Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jg91
jg91
Path Finder
Member since:
11-22-2019
12-16-2022
Community Statistics
| Posts | 33 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 2 |
| Member Since | 11-22-2019 |
Activity Feed
- Posted Configure forwarding data to two tcpout groups without blocking on group failure. on Getting Data In. 12-16-2022 02:46 PM
- Posted Why does Splunk UF stop sending data a few minutes after the start? on Getting Data In. 09-19-2022 05:34 PM
- Posted Re: How to download Splunk App for MS Echange? on All Apps and Add-ons. 05-30-2022 01:27 PM
- Posted How to download Splunk App for MS Echange? on All Apps and Add-ons. 05-11-2022 04:27 PM
- Posted Protecting UF from stopping and Uninstallation on Installation. 12-06-2021 11:27 PM
- Tagged Protecting UF from stopping and Uninstallation on Installation. 12-06-2021 11:27 PM
- Got Karma for How to find users who stopped a windows service. 12-05-2021 11:05 PM
- Tagged how to anonymize and route specific events on Getting Data In. 09-11-2021 06:48 AM
- Tagged how to anonymize and route specific events on Getting Data In. 09-11-2021 06:48 AM
- Posted how to anonymize and route specific events on Getting Data In. 09-11-2021 06:47 AM
- Tagged how to anonymize and route specific events on Getting Data In. 09-11-2021 06:47 AM
- Posted Alert Action to call a Rest API on Splunk Enterprise. 05-06-2021 04:44 AM
- Tagged Alert Action to call a Rest API on Splunk Enterprise. 05-06-2021 04:44 AM
- Posted Re: create notable event for missing forwarders on Getting Data In. 03-13-2021 09:12 PM
- Posted create notable event for missing forwarders on Getting Data In. 03-13-2021 08:49 PM
- Tagged create notable event for missing forwarders on Getting Data In. 03-13-2021 08:49 PM
- Tagged create notable event for missing forwarders on Getting Data In. 03-13-2021 08:49 PM
- Posted Re: Recursive query with unlimited depth on Splunk Search. 03-13-2021 07:10 PM
- Posted Recursive query with unlimited depth on Splunk Search. 03-13-2021 05:05 AM
- Tagged Recursive query with unlimited depth on Splunk Search. 03-13-2021 05:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
12-16-2022
02:46 PM
Is it possible to configure heavy forwarders to send data to two tcpout groups (A,B) (outputs.conf) and don't block on group B failure? We want to send all data to group A, and a subset of data (specific sourcetypes) to group B, but group B is in a remote location and our link to that location is not fully stable and we don't want to event loss in group A on link failures or group B failures. [tcpout]
[tcpout:groupA]
server=indexerA1_ip:9997,indexerA2_ip:9997
[tcpout:groupB]
server=indexerB_ip:9997
... View more
Labels
09-19-2022
05:34 PM
Hi, in a Linux server, a UF is configured to monitor a log directory, and it stops sending data to the indexer after about 2 minutes. When I restart the UF from the deployment server, it will start sending data and then stop sending. Other inputs configuration like running scripts are working fine, and there is no error or warning in the _internal index about this host. Do you have any idea about this problem?
... View more
Labels
- Labels:
-
inputs.conf
-
monitor
-
universal forwarder
05-11-2022
04:27 PM
Hello, I wanna download MS Exchange app but it's not available via https://splunkbase.splunk.com/app/1660 Where can I find version 4.0.4 of this app ?
... View more
Labels
- Labels:
-
installation
12-06-2021
11:27 PM
Is there any solution to protect UF from stopping or uninstalling by users on endpoints? For example, most Antivirus agents are password protected and on uninstallation, users must provide the password, I'm looking for this kind of solution. Thank you.
... View more
Labels
- Labels:
-
universal forwarder
09-11-2021
06:47 AM
I want to anonymize one sourcetype before routing it to 3rd party system with Syslog. what is the proper config for props, transforms, and outputs config files? When is use SEDCMD in props.conf, all events (for me and 3rd party system) will be anonymized, and when I use REGEX in transforms.conf for anonymizing, I can't route events to another system at the same transform stanza because FORMAT field should be used with _raw value.
... View more
Labels
- Labels:
-
heavy forwarder
05-06-2021
04:44 AM
Hello, We want to call a REST API endpoint as the action for an alert and also wish to send some parts of the search result with this API call. Do you have any suggestions?
... View more
Labels
- Labels:
-
configuration
-
development
03-13-2021
09:12 PM
Hi, Yes, but I want to find a way to forward MC Missing Forwarders Alerts to ES as a Notable Event, not creating a new Correlation search.
... View more
03-13-2021
08:49 PM
Hi, is there any solution to create a notable event for missing forwarders? Now missing forwarders generate an alert on Monitoring Console, which runs on a separate Splunk instance than ES.
... View more
Labels
- Labels:
-
monitor
-
universal forwarder
03-13-2021
07:10 PM
My events are firewall events with src, dest, and actions fields, and a firewall log event with allowed action is the connection between two nodes. My events: A -> target (raw event: src=A dest=target action=allow) B -> A (raw event: src=B dest=A action=allow) C -> B (raw event: src=C dest=B action=allow) D -> B (raw event: src=D dest=B action=allow) A -> C (raw event: src=A dest=C action=allow) C -> D (raw event: src=C dest=D action=allow) My goal is to find A, B, C, D nodes (all nodes that have a route/connection to the target node) with a recursive query.
... View more
03-13-2021
05:05 AM
Hello, I want to search for all src hosts that connect to a specific destination with or without intermediary hopes. I want to use a recursive query on the core firewall logs and its dest and src fields to find all sources. Would you please help me with this query?
... View more
Labels
- Labels:
-
other
03-09-2021
02:36 AM
1 Karma
How can I find users who stopped a service? I have tried [WinHostMon://service] and [WinEventLog://System] But the first option lists the status of services and for second option log doesn't have a User field.
... View more
Labels
- Labels:
-
configuration
09-20-2020
02:30 PM
1 Karma
Hello friends, We have Splunk ES and we stored our data in different indexes (OS logs, Network logs, ...) I have a question about correlation searches. Some correlation searches didn't use Data Models and just used simple search commands, how I can change these correlation rules to use our indexes? at first, is it needed to change anything? My second question is which permission or user will ES use to run Correlation Searches? I mean I have to grant access to our indexes to which Roles/Users? thanks.
... View more
- Tags:
- correlation search
- es
Labels
08-23-2020
03:13 PM
I have the same problem with MonitorNoHandle for dns.log. Did you solved it?
... View more
07-19-2020
02:11 PM
Hi, yes I saw these documents, with these configs we can blacklist some sort of events, for example, we can nullQueue (or Drop) events with specific field values or strings, but I don't want to drop the event, I want to delete some fields or parts of the event before indexing, like summarization.
... View more
07-19-2020
01:46 PM
so there is no restriction to use the same license for the HF and All Indexers (in both clusters) and simply I can use just one of those license masters, is it right?
... View more
07-19-2020
01:06 PM
Hello, we want to filter some fields of receiving events before indexing for the license saving, for example, in a firewall traffic log we want to delete the country field in the event and index the remaining fields or parts of the event. How we can do that? Can we do that with Heavy Forwarder? We don't want to drop any events, we just want to delete some parts of events before indexing.
... View more
Labels
- Labels:
-
heavy forwarder
07-19-2020
12:55 PM
Hello, we Have 2 separate Splunk indexer clusters with 2 separate licenses for each one, can we forward data to both of them from one Heavy Forwarder? what license we should use on the HF?
... View more
- Tags:
- indexer cluster
Labels
- Labels:
-
configuration
05-13-2020
03:32 PM
thanks for your answer, Do you have any document or link about this ?
... View more
05-11-2020
12:48 PM
Hello, I have a simple question, Does using indexer clustering affect Index Per Day license usage? for example, if I have a 100 GB/Day license and use 3 indexers with the replicate factor of 3, my license will be used 3 times or not?
... View more
Labels
- Labels:
-
capacity planning
05-01-2020
11:49 AM
Hi,
We plan to deploy Splunk with indexer clustering (with 3 indexers) in our company.
We know the hardware requirements for indexers and search heads, but it's not clear to us what recourses (CPU Cores, RAM, Storage) are needed for Cluster Master, License Master, Deployment Server, Heavy Forwarders, DMC.
Is there any recommendation for these components?
Thanks!
... View more
04-30-2020
01:11 PM
Hello, in recent years we always used CentOS 7 as OS for Splunk deployment, my question is about CentOS 8, is it a good choice for Splunk in a large deployment? My question is based on new features and changes made in CentOS 8 over CentOS 7.
As the second question in general, what is your recommended OS?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-16-2022
06:35 PM
|
