About jonxilinx

jonxilinx · ‎10-11-2022

This was the work around from Splunk support on the Windows "UF upgrade" KVstore problem "Hello Jonathan, Thank you for your time on todays call. I have just tested performing the Splunk universal forwarder 8.2.6 to Splunk universal forwarder 9.0.1 upgrade on Windows 2019 Server. I added the following settings to the server.conf [kvstore] disabled = true The upgrade completed with 30 seconds after starting the upgrade process. Please let me know if you have any further questions prior to concluding this case"

jonxilinx · ‎10-07-2022

This seems to be a big problem , it affects migration of UFs in our environment 9.0.0.1 -> 9.0.1 and 8.2.6 -> 9.0.1 the sourcetype=splunk_migration, shows that all UF clients suffer a 15minute outage while they wait for the UF to"upgrade the kvstore" ? --- Failed to start mongod. Did not get EOF from mongod after 5 second(s). [App Key Value Store migration] Starting migrate-kvstore. Created version file path=C:\Program Files\SplunkUniversalForwarder\var\run\splunk\kvstore_upgrade\versionFile36 [App Key Value Store migration] Collection data is not available. Starting KV Store storage engine upgrade: Phase 1 (dump) of 2: Failed to migrate to storage engine wiredTiger, reason=Failed to receive response from kvstore error=, service not ready after waiting for timeout=914000ms [App Key Value Store migration] Starting migrate-kvstore. [App Key Value Store migration] Migration is not required. If I get something back from splunk ticket will post here

jonxilinx · ‎03-08-2022

I have been trying to load balance firewall logs across a 12 node index cluster the heavy forwarder is under cluster control . It sees all 12 indexes to be able to write to from its "plunk list forward-server". But regardless of all the changes I have been making in the outputs.conf with LB settings it never want to send to more than five when I monitor | tstats summariesonly=t count WHERE index="network_traffic" by splunk_server _time | timechart span=1m sum(count) by splunk_server autoLBVolume=1048576 autoLBFrequency=5 I have split the ingest into multiple small files using syslog-ng Im just wondering is this "five" a hard limit for a forwarder? or a limitation for the old release I am currently on (will I have to create a horizontal forwarding layer for the firewall logs , artificially splitting the syslog ) Im running Splunk Enterprise 7.3.9 Many thanks , if anyone has any insight

jonxilinx · ‎10-26-2021

Hi , does anyone have any experience with Parsing Version 6 schema of Umbrella logs the release notes from the addon https://splunkbase.splunk.com/app/3926/ talks only of version5 1.0.5: Adds support for logging format version 5 + Firewall Logs the change in Umbrella seems for my environment to be only from Version4 -> version6 and "Schema upgrades are one way; you will not be able to revert this upgrade." Its scary you cant revert Anyone moved to version6 and did they make changes in the local/{props,transforms} ?

jonxilinx · ‎08-17-2021

sorry , not an answer , but i have the same problem with running windows8.1.2 or 8.0.0 on 7.3.X It works on 8.1.X windows UF It is also good on Unix 7.3.6 Search heads (no btool,errors at restart) but lots of stanza errors are introduced , including in other apps if we deploy to windows UF Note we have just decided to migrate from 5.0 to 7.0 for the windows TA until we can complete the 7.3.X UF upgrades If anyone has a soln to it not working I would be glad to hear abut it

jonxilinx · ‎08-16-2021

Splunkbase page for the app https://splunkbase.splunk.com/app/833/ says its supported for 7.3 But the Release notes says its only supported for 8.X https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/Releasenotes 8.3.0 package is no longer on splunkbase Can someone let me know if 8.3.1 is supported on Splunk enterprise 7.3.X Many thanks, Jon

jonxilinx · ‎03-25-2021

In the cofense addon https://splunkbase.splunk.com/app/5253/ this confused me for a while on what the credentials where tried adding the username and passwords in the credentials, by which I thought it means the username and password you use to access the gui In the cofense v2API we can create Client ID: Client Secret: but that doesnt seem to work with app (think its V1) Found eventually under Account mangement that a User can create an API V1 key so use the logui gin as the username and the API as the password It now seems obvious , put posting for thick people like me , who might find this useful

jonxilinx · ‎03-05-2021

in the distsearch.conf on our search head we can blacklist applications [replicationBlacklist] splunk_app1_blacklist = apps/splunk_app1/... splunk_app2_blacklist = apps/splunk_app2/... We can also define groups of search peers (here we have peers in two groups) [distributedSearch:dmc_group_main] servers = 172.21.72.127:8089,172.21.72.128:8089 default = true [distributedSearch:dmc_group_satelite] servers = 10.1.1.1:8089,10.1.1.2:8089 default = true If we dont have indexes for app1 and app2 on peers dmc_group_satelite, can the [replicationBlacklist] be written in a way so that its not pushing the peerbundles to it ONLY want to push bundles to group_main (no need to have a knowledge bundle on peers that dont have searchable index) Many thanks, Jon

jonxilinx · ‎02-09-2021

worked no more messy systemd or messing with sudoers 🙂

jonxilinx · ‎01-06-2021

Dear Splunkers, Trying to get my apache logs from predefined into key value pairs and supply to the web admins for his modification of the httpd.conf the documentation under the Splunk addon for Apache web server , the xml stanza does not have any closing elements and is breaking the httpd startup (syntax of conf) https://docs.splunk.com/Documentation/AddOns/released/ApacheWebServer/Configure Has anyone installed this app and have a correct <IfModule log_config_module> block that I can pass on Many thanks

jonxilinx · ‎09-14-2020

I see a new release 3.40 https://docs.splunk.com/Documentation/DBX/latest/ReleaseNotes/Releasenotes and in the release notes the following FIX 2020-07-22 DBX-5078 DBXQuery hangs when running 'Execute SQL' Preview so Im hopeful 🙂

jonxilinx · ‎09-03-2020

in the current version 3.3.1 of Splunk DB Connect , this bug makes adding new database source impossible without reverting to editor 'Execute SQL' Preview is a requirement for adding inputs in the App (dont seem to be able to by pass it) Any word on possible upgrade to the app to fix? Or have people been successful in reverting back to an older version of the App (and which one ?) Many thanks, Jon

jonxilinx · ‎12-03-2019

It seems like we have a fix in 7.3 for the splunk date-time issue since 2019-11-07 Not that long ago we were told to stay away from 7.3 by splunk (7.2.6 is what we are mainly on) But it seems an age for splunk to get a fix out for 7.2 and 6.6 which are surely major deployment versions for splunk users Any chance of an available fix before january ?? Help splunk!

jonxilinx · ‎11-22-2018

thanks Again I was really looking for a reference company , but I really appreciate you answering (and will keep asking splunk for a reference otherwise wont be able to role out to the company) Note loaded the Dashboard App(3544) first thing I noticed on the Status dashboard was it wasn't using the same name for identifing a Computer it uses sysmon | stats count by Computer | sort - count While the TA uses ComputerName So doesnot return anything in the search Will see if anyone has reported to github Many thanks again

jonxilinx · ‎11-20-2018

Many thanks yes rolled out the Add-on but not the Dashboard mai purpose is to get input into SES, but will investiagte the dashboard Also rolled out along with Splunk_TA_windows , TA-Sysmon-deploy, TA_PWChange and a modified System App to blacklist the metrics.log traffic (thought important) only rolled out to a handfull of systems so far (15), My company was looking for some similar company who had gone through the install, for reference many thanks

jonxilinx · ‎11-19-2018

Hi , Our desktop team are looking for a reference company who has rolled out sysmon under splunkUF Size 5000 endpoints Mix of windows7/10 business has an engineering focus would anyone be interested in a quick meeting and seeing if they have experienced any issues (performance or otherwise). Many thanks if willing to help out a fellow splunker

jonxilinx · ‎02-01-2018

Hi, Looking for some advice We have an Asset field trying to get into CIM compliance ChassisType = Laptop, Notebook,Docking Station,Desktop,Server etc What is the most appropriate field in the CIM Inventory event dataset to write this too? We have other sources of inventory and would like to map for inventory type reports

jonxilinx · ‎12-10-2015

Less of a question, but just wanted to say Many thanks for this, works like a treat. I found I had to set UseLegacySyslogFormat=No in the dbparm.ini to send the priority of the SYSLOG to Splunk, and then add this in the props.conf for line breaking for multiline events that are sent from the vault. [cyberark:epv:cef] LINE_BREAKER = (<5>1 ) There may have been a better way (I'm a bit of Splunk newbie), but thanks for this TA which is most useful.

Posts	18
Solutions	0
Karma Given	15
Karma Received	2
Member Since	‎08-20-2014

Online Status	Offline
Date Last Visited	‎11-16-2023 04:57 AM

Is there a hard limit of "five splunk_servers" tha...

Cisco Umbrella Add-On for Splunk Version6 support

Splunk_TA_nix 8.3.1 is it supported for 7.3.X ?

Cofense Triage Add-On account credentials

distsearch.conf can you link replicationBlacklist...

Correct stanza for Configure log formatting on the...

Fix for DBX-5078 DBXQuery hangs when running 'Exe...

Does Splunk have a timeline for releasing 7.2.9.1 ...

Anyone prepared to be a reference for sysmon splun...

Writing our first custom App for Avecto chassis_ty...

Re: Windows upgrade from 8.1.1 to 9.0: Why getting...