About natalielam

natalielam · ‎06-22-2020

Do you have access the the CLI of this Splunk instance? If so, you can reset the password: Stop splunk service Move the $SPLUNKHOME/etc/passwd file to $SPLUNKHOME/etc/passwd.bak Start Splunk. After the restart you should be able to login using the default login (admin/changeme). source: https://community.splunk.com/t5/Security/Splunk-Admin-Password/td-p/326020 If this is a training provided instance, contact your instructor.

natalielam · ‎05-28-2020

My error disappear once I initiated a restart. It seems that after the restart, Splunk reruns the search and the issue is gone.

natalielam · ‎05-28-2020

I encountered this problem as well. The alerts was triggered by restarting an indexer cluster peer, which caused this peer to roll all its indexes. I believe this is just a one-time thing, and the internal logs shows that the hotBucketRoller is working perfectly normal. My problem is that the alerts stayed here for almost a day now. @jacobevans Have you found how long the health status alert will stay?

natalielam · ‎03-08-2020

Noticed I put the wrong link to the windows add-on. Edited now. Cheers

natalielam · ‎03-08-2020

Yes definitely! I used the trial version for my testing and it works.

natalielam · ‎03-08-2020

Windows raw logs are binary files. Seems that your Splunk forwarder are not reading the logs properly. If you already installed the forwarder on your windows server, you can consider using the universal forwarder to forward the logs to your indexer: https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWindowseventlogdata#Use_a_universal_forwarder It is also more convenient to use the add-on to set up log collection: https://splunkbase.splunk.com/app/742/

Posts	6
Solutions	1
Karma Given	6
Karma Received	2
Member Since	‎03-05-2020

Online Status	Offline
Date Last Visited	‎06-22-2020 10:56 PM

Re: Installing Splunk

Re: The percentage of small of buckets is very hig...

Re: The percentage of small of buckets is very hig...

Re: Getting windows logs into splunk

Re: Getting windows logs into splunk

Re: Getting windows logs into splunk