why am I not seeing any events in Splunk after cre...

Template for Citrix XenApp: What is the best way t...

After installing the Template for Citrix XenApp ap...

How to set up an alert when a host doesn't phone h...

How to determine forwarder configuration

How to monitor deployed universal forwarders

Where can I find information on OS Patching in reg...

Does anyone have a group of security audits alread...

Re: Why am I not seeing any events in Splunk after...

Why am I not seeing any events in Splunk after cre...

Re: Template for Citrix XenApp: What is the best w...