About CerielTjuh

CerielTjuh · ‎03-28-2013

Sorry, I forgot to mention that I changed the SQL statement to include the WHERE statement but Splunk doesn't recognize the SQL view, only SQL tables..

CerielTjuh · ‎03-28-2013

My collegue was searching for a way to change the layout of the page and in the current version (5.0.2) it is possible to change the layout to landscape in the scheduled search.

CerielTjuh · ‎03-25-2013

I can only add my opinion: great work ! This helped me a lot !!!

CerielTjuh · ‎03-23-2013

Hi there, I am try to import data from a SQL Server. Because the tables do not contain all the fiels i want to see i have created a view on the SQL server with some left joins. I would like to index the data from that SQL view with the Splunk DBConnect app but I receive an error that "Incident" is an invalid Object Name. My Select code: SELECT [Incident #] ,[Opened Group:] ,[State:] ,[Open Date & Time] ,[Close Date & Time] ,[Incident Type] ,[Due Date & Time:] ,[First Call Resolution:] ,[Closed Group:] ,[Contact Type] ,[Group Name] ,[Client ID] ,[Login ID Closed By] ,[Asset/Tag #] ,[Department Name] ,[Login ID Opened By] ,[Impact ID:] ,[Urgency ID:] ,[Status ID:] ,[Subject ID] FROM [SDE].[_SMDBA].[Incident] WHERE [Incident #] > 10000_ Is it even possible to data input a view from a SQL server or what method should i use? Thank you in advance!

CerielTjuh · ‎03-12-2013

I have found an answer to all my questions. Splunk generates a lot of CPU time on machines when polling with WMI. This is not an issue at all, if a user or the system requires CPU time, the WMI service is suppressed and releases the CPU. When the process finishes and WMI gets CPU time all the eventlogs are collected and send to the central Splunk server. You can check this out your self by running CPU Burn-in on the target machine (twice for a dual core machine).

CerielTjuh · ‎03-07-2013

As extra information: The high CPU is caused by the Security Eventlog, my thoughts are to filter the events when querying for them, is that possible?

CerielTjuh · ‎03-07-2013

Hi there, I know that the best practice for high usage systems is a Splunk Forwarder but due to easy management my system administrators don't want any Splunk software on the machines and want to use WMI polling. WMIprvse.exe takes up 20% of CPU on my Exchange server as soon as i turn on the Remote Eventlog polling. Is there a way to limit this or change this behaviour? Thanks in advance!

CerielTjuh · ‎02-24-2011

Don't save your config files as .conf.txt....

CerielTjuh · ‎02-24-2011

Never mind, i feel very very very stupid! For everyone who doesn't have a good configures GPO, uncheck the hide extentions for known file types and don't work with notepad!!!

CerielTjuh · ‎02-24-2011

Realization (Actions executed leading to the disruption): We are currently trying to poll Windows 2008 servers with Splunk-wmi. As you know Windows 2008 generates a lot of eventlog messages and to stay within our 2GB/a day limit we want to filter out some data before sending it to the general indexer. We are currently using a demo splunk license to test it out before we are putting it into production. I have created a wmi poll using the Splunk data input wizard and I am getting the results in Splunk. My next step was to start filtering out events with an eventcode=5156 filter using a props.conf and transforms.conf file but I am not able to "filter out" the events. Recreation (Could the disruption be recreated? If yes, please provide a exact step by step scenario): ---props.conf--- [wmi] TRANSFORMS-null = wmi-null ---transforms.conf--- [wmi-null] REGEX=EventCode=(5156) DEST_KEY = queue FORMAT = nullQueue I know there are a lot of topics about this subject but somehow I am to stupid to get this working with the examples given by other users...

CerielTjuh · ‎09-16-2010

Hi there, I have noticed a difference in format between the csv files generated by Splunk when e-mail the results or saving them using the outputcsv function. If I export the results to e-mail the multiline Windows events are processed as a single field with \n for new lines. When I export the results into a field the multilines are preserved and I cannot use the csv fields in an excel sheet since Excel sees them as multiple lines. First of all did anyone notice this as well and second (even more important 🙂 ) how can i change this so that the outputcsv function works the same as the e-mail function? Second question, could anyone tell me if it is possible to change the names of the csv files stored by the outputcsv function? Thank you in advance!

CerielTjuh · ‎06-18-2010

this could mean that you don't have any "lost" hosts

CerielTjuh · ‎06-18-2010

I will change the order and try again, I tried it on a light forwarder (but that doesn't work by design) and now on a forwarder (basic install with a deployment app to forward the data)

CerielTjuh · ‎06-18-2010

Thnx guys, I will wait for the new release 🙂

CerielTjuh · ‎06-16-2010

Any new thoughts on this issue? -props.conf- [source::WinEventLog:Security] TRANSFORMS-set= setparsing, setnull Part two. -transforms.conf- [setparsing] REGEX = (?m)^EventCode=(592|593) DEST_KEY = queue FORMAT = tcpOutQueue [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue The funny side is that Splunk does not forward anything when i activate this script. Only the Application and System logs are forwarding. I also tried to publish this application as a deployment app, but that doesn't work either... I could really use some help 😉

CerielTjuh · ‎05-10-2010

true gkanapathy 😉

CerielTjuh · ‎05-07-2010

If you need the audio on 1 computer only you could make a batch which starts windows media player on a remote pc and start an audio file. psexec (sysinternals) could help you with that. psexec \\computername sndrec32 /play /close c:\windows\media\chimes.wav Technet link to psexec

CerielTjuh · ‎05-07-2010

In the app.conf file located in your etc\apps\SplunkLightForwarder\local folder adjust the settings to: [install] state = disabled and then restart your Splunk instance, this will do the trick. splunk disable app SplunkLightForwarder will do the trick as well

CerielTjuh · ‎05-07-2010

You can try this yourself 🙂 sourcetype="wineventlog:security" instead of sourcetype="WinEventLog:Security" both work, so I'm assuming its not case sensitive

CerielTjuh · ‎05-07-2010

Maybe next gen syslog. Syslog but over a TCP connection. http://www.debianhelp.co.uk/syslog-ng.htm

CerielTjuh · ‎05-07-2010

Im not sure if this is what you mean but: If the primary server is a windows server you could use a splunk forwarder with ssl connection, this will ensure data transport and data integrity. (does not require a extra license, forwarder licenses are free) If the primary server is not a windows server, try a secure FTP connection to transfer the files to the splunk server. The first method is approved by our SAS70 compliancy auditors, so should work for you as well 🙂

CerielTjuh · ‎05-07-2010

If Splunk is showing more fields then those two (_time) you can remove the fields you don't want by issuing the command | fields - _time after the | fields + host, _raw.

CerielTjuh · ‎05-07-2010

Latest version, 4.1.2, I found out yesterday that if i create a new dashboard with the search, the order is fine, only when i create a saved search and let Splunk e-mail me the results it is messed up.

CerielTjuh · ‎05-06-2010

Hi mzorzi, I reduced my footprint by deleting the demo indexes on the forwarders, limiting the log size and log indexes and removing some of the apps, (gettingsstarted, sample app). I deleted the indexes trough the web interface. Log files i limited using the script below appender.A1=RollingFileAppender appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log appender.A1.maxFileSize=50000000 (used to be 25 MB) appender.A1.maxBackupIndex=1 (used to be 5) appender.A1.layout=PatternLayout appender.A1.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l} %-5p %c - %m%n Log Files Splunk Documentation

CerielTjuh · ‎05-06-2010

Just an idea, this is how I should do it: Detele the current logs untill the date/time of your earliest entry in the current eventlog. Tell Splunk to index the entire Windows eventlog (change inputs.conf) After Splunk is done, change the inputs.conf to take only newest http://www.splunk.com/base/Documentation/latest/Admin/MonitorWindowsdata start_from = oldest current_only = 1

Posts	31
Solutions	4
Karma Given	2
Karma Received	22
Member Since	‎04-16-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Import data from SQL view with DBConnect

Remote Eventlog with wmi generates high CPU

WMI EventLog Filtering

CSV format difference between e-mail and output

Define field order on export

WinEventLog filtering on indexer

Re: Import data from SQL view with DBConnect

Re: pdf report issue: landscape format and no csv ...

Re: Splunk DB Connect - dbquery inline search and ...

Import data from SQL view with DBConnect

Re: Remote Eventlog with wmi generates high CPU

Re: Remote Eventlog with wmi generates high CPU

Remote Eventlog with wmi generates high CPU

Re: WMI EventLog Filtering

Re: WMI EventLog Filtering

WMI EventLog Filtering

CSV format difference between e-mail and output

Re: How do I alert when a host stops sending data?

Re: WinEventLog filtering on indexer

Re: Define field order on export

Re: WinEventLog filtering on indexer

Re: Secure transport of log files to our Splunk Se...

Re: Audio Alerts on Client Browser. Is it Possible...

Re: Disable lightweight forwarding in 4.1 from com...

Re: are sourcetype names case-sensitive?

Re: Secure transport of log files to our Splunk Se...

Re: Secure transport of log files to our Splunk Se...

Re: How to select fields for email alert

Re: Define field order on export

Re: How to Minimize Light Forwarder Footprint?

Re: What would cause a Windows forwarder to re-sca...