×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- About danielbb
danielbb
Motivator
Member since:
07-24-2019
a week ago
Community Statistics
| Posts | 599 |
| Solutions | 3 |
| Karma Given | 381 |
| Karma Received | 30 |
| Member Since | 07-24-2019 |
Activity Feed
- Posted Re: Why is the Tenable vulnerability time stamp off? on Getting Data In. 2 weeks ago
- Karma Re: Why is the Tenable vulnerability time stamp off? for Prewin27. 2 weeks ago
- Karma Re: Why is the Tenable vulnerability time stamp off? for PickleRick. 2 weeks ago
- Karma Re: What Splunk apps exist for Tenable IO data? for sainag_splunk. 2 weeks ago
- Karma Re: Why is the Tenable vulnerability time stamp off? for richgalloway. 2 weeks ago
- Karma Re: Why is the Tenable vulnerability time stamp off? for aromanauskas. 2 weeks ago
- Posted Re: Why is the Tenable vulnerability time stamp off? on Getting Data In. 2 weeks ago
- Posted Re: What Splunk apps exist for Tenable IO data? on Dashboards & Visualizations. 2 weeks ago
- Karma Re: What Splunk apps exist for Tenable IO data? for livehybrid. 2 weeks ago
- Posted Why is the Tenable vulnerability time stamp off? on Getting Data In. 2 weeks ago
- Posted What Splunk apps exist for Tenable IO data? on Dashboards & Visualizations. 2 weeks ago
- Tagged What Splunk apps exist for Tenable IO data? on Dashboards & Visualizations. 2 weeks ago
- Tagged What Splunk apps exist for Tenable IO data? on Dashboards & Visualizations. 2 weeks ago
- Karma Re: Is there an app that presents the following Meraki sourcetypes? for Meett. 4 weeks ago
- Posted Is there an app that presents the following Meraki sourcetypes? on All Apps and Add-ons. a month ago
- Karma Re: How to go about a PoC license with minimal ingestion? for isoutamo. 05-16-2025 08:53 AM
- Karma Re: How to go about a PoC license with minimal ingestion? for livehybrid. 05-16-2025 08:17 AM
- Posted How to go about a PoC license with minimal ingestion? on Splunk Enterprise. 05-16-2025 07:51 AM
- Karma Re: How to upload a csv from a host that has a universal forwarder? for marycordova. 05-06-2025 10:25 AM
- Karma Re: How to upload a csv from a host that has a universal forwarder? for livehybrid. 05-02-2025 08:31 AM
01-03-2025
07:50 AM
Thank you @kiran_panchavat, How do I ensure that?
... View more
01-03-2025
07:21 AM
We are about to create new VMs with the Ubuntu OS. Which version of Ubuntu is supported and recommended?
... View more
- Tags:
- Ubuntu's version
Labels
- Labels:
-
Linux
12-18-2024
09:25 AM
I'm under the impression that HEC ingestion directly to the indexers is supported natively on cloud. I wonder whether the HEC ingestion on-prem to the indexers is supported in the same way?
... View more
Labels
- Labels:
-
indexer clustering
12-18-2024
09:12 AM
We have a case in which each email message is stored on the file system as a distinct file. Is there a way to ingest each file as a distinct Splunk event? I assume that UF is the right way but I might be wrong.
... View more
Labels
- Labels:
-
universal forwarder
12-16-2024
07:47 AM
Thank you all, since I have already the HEC cluster and it is with HFs, wouldn't it be better to have UFs since my understanding is that data flows quicker through UFs? and we don't process the data at all at this HEC cluster level.
... View more
12-13-2024
01:25 PM
I see - $ ps -ef | grep splunk
splunk 2802446 2802413 0 Dec08 ? 00:00:08 [splunkd pid=2802413] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner] Meaning, the user splunk runs on the host and when I sudo to be the splunk user, I don't have access the these logs files, even though they are being ingested.
... View more
12-13-2024
01:20 PM
I love of the idea of the - HEC inputs directly on indexers (and have an LB in front of them) !
... View more
12-13-2024
10:59 AM
We fail again and again these days when we have major spikes in ingestion, primarily with HEC. What would be a good and efficient way to detect major up/down spikes in data ingestion.
... View more
12-13-2024
10:49 AM
On Splunk cloud, we can receive HEC ingestion directly to the cloud whereas on-prem we install distinct subclusters for HEC and struggle to scale them up with multiple down-times cases. I wonder whether it's possible for an on-prem installation to send HEC data directly to the indexers.
... View more
Labels
- Labels:
-
indexer clustering
12-13-2024
10:43 AM
We have a case where the data resides under /usr/feith/log/*.log and the Splunk process can read these files however, when I log in to the unix server I cannot navigate into this directory as the Splunk user. What's going on? bash-4.4$ whoami
splunk
bash-4.4$ pwd
/usr/feith
bash-4.4$ \ls -tlr
total 388
...
drwxr-xr-x. 2 feith feith 4096 Dec 12 12:17 lib
drwx------. 19 feith feith 4096 Dec 13 01:00 log
bash-4.4$ cd log/
bash: cd: log/: Permission denied
... View more
- Tags:
- Permission issue
Labels
- Labels:
-
Linux
11-29-2024
12:14 PM
We are building a small Splunk installation in Azure and I'm not sure what the architecture should look like. The client came up with the idea based on the following link - Deploying Splunk on Microsoft Azure. They created an indexer, a search head, and a license server/cluster master. We do need to ingest syslog data from Meraki devices, so I wonder whether we need a heavy forwarder. Any thoughts?
... View more
Labels
11-29-2024
12:05 PM
I want to use HTML on multiple panels in order to create a custom layout of my Splunk Dashboard. I want to use this layout where each rectangle is a panel - Please advise. Is this possible to implement in a Splunk Dashboard?
... View more
07-30-2024
11:45 AM
When ingesting Microsoft Azure data, we see different time formats for different Azure categories, and I wonder how to parse it correctly? Both timezones seem to be UTC. Is the proper approach to set
TZ=UTC
and specify in datetime.xml the two formats?
{
category: NonInteractiveUserSignInLogs
time: 2024-07-30T18:02:42.0324621Z
. . .
}
{
category: RiskyUsers
time: 7/30/2024 1:48:56 PM
. . .
}
... View more
- Tags:
- datetime.xml
- json
Labels
- Labels:
-
JSON
06-05-2024
10:56 AM
We see cases where warm buckets are not being moved to cold storage for six weeks, and we wonder how to set it up correctly so they move within two or three weeks.
... View more
- Tags:
- bucket lifecycle
Labels
- Labels:
-
configuration
05-22-2024
07:12 AM
We apparently have the StreamWeaver integration in place, but we are not sure how it was implemented as the folks who did it are no longer around. How is it done usually? Is it a REST API integration? as I see at Connect: Splunk Enterprise
... View more
- Tags:
- REST API
Labels
- Labels:
-
monitor
05-19-2024
11:54 AM
Thank you so much, one of our stanzas looks like the following - [script://./bin/ulimit.sh]
interval = 27 5 * * *
source = scripted_input
sourcetype = virtualization:sanity:ulimit
index = os
disabled = false Based on the link you provided, a reload should be fine. How would we run a "reload"? inputs.conf http reload inputs.conf script reload inputs.conf monitor reload inputs.conf <modular_input> reload inputs.conf batch reload
... View more
05-17-2024
01:43 PM
We want to add a TA (app) to our indexers at the path /opt/splunk/etc/master-apps by running the command /opt/splunk/bin/splunk apply cluster-bundle My question is if we can deploy an indexer app without a restart of the indexer? The TA we want to deploy is an extension to the nix TA, and all it does is run some simple bash scripted inputs.
... View more
Labels
- Labels:
-
installation
04-29-2024
12:16 PM
We are in the midst of a migration from physical servers to virtual servers, and we wonder if stopping Splunk is mandatory in order to perform the Cold Data migration or if there’s a workaround to this and this can be safely done without stopping Splunk.
... View more
Labels
- Labels:
-
administration
04-07-2024
11:19 AM
Since we are in early stages of using Splunk cloud, we don't define props.conf as part of the onboarding process, and we introduce props for a certain sourcetype only when parsing goes off. So for a certain sourcetype, line-breaking is off, and when looking for the sourcetype on the indexers (via support) and on the on-prem HF where the data is ingested and I cannot find the props for this sourcetype. So I wonder is it possible to have no sourcetype anywhere for a particular source?
... View more
Labels
- Labels:
-
props.conf
03-04-2024
10:21 AM
It comes down to whether Kafka can transport UDP and TCP reliably from all the devices to the various Splunk clusters.
... View more
03-03-2024
01:10 PM
With syslog-ng we hit all kinds of limitations from the inability to support TCP, to the inability to write fast enough to disk, and therefore losing vast amounts of UDP data, struggling to have the various F5 LBs to distribute the data evenly to the syslog servers behind the F5s... and all of this led to Kafka as a potential solution. Does anybody use Kafka effectively instead of syslog-ng? By the way, we did look at Splunk Connect for Syslog (SC4S) without much luck.
... View more
Labels
- Labels:
-
using Splunk Enterprise
02-21-2024
10:05 AM
Thank you @richgalloway you are helpful as always
... View more
02-21-2024
07:29 AM
I just realized that the NIX TA is being deployed to our forwarders via the deployment apps, to the indexers via the master apps and to the SHs via the SH apps. It was a surprise for me to realize that the TA is not being deployed to the deployment and deployer servers, the license master and the cluster master. And therefore, how can the TA be deployed to all Splunk servers?
... View more
Labels
- Labels:
-
installation
01-29-2024
01:10 PM
Sorry for not being clear. The process of building these VMs is ongoing, and during this process we would like to be absolutely sure that these VMs are ready to host all the Splunk components. For example. our SE suggested to check the following - THP turned off. All internal logs are being forwarded to indexer tier. MC set-up Splunk running as correct user Splunk restart enabled So I wonder what would be the best way to ensure that these VMs are built correctly? I’m thinking about scripted input, and a dedicated dashboard to monitor and verify all the settings. Do you have any other suggestions, by any chance?
... View more
01-26-2024
11:11 AM
We are in the midst of a virtualization project, and we are looking for a way to sanity check all the different components. I know that the MC does some of it, but I’m not sure if it covers all aspects. I’m thinking about scripted input, and a dedicated dashboard to monitor and verify all the settings. Do you have any other suggestions, by any chance?
... View more
- Tags:
- validations
Labels
- Labels:
-
administration
-
configuration
-
installation
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
Karma from
Karma given to
