About cgardiner

cgardiner · ‎09-18-2023

Just wanted to add this one for future readers. Another important advantage of HEC over TCP is error handling. Specifically, if you send data to a TCP endpoint, there is no interaction. No response from the TCP endpoint to let you know data has been received and processed. If there are load issues on the server or Queues are filled up, there is a chance that data will get lost. Data may get dropped and the sending process will not have any idea there was an issue. With HEC, you get an HTTP response such as a 400 or 500 error indicating problems. While most of the possible errors are specific to HEC, at least 2 would be an advantage over TCP. (Server is busy and Internal Server Error) https://docs.splunk.com/Documentation/Splunk/9.1.1/Data/TroubleshootHTTPEventCollector#Possible_error_codes Receiving these codes, a sender would know there is a problem.. And could attempt to resent the data again later. You can also configure your "use Ack" which will allow the sender to check and confirm that data has been received and indexed before purging those events from the system.

cgardiner · ‎01-21-2020

Also remember... The behavior has changed with ES 6.0. ES no longer explicitly imports apps using the naming convention. It has reverted to requiring configuration to be exported to system in order to see the configuration.. So which answer is correct depends on which version of ES you are working with.

cgardiner · ‎06-16-2017

I have downloaded and looked at the TA and the code being used and the simple answer to your question is no. It will not encrypt the password. The file in question is a plain text file for the TA developers own making and not something Splunk is even aware of. It would never be able to encrypt this password. If the app developer had made use of the build in password functionality and a setup.xml, this could have been handled easily. Optionally, the password could have been encrypted using his own algorithm if he so desired in the same way that DB connect does or did, but that was not done here. Additionally, if you attempt to encrypt the password in the xsconfig.conf file on your own, you will break the app because the script is expecting a plain text string. IF you have any python development background and a few hours, you could make some changes to the xsUtils.py script where the user and password are read from the config and the session creation is performed. If you wrote your own encryption and decryption function into this script, all the individual input scripts would be able to make use of it. Outside of this, your best bet is to try and contact the developer and ask if they would be open to adding some manner of encryption for the password on disk. Sorry I don't have a better option for you.

cgardiner · ‎07-28-2014

Perfect but is there any documentation on creating a splunk repository or a splunk base? thanks, Chris

cgardiner · ‎07-28-2014

Hi, Is there any way to configure Splunk to use an application repository other than apps.splunk.com? For example, if I wanted to create a local app repository within my organization such that we could create corporate specific applications and make them available to any business unit which has a local Splunk or if we wanted to use it as an application update location? Is this possible? Is there a way to change the URL that is used and is there any documentation on how this access and sync is accomplished? Thanks, Chris

Posts	5
Solutions	1
Karma Given	2
Karma Received	2
Member Since	‎07-28-2014

Online Status	Offline
Date Last Visited	‎09-18-2023 04:34 PM

Changing the Splunk Application Repository Locatio...

Re: Why would I use the HTTP Event Collector when ...

Re: Splunk Enterprise Security: Lookups and other ...

Re: Splunk Add-on for Citrix XenServer: How do I f...

Re: Changing the Splunk Application Repository Loc...

Changing the Splunk Application Repository Locatio...