About khalidewaidah

khalidewaidah · ‎10-31-2021

I have tried to run paloalto adaptive response but I face below error ""PAN : Tag to Dynamic Address/User Group" - Adaptive response action could not be dispatched.Unexpected token M in JSON at position 0" Kindly , help me if you have experience on that .

khalidewaidah · ‎06-26-2021

Hi thanks for sharing your experience . I didn't find TA for Ruckus Wireless in splunkbase . did you create custom TA or you download and modify it .

khalidewaidah · ‎06-13-2021

Hi . Dose this app work with forescout NAC

khalidewaidah · ‎08-10-2020

Hi , Could you let me know how do you solve it

khalidewaidah · ‎07-12-2020

I have below error when I use search some indexes . 'asset_lookup_by_cidr' KV Store lookup table is empty or has not yet been replicated to the search peer (path used is: /opt/splunk/var/run/searchpeers/A2557FA9-9D57-4231-A48D-82E29327A675-1594539930/kvstore_s_SA-IdeRjww0FotymhlCIaS1cqkc05a_assetsUsLDHpCAlNCPKOnjIAACK5z5).

khalidewaidah · ‎06-25-2020

I have one requirement we need to give cretin users access only to windows app ans search app my question what is the easier to this requirement .

khalidewaidah · ‎05-14-2020

I tried to segment the log below using \s but it does not work, even after modifying segmenters.conf and props.conf . 2020-05-13 19:27:35,921 INFO com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - Failed to obtain a reference to remote EventBus. Connection to rmi://BCKCMD1:1050/EventBus refused. /opt/splunk/etc/apps/search/local/props.conf [test] . . . . . . SEGMENTATION = inner SEGMENTATION-full= inner /opt/splunk/etc/apps/search/local/segmenters.conf [inner] MAJOR = \s MINOR =

khalidewaidah · ‎05-13-2020

Could you provide me how it can write line break and Time regex below logs . 2020-09-26 19:27:33,092 DEBUG com.edifecs.shared.rmi.RMISocketFactoryInitializer - Initialize custom rmiSocketFactory...\n2014-09-26 19:27:33,983 DEBUG com.edifecs.shared.events.transport.rmi.RmiEventBusBuilder - Building EventBus instance for parameters: [eventBusID=EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}, rmiConfigurer=com.edifecs.shared.registry.RMIConfigurer@a9255c, remoteEventBusAddresses=[rmi://TEDITM01:1090/EventBus, rmi://TXENGN01:1090/EventBus, rmi://BCKCMD1:1090/EventBus], serverMode=true]\n2014-09-26 19:27:34,155 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Web Component/TEDITM01 {5ba842c9-9310-4342-9362-e63d8a964605}\n2014-09-26 19:27:34,186 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] local bus started up\n2014-09-26 19:27:35,921 INFO com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - Failed to obtain a reference to remote EventBus. Connection to rmi://BCKCMD1:1090/EventBus refused.\n2014-09-26 19:27:35,921 DEBUG com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - java.rmi.ConnectException: Connection refused to host: BCKCMD1; nested exception is: \n java.net.ConnectException: Connection refused: connect\n2014-09-26 19:27:37,655 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Service Manager/TEDITM01 {20f1a2e4-14d7-40e0-85b1-7462173ac1c3}

khalidewaidah · ‎05-01-2020

Dear , Is there any way to deploy Splunk Deployment instance with HA concept I mean if DS1 down the DS2 will work without any interrupt , Thanks ,

khalidewaidah · ‎05-01-2020

Thanks a lot it's working fine and provide me the original Password-Key.

khalidewaidah · ‎04-30-2020

I forgot pass4SymmKey for Splunk Indexer cluster. Is there any way to restore it in order to avoid changing the pass4Aymmkey in all cluster members? I need that pass4AymmKey in order to add a new indexer. [clustering] pass4SymmKey = Thanks

khalidewaidah · ‎03-03-2020

Dear , I have cluster setup and we need to collect local logging logs from work station using WMI without install UF on targets so I need to know the pre-request .

khalidewaidah · ‎10-24-2019

Dear , Do you have tested script in-order to install splunk forwarder last version remotely .

khalidewaidah · ‎04-28-2019

• [RY-SPLUNKID-01] Could not load lookup=LOOKUP-branding_kv_lookup • [RY-SPLUNKID-01] Could not load lookup=LOOKUP-iris_lookup_history • [RY-SPLUNKID-01] Could not load lookup=LOOKUP-iris_lookup_queue • [RY-SPLUNKID-01] Could not load lookup=LOOKUP-whois_lookup_history • [RY-SPLUNKID-01] Could not load lookup=LOOKUP-whois_lookup_queue • [RY-SPLUNKID-02] The lookup table 'branding_kv_lookup' does not exist. It is referenced by configuration 'dtoolscsvkv'. • [RY-SPLUNKID-02] The lookup table 'iris_lookup_history' does not exist. It is referenced by configuration 'dtoolscsvkv'. • [RY-SPLUNKID-02] The lookup table 'iris_lookup_queue' does not exist. It is referenced by configuration 'dtoolscsvkv'. • [RY-SPLUNKID-02] The lookup table 'whois_lookup_history' does not exist. It is referenced by configuration 'dtoolscsvkv'. • [RY-SPLUNKID-02] The lookup table 'whois_lookup_queue' does not exist. It is referenced by configuration 'dtoolscsvkv'. • [RY-SPLUNKID-03] Could not load lookup=LOOKUP-branding_kv_lookup • [RY-SPLUNKID-03] Could not load lookup=LOOKUP-iris_lookup_history • [RY-SPLUNKID-03] Could not load lookup=LOOKUP-iris_lookup_queue • [RY-SPLUNKID-03] Could not load lookup=LOOKUP-whois_lookup_history • [RY-SPLUNKID-03] Could not load lookup=LOOKUP-whois_lookup_queue

khalidewaidah · ‎01-29-2019

Dear All , I need to know how to configure F5 ASM version 13 to send logs to splunk as below format . Below link contains format for version 12 and not support version 13 . https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup Regards ,

khalidewaidah · ‎01-25-2019

Thanks for your answer , this TA for Forcepoint Web not Forcepoint firewall .

khalidewaidah · ‎01-20-2019

Is there TA for ForcePoint Fierwall or document explain the logs that help me when I create TA

khalidewaidah · ‎11-08-2018

I need sample logs for Symantec Bluecoat proxy logs and TA I install the TA from Symantec site but it does not work any body can help me .

khalidewaidah · ‎03-05-2018

Dear All I follow all steps above but the new indexers can't add is there any settings need to do in cm

khalidewaidah · ‎03-05-2018

I have below error when integrate between splunk & F5 using API I control 2018-03-05 14:07:51,100 ERROR pid=8608 tid=MainThread file=Splunk_TA_f5_bigip_main.py:stream_events:123 | Error in getting task definitions by restful API(maybe splunk daemon is down?) - Traceback: Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py", line 115, in _stream_events servers = to_dict(server_manager.all(), ':') File "/opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip/Modules/init_.py", line 6, in to_dict

khalidewaidah · ‎09-07-2017

We need to send alert shows if hosts status change from down to up please help me how we can do this

khalidewaidah · ‎07-24-2017

Hi , Below all config i did . 1- On indexers below setting put it [splunktcp-ssl:9997] disabled = 0 [SSL] password = $1$hRTZVBQRSqRp rootCA = $SPLUNK_HOME/etc/auth/cacert.pem serverCert = $SPLUNK_HOME/etc/auth/server.pem 2- On Forward below setting put it Configure Outputs on Universal Forwarders in KW [tcpout] defaultGroup = kw_indexer_new useACK = true forceTimebasedAutoLB = true [tcpout:kw_indexer_new] server = ksplkprdaio.alrajhi.bank:9997 autoLB = true sslVerifyServerCert = false sslPassword = password sslCertPath = $SPLUNK_HOME/etc/auth/server.pem sslRootCAPath = $SPLUNK_HOME/etc/auth/ca.pem useClientSSLCompression = true 3- Below input.conf push to universal forward . [monitor://D:\FTP\BlueCoatLogs*.log.gz] disabled = 0 host = kwproxysg1 blacklist = .(gz|tgz|bz2|z|zip)$ index = bcoat sourcetype = bluecoat:proxysg:access:file I did all above things but still the problem still exists .

khalidewaidah · ‎07-24-2017

Also I used SSL on indexer already

khalidewaidah · ‎07-24-2017

The splunk version installed is 6.1.7 can I upgrade it to 6.3.10 directory .

khalidewaidah · ‎07-23-2017

Dear , I installed universal Forward on windows server 2003 & I the installation was successfully but the event & path that put in inpit.conf not working & sending logs to splunk I tried to check if there is any permission issue by using this SPL (index=_internal "Machine Name" "Path" ) nothing appear . Also I fond below error when I run this SPL (index=_internal "10.160.0.5" ssl) maybe this is the reason . 07-24-2017 09:19:42.753 +0300 ERROR TcpInputProc - Error encountered for connection from src=10.160.0.5:3373. error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired I'm looking forward your help please

Posts	32
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎05-02-2017

Online Status	Offline
Date Last Visited	‎10-31-2021 05:39 PM

SH Cluster Error

Spacify User Apps

Help with segmenters.conf search.

Line Breake issue

Deployment server High Availability Set up

Forgot password Key for indexer cluster?

Get windows Local login logs using WMI

Installing Forwarder on Centos machine remotly

ERROR AFTER UPGRADING SPLUNK TO LATEST VERSION

F5 Version 13.0

Re: Palo Alto: Adaptive Response: Tag to Dynamic A...

Re: Splunk Add-on for Ruckus Wireless - Fields not...

Re: Integration Forescout with Splunk ES

Re: Why is the assets_by_cidr.csv lookup file not ...

SH Cluster Error

Spacify User Apps

Help with segmenters.conf search.

Line Breake issue

Deployment server High Availability Set up

Re: Forget Password Keyfor splunk Indexer cluster

Forgot password Key for indexer cluster?

Get windows Local login logs using WMI

Installing Forwarder on Centos machine remotly

ERROR AFTER UPGRADING SPLUNK TO LATEST VERSION

F5 Version 13.0

Re: ForcePoint Firewall TA

ForcePoint Firewall TA

Symntec Blucoat Proxy last version

Re: How to add more indexers to your existing inde...

F5 API Integration

Create search shows hosts status from Down to up

Re: Can't get event

Re: Can't get event

Re: Can't get event

Can't get event