topic Re: Continuous CAT to Splunk Logs Failing to host = 161.209.202.108, user = sv_cat, port = 22 in Dashboards & Visualizations

Continuous CAT to Splunk Logs Failing to host = 161.209.202.108, user = sv_cat, port = 22

Praz_123 — Wed, 25 Oct 2023 07:07:40 GMT

CAT to Splunk Logs Failing:
host = 161.209.202.108
user = sv_cat
port = 22

Start time: 10/24/2023 at 4:21am

Re: Continuous CAT to Splunk Logs Failing to host = 161.209.202.108, user = sv_cat, port = 22

ITWhisperer — Wed, 25 Oct 2023 08:14:05 GMT

Is there a question or are you just reporting this? If it is a question, you should provide more information about what you have tried, and what the actual errors are.

Re: Continuous CAT to Splunk Logs Failing to host = 161.209.202.108, user = sv_cat, port = 22

Praz_123 — Wed, 25 Oct 2023 09:29:31 GMT

Basically, this is a question , able to see events till 4:00 am and after that not able to see.

With the below query able to check the last events :-

| tstats count where index=cat by host, index, source, sourcetype, _time

| search host=* |sort _time

@ITWhisperer

Re: Continuous CAT to Splunk Logs Failing to host = 161.209.202.108, user = sv_cat, port = 22

ITWhisperer — Wed, 25 Oct 2023 09:48:54 GMT

Basically, still not a question. If it is a question, what sort of answer are you expecting?

Re: Continuous CAT to Splunk Logs Failing to host = 161.209.202.108, user = sv_cat, port = 22

inventsekar — Wed, 25 Oct 2023 20:06:46 GMT

>>>Basically, this is a question , able to see events till 4:00 am and after that not able to see.

Hi @Praz_123 ... you were able to see logs/events till 4am and then not able to see, (for the host with ip 161.209.202.108... next time please avoid the ip addresses in your post, for security concerns)

maybe... there are not events/logs after 4am at all.

so, you should check the team or person who creates those events/logs(at the required host)

Iif you are looking for more details, Pls update us with more info, thanks.