Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About damode
damode
Motivator
Member since:
09-26-2017
05-06-2021
Community Statistics
| Posts | 310 |
| Solutions | 8 |
| Karma Given | 132 |
| Karma Received | 21 |
| Member Since | 09-26-2017 |
Activity Feed
- Got Karma for Re: How to upgrade add-ons on Indexers and Forwarders after Splunk ES upgrade ?. 01-27-2026 11:03 AM
- Got Karma for Re: operation:"copying source to destination", error:"Access is denied.". 03-19-2025 09:25 PM
- Got Karma for Bucket replication issues - No possible srcs for replication. 08-26-2021 01:26 PM
- Posted cannot change user and/or app context of a report that is embedded on Knowledge Management. 05-06-2021 03:57 AM
- Posted Re: How to configure index settings to index data directly in S3 buckets/smartstore ? on Getting Data In. 05-05-2021 06:48 PM
- Posted How to configure index settings to index data directly in S3 buckets/smartstore ? on Getting Data In. 05-04-2021 05:38 PM
- Posted Is there any Splunk recommended best practice for ingesting Netflow data ? on Getting Data In. 05-03-2021 09:16 PM
- Got Karma for How to configure input in DB Connect v3.1.2 for Splunk Add-on for Microsoft SQL Server using template mssql:audit ?. 03-01-2021 04:55 PM
- Posted Re: What is the recommended logging requirement for Linux OS from Splunk ES perspective ? on Splunk Enterprise Security. 02-04-2021 01:54 PM
- Posted What is the recommended logging requirement for Linux OS from Splunk ES perspective ? on Splunk Enterprise Security. 02-03-2021 09:18 PM
- Posted Need help to find specific auth logs for Linux OS on Getting Data In. 02-01-2021 12:31 AM
- Posted Re: Is there any ES Analytical Story or Usecase for Certificates and Alerts datamodel ? on Splunk Enterprise Security. 01-31-2021 04:22 AM
- Posted Is there any ES Analytical Story or Usecase for Certificates and Alerts datamodel ? on Splunk Enterprise Security. 01-28-2021 11:48 PM
- Posted Application Protocols list in ES - unclear in documentation on Splunk Enterprise Security. 01-28-2021 02:30 AM
- Posted What is the actual use of Expected Views lookup ? on Splunk Enterprise Security. 01-28-2021 02:23 AM
- Posted How does ESCU app exactly maps Analytical Stories against CIS Controls ? on Splunk Enterprise Security. 01-12-2021 03:43 AM
- Posted Is there any automated way to check or validate magix six parsing attributes have been configured ? on Getting Data In. 01-09-2021 05:28 PM
- Posted Re: Accelerating CIM Validation (S.o.S.) datamodel results in error on Splunk Enterprise Security. 01-06-2021 04:09 PM
- Posted Re: SSL Certificate Checker: Which extensions are supported? on All Apps and Add-ons. 01-05-2021 02:17 PM
- Posted Strategies for populating watchlist field in Assets and Identity Framework on Splunk Enterprise Security. 01-04-2021 05:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-01-2018
01:07 AM
I have a Kiwi Syslog server where all Cisco logs are getting stored in folders with the host IP as the folder name.
I have configured an app in the universal forwarder that reads those logs. Below is the inputs.conf,
[monitor://E:\SyslogData\10.10.10*\log*]
host_segment = 2
index = test_index
sourcetype = syslog
disabled = 0
When the Kiwi log file format is set to Kiwi format ISO yyyy-mm-dd (Tab delimited) while data encoding is UTF-8. The host value extracted is Local0.Info.
And with the above settings, the logs in kiwi look like below :
2018-08-01 16:06:30 Local0.Info 10.10.10.X.X 1 153232424240.525452732241 cfC_G_AP07 flows allow src=13.13.140.249 dst=12.12.122.21 mac=43:43:5C:83:25:CA protocol=t3p sport=7240 dport=6224
The only exception when the extraction with the above inputs.conf works well is if the log format is changed in Kiwi to either "message text only (no priority) or raw logging", however, even in that case the data does not get populated in the Cisco Networks app. It still shows no data.
Last thing I tried was I uninstalled my custom app I had deployed in UF that had the above inputs.conf and deployed Cisco Networks add-on in the UF with the above inputs.conf, in the hope that maybe transforms.conf from the add-on would properly parse data and send to Indexer. But after doin that, I have stopped receiving data altogether in Splunk.
Arch Info : 1 S.H, 1 Indexer, 1 HF
I have tried numerous way to try to make this work but nothing has helped. Please help
... View more
08-01-2018
12:49 AM
@splkmika1 Can you please share how have you configure the Kiwi Server ? for e.g: data encoding set to UTF-8 ? what is the log file format set to ?
Also, in what app have you put the inputs.conf that has the monitoring stanze reading your Cisco logs ? is it a customised app or Cisco add-on ?
Thanks!
... View more
07-30-2018
04:55 PM
I am in the Pre-req step of Guided step of Windows Infra app and its giving me the below message.
Splunk Add-on for Microsoft Windows v4.8.3 or 4.8.4
Update required: v5.0.0 installed. It does not match with v4.8.3 or 4.8.4
I have installed the latest version of Windows add-on. Please advise if I am supposed to downgrade the add-on to v4.8.3 or 4.8.4 ?
... View more
05-21-2018
10:28 PM
Hi @vgollapudi,
Thanks for sharing your implementation steps. I will give it a try.
... View more
05-20-2018
04:14 PM
Hi @adonio,
Thanks for your reply.
My question is mainly about estimating the storage and whether the IOPS of the storage would in any way impact the size of the storage. We are only planning to use Splunk Enterprise.
EDIT:
one more thing I noticed on the splunk-sizing(dot)appspot(dot)com, is that its showing me the wrong value for archived/frozen storage.
With the same settings as above, if you see the results, it gives, for cold , i.e 120 days - 11.7 TB
and for frozen/archived storage - 365 days, it shows 10.5 TB.
Not sure, how it came up with that value ?
... View more
05-18-2018
12:04 AM
Hello Splunkers,
Below is our retention requirement while aiming to index approx 250GB of data per day in only 1 Indexer
hot - 60 days - Tier 1- SSD
cold - 4 months - Tier 2 - 10K RPM
Frozen – (12 Months) - tier 3 - 7200 RPM
I have already got an estimate from splunk-sizing(dot)appspot(dot)com, however, as the IOPS readings based on the RAID configuration on that site dont really match that accurately with the storage requirement I have, I am not too sure how reliable the estimate is.
Hence, please help me figure out the right estimate for this requirement.
Thank you.
... View more
04-18-2018
10:14 PM
Hi @Adonio,
Thanks for your input. However, I am looking for a little more detailed suggestions on how Splunk deployment can be planned to support DR in some common scenarios.
... View more
04-17-2018
06:04 PM
As the title suggests, is it possible to do that? logically it seems possible but I am not sure what performance impact it would have on the functioning of the cluster.
Hence, please suggest if this is possible and any points that should be taken into consideration.
Thank you.
... View more
04-16-2018
04:09 PM
As the title suggests, I would like to seek help in understanding how Splunk can be deployed to support DR and not HA functionality.
... View more
03-19-2018
09:04 PM
1 Karma
Hi I have been trying to set up the input on the DB Connect app "New Input" page using template mssql:audit template from the Splunk Add-on for Microsoft SQL Server add on but have not been able to progress much.
I am trying to figure out what would be the correct checkpoint value for the query below. I have tried lot of variations based on answers from other posts on this site, but none of the answers have proved useful in this case.
SELECT *
FROM sys.fn_get_audit_file ('C:\\\\SQLAudit\\\\*',default,default)
WHERE event_time > ?
ORDER BY event_time ASC
W.r.t Timestamp, I have chosen "event_time" as preferred column, and specified time format as yyyy-MM-dd HH:mm:ss.
Input type : Rising Column
Please help.
... View more
03-01-2018
07:42 PM
Hi @vgollapudi, did you finally get around this issue ? if yes, please share which add-on did you choose to make the setup work properly. Thanks!
... View more
02-26-2018
05:16 PM
1 Karma
There are only INFO messages.
Strangely, after I restarted the universal forwarder and re-deployed the app, I was able to see logs on the Indexer now. However, I am still unsure where was the fault.
Does restarting the U.F or splunk reload deploy-server both required to apply config settings on U.F ?
Also, in Forwarder Management, it shows me all info like apps, server classes and deployment client, however, in Settings-->Server Settings--> Deployment Client, it shows nothing at all. Any reason why ?
... View more
02-26-2018
04:05 PM
I have set up a universal forwarder to read logs from kiwi syslog server.
Universal Forwarder is set to forward logs to the Indexer via Heavy Forwarder.
I have also set up the Heavy Forwarder as deployment server.
I have deployed the following inputs.conf to the U.F by deploying an app from the deployment server.
[monitor://C:\Program Files (x86)\Syslogd\Logs\x.x.x.x\log*.txt]
index = main
sourcetype = syslog
disabled = false
With all the above settings, I still cant see any logs on the Indexer.
I have confirmed following things already,
U.F has the right privilege to read logs from syslog's log folder.
network connection established between Syslog Server and H.F on H.F's port 9997 and 8089.
receiving port 9997 on Indexer enabled.
splunk btool inputs list monitor command also does not work on the U.F
Please help me troubleshoot this.
Thank you.
... View more
02-26-2018
02:03 PM
I am using a full version of Kiwi. Thanks for the suggestion. It has helped to deal with the issue of multiple type of logs on one port.
... View more
02-22-2018
06:23 PM
I am installing MS SQL Server Add-on. In the instructions, it mentions to install the DB Connect app on a Search head or Heavy Forwarder.
But I wish to know from least performance impacting perspective, which would be the best place to install ?
I am only interested in gathering the trace and audit logs, for which DB Connect app is required.
... View more
02-19-2018
02:44 PM
Hi @rich7177,
We need the HF for data filtering and dbconnect app.
I checked out each syslog server, however, none of them support multiple UDP ports. Hence, as an alternative to solution to this, I have decided to change the architecture by having all logs sent to the Heavy forwarders instead of syslog server and from there, forward logs to syslog server as well, in addition to the Indexer. That way, I can reduce the risk of data loss.
Please suggest if there could be any drawbacks for this method ?
Thanks.
... View more
02-10-2018
09:33 PM
I have installed a universal forwarder to read logs from syslog server and forward them to heavy forwarder. I have kiwi syslog server to receive logs from all syslog based data sources and had planned to configure multiple UDP ports for ease of sourcetype categorisation. However, I realised it only supports 1 udp port at a time.
Can anyone please advise what can be done in this case ?
... View more
01-30-2018
08:00 PM
Install a universal forwarder on your windows server
During the installation, put Heavy Forwarder's IP in the Receiving Indexer field (and deployment server IP if you have one)
Configure monitor input stanza in inputs.conf to point to the authentication.log
restart the universal forwarder.
... View more
01-28-2018
05:07 PM
I am assuming this could done via GPO (to log events related to file/folder access) and push the GPO policy to the file server (F.S). And install universal forwarder on the F.S to monitor the folder and send logs to the Indexer.
Please let me know if my understanding is right and possibly point me towards the documentation for it.
Thanks in advance.
... View more
- Tags:
- splunk-enterprise
01-17-2018
04:05 PM
In addition to the main question,
Client wants to install Splunk in non-default partition (i.e not the default Splunk drive (C:)) and
also wants to store all indexes in other partition (E:)
It's on a Windows Server
I know that the above is possible but I would just like to know if there are any things I should keep in mind before doing that. If that would affect in the way Splunk operates
... View more
01-09-2018
05:56 PM
Thanks @micahkemp!
... View more
01-09-2018
04:53 PM
Yes, thats right.
the data is of bank transactions in csv file format.
... View more
01-09-2018
04:48 PM
No, the lookup table doesnt have any numbers. Sorry, I got the formatting wrong while posting this qn. I will update it.
... View more
01-09-2018
04:07 PM
I have the below type of event and I want to add a category field to it using lookups
time Transaction Business name
6/01/2018 40.22 ABC foods 6697 VALE TAP AND PAY 0000
8/01/2018 45.22 supermarket suburb TAP and PAY 0000
So, I created the following lookup - test.csv
Business name,Category
ABC foods 6697 VALE TAP AND PAY 0000,Dine out
DEF utilities,Utilities
TARGET suburb name,Shopping
supermarket suburb TAP and PAY 0000,Groceries
Below is my search query,
index="finance" sourcetype="csv_finance" | lookup test.csv "Business name" OUTPUT Category| table "Business name" Category
but its not displaying the results.
How can I create a successful lookup that will display the categories along with the business name in the search results ?
... View more
12-19-2017
03:06 AM
@niketnilay, the userid is only present in IndexA. The only common factor between both indexes is the IP.
The field extractions in both indexes are built-in. Yes, the data above is not the real data but its just to give an idea how the logs look like. Thanks for the additional Info.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-06-2021
08:24 AM
|
