Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About developmenttool
developmenttool
Loves-to-Learn Lots
Member since:
05-18-2019
07-24-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 05-18-2019 |
Activity Feed
- Posted Re: Worker Process CPU and RAM monitoring on Getting Data In. 07-24-2020 06:33 AM
- Posted Re: Worker Process CPU and RAM monitoring on Getting Data In. 07-22-2020 05:49 AM
- Posted Re: Worker Process CPU and RAM monitoring on Getting Data In. 07-22-2020 12:57 AM
- Posted Re: Worker Process CPU and RAM monitoring on Getting Data In. 07-15-2020 07:44 AM
- Posted Worker Process CPU and RAM monitoring on Getting Data In. 07-15-2020 06:34 AM
- Posted How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 06-04-2020 06:14 AM
- Tagged How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 06-04-2020 06:14 AM
- Tagged How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 06-04-2020 06:14 AM
- Tagged How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 06-04-2020 06:14 AM
- Tagged How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 06-04-2020 06:14 AM
- Tagged How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 06-04-2020 06:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
07-24-2020
06:33 AM
Hi @gcusello , I am going with scripted inputs in my windows universal forwarder. This is my configuration in inputs: [powershell://Processes-EX1] disabled = false script = . "C:\Program Files\SplunkUniversalForwarder\etc\apps\myapp\bin\WPSMonitor.ps1" index = myindex schedule = * * * * * sourcetype = stdout:wps:script It is entering my script WPSMonitor.ps1 but it is throwing the below error: ERROR Executing script=. "C:\Program Files\SplunkUniversalForwarder\etc\apps\myapp\bin\WPSMonitor.ps1" for stanza=Processes-EX1 failed with exception=The term '“Handle=â€' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again I have used $filter = “Handle=” + $p.Id in my script. Do you have any idea on this error? Regards, Vedhajanani
... View more
07-22-2020
05:49 AM
Hii @gcusello , Yes. I have the working script and I can configure the scripted input as well. I would like to confirm if there is any splunk native add-on which does the same thing so that I can use the add-on itself instead of scripted input. If you confirm that there is no TA config for this, I will go with my scripted input itself. Regards, Vedhajanani
... View more
07-22-2020
12:57 AM
Hi @gcusello , https://docs.splunk.com/Documentation/WindowsAddOn/8.0.0/User/Configuration I cannot find any config which monitors the CPU and memory for worker processes So we should proceed with scripted input only right? https://www.anexinet.com/blog/powershell-script-to-list-worker-processors-and-their-application-pool-names-with-memory-consumption-and-cpu-utilization/ Please help me if you can suggest any better native add-on which does the same. Regards, Vedhajanani
... View more
07-15-2020
07:44 AM
Hi Giuseppe, I am thinking to keep the powershell script and scripted input as a last option if there is no native splunk capability. I have tried to enable perfmon counters and instances as wildcard and checked the logs using Splunk App for Infrastructure. [perfmon://CPU] counters = * instances = * interval = 60 object = Processor mode = single useEnglishOnly = true sourcetype = PerfmonMetrics:CPU index = em_metrics But still I cannot find these application pools as metric names in the query |mstats avg(_value) prestats=true WHERE environment="PROD" AND entity_type="Windows_Host" AND host=myhost AND metric_name=* AND "index"="em_*" span=1m BY "host" |timechart avg(_value) as "Avg" agg=max limit=100 useother=false span=5m BY "metric_name". Please let me know if there is any other native option. Regards, Vedhajanani
... View more
07-15-2020
06:34 AM
Hi Team, I want to monitor individual CPU and RAM of the worker processes which I get when I run C:\Windows\System32\inetsrv>appcmd list wps Please let me know how to onboard the CPU and RAM metrics of these worker processes. Regards, Vedhajanani
... View more
Labels
- Labels:
-
monitor
06-04-2020
06:14 AM
I am trying to send Meraki Alerts to Splunk HEC Endpoint.
Please refer this URL to understand how we send Meraki alerts to receiving services. https://developer.cisco.com/meraki/webhooks/#!introduction/overview
I need to specify the Splunk endpoint and the shared secret in the Meraki webhook alert page as expected by Meraki. And here are the following details"
Webhook URL: Splunk Public Endpoint DNS(Backend will be heavy forwarder:8088)/services/collector/raw Shared Secret: HEC token in that Heavy forwarder
Now when I hit the test option, the Meraki alerts are not flowing into Splunk and on detailed log Splunk analysis, we get the below error in our splunkd.log :
06-03-2020 17:12:23.556 +0200 ERROR HttpInputDataHandler - Failed processing http input, token name=n/a, channel=n/a, source_IP=****, reply=2, events_processed=0, http_input_body_size=878
I could see that Meraki is not able to send the shared secret key with Splunk token embedded and hence failing. Any suggestion on fixing this would be of great help.
... View more
Labels
- Labels:
-
alert action
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-24-2020
01:20 PM
|
