Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About MuS
MuS
Legend
Member since:
02-05-2011
yesterday
Community Statistics
| Posts | 4441 |
| Solutions | 813 |
| Karma Given | 2136 |
| Karma Received | 3932 |
| Member Since | 05-02-2011 |
Activity Feed
- Got Karma for Re: How to replace Join to search large data sets. 2 weeks ago
- Posted Re: How to search and monitor Splunk user logins that are using LDAP based authentication? on Splunk Search. a month ago
- Posted Re: How to replace Join to search large data sets on Splunk Search. a month ago
- Got Karma for Re: How to search and monitor Splunk user logins that are using LDAP based authentication?. a month ago
- Got Karma for Re: Timestamp lookahead questions. 12-12-2024 03:17 PM
- Got Karma for Re: Use results from one search in another query. 12-05-2024 09:50 AM
- Karma Re: Sourcetype restricted access for gcusello. 11-14-2024 11:25 PM
- Posted Re: Check Point Firewall Log Exporter_TLS Config on Splunk Enterprise. 11-14-2024 04:11 PM
- Posted Re: Request for app Splunk Enterprise Security on Splunk Enterprise Security. 11-13-2024 02:19 PM
- Posted Re: Need help with the correct regex on Splunk Search. 11-13-2024 02:08 PM
- Got Karma for Re: WEF - Universal Forwarder multiple Windows TA's / performance issues. 11-12-2024 07:11 PM
- Got Karma for Re: Python Libraries. 11-07-2024 12:39 AM
- Posted Re: Python Libraries on Dashboards & Visualizations. 11-06-2024 06:00 PM
- Posted Re: Trouble with time in join on Splunk Search. 11-06-2024 11:37 AM
- Posted Re: WEF - Universal Forwarder multiple Windows TA's / performance issues on Getting Data In. 11-05-2024 03:39 PM
- Got Karma for Re: Join two indexes on time where time is different by 2 sec. 11-05-2024 06:41 AM
- Got Karma for Re: Join two indexes on time where time is different by 2 sec. 11-05-2024 06:41 AM
- Posted Re: Join two indexes on time where time is different by 2 sec on Splunk Search. 11-04-2024 01:12 PM
- Posted Re: Join two indexes on time where time is different by 2 sec on Splunk Search. 11-04-2024 01:07 PM
- Got Karma for Re: How can we programatically disable/enable a data input?. 10-25-2024 07:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 8 | |||
| 20 | |||
| 5 | |||
| 5 | |||
| 14 | |||
| 2 | |||
| 15 | |||
| 15 | |||
| 6 |
06-30-2011
05:11 AM
3 Karma
Hi thscheidegger
just was able to load PKCS12 certs into Splunk using this excellent wiki article.
cheers
... View more
06-15-2011
12:15 AM
3 Karma
Hi dottom
well basicly an indexer can do the same filtering/routing of data like a forwarder. here is a post about how to configure forwarder to send different information to 2 different indexers
so your indexer can be setup to filter data to different indexes or forward any data to 3rd party systems.
regrads
... View more
06-14-2011
11:07 PM
4 Karma
Hi dottom
either take a look here:
http://splunk-base.splunk.com/answers/1888/how-do-i-configure-splunk-to-filter-out-events-i-dont-want-to-index
or read the docs here:
http://www.splunk.com/base/Documentation/4.2.1/Deploy/Routeandfilterdatad
both is working as designed, but be aware about this here:
http://splunk-base.splunk.com/answers/13139/wineventlogsecurity-filtering-does-not-work
I just run into this bug last week. but as said, beside this, all is working like in the docs written.
regards
... View more
06-14-2011
02:42 AM
2 Karma
Hi mrpickford
NetScaler can sent the data over syslog dirctly into splunk over udp://514 for example, works great.
regards
... View more
06-14-2011
01:46 AM
9 Karma
Hi guys
just as addition to this topic:
I tried to setup a heavy forwarder by script and encountered the problem to change/activate the license by script. after a small chat with yannK I found this solution, just add the following to your servers.conf and your done:
[license]
active_group = Forwarder
kudos go to yannK 😉
... View more
06-08-2011
12:26 PM
Hi Ellen,
is this really solved in 4.2.1 universal forwarder? I just ran into exactly this problem, that I was unable to redirect WinEventLog events no matter what transform I used. Only way to get them into different indexes was to set the index in inputs.conf on the 4.2.1 universal forwarder.
best regards, MuS
... View more
05-31-2011
01:13 AM
Hi dmlee
could you please be so kind to mail the scripts to mus_at_lcsys_._ch please? thanks
... View more
05-26-2011
04:59 AM
Hi Guys
since 4.2.1 is out now, what would be the CLI command to change the license? And what if your not using a license master at all?
... View more
05-25-2011
01:52 AM
1 Karma
Hi dominiquevocat
take a look here http://splunk-base.splunk.com/answers/24863/where-splunk-store-syslog-data it's about the same.
regards
... View more
05-24-2011
11:23 PM
Hi thoree, that is possible but why don't you just limit yourself to one Windows, one Linux and one Network Device instead of everything and all rigth from the start?
regards
... View more
05-24-2011
11:14 PM
1 Karma
Hi thoree
maybe you have to ask yourself, 'what do you want to know or find out?' then you can figure out which logs must be indexed.
for example: are you after login failures, then you have to index the log with the failed logins. would you like to check to what inet page the users go, then index the proxy logs. get it?
there is no masterplan to index data, it depands on your use case.
regards, MuS
... View more
05-23-2011
09:46 PM
3 Karma
Hi hazekamp, thanks for the answer. you got it right, but how could this be done with just one search head? we already came up to the solution with two search heads.
... View more
05-23-2011
11:09 AM
15 Karma
Hi Splunk- and other Gurus
Assumption:
Captain Picard's room is a high security Environment, so him and only himself is allowed to read all the high classified Star fleet messages. if Captain Picard is called to the Bridge, he also can read his private messages but not the high classified messages although he is identified as Captain Picard.
Is there a way to filter/handle this in Splunk for example by search origin or by user role?
cheers, MuS
... View more
05-19-2011
09:50 PM
1 Karma
Hi fredrichmaney
to make it short; no.
regards
... View more
05-19-2011
03:59 AM
Hi aymericbrun
running the cli in DOS prompt, you have to login via cli in DOS prompt at least once. this will help http://www.splunk.com/base/Documentation/latest/Admin/CLIadmincommands
your login in firefox has no effect on the cli login in DOS, because firefox uses other authentication methods then the cli.
regards
... View more
05-17-2011
04:05 AM
2 Karma
Hi cassie90
you are aware this is the Splunk homepage?
anyways, just add your batch .bat to the startup program group and it will run anytime you login, no need to setup a scheduled task. And if you want it to run in the background 😉 then make it a WSH script, this will not launch a window.
regrads
... View more
05-17-2011
02:31 AM
3 Karma
Hi wbordeau
maybe this helps:
http://www.splunk.com/wiki/Deploy:Migrating_a_Splunk_Install
http://www.splunk.com/base/Documentation/latest/Admin/Moveanindex
regards
addition: your old indexer will only forward new data, the old already indexed data will stay.
... View more
05-16-2011
05:05 AM
if you double click a bat file you get either a minimized windows in the taskbar or the window itself. try writing another bat locks like this
@echo off
start "window1" /min cmd.exe /c batch1.cmd
start "window2" /min cmd.exe /c batch2.cmd
start "window3" /min cmd.exe /c batch3.cmd
start "window4" /min cmd.exe /c batch4.cmd
echo four minimized background command prompts running four scripts
and run this new one, this will start new batches in background.
... View more
05-16-2011
04:39 AM
you can spend some kudos and make the questions disapear from 'unanswered' answers by clicking the 'correct' button 🙂
... View more
05-16-2011
04:31 AM
http://support.microsoft.com/kb/313565/EN-US
if you use the /interactive option then you get a window for this job. if you don't use the option, well you will not see a thing 😉
... View more
05-16-2011
04:21 AM
1 Karma
Hi cassie90
are you talking about windows batch jobs? they can be started as scheduled jobs and then they are not visible, if you configure the job this way.
hope this helps
regards
... View more
05-06-2011
06:25 AM
4 Karma
Hello geetanjali
http://www.splunk.com/base/Documentation/latest/SearchReference/Sort
have fun
... View more
05-05-2011
02:28 AM
4 Karma
Hi Hazel
I would do this with a script which calls 'wget' or 'lynx -d'
then you get a dump of the webpage, which could be read by splunk or if the page is down (not pingable) your script can error out something which is also read by splunk.
regards
... View more
05-04-2011
04:29 AM
just add the path where your logs are stored, no need to add every single file. also no need to exclude old files, once indexed by splunk old file are 'ignored'.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
Karma given to
