About ahall_splunk

ahall_splunk · ‎11-13-2014

The Microsoft SQL Server app is designed for a specific use case (SQL Server Enterpride edition running a SharePoint farm). Outside of that, it was hoped to be more generally useful. The only thing different from a data collection point of view between Standard and Enterprise edition is the audit collection. Thus the dashboards driven by the SQL audit will not be available. Everything else should work.,The Microsoft SQL Server app and technology add-on were designed with Enterprise edition in mind and a specific use case (SQL Server with SharePoint) - they were released separately in case someone else could find them useful. The audit specifications cannot be used (and thus the dashboards driven by audit cannot be used). However, all other functionality should be ok.

ahall_splunk · ‎11-04-2014

SA-ldapsearch requires Java 1.7. I suspect that is your problem. However, it may not be. I can't tell on the incomplete information being given.

ahall_splunk · ‎11-04-2014

Your comments indicate that data is missing. We can't tell what data is missing. Based on the comments, at least the WinHostMon data is missing. Check out the documentation to the WinHostMon data input and add that to the TA. Docs link: http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/MonitorWindowshostinformation Other than that, it looks like some of the perfmon you are looking for is not getting gathered. Check out the documentation to the Perfmon data input and add what you need to the TA. Docs link: http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Real-timeWindowsperformancemonitoring

ahall_splunk · ‎11-03-2014

The "for instance" worries me - we are not getting a complete picture of what is wrong. 1) Is the data coming in? Check Splunk_TA_Windows that you are deploying to your endpoints to ensure that you are collecting the disk, memory and CPU data 2) Are the lookups being built? Check the lookups directory for CSV files - are they populated? These are probably the two major causes for concern.

ahall_splunk · ‎11-03-2014

Once the universal forwarder is restarted, it should be fairly quickly. Your internal logs are your friend here, Check index=_internal source=*splunkd.log to check for any errors.

ahall_splunk · ‎11-03-2014

Also, there is a known issue with SA-ldapsearch 2.0 right now - your comments suggest this is the version you are running. I'd recommend downgrading to SA-ldapsearch 1.1.13 until v2.0.1 comes out when you are using SA-ldapsearch in conjunction with Windows Infrastructure.

ahall_splunk · ‎11-03-2014

Make sure the user you are using has permissions to the indices. We have added roles which have access to the appropriate indices. You need to add the admin user plus other users (whoever uses the app) to these roles. Other than that, it's a basic diagnostics process - click on the "open in search" button and see what you can see. Check the search inspector and see if any events are being processed.

ahall_splunk · ‎11-03-2014

The monitorNoHandle type will only monitor single files (see http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#Why_use_MonitorNoHandle.3F ) - use monitor instead.

ahall_splunk · ‎10-13-2014

No, you cannot put a second searchTemplate inside SimpleXML. Old way: Within AdvancedXML, you can specify multiple elements. New way: The modern way to do it is to use the Web Framework with multiple search artifacts. I recommend learning the new way.

ahall_splunk · ‎10-13-2014

I believe the correct field name is SplunkTime - note the camel case.

ahall_splunk · ‎10-13-2014

Use a props.conf EVAL statement.

ahall_splunk · ‎10-09-2014

Follow-up answer. The Exception mentioned in your comment indicates that you have not enabled script execution properly. Microsoft limits the scripts that can be run via PowerShell for security reasons. The default setting is AllSigned, indicating that the scripts must have a digital signature. We do not ship the scripts signed. As a result, you need to ensure the proper execution policy is implemented. In the short term, you can set the proper execution policy by running the following command from an ELEVATED PowerShell console: Set-ExecutionPolicy RemoteSigned However, a group policy may over-ride this setting, so ensure your group policy from Active Directory does not reset it for you. If it does, then get the change made in Active Directory. In addition, the system will not execute "blocked" scripts. When you download a file from the internet, Windows blocks the execution of the file. If you unpack the file without unblocking it, then all the unpacked files are similarly blocked. You may need to go into the path mentioned in the log, right-click on the file, select Properties and unblock the file.

ahall_splunk · ‎10-08-2014

The WinXmlEventLog:channel is a sourcetype. If your Channel field in the event logs is, for example, Security, then you would set the source type to WinXmlEventLog:Security - this allows the Splunk_TA_windows to decode the events and populate the common fields.

ahall_splunk · ‎10-07-2014

Windows Event Logs are two parts - an XML component (stored potentially compressed in the EVTX file) and the Message (stored in a DLL). Splunk puts these together to create the standard Windows Event Logs. You get a decoded event which is the XML + Message, hence the ballooning storage. Rename the .EVTX file to .XML and import, setting the sourcetype to WinXmlEventLog:channel and the event separator appropriately (I think it's ) and the event will be stored in Splunk in XML. In addition, if your events are from the Security channel, the Splunk_TA_windows will decode them in a CIM compliant manner, allowing you to use them in all the CIM data models that they are appropriate to.

ahall_splunk · ‎10-07-2014

Take a look through the TA-sqlserver inputs.conf - each stanza has an index and a sourcetype. A good search is: index=mssql | chart count by host,sourcetype This will tell you which hosts are producing which sourcetypes. Correlate that visually with the list of sourcetypes from your inspection of the inputs.conf file and you will know which pieces are not running. Once you have that, the next step is to look for possible errors. A search that will help there is: index=_internal source=*powershell*.log Look for any obvious errors. Anything leap out at you? If nothing does, then take a look at the splunkd.log which you can use a similar search as above. Let me know what you find out.

ahall_splunk · ‎09-25-2014

Thats because the system log files and the audit logs files (if you follow the instructions) are provided within the Windows Event Logs - the TA and app contain specific decodes for those logs so you can recognize them.

ahall_splunk · ‎09-25-2014

Which specific log files are you trying to read? The MSSQL "transaction log" files are binary and are not splunkable. If you are after audit logs, then this needs to be configured within the MSSQL Management Console - at which point you choose the file location or Windows Event Log streams. You can use the Splunk App for Microsoft SQL Server - it contains a specific TA for doing the SQL Server logs (both audit and functional aspects).

ahall_splunk · ‎08-26-2014

You need to install the Splunk_TA_windows on the Splunk instance as well.

ahall_splunk · ‎08-26-2014

We have to explicitly decode several attributes for this to work. Currently (v1.1.13 of the app), we support a small list, like fullName, cn, givenName, sn. If you want more, we need to know which ones. Note that we do not support Novell eDirectory. If you want to submit a request, we test only against Active Directory.

ahall_splunk · ‎08-26-2014

This is a known issue with the WORKGROUP domain and not something we can do much about. I recommend altering the search that you are using to explicitly not include WORKGROUP.

ahall_splunk · ‎08-26-2014

I'd suggest reading the following blog posts: http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows/ http://blogs.splunk.com/2013/09/28/monitoring-windows-file-share-permissions-with-splunk-and-powershell/ http://blogs.splunk.com/2013/09/22/monitoring-windows-shares-with-splunk-and-powershell/

ahall_splunk · ‎07-10-2014

You can do this by wildcards in the object. This is a regular expression, so something like the following in Splunk Universal Forwarder 6.0 and beyond: [perfmon://GeneralStats] counters = User Connections interval = 60 object = [^:]+:General Statistics index = perfmon disabled = 0

ahall_splunk · ‎06-20-2014

Is there some reason you are not using INDEXED_EXTRACTIONS? Here is a blog post about the feature: http://blogs.splunk.com/2013/10/18/iis-logs-and-splunk-6/ It deals with IIS logs, but the same principal can be used.

ahall_splunk · ‎06-12-2014

SA-ModularInput-PowerShell goes on the Universal Forwarder in the same way as the TA-SQLServer. However, it has installation instructions included as a dashboard. So your first step should be to install SA-ModularInput-PowerShell onto your central Splunk instance so you can read the documentation.

ahall_splunk · ‎05-28-2014

That message is fairly normal in a stable system that doesn't see a lot of activity. However, I'm no closer to understanding why mailbox audit is duplicating events. I'll try to set up a repro. In the meantime, I suggest disabling the mailbox audit data input.

Posts	269
Solutions	61
Karma Given	8
Karma Received	146
Member Since	‎03-08-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Using $foo$ to link views together in HTML module

Horizontally grouping modules without extra text/t...

Re: Can Splunk App for Microsoft SQL Server monito...

Re: How to troubleshoot why Splunk App for Windows...

Re: How to troubleshoot why Splunk App for Windows...

Re: How to troubleshoot why Splunk App for Windows...

Re: Why are we not getting any message tracking lo...

Re: How to troubleshoot why Splunk App for Windows...

Re: How to troubleshoot why Splunk App for Windows...

Re: Why are we not getting any message tracking lo...

Re: Can I define multiple searchTemplate in one vi...

Re: Powershell - How can I assign Get-Date to SPLU...

Re: How to add a new field called "site" that sets...

Re: Splunk App for Microsoft SQL Server: Why am I ...

Re: 200 Meg of .EVTX files uploaded into splunk ex...

Re: 200 Meg of .EVTX files uploaded into splunk ex...

Re: Splunk App for Microsoft SQL Server: Why am I ...

Re: Reading MSSQL logs into splunk

Re: Reading MSSQL logs into splunk

Re: Windows Infrastructure App doesn't detects Use...

Re: non ASCII characters in LDAP attributes

Re: Set Default Account Domain

Re: How to audit files in Splunk monitoring securi...

Re: MS SQL Server Perfmon multiple Install instanc...

Re: Regexes for Exchange SMTP logs

Re: Installation problems

Re: Exchange Add-On Duplicated Logs

Join the Conversation