Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About johnny21
johnny21
Path Finder
Member since:
04-26-2011
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 04-26-2011 |
Activity Feed
- Karma Re: Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? for marycordova. 06-05-2020 12:50 AM
- Got Karma for Re: Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve?. 06-05-2020 12:50 AM
- Got Karma for Re: Pi-hole DNS App for Splunk: Why are we getting error "no route to host" when sending logs from pi-hole to Splunk with a UF?. 06-05-2020 12:50 AM
- Posted Technology Add-on for pfSense Version 2.2.0 - 4 errors occurred while the search was executing on All Apps and Add-ons. 10-27-2019 01:46 PM
- Tagged Technology Add-on for pfSense Version 2.2.0 - 4 errors occurred while the search was executing on All Apps and Add-ons. 10-27-2019 01:46 PM
- Posted Re: Pi-hole DNS App for Splunk: Why are we getting error "no route to host" when sending logs from pi-hole to Splunk with a UF? on All Apps and Add-ons. 06-18-2019 05:14 PM
- Posted Pi-hole DNS App for Splunk: Why are we getting error "no route to host" when sending logs from pi-hole to Splunk with a UF? on All Apps and Add-ons. 05-29-2019 10:04 AM
- Tagged Pi-hole DNS App for Splunk: Why are we getting error "no route to host" when sending logs from pi-hole to Splunk with a UF? on All Apps and Add-ons. 05-29-2019 10:04 AM
- Tagged Pi-hole DNS App for Splunk: Why are we getting error "no route to host" when sending logs from pi-hole to Splunk with a UF? on All Apps and Add-ons. 05-29-2019 10:04 AM
- Tagged Pi-hole DNS App for Splunk: Why are we getting error "no route to host" when sending logs from pi-hole to Splunk with a UF? on All Apps and Add-ons. 05-29-2019 10:04 AM
- Posted Re: Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-24-2019 04:22 AM
- Posted Re: Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-23-2019 01:41 PM
- Posted Re: Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-23-2019 06:55 AM
- Posted Re: Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-23-2019 06:17 AM
- Posted Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-23-2019 05:00 AM
- Tagged Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-23-2019 05:00 AM
- Tagged Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-23-2019 05:00 AM
- Tagged Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-23-2019 05:00 AM
- Tagged Why does SHOULD_LINEMERGE setting appear to make the date go backwards and how can I resolve? on Getting Data In. 05-23-2019 05:00 AM
- Posted Re: Splunk date going backwards? on Getting Data In. 05-22-2019 06:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-27-2019
01:46 PM
Installed TA Addon Version 2.2.0 and it is almost working but get the error below, not sure exactly how to correct.
4 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.
Could not load lookup=LOOKUP-filterlog_action
Could not load lookup=LOOKUP-filterlog_tcpflags
Could not load lookup=LOOKUP-filterlog_transport
Could not load lookup=LOOKUP-openvpn_action
... View more
06-18-2019
05:14 PM
1 Karma
It was the host based FW blocking the connection.
... View more
05-29-2019
10:04 AM
I am attempting to send DNS logs from pi-hole to Splunk, I have the Universal forwarder installed on the Pihole and when I attempt to start Splunk on the UF I get the following error.
I confirmed that the Splunk host is listening on TCP 5353 for that connection and can ping the host from the pi-hole.
Any ideas on what I am missing?
05-29-2019 12:40:42.231 -0400 WARN TcpOutputFd - Connect to 10.0.155.157:5353 failed. No route to host
05-29-2019 12:40:42.231 -0400 ERROR TcpOutputFd - Connection to host=10.0.155.157:5353 failed
05-29-2019 12:40:42.232 -0400 WARN TcpOutputFd - Connect to 10.0.155.157:5353 failed. No route to host
05-29-2019 12:40:42.232 -0400 ERROR TcpOutputFd - Connection to host=10.0.155.157:5353 failed
root@raspberrypi:/opt/splunkforwarder/etc/system/local# ping 10.0.155.157
PING 10.0.155.157 (10.0.155.157) 56(84) bytes of data.
64 bytes from 10.0.155.157: icmp_seq=1 ttl=64 time=0.564 ms
64 bytes from 10.0.155.157: icmp_seq=2 ttl=64 time=0.530 ms
64 bytes from 10.0.155.157: icmp_seq=3 ttl=64 time=0.532 ms
Here are the config files on my pi-hole:
inputs.conf
root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat inputs.conf
[default]
host = raspberrypi
[monitor:///var/log/pihole.log]
index = pihole
sourcetype = dnsmasq
disabled = false
outputs.conf
root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 10.0.155.157:5353
[tcpout-server://10.0.155.157:5353]
props.conf
root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat props.conf
[dnsmasq]
NO_BINARY_CHECK = true
DATETIME_CONFIG =
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 24
... View more
05-24-2019
04:22 AM
1 Karma
Seems to have resolved my issue, many thanks!
... View more
05-23-2019
01:41 PM
Thanks for the advice Mary!
So far things are looking good, I'll confirm everything works tomorrow morning once we hit a new day.
Current props.conf
[sophos:syslog]
TIME_PREFIX = <\d\d>
TIME_FORMAT = %Y:%m:%d-%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 19
TZ = US/Eastern
... View more
05-23-2019
06:55 AM
Additional information for context on what I mean by "going backwards".
... View more
05-23-2019
06:17 AM
Hey Rich - that is correct, I didn't want to conflate the issue as "technically" the props.conf as answered in that question addresses that one issue...it just also introduces a new one. I will try to clarify:
I am attaching a screenshot of what I mean by going backwards in the answers section below (as I can't attach screenshots in replies).
The blue line represents 11:59:59 then the red line takes us back to a previous date and inserts events from 12:00:00 and on to a previous day. The newest events are not being shown first; the newest event is at the end of the second red arrow.
... View more
05-23-2019
05:00 AM
Splunk noobie here: When I configure my props.conf file like the first snippet I get multiple events showing as a single event.
[splunk@localhost ~]$ cat /opt/splunk/etc/apps/search/local/props.conf
[sophos:syslog]
TIME_PREFIX = <..>
TIME_FORMAT = %Y:%m:%D-%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 19
So in an attempt to resolve I modify props.conf to look like this:
[sophos:syslog]
TIME_PREFIX = <..>
TIME_FORMAT = %Y:%m:%D-%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 19
SHOULD_LINEMERGE = false
I get the event issue resolved BUT then my dates appear to go backward at the beginning of the new day...
Any ideas/thoughts on how to resolve?
... View more
05-22-2019
06:31 AM
Follow up resolution that seems to work - I didn't realize I needed to modify the props.conf file AND the inputs.conf files.
props.conf file
[splunk@localhost ~]$ cat /opt/splunk/etc/apps/search/local/props.conf
[sophos:syslog]
TIME_PREFIX = <..>
TIME_FORMAT = %Y:%m:%D-%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 19
inputs.conf file
[splunk@localhost ~]$ cat /opt/splunk/etc/apps/search/local/inputs.conf
[tcp://10.0.100.1:5114]
connection_host = ip
source = UTM Syslog
sourcetype = sophos:syslog
... View more
05-14-2019
04:58 PM
After making the change when I run splunk btool check --debug I get an error:
Invalid key in stanza [source::syslog] in /opt/splunk/etc/system/local/inputs.conf, line 4-7
Is this the correct location where I am supposed to modify props.conf?
Is this the correct way to specify a syslog stanza?
... View more
05-05-2019
12:44 PM
Also as information this unique syslog is coming from a Sophos UTM security appliance.
... View more
05-05-2019
05:51 AM
Splunk noobie here - basic install on Centos 7, forwarding syslog from security device and the reported date seems to be going backwards, date in syslog message is correct (example below), where should I be looking/checking?
... View more
04-28-2011
07:51 PM
Good Evening,
I am trying to run the following command from a Mac workstation on the latest "Splunk Free" license.
./splunk add forward-server 10.0.155.112:9997
Splunk username: admin
Password:
Login failed
When I try to add an account to setup the forwarder, splunk tells me the following:
"Users is an Enterprise license-level feature and is currently not available on this instance.
To enable this and other Enterprise features, learn more about licenses at Splunk.com or contact Splunk Sales directly."
Am I doing something wrong or is the free version designed primarily for windows? Or is there a setting which will allow the admin account to authenticate this user for forwarding? Thanks for the help.
... View more
04-26-2011
09:02 PM
Hello, I just setup a splunk server and have all my windows machines running the splunkforwarder without any problems.
I have installed the splunkforwarder application onto my client machine (Mac) and can see that a PID is running on port 8089 for this application. I am unsure where to "configure" this application or what file to change/update so it points back to my splunk server with the appropriate listening port. I tried using the "To use the Splunk Web interface, point your browser at: "http://myserver.local:8000" to no avail. Any suggestions would be appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
