Hi, Recently I encountered the issue "The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch". My splunk is installed on a vm so I just tried to give more disk space to linux by just increasing the provision space. Somehow, the splunk message is no more. However, I read that I still need to do something to the linux partition table? Do I really need to do the change to partition table in linux to really solved the disk space issue for splunk?? https://www.unixmen.com/increase-disk-space-and-memory-in-linux-vmware-virtual-machines/ ... View more

Hi, I am trying to analyze a static PCAP file. I have point splunk to the pcap file using "Data inputs » PCAP File Location". But when I view the Top Talker Overview, with "Selcet tcpdump file" as "All" or "C:\Program Files\Splunk\etc\apps\SplunkForPCAP\bin\pcap2csv.bat" , the search status is always "Search is waiting for input...". As an alternative, I have managed to conver the pcap file to cvs using wireshark and upload the data to splunk, but I still like to use the app as a reference on what I can see from a pcap file. May I know what else do I need to do to view the pcap file using the app? ... View more

Hi, how does one forward something like sysmon from 1 vm (guest1) to another vm (guest2) and then out to another pc (outside network)? Do I install universal forwarder and sysmon on Guest 1, and use deployment server to send out to another PC outside network? ... View more

Hi, Is it possible to forward data from a vmnet1 Host-Only VM Guest to another vmnet1 Host-Only VM Guest? I actually set up this way and list forward-server does see the ip:port active but my other Guest collector could not see any data coming in. After I switch to vmnet8 nat on both machines, I can see my data coming in but I need to block my data source from the internet. How do I do it without vmnet Host-Only or Host-only network configuration?? ... View more

Hi, I'm playing with Splunk Security Essentials for Ransomware and I managed to see it on a live data...but...what can we do to actually stop the ransomware or is this just for behavior study? ... View more

Hi, I'm doing the exercise at https://www.splunk.com/blog/2017/05/13/steering-clear-of-the-wannacry-or-wanna-decryptor-ransomware-attack.html. Step 10 was to search for the following syntax: sourcetype=xmlwineventlog:microsoft-windows-sysmon/operational EventCode=1 | eval cmdlen=len(CommandLine) | eventstats avg(cmdlen) as avg, stdev(cmdlen) as stdev by host | stats max(cmdlen) as maxlen, values(avg) as avgperhost, values(stdev) as stdevperhost by host, CommandLine | eval threshold = 4 * ( stdevperhost + avgperhost ) | where maxlen > threshold Example returned an event with maxlen = 4490 but when I tried it on the "Launch Online Session" with the same search, I cannotfind that event. I went to analyze the logs again and found that the maxlen is only 309. Step 1 to Step 9 were very accurate. What did I do wrong?? ... View more