About tsweet_splunk

tsweet_splunk · ‎08-16-2016

Active Directory app is also needed: https://splunkbase.splunk.com/app/3207/ enjoy

tsweet_splunk · ‎07-28-2016

This started with Windows Infrastructure App V 1.3 that was released last month. I am guessing you recently upgraded this application as well. The other error message is related to something else if I had to guess.

tsweet_splunk · ‎07-27-2016

I usually use way #2 but use $SPLUNK_HOME so that you do not need to worry about the deployment type (Enterprise or Forwarder). This would require pushing both the original Splunk_TA_nix (containing the scripts) and custom Splunk_TA_nix_mycustomtype_inputs applications to the NIX UF's. [script://$SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/netstat.sh]

tsweet_splunk · ‎07-27-2016

If you have the Windows Infrastructure app installed on this SH, it requires knowledge objects from the AD and DNS apps so these need to be installed to make those messages go away. The alternative is to disable the eventtypes (which if you are not using AD or DNS should not have any impact on the Windows Infrastructure functionality) Create a /splunk_app_windows_infrastructure/local/eventtypes.conf file with the following to disable the unneeded eventtypes. This should suppress those messages [msad-anomalous-events] disabled=1 [msad-dirsvcs-anomalous-events] disabled=1 [msad-rep-errors] disabled=1 [msad-dns-events] disabled=1

tsweet_splunk · ‎07-26-2016

See answer here, should fix your issue: https://answers.splunk.com/answers/433485/message-eventtype-wineventlog-ds-does-not-exist-or.html

tsweet_splunk · ‎07-26-2016

There are pre-req's that are required to have the correct knowledge objects for Windows Infrastructure app. If these are not on the same Search Head as the windows infrastructure app it will give you those errors. http://docs.splunk.com/Documentation/MSApp/1.3.0/MSInfra/Platformandhardwarerequirements#The_Splunk_Add-ons_for_Microsoft_Active_Directory_and_Windows_DNS_v1.0.0_or_later The Splunk Add-ons for Microsoft Active Directory and Windows DNS v1.0.0 or later The suite of Splunk Add-ons for Active Directory must be installed on universal forwarders in the Windows deployment. You can download the Splunk Add-ons for Microsoft Active Directory and Windows DNS from Splunkbase.

tsweet_splunk · ‎04-07-2016

Check out this post from yesterday - I think it may be your issue: https://answers.splunk.com/answers/389001/checkpoint-add-on-for-check-point-opsec-lea-why-is.html#comment-389175

tsweet_splunk · ‎04-05-2016

Did you add the two libraries listed here: http://docs.splunk.com/Documentation/OPSEC-LEA/latest/Install/Systemrequirements GNU C library (glibc.i686 32-bit). Install using yum install glibc.i686 PAM shared libraries (pam.i686 32-bit). Install using yum install pam.i686 Last time i had an issue with that app it was I forgot to add these.

tsweet_splunk · ‎04-04-2016

For Linux Weblogic Server: Function1_WLS_Admin_nix_TA Function1_WLS_Managed_nix_TA For Windows WebLogic Server: Function1_WLS_Admin_win_TA Function1_WLS_Managed_win_TA Look at the inputs.conf on each of these Admin/Manged files to verify the location is correct (this only monitors in the default logging location) On Search Heads and Indexers: Function1_WLS_IDX_SH_TA On Search Head: Function1_WLS_App

Posts	9
Solutions	2
Karma Given	5
Karma Received	15
Member Since	‎01-14-2016

Online Status	Offline
Date Last Visited	‎01-28-2021 09:18 AM

Re: Message "Eventtype 'wineventlog-ds' does not e...

Re: What does yellow boxes/triangles in the search...

Re: Splunk_TA_nix multiple inputs configurations

Re: Message "Eventtype 'wineventlog-ds' does not e...

Re: What does yellow boxes/triangles in the search...

Re: Message "Eventtype 'wineventlog-ds' does not e...

Re: Splunk Add-on for Check Point OPSEC LEA: Why d...

Re: Checkpoint Add-on for Check Point OPSEC LEA: W...

Re: Oracle WebLogic App for Splunk: Which add-on d...