About splunkcol

splunkcol · ‎11-20-2020

I understand that this is the most updated version role management in Splunk Enterprise does not have the same fields as in Cloud

splunkcol · ‎11-20-2020

I need a user with role "user" to be able to consult the consumption of the license in splunk cloud. When I enter roles, I do not see any option that refers to the license as if it happens on premises

splunkcol · ‎11-19-2020

I have stopped the service from bin folder using ./splunk stop then i moved the content of the install from the first folder to the second folder and i get an error message root@index:/xxx/splunk/splunk/bin# ./splunk start Splunk> CSI: Logfiles. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. The certificate generation script did not generate the expected certificate file:/opt/splunk/splunk/etc/auth/mycerts/myNewServerCertificate.pem. Splunkd port communication will not work. SSL certificate generation failed.

splunkcol · ‎11-18-2020

I have the doubt for this answer, according to this, in windows it is a bad idea, but in linux if it is viable https://community.splunk.com/t5/Installation/move-Splunk-install-from-one-directory-to-another/m-p/13198

splunkcol · ‎11-18-2020

I need to install this APP but I don't know if I should install it in the indexers, in the search heads or in both

splunkcol · ‎11-18-2020

thanks for answer so soon i have splunk installed on linux

splunkcol · ‎11-18-2020

if someone request to change the splunk installation folder: 1. Is it possible to just move and everything works normal? 2. what should I keep in mind? or exactly what should I do in a step by step? the truth worries me a lot As I see it, it is as if they asked me to move a program in windows from C to a D partition and hope that it continues to work normally and obviously that will not happen

splunkcol · ‎10-19-2020

In splunk enterprise on premises solutions when the contracted license is exceeded, a warning appears But in splunk cloud I don't see any alerts when the contracted license is exceeded can someone explain to me?

splunkcol · ‎10-14-2020

Has anyone presented this error message? "External handler failed with code "1! and output REST ERROR[400] Bad Request - An error occurred (AccessDenied) when calling the ListQueues operation: Access to the resource https://queue.amazonaws.com/ is denied. See splunkd.log for stderr output."

splunkcol · ‎10-14-2020

@richgalloway Through which port does the heavy forwarder communicate with splunk cloud?

splunkcol · ‎10-13-2020

by mistake I put in host the url of splunk cloud and port 9997, I would appreciate how I can revert it?

splunkcol · ‎10-13-2020

In the servers that contain the logs I have installed in universal forwarder and I have configured with inputs the path where the logs are and with outputs the ip and the port where these logs should be sent. I have installed the credential package in heavy forwarder I have activated port 9997 and I see communication between the servers and the heavy forwarder. I have doubts in the process of forwarding logs from the heavy forwarder to splunk cloud if the heavy forwarder points directly to splunk cloud, the "host" field should I put https://xxxxxxxx.splunkcloud.com? and what port? 443 or 9997? https://docs.splunk.com/Documentation/SplunkCloud/8.0.2006/Forwarding/Deployaheavyforwarder splunk add forward-server <host>:<port> -auth <username>:<password> I have already created the index with the same name that I defined in the intputs file of the logs source server I don't see logs coming in, what else do I need to review?

splunkcol · ‎10-08-2020

Solved `notable` | search NOT `suppression` | fields rule_name urgency | stats count(eval(urgency="low")) as low count(eval(urgency="medium")) as medium count(eval(urgency="high")) as high count(eval(urgency="critical")) as britical by rule_name

splunkcol · ‎10-08-2020

With this query I can see the notable events that are currently active. But not everyone has been alerted even if they are active. I would like to know what the query would be to see those that the tool has alerted in the last month | rest splunk_server=local count=0 /services/saved/searches |search action.notable.param.severity=* | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | rename eai:acl.app as app, title as csearch_name, action.correlationsearch.label as csearch_label, action.notable.param.security_domain as security_domain | table csearch_name, csearch_label, app, security_domain, description action.notable.param.severity

splunkcol · ‎10-06-2020

the query if it works I will keep in mind your suggestion about grouping About the number of events I have been confused, just as indifferent to the number the help helps me I don't know if I'm confused, I've seen queries where I put values like "earliest = -30d" or "bucket _time span = 1s"

splunkcol · ‎10-06-2020

I know that someone may have asked this, but the truth is I did not find anything similar. I need to create a query for the events that exceed 500 attempts every 1 hour, when this happens an alert is generated. index=* dest=200.22.22.22 dest_port=443 action=Accept |stats count by action src dest dest_port |where count > 120 |sort -count

splunkcol · ‎10-01-2020

How have you solved it?

splunkcol · ‎10-01-2020

In a previous post you suggested that I check that it will have a minimum IOPS, after checking, the disk has more than 800, it even has double.

splunkcol · ‎10-01-2020

yes, the syslog server receives the logs and forwards them to the indexers using UF I understand that the cause of the queuing is typingqueue?

splunkcol · ‎10-01-2020

I have a problem with the logs, they are arriving with a delay of 12 hours or more The information first reaches a syslog server and is forwarded to the indexers When reviewing the logs in the syslog servers I find that they arrive without problem and with the correct date and time when I go to the indexers or search heads to look at the logs I see that they have a delay of 12 hours or more With this document I have tried to diagnose the problem but I cannot find the same panels that ask to review the document in the part where it is suggested to check with the command iostat -zx 1 one of the parameters are in the values cataloged as bad https://www.splunk.com/pdfs/technical-briefs/disk-diagnosis-digging-deep-with-monitoring-console-and-more.pdf What else should I check?

splunkcol · ‎09-29-2020

I have seen that there is a way to authenticate using the second factor of authentication through RSA and DUO. But I would like to know if there is another way and even better if it has no cost. I need to show a dashboard which can be accessed from anywhere so as not to have to be creating VPN and permissions for whoever wants to access it.

splunkcol · ‎09-27-2020

Yes, it is new, the problem occurs at least once a week. When the problem is present, no matter how hard I try to solve it, it finally fixes itself. It seems like a queuing issue, what I have investigated is that the possible cause is that I have activated all the notable event functionalities This process helped me not to have the problem so frequently, but it still happens https://splunkonbigdata.com/2020/07/21/concurrent-historical-searches-in-splunk/ There are other errors that I have pending to solve and I do not know if they are related other times when the searches are not completed or the graphics are not loaded, an error appears that refers to loss of connection with the peer, that is, with the 2 indexers, after 2 min it normalizes, but it happens at least 5 times every 10 min

splunkcol · ‎09-27-2020

Hello, the causes can be many, you must provide a little more information to try to help you For example, at the top there are some warnings, be it a warning or error message

splunkcol · ‎09-27-2020

Has anyone presented this problem?

splunkcol · ‎09-21-2020

This warning message indicates that even though it has errors, it is still running or is definitely not working? Asynchronous bundle replication might cause (pre 4.2) search peers to run searches with different bundle/config versions. Results might not be correct. [subsearch]: Subsearches of a real-time search run over all-time unless explicit time bounds are specified within the subsearch. [subsearch]: Successfully read lookup file '/splunk/etc/apps/SA-Utils/lookups/qualitative_thresholds.csv'. remote search process failed on peer

Posts	196
Solutions	13
Karma Given	92
Karma Received	14
Member Since	‎07-15-2020

Online Status	Offline
Date Last Visited	‎02-06-2025 10:36 AM

Copy windows logs in raw mode

Expired key microsoft 365 app

Alien Vault Check OTX

Splunk ES fortinet new source

How do I Download and Setup DB Connect?

How to show 2 eventcode fields?

Upgrading Splunk 8.0.x to 9.0.x

Does the Elasticsplunk app no longer exist?

VT4Splunk APP correlation with paloalto

Upgrade DBConnect version

Re: Assign license revision role

Assign license revision role

Re: change splunk installation folder

Re: change splunk installation folder

TA Splunk Add-on for Citrix NetScaler

Re: change splunk installation folder

change splunk installation folder

splunk cloud license generates alert?

Error output REST ERROR[400] CloudWatch Splunk Add...

Re: Splunk Cloud does not receive logs

Re: Splunk Cloud does not receive logs

Splunk Cloud does not receive logs

Re: list of events alerted last month

list of events alerted last month

Re: help creating alert port 443 for 1 hour by act...

help creating alert port 443 for 1 hour by action

Re: long delay /missing data from sourcetypes?

Re: delayed logs

Re: delayed logs

delayed logs

2FA authentication

Re: Splunk entreprise security status "Pending..."

Re: Incident rewiew does not show events.

Splunk entreprise security status "Pending..."

Jobs with warning message Splunk ES

Join the Conversation