About lloydknight

lloydknight · ‎10-19-2017

Hello sahr Kindly check this similar question. https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html Hope it helps! Thanks!

lloydknight · ‎10-19-2017

Hello, Can you share your search query?

lloydknight · ‎10-19-2017

Hello test_qweqwe These links might help by blocking the domains that could host ransomware using Splunk ES. Official Documentation: http://docs.splunk.com/Documentation/ES/4.6.0/User/Configureblocklists#Add_a_ransomware_threat_feed_to_Splunk_Enterprise_Security Splunk Blog: https://www.splunk.com/blog/2017/01/24/enhancing-enterprise-security-for-ransomware-detection.html Hope it helps! Thanks!

lloydknight · ‎10-19-2017

Hello gcescatto Try installing the Splunk Dashboard Examples app. Though you'll have to do some customization, the codes can be copy-pasted and is very straightforward. Here's the link: https://splunkbase.splunk.com/app/1603/ You'll have to provide your own set of smileys and assign a number range from it. Check this blog below for more details: https://www.splunk.com/blog/2014/03/17/custom-icons-in-splunk-6-tables.html Hope it helps! Thanks!

lloydknight · ‎10-19-2017

Hello cutright_jm Try binding Splunk's port 8089 to an IP to address the web interface: Kindly see this documentation below: https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/BindSplunktoanIP As for the deployment_client role, i believe you have created a deploymentclient.conf which the Forwarder is reporting to the Deployment Server. You can verify this by checking the Forwarder Management on the Deployment Server. You can just directly set the Forwarder to forward logs to the Indexer by just configuring its outputs.conf. The only downside to this one is you can't push apps to the Forwarder. Hope it helps! Thanks!

lloydknight · ‎10-19-2017

Hello, shouldn't this be web.conf instead of server.conf ?

lloydknight · ‎10-19-2017

Hello gorlov Have you tried entering the default port of Splunk? http://localhost:8000 If port 8000 is already taken, refer to this link below to change the port: https://answers.splunk.com/answers/398933/after-installing-splunk-light-is-there-a-way-to-ch.html Hope it helps! Thank you!

lloydknight · ‎10-18-2017

Hello @tomasnelson I believe your current question tells that you want to convert your Splunk Light to a Heavy Forwarder. Kindly check out this link below: https://answers.splunk.com/answers/379469/can-splunk-light-be-converted-to-a-heavy-forwarder.html As the poster said "Splunk Light doesn't appear to allow him/her to point it to a remote master license server", (I personally haven't tried this before) your best bet is to convert your Splunk Light to a Splunk Enterprise License to be able to convert your instance as a Heavy Forwarder. Hope it helps! Thanks!

lloydknight · ‎10-18-2017

Hello @mdzaman, Licensing in Splunk is very straightforward. It is still a GB per day regardless of reindexing previously deleted data. Example: Your License: 100GB Say for example you're currently indexing a 90GB/day today then you decided to re-index your previously deleted indexed data, the reindexed data will add up to your current 90GB/day license utilization. If you're currently using Splunk Enterprise 6.5 or later, I highly suggest you contact Splunk and request for the "No-enforcement license" to remove your worries on exceeding your current license. See link below for more details on the NEL https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/TypesofSplunklicenses Hope it helps! Thanks!

lloydknight · ‎10-16-2017

Apologies. I'm really confused with your requirements. so what do you want to trend every month? distinct count of EOL? ATTENUATION?

lloydknight · ‎10-16-2017

Hello ngerosa, If my understanding is correct, you want to trend the count of the fields into its own value in the x-axis. say for example: index=your_index earliest=@mon latest=now | chart count(ATTENUATION) AS ATTENUATION_count by ATTENUATION What I don't understand is that you have two fields (ATTENUATION and EOL) that you want to put in the x-axis? is that correct? EDIT: try this: index=your_index earliest=@mon latest=now | chart count(ATTENUATION) AS ATTENUATION_count by ATTENUATION | join [search index=your_index earliest=@mon latest=now | chart count(EOL) AS EOL_count by EOL] then click Format on the Visualization tab and select Chart Overlay and Overlay the field EOL to have a Y-axis count on the right side. Hope it helps!

lloydknight · ‎10-16-2017

is it something like this? base search | chart count(ATTENUATION) AS ATTENUATION, count(EOL) AS EOL by date_month

lloydknight · ‎10-16-2017

Hello @anandhalagarasan You may want to check these similar questions. https://answers.splunk.com/answers/92960/how-to-view-data-retention-settings-in-splunk.html https://answers.splunk.com/answers/553180/how-to-find-the-retention-period-of-an-index.html Hope it helps! Thanks!

lloydknight · ‎10-16-2017

Hello @nsanchezfernandez, You may want to read this documentation. http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkdoeswithyourdata Also, check this question below. Your question is nearly similar to this one. https://answers.splunk.com/answers/154006/where-can-i-find-a-detailed-explanation-on-how-splunk-search-works-relative-to-index-time-fields.html Hope it helps. Thanks!

lloydknight · ‎09-11-2017

If your splunk is running on Unix systems, try installing the unix and linux add-on app then enable the script that captures the uptime of the processes. Then create a gentimes search that will alert you when the process is not running since there will be no logs that will indicate the process is down I believe.

lloydknight · ‎08-01-2017

hello, klaxdal. so I have already set the sourcetype as cisco:asa but this will only limit me to monitor the cisco:asa sourcetypes. I need all the cisco logs to automatically populate all the dashboards in this app. check this link https://answers.splunk.com/answers/188473/what-sourcetype-should-i-set-ciscoasa-switch-data.html it says their that sourcetype=syslog will automatically redefined with their respective sourcetype. thoughts?

lloydknight · ‎07-26-2017

Hello, thank you for the comment.i believe klaxdal already pinpointed my problem which is the sourcetype not being defined properly. Though you're right about the local folder since i didn't change any conf files so no need for the local

lloydknight · ‎07-26-2017

So meaning, i should define different ports for every new cisco device with the same index right but with different correct sourcetypes right?

lloydknight · ‎07-26-2017

Yes you're right. I precreated the index with the sourcetype as syslog before the integration. :)) If i will have to populate the other dashboards in cisco suite, say for example the cisco esa or wsa, should I create another index and define a new port for logging as 514 is exclusively for asa? Many thanks btw, i will try this by tomorrow and will accept this answer if it works

lloydknight · ‎07-25-2017

I've read a couple of posts/answers here. What I did. created a local directory on the TA_cisco-asa app and copied eventtypes, transforms, and props. Upon checking on the config files, contrary to the answers on the posted questions here, they were already commented out by default. *the [source::udp::514] Upon checking on the dashboards, they were looking for eventtype=cisco-firewall checked eventtypes.conf and no cisco-firewall defined like really? why? and i thought add-ons will require minimal to no configuration already. only enabling some of the metrics. current setup is splunk listening to 514 with the sourcetype=syslog Thoughts?

lloydknight · ‎07-25-2017

apparently this doesn't work for me. props.conf config was already commented out but still not working. and the dashboards were looking for eventtype=cisco-firewall and upon checking on the eventtypes.conf, there's no cisco-firewall defined in there. what's happening here?

lloydknight · ‎07-23-2017

Hello, So we ran a health check on our Splunk Search Head (w/ Splunk ITSI) and indexers. Though the results were pretty straightforward, would still like to know your inputs, assessments, and if possible, recommendation on this. Current Situation: Our Splunk ITSI is experiencing some frequent N/A KPIs which in my assessment would be the skipped searches due to 1000+ KPIs were already created (that's 1000+ saved searches every 5 minutes) and some Forwarders are not following the interval on the inputs.conf (from Add-On Apps, enabled scripted inputs especially on Windows) Architecture: 3 Indexers 2 Search Heads (not clustered) Search Head Statuses: Search Head 1 is for miscellaneous reporting - 5-10 concurrent users and some are viewing dashboards with expensive searches - (some searches are using summary data, but most are raw data) Search Head 2 is dedicated for Splunk ITSI - with 1200+ KPIs defined (scheduled searches) and Jobs are averaging from 700-1000+ - occasional warnings on dispatch directory and as observed, if many users are using, Searches are queuing which is to be expected. Health Checks result: Search Head w/ ITSI Indexers Thoughts? Much appreciated!

lloydknight · ‎07-13-2017

If you want to delete an already indexed data and just view the latest, you can try to set a retention period with it. https://answers.splunk.com/answers/107910/determine-index-retention-time.html https://docs.splunk.com/Documentation/Splunk/6.6.1/Indexer/Setaretirementandarchivingpolicy And if you want to delete the files you are monitoring after indexing it, you can use batch instead of monitor. https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Inputsconf Consider this as a work-around since this doesn't directly addresses your concern. Hope it helps.

lloydknight · ‎07-13-2017

Hello niveditahanumant, Have you tried creating an inputs.conf with it? https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Inputsconf But if you have an existing inputs.conf already including the data that you're monitoring, ensure that the needed port for forwarding (default port for forwarding data is 9997) is allowed in the firewall, and do basic connectivity tests like ping and telnet for assurance. Hope it helps.

lloydknight · ‎07-13-2017

hello, what do you mean by unsplunk? Is it system/server without splunk installed on it?

Posts	138
Solutions	8
Karma Given	16
Karma Received	15
Member Since	‎08-11-2015

Online Status	Offline
Date Last Visited	‎09-21-2024 02:09 PM

Splunk ITSI - Netcool Integration (kvstore_to_json...

Sending SNMP from Splunk to Netcool

Cisco Security Suite not populating

Splunk Health Check Inquiry

Where to install AppDynamics App and Add-on?

Spunk Forwarder troubleshooting

Show Dashboard Tab

Indexing compressed vs raw logs

Splunk HEC Integration. Where to enable? Deploymen...

Splunk Machine Learning Toolkit: Added Correlation...

Re: Combining unique field values

Re: How to filter out the list of hosts that are i...

Re: How do you detect WannaCry by Splunk Enterpris...

Re: How can I display images in my dashboard?

Re: Splunk Universal Forwarder -- installing addit...

Re: Starting Splunk Light

Re: Starting Splunk Light

Re: Is it possible to send all data from Splunk Li...

Re: How does reindexing data count against the lic...

Re: How can I change the x-axis label on my chart ...

Re: How can I change the x-axis label on my chart ...

Re: How can I change the x-axis label on my chart ...

Re: How can we view the data retention policy we h...

Re: How does the Splunk internal search functional...

Re: Measuring Splunkd Uptime

Re: Cisco Security Suite not populating

Re: Cisco Security Suite not populating

Re: Cisco Security Suite not populating

Re: Cisco Security Suite not populating

Cisco Security Suite not populating

Re: Cisco Security Suite ASA firewall logs not sho...

Splunk Health Check Inquiry

Re: i was monitor a folder continuously in which i...

Re: How to forward data to unsplunk system?

Re: How to forward data to unsplunk system?

Join the Conversation