Im setting up a new DB connect to pull data from MS SQL server 2016 database to splunk : 1. Downloaded the latest version of DB Connect 3.3.1 2. Downloaded sqljdbc_4.2 driver and moved the m...
I am having some trouble working with JSON events. I use SplunkEnterprise 6.4.1. I'm using KV_MODE=json in my props.conf file. For regular fields and top level arrays, it's working great. How...
Hello Splunk ES users 🙂
I'm using the latest Splunk ES (2.4.0) and since the upgrade from 2.0.2, I have the following error:
lookup_expander: Some lines in the input CSV contained bad data...
...earches (incl. ES) built over tags, we're having really sustained searches.
The question: What approach is more correct to handle lots of distinct types of data, especially for Enterprise Security c...
...o pre-define the JSON structure somehow? I though it could absorb any structure and you parse for what you need later with the spath command.
I am using Splunk 7.1.2. Community edition of SplunkEnterprise...
Hi can you help with these security questions about howSplunkhandles sessions? (Either On-Premise EnterpriseSplunk or in Cloud) We can't find anything about it in the SplunkEnterprise / Splunk C...
Over the weekend we bounce our indexers and we just found out that the data model accelerations take over an hour to stabilize after such bounces. Their cpu is close to 100% for a while, the time t...
We're currently running SplunkEnterprise on AWS EC2 as a single instance deployment. We have ~ 10,000 forwarders pushing ~ 90G (daily) of logs to the instance and indexing ~13G of logs. We are e...
Our current setup has a Heavy Forwarder running Enterprise 6.5 and DB Connect 3.1.3 that handles all our database connections and a few other miscellaneous connections to send to both our Cloud and Enterprise...
When we tried to run the script te_asset.py we expected an error where it said that no data was retrived from the "make" field.
When looking in to the XML from Tripwire we noticed that we hade s...