About saramamurthy_sp

saramamurthy_sp · ‎01-29-2020

Hi David, Good that you found something good, I guess you need to raise a case with the Splunk support they can be helpful with this and they can reach the respective department to make the changes.

saramamurthy_sp · ‎12-31-2019

Are you speaking about Linux or Splunk Users? if Linux Users, you have to install on your forwarder a TA-Linux that contains a script to collect Linux users. If you don't want to install the full TA_Linux, you can take only the script to extract users ($SPLUNK_HOME/etc/apps/Splunk_TA_nix/ bin/usersWithLoginPrivs.sh). After you can search them in Splunk with a simple search ( index=os | dedup users | table users ). Cheers.

saramamurthy_sp · ‎12-31-2019

You need to login, when you open the link you will be asked to login and when you login you can download the application. https://splunkbase.splunk.com/app/3311/

saramamurthy_sp · ‎12-31-2019

As mentioned in the document, you do not need the restart of the Splunk services once the patch is done. https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020#Download_and_deploy_an_app_that_temporarily_replaces_the_defective_datetime.xml_file_with_the_fixed_file

saramamurthy_sp · ‎12-31-2019

Hi Kindly increase the size under the below parameter and restart the splunk services. Under the server.conf [queue] maxSize

saramamurthy_sp · ‎11-30-2019

Hi This question is about buckets, and I would advise you to reffer the below document which will help you to understand what is the buckets and what is the time range and what is the rolling of buckets. https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/HowSplunkstoresindexes Coming to your question you need to either make it, on the time period or on the size of the bucket. Since you require 180 days of the data then you need to make changes in the indexes.conf frozenTimePeriodInSecs = 15552000 (180 Days) This is the time you are setting to make the data into frozen, you can read more details on this in the below document. https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Indexesconf

saramamurthy_sp · ‎11-30-2019

You can make it by using the reverse command, this basically reverses the timeline you want to happen, at the end of the search use the below command. |reverse

saramamurthy_sp · ‎11-30-2019

If you are question is , when the forwarder forwards a data to a indexer and these data will be forwarded into a different folder, then I am sorry this wont happen. Forwarder only forwards the data to the indexer,you can forward the same data to multiple process, but you cant forward the indexed data to a different file or location.

saramamurthy_sp · ‎11-25-2019

Does this workaround apply for 7.2.9 as well?

saramamurthy_sp · ‎10-28-2019

You must have a Monitoring console as it becomes handy and also to get the complete information about you enviornment. You can monitor a lot of aspect of your enviornment. The dashoboard will give you the complete insight of your indexing performances. The dash board will give you plenty of information about your indexes and volumes such as: Disk usage by index Volume usage Index and volume size over time Data age Statistics for bucket types Bucket settings And viewing this dashboard will give you all the requred information. I would suggest you to read the below document. DOC: https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Viewindexstatus

saramamurthy_sp · ‎10-28-2019

I don't see the point in the way you are trying to achieve this, having said that with respect to your question of the limits. Well, there is no limitation in which we can blacklist/whitelist the server and you can add n number of the server names in these filtering fields. To have a better understanding of these two, I would suggest you to check the below link. DOC: https://docs.splunk.com/Documentation/Splunk/7.3.2/Updating/Filterclients#Define_filters_through_serverclass.conf. https://docs.splunk.com/Documentation/SplunkCloud/7.2.7/Data/Whitelistorblacklistspecificincomingdata. I would still suggest you to cross-check your implementation.

saramamurthy_sp · ‎10-28-2019

You can always build your alerts and when these alers meet the condtion i.e the alert value reaching >1 then these alerts will be triggered and you will get the notifications in the form the email. You can set these alerts, you can reffer to the below document which will help you to understand more. https://docs.splunk.com/Documentation/UnixApp/5.2.5/User/Createcustomalerts And if you are looking out which is the app that can help you for your requirement, I would suggest you to use the Rest API, you can download these in the below link. LINK : https://splunkbase.splunk.com/app/1546/ You can configure it using the below link. https://docs.splunk.com/Documentation/AddonBuilder/2.2.0/UserGuide/ConfigureDataCollection

saramamurthy_sp · ‎09-30-2019

Hi As of today I dont think the MacOS Catalina (version 10.15) has been released, so once the OS version gets released Splunk should be able to release the UF version as per the same. You will get the details once its been released in the below link. https://www.splunk.com/en_us/download/splunk-enterprise.html#tabs/macos.

saramamurthy_sp · ‎09-30-2019

If a Certificate has been expired then you have to renew the certificate, Splunk wont do auto-renewal. Below is the set of document, which will help you to understand how to renew your certificates, please go through the sub links as well. https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Howtoself-signcertificates.

saramamurthy_sp · ‎09-30-2019

You can check the below document which will help you to understand and configure the users and roles. https://docs.splunk.com/Documentation/ES/5.3.1/Install/ConfigureUsersRoles. Let me know if this was helpful.

saramamurthy_sp · ‎08-30-2019

Hi You can use the below command to rebuild the buckets, from the raw data file alone. $plunk_home/bin/splunk rebuild You can use the fsck command on the indexers to repair them as well. $plunk_home/bin/splunk fsck repair --all-buckets-all-indexes his will rebuild hot/warm/cold in all indexes. If you require it in a single index, then you can use the below command. $plunk_home/bin/splunk fsck repair --all-buckets-one-index --index-name= Below is the document which will help you to understand better. https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Bucketissues

saramamurthy_sp · ‎07-31-2019

To diable the cipher legacy suits in the Splunk 7.2 and higher you need to follow below process. FIrst, you need to perform it on the indexers, you need to add the [node_auth] in the server.conf restart splunkd services You need to add "legacyCiphers = disabled" below the general stanza and restart the services. You need to comment out the pass4SymmKey in the clustering stanza and add an other pass4SymmKey on the indexers. You need to do the same steps on all the indexers and then you need to perform the same steps in the cluster master. You need to run the command $plunk_home/bin/splunk rotate splunk-secret on the cluster master and the secret key will be distributed to all the indexers. You can follow the same process on the SH as well, and for search head, you need to run the Secret key on the SH Captain. Let me know if you face any difficulties.

saramamurthy_sp · ‎07-31-2019

The parameter which helps you define these setting is "max_users_to_precache " in the limits.conf, by default the value will be 1000 and yes the users expire from the LDAP pre-cache. We can increase or decrease the value of the max_users_to_precache by which we can restrict them from the expire of the LDAP pre-cache.

saramamurthy_sp · ‎07-26-2019

I had a similar case where the client himself found the solution, he performed the below steps and it fixed the issue. While upgrading from 6.6 to 7.2.3 if you are not able to start the Splunk and if it keeps on prompting to accept license follow the below steps Go to /opt/splunk mv ftr /tmp cd /etc/init.d ./splunk start If the above steps are followed we can get rid of MongoDB error and we can upgrade to the latest version.

saramamurthy_sp · ‎07-18-2019

I would like to send it to 2 different indexers not index. I see that one of the source type is going to production indexer but not on the development indexer. Though I have one of the other source type going to both with the same configuration, So i am little confused with this.

saramamurthy_sp · ‎07-15-2019

I have a setup, where I have one production indexer and another one is development indexer. I want all the data to be flown into production and specific set of data to be flown into development indexer. THe splunk architecture is UF>HF> IDX. I see that one source type( ping:directory) is able to send the data to both the indexer, while the other one(inventory:a10) is sending data only to production not into development. There are 2 indexers which are in a different cluster environment. Indexer1 : Lewisville_Indexers Indexer2 : DevIndexer These are the configurations set up we have made on our environment. UF : inputs.conf [monitor:///opt/csv/a10/*.csv] disabled = 0 index = inventory sourcetype = inventory:a10 crcSalt = initCrcLength = 1048576 [monitor:///u1/ds/logs/access] sourcetype=ping:directory index=ti_directory disabled = 0 HF : props.conf [ping:directory] TRANSFORMS-routing=SecOps_Prod_Dev [inventory:a10] TRANSFORMS-routing=SecOps_Prod_Dev Transforms.conf [SecOps_Prod_Dev] REGEX = . DEST_KEY=_TCP_ROUTING FORMAT=Lewisville_Indexers,DevIndexers output.conf [tcpout] defaultGroup = Lewisville_Indexers,DevIndexers

saramamurthy_sp · ‎06-27-2019

Kindly, check for which specific indexes and for which bucket directories it is giving the error. Generally, whenever an index generates too many small tsidx files(more than 25) Splunk is not able to optimize all those files within the specified time period. Kindly, run the below command against the specific directory to optimize it manually:- splunk-optimize -d|--directory Or you can make the below changes in Indexes.conf to fix the issue:- indexes.conf [default] maxConcurrentOptimizes=25 maxRunningProcessGroups=12 processTrackerServiceInterval=0 Please go through the below documentation to have a better understanding of Splunk Optimization. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Optimizeindexes

saramamurthy_sp · ‎06-27-2019

Hi You can download the Splunk Universal forwarder using the link below, you need to use your login credentials before you download the package. https://www.splunk.com/en_us/download/universal-forwarder.html#tabs/linux You can install it using the wget and download the package and untar the package. Later move it to the /opt folder on your server. Please check for the system requirements before you download the package. You can check for the system requirement using the below link https://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/Systemrequirements. https://docs.splunk.com/Documentation/Splunk/6.5.1/Installation/Systemrequirements#Supported_OSes Make sure you are using the equal version or the lower version of the indexer. Thank you

saramamurthy_sp · ‎05-20-2019

What should be my inputs.conf stanza to run the PowerShell script in the Exchange server 2016 with windows server 2016 [script://.\bin\exchangepowershell.cmd v15 get-inboxrules_2010_2013.ps1] source=Powershell sourcetype=MSExchange:2016:InboxRules interval=3600 index=msexchange disabled=false or [script://.\bin\exchangepowershell.cmd v15 get-inboxrules_2010_2016.ps1] source=Powershell sourcetype=MSExchange:2016:InboxRules interval=3600 index=msexchange disabled=false

saramamurthy_sp · ‎05-05-2019

The is an observed behavior in Splunk 7.x versions, the FIELDALIAS overwrites the null value from the source field to the destination field and is having the values in it, So the final result is null value in the Destination field and because of which the baheviour change the rule field is not getting extracted. So you need to makes these changes in the props.conf Comment below in the $plunkhome/etc/apps/Spunk_TA_cisco-asa/default/props.conf FIELDALIAS-fwsm_acl_for_rule= acl as rule(in cisco:fwsm stanza)

Posts	29
Solutions	1
Karma Given	6
Karma Received	2
Member Since	‎03-28-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

I am not able to send logs to 2 different indexer

stanza to run powershell script in exchange 2016.

Monitoring console not working for user prievilege...

Unable to open external link in new tab ; -blank n...

Re: Spelling mistake

Re: List of users on Linux and Windows clients, ho...

Re: Why I can't download the add-on of splunk anal...

Re: Should we be adding a restart flag to the Splu...

Re: Search peer has the following message: idx=_in...

Re: Index Retention Time

Re: How to change order of result in splunk query

Re: Splunkforwarder - log to file?

Re: Dashboard PDF email failing

Re: How to check my indexing volume exceeded and ...

Re: Is there a limit to the amount of servers a de...

Re: How to be notified by Splunk?

Re: Is there a Universal Forwarder installer for M...

Re: SSL cert expired for 'https://mint.splunk.com'

Re: Splunk Fundamentals 1 - Module 3 Lab - adding ...

Re: splunk command to repair buckets

Re: Running into errors while disabling the legacy...

Re: LDAP pre-cache

Re: upgrade to 7.2 fails with "ERROR while running...

Re: I am not able to send logs to 2 different inde...

I am not able to send logs to 2 different indexer

Re: Too many tsidx files

Re: Splunk forwarder

stanza to run powershell script in exchange 2016.

Re: CISCO ASA add on is not extracting fields