Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About AaronMoorcroft
AaronMoorcroft
Communicator
Member since:
01-04-2013
06-05-2020
Community Statistics
| Posts | 129 |
| Solutions | 3 |
| Karma Given | 2 |
| Karma Received | 13 |
| Member Since | 01-04-2013 |
Activity Feed
- Got Karma for Is it safe to delete .bundle files ?. 06-05-2020 12:48 AM
- Got Karma for How to write a search to display forwarders missing at a certain point in time?. 06-05-2020 12:48 AM
- Karma Re: Ignoring events confusion for Jeff_Lightly_Sp. 06-05-2020 12:47 AM
- Got Karma for Re: SNMP Modular Input: Why is the dashboard showing a 404 Not Found error and "Splunk cannot find the 'dailyreview1' view"?. 06-05-2020 12:47 AM
- Got Karma for Unable to Export to CSV with error "File not found". 06-05-2020 12:47 AM
- Got Karma for Change Windows Event Log Format. 06-05-2020 12:46 AM
- Got Karma for Re: Upgrade Splunk Universal forwarder ?. 06-05-2020 12:46 AM
- Got Karma for Re: Upgrade Splunk Universal forwarder ?. 06-05-2020 12:46 AM
- Got Karma for Re: Upgrade Splunk Universal forwarder ?. 06-05-2020 12:46 AM
- Got Karma for Monitor evtx log. 06-05-2020 12:46 AM
- Got Karma for Monitor evtx log. 06-05-2020 12:46 AM
- Got Karma for Monitor evtx log. 06-05-2020 12:46 AM
- Karma Re: How do i exclude some events from being indexed by Splunk? for dskillman. 06-05-2020 12:45 AM
- Got Karma for Re: Applications and Services Logs. 06-05-2020 12:45 AM
- Got Karma for Re: Applications and Services Logs. 06-05-2020 12:45 AM
- Posted Re: Is there a search for a set commands in quick succession? on Splunk Search. 03-18-2019 08:55 AM
- Posted Is there a search for a set commands in quick succession? on Splunk Search. 03-18-2019 08:08 AM
- Posted Re: Simple search extraction for lines of text with spaces ??? on Splunk Search. 01-22-2019 07:48 AM
- Posted Re: Simple search extraction for lines of text with spaces ??? on Splunk Search. 01-22-2019 07:38 AM
- Posted Re: Simple search extraction for lines of text with spaces ??? on Splunk Search. 01-22-2019 06:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-03-2014
06:56 AM
No i have no setup like that within the inputs file other than the default host name
... View more
04-03-2014
06:55 AM
Hi Luke,
no the the file is on a different server and is being forwarded with the universal forwarder to our main indexer
... View more
04-03-2014
06:44 AM
3 Karma
Hi Guys
I need to drag a evtx log from %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-PrintService.evtx
This needs to show all the indivdual print jobs/ info
This needs to be completed in a conf file, currently looking like this -
[WinEventLog://C:\Windows\System32\Winevt\Logs\Microsoft-Windows-PrintService%4Operational.evtx
disabled = false
sourcetype = printname
currently the results look a little like this -
x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\
Can anyone help me please ?
... View more
- Tags:
- conf-files
- evtx
01-16-2014
04:41 AM
Cheers guys this thread pointed me in the right direction and gave me enough direction to figure out what my issues was. FYI it was the Splunkd service overloading my Splunk cluster which in turn was stopping the service from starting on one of my indexers.
Thanks again, the log file was the big help 🙂
... View more
10-10-2013
01:47 AM
That does seem to bring a few up with the expected results but by no means all, do you have any further advice ?
... View more
10-09-2013
03:47 AM
Hey Guys
I have multiple DMZs with forwarders all over the places that send to specific main forwarders if you like and then onto the indexer, is there a search that anyone knows of that I can run on a host to tell me where that device is set to forward too, I have a few boxs I need to jump on but its would be better if I can run a search as to jumping through hoops to log onto the actual device its self.
Thanks
Aaron
... View more
09-17-2013
12:45 AM
Hey Guys
So Im looking for a search that will show me either in a graph, txt, chart doesnt matter really the realtime stats of systems logging events.
so for example if I have 1000 servers and for some reason 1 has started logging through the roof due to some random error how can I search all systems and have that displayed easy and quickly to show say the top 10 systems logging high volumes.
Thanks in advance.
... View more
- Tags:
- search
09-17-2013
12:24 AM
I had this same issue, it came down to being the version of the forwarder 4.3.2
4.3.2 has a known bug and can cause this issue, to resolve this I had to upgrade all my forwarders from this version to 5.0.1
... View more
09-02-2013
04:54 AM
Can anyone provide any further info on how to get EPO to export to a .txt file and then monitor with Splunk ?
... View more
07-11-2013
01:13 AM
Pleased I could help 🙂
Please give the tick box a tick to mark as an answer.
... View more
07-02-2013
03:43 AM
Hi guy, how do I go about setting a limit on our data retention.
I need the data on the indexer to be deleted after 2 years, is there a way to do tjis via the web interface or is this somthing that must be done in the inputs.conf on the indexer itself.
Also am I correct in thinking that you have to define the time in seconds if going down the inputs.conf route ?
Cheers
Aaron
... View more
- Tags:
- data
- rentention
04-26-2013
01:52 AM
Thanks for that, great help 🙂
... View more
04-24-2013
08:26 AM
Hi Guys
I work in a huge enviroment and one of the Unix guys has installed a forwarder on there Unix box, I'm assuured that the installation was succesful and I have to take that as gospel at the moment, my question is should I expect to see a Unix forwarder in the Deployment manager app ?
Is there a serch and can put into Splunk to find the Unix forwarder ? the funny thing is Im able to search the host name of where this forwarder has been installed and logs are found but there found from a while back up until now, the forwarder was only installed a few hours ago so Splunk is getting this information from somewhere else by the look of it.
Any Ideas ?
... View more
04-18-2013
12:50 AM
thats a great help, thanks for your advice.
... View more
04-17-2013
07:39 AM
Hey Guys
A simple one for someone out there im sure, I have a file on 3 servers that I currently monitor the changes to with Splunk, I have been asked to monitor the said files for the change and also the user account that makes the change, can anyone advise on how to do this ?
... View more
04-16-2013
04:09 AM
3 Karma
OK I have sorted it -
I ended up deleting the service from services, this was named SplunkForwarder ( it was the only Splunk service listed), of course it didnt go smoothly and there was an error to state that the service didnt exist, I then tried to restart the said service only to get yet another error.
I then ran the upgrade again which then got 1 step further but failed again but with another error stating that Splunk couldnt create a service, I then rebooted and ran the installer again and low and behold it installed without issue.
... View more
04-16-2013
02:27 AM
EDIT --- exact error message is -
Splunk Installer was unable to launch Splunks first time run - Error Code 1
... View more
04-16-2013
02:11 AM
Another thing that I noticed is that when upgrading Im asked questions such as the deployment servers details and forwarders details IP's even what logs I would like to monitor, on other machines with the upgrade it just installs without being prompted for this info.
... View more
04-16-2013
01:42 AM
Hi Guys
Im a little confused, I need to upgrade what I believe is a Splunk universal forwarder, I think this as its located "C:\program files\SplunkUniversalForwarder" build version is below -
VERSION=4.3.2
BUILD=123586
PRODUCT=splunk
PLATFORM=Windows-AMD64
This is installed on a 2008 R2 64bit box, my issue is that when trying to upgrade with SplunkFprwarder-5.0.2-149561-x64-release
the upgrade seems to get about halfway though but then fails with this error -
Splunk Launcher - Splunk could not start splunks first time run - Error Code - 1
Im installing as a domain admin so its not related to privlidges, the other issue I see is that the only service that is running is called Splunk Forwarder, there are no other Splunk services installed from what I can see, I dont know if thatts an issue ?
any ideas guys ?
... View more
- Tags:
- upgrade
04-03-2013
03:58 AM
1 Karma
Hi guys
Please see below for an example of the event log I'm referring to.
In a nut shell we send some logs off to a 3rd party but there telling us that they are having issues reading them from Splunk, I have looked into this and Splunk is sending the events from Windows without issue however the description has an error, after reading up a little there are a few posts on here but I dont see an answer that has resolved this as yet, from what I have read it looks like we may need to try and change the way that Windows writes the eventlog. Im not even sure if we can do this but I was hoping that someone out there may have had this before and resolved the issue
<13> XXXXXXXXXX 03/08/2013 02:50:49 PM
Log Name=Security
SourceName=Microsoft-Windows-Security-Auditing
EventCode=4776
EventType=0
ComputerName=XXXXXXXXXXXXX
TaskCategory=None
OpCode=None
RecordNumber=6063330
Keywords=None
Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.
FormatMessage error: The handle is invalid.
Got the following information from this event:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
XXXXXXXXXXXXX
XXXXXXXXXXXXX
any help would be much appreciated
... View more
- Tags:
- windows-event-logs
03-28-2013
09:31 AM
Hey, Just completed the upgrade on our server without any issues at all, just wanted to say thanks again for your help, your a star
... View more
03-28-2013
04:32 AM
Thank you thats a great help, so if I go ahead and install a full installation of Splunk over the top of what I already have, would I be right in presuming that it will just keep all the settings it currently has and that will be that ?
... View more
03-28-2013
04:02 AM
Hi Guys
I have an instance of Splunk installed on a sevrer which I need to upgrade I was under the impression that it was a forwarder however it has the web interface with tools avaiable, im told that this is a full fat client.
what should I be downloading to upgrade this instance with ? and will it have any effect on what work its already doing ? after upgrading,
Edit>>>
Ok So I have a little more info on this, I managed to get hold of the previous employee who looked after this, this specific installation im told is a Full Fat Forwarder, Ver 4.3.2 I still need to upgrade to the latest ver of 5.x.x
I gather that full fat forwarders no longer exist ? and it would be a universal forwarder that would now be downloaded and installed over the top of this, is that correct ? again would everything still work as it currently is ?
... View more
- Tags:
- indexer
03-11-2013
02:24 AM
Hi Guys
So I'm sending out logs to a 3rd party regarding one of our servers, the logs when they are received look like below -
<13> **************** 03/08/2013 02:52:04 PM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=***************
TaskCategory=The operation completed successfully.
OpCode=The operation completed successfully.
RecordNumber=11711
Keywords=Classic
Message=The Software Protection service entered the stopped state.
The data in the props file look like this at the moment -
[host::***********]
TRANSFORMS-tran8 = send_to_syslog
my question is, is there a way to alter the above date / time stamp in the props.conf so that the date in the top log is shown as 24 hours not 12 ?
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
