topic how do i monitor my own system ? in Security

how do i monitor my own system ?

rcon313 — Thu, 30 Sep 2021 23:46:45 GMT

So I am very new to Splunk and I have just started using it. What I want to do is be able to view my own laptops operating system file logs and performance data. What I have been doing is logging onto my splunk and then selecting the "add data" button. From there I select the "monitor" button. For example I have chosen to monitor my local events log but for some reason when I try to search anything I get nothing so something is wrong and I dont know what.

Please help

Re: how do i monitor my own system ?

gcusello — Fri, 01 Oct 2021 06:45:12 GMT

Hi @rcon313,

probably you need to have a training before to start to work on Splunk.

You could follow the Splunk Fundamentals I course (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) that's a free course and the Search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchTutorial/WelcometotheSearchTutorial) that help you to understand how Splunk searches work.

About the ingestion of windows logs, there's an interesting video in the download page of splunk that could help you to understand how Splunk ingests local logs.

Then these other videos on YouTube:

https://www.youtube.com/watch?v=3GKhCZfQqDM

https://www.youtube.com/watch?v=1AyJaKxks-I

https://www.youtube.com/watch?v=rT-O80XfWuY

https://www.youtube.com/watch?v=sLMIEjgD6UY

maybe someone is late but this part is almost the same.

Ciao.

Giuseppe

Re: how do i monitor my own system ?

rcon313 — Fri, 01 Oct 2021 11:37:22 GMT

Hi Gcusello,

I finished the fundamentals part 1 course yesterday. It was a good course but it only really covered how to upload data into splunk. Maybe its a wee bit different for when you monitor your own system. I will have a look at the videos you sent me as well.

Thank you very much

Re: how do i monitor my own system ?

gcusello — Fri, 01 Oct 2021 14:04:03 GMT

Hi @rcon313,

there are two videos that describe how to ingest Windows logs.

Anyway, I usually don't start from Add Data, but from Data Inputs, I Use Add-Data when I want to upload logs from a text or csv file.

So if you want to take the logs from the machine where Splunk is installed, you have to see in the menu choice [Settings -- Data Inputs] and choose the logs you want:

Local Eventlog Collection for Wineventlogs,
Files & Directories to read logs e.g. from IIS,
Local Performance Monitor to take the performance counters
and so on.

Please, let me know if my answer solved your need, in this case, please accept it for the other people of Community, otherwise, tell me how can I help you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉