About tnorth42

tnorth42 · ‎09-18-2020

This worked for us.

tnorth42 · ‎02-15-2019

When deploying in a cluster only setup data inputs on one of the search heads.

tnorth42 · ‎12-05-2018

installed the app and add on however we are not getting any information pulled through the API key? ran all the troubleshooting suggestions to no avail? The API key owner has Metrics:Full, is there any other tests/troubleshooting that can be done?

tnorth42 · ‎03-16-2018

Unfortunately I am not sure exactly which one does it, i do know that after enabling all it was showing up. can you tag this with "Splunk Security Essentials", the developer usually replies back very quickly.

tnorth42 · ‎03-02-2018

You need to setup the inputs.conf for the Splunk_TA_windows app. https://docs.splunk.com/Documentation/WindowsAddOn/4.8.4/User/Configuration

tnorth42 · ‎02-23-2018

Thank you!

tnorth42 · ‎02-23-2018

Awesome, we just installed 2.0 today. We will edit the json as suggested above. We have a subscription pushed out through GPO to all of our windows systems that send their data to 2 windows event collectors, from there we are utilizing splunk universal forwarder and all events are coming in with source="WinEventLog:ForwardedEvents".

tnorth42 · ‎02-23-2018

The searches in security splunk essentials point to a default source of wineventlog:security, can we change to point to a different source or index?

Posts	8
Solutions	1
Karma Given	1
Karma Received	1
Member Since	‎02-23-2018

Online Status	Offline
Date Last Visited	‎09-18-2020 04:35 PM

Unable to pull info

look elsewhere for data

Re: Upgraded Splunk DB Connect V3.2.0 to V3.3.0 se...

Re: Unable to pull info

Unable to pull info

Re: Define user field in Security Essentials

Re: Define user field in Security Essentials

Re: look elsewhere for data

Re: look elsewhere for data

look elsewhere for data