About Rocky31

Rocky31 · ‎09-06-2017

1) How to auto restart Splunk. 2) How to upgrade Splunk 6.5 to the latest version. we currently have 325 GB license. Any suggestion. 3) How to add license after installing Splunk.

Rocky31 · ‎08-10-2017

I am not sure about this, it's very tricky. Can anyone help me on this? Do I need to update any .conf files?

Rocky31 · ‎08-06-2017

Thanks you very much

Rocky31 · ‎08-06-2017

Thank you sir

Rocky31 · ‎08-06-2017

Oh yeah thank you sir

Rocky31 · ‎08-06-2017

I install in my Mac

Rocky31 · ‎08-05-2017

I am typing all command like splunk start, splunk help, nothing is working, i don't know what to do, every time command not found showing

Rocky31 · ‎06-28-2017

i want to check whether it is up and running or sending data, just like i want to diagnose

Rocky31 · ‎06-28-2017

Any help will be appreciated, i trying from long back how to check missing forwarders.

Rocky31 · ‎05-02-2017

I really appreciate the help, thanks in advance How to Implement forwarders to support Application and Systems Monitoring

Rocky31 · ‎04-23-2017

Please help me out anyone, need these topics to learn. Onboarding syslog-ng architecture networking

Rocky31 · ‎03-15-2017

Thank for your response, here i want to know how we will figure out, how many SH, indexers we required for our environment. PLEASE TRY TO UNDERSTAND I AM VERY NEW TO THIS TOOL.

Rocky31 · ‎03-15-2017

We have like 5 S.H and 7 Indexers, how i know these numbers, some environments have 10 indexers and more SH, how we will know we need that number, If anyone understood my question and answers me i will be very thankful to you.

Rocky31 · ‎02-07-2017

Rocky31 · ‎02-07-2017

No new malware showing up in Malware center. We had no malware from last two weeks, any idea, i'm very new to Splunk

Rocky31 · ‎01-30-2017

index=_internal (action=edit) user=admin | table _time,user,user_email,action,info this is the search string i using, i checked in the roles access, i don't have access for _internal.

Rocky31 · ‎01-27-2017

do i need admin access, to access this index.

Rocky31 · ‎01-25-2017

i mean what is best suitable application context.

Rocky31 · ‎01-25-2017

Thanks for your reply. i don't see any internal index, you mean internal_audit_logs, splunk_audit. Thanks,

Rocky31 · ‎01-24-2017

i want to see an event in incident review on admin activity, how to create a correlation search for, give me advice guys this is high priority.

Rocky31 · ‎01-06-2017

is that a syntax

Rocky31 · ‎01-02-2017

I created an alert with this SPL( index=_audit action=edit OR action=create OR action=delete OR action=change| stats count by user, action ) but i am receiving email when admin trigger, but in that email i don't see any information about who trigger and what he trigger, can any one help me out of this.

Rocky31 · ‎01-02-2017

I really appreciate for you concern, i have question. i created alert using above logic, but here i want alert with information with who did trigger and what he trigger all information in email. can you please help me out of this.

Rocky31 · ‎12-28-2016

Thanks for you response buddy, can i create an alert for this command. every time they made change, alert comes up. do i need to change in command. Thanks.

Rocky31 · ‎12-28-2016

we have like couple of admins, myself power, i want to create a alert any one of them made any changes. please share some commands, instead of links and docs.

Posts	83
Solutions	0
Karma Given	5
Karma Received	5
Member Since	‎12-19-2015

Online Status	Offline
Date Last Visited	‎06-20-2020 07:31 PM

Please route me i am at INDEX deadend.

Help me in creating a index.conf for new index.

Management port already in use

How to install splunk app through Linux terminal?

How do you delete a private dashboard?

Can i send Splunk text alerts to phone numbers?

How can I trigger a whole dashboard with a bunch o...

Can you help me write a subsearch?

How to to take median of number of users logged in...

I want to create an alert from last 7 days

Settings to auto-restart Splunk?

How can I send events from a monitor input file to...

Re: I have question on SSH, i dont know how connec...

Re: I have question on SSH, i dont know how connec...

Re: I have question on SSH, i dont know how connec...

Re: I have question on SSH, i dont know how connec...

I have question on SSH, i dont know how connect, a...

Re: How to check missing universal forwarders

How to check missing universal forwarders

Help need for splunk rookie. How to Implement forw...

Need some topics to prepare for my splunk intervie...

Re: Splunk Architecture, How do we know we need ho...

Splunk Architecture, How do we know we need how ma...

Re: Splunk Enterprise Security: No new malware sho...

Splunk Enterprise Security: No new malware showing...

Re: Splunk Enterprise Security: Is it possible to ...

Re: Splunk Enterprise Security: Is it possible to ...

Re: Splunk Enterprise Security: Is it possible to ...

Re: Splunk Enterprise Security: Is it possible to ...

Splunk Enterprise Security: Is it possible to crea...

Re: Need Alert email with the information of trigg...

Need Alert email with the information of triggered...

Re: How to pull a audit trail logs who made change...

Re: How to pull a audit trail logs who made change...

How to pull a audit trail logs who made changes fr...