About kkossery

kkossery · ‎10-14-2014

Let's say my PDF output has the following, 2014-10-10 09:58:27 EDT (Framework:INFO) [RID:526] - [randompassword123:bob.dole@ politics.com] - User authenticated 2014-10-10 09:59:31 EDT (Framework:INFO) [RID:526] - [sthisisencryptedpassword:tiger_woods@ golf.com] - User authenticated 2014-10-10 09:59:37 EDT (Framework:INFO) [RID:526] - [anotherpassword:roger@ tennis.com] - User authenticated You can see the e-mail addresses are different. 1. has a period, 2. has an underscore and 3. doesn't have a lastname.

kkossery · ‎10-14-2014

This is fantastic. Is there a manual where you can learn all of this? One more question - What if I want multiple users instead of firstname_lastname and some with only a firstname, without an underscore etc.. I tried to do a * in place of the firstname but it errors out.

kkossery · ‎10-14-2014

Hi Experts, I'm getting below output in a PDF report from Splunk, 2014-10-10 09:58:27 EDT (Framework:INFO) [RID:526] - [sthisisencryptedpassword:firstname_lastname@ serial.mobile.com] - User authenticated I only need the report to contain, Time firstname_lastname Can I do this on Splunk or do I need to script on the log file before it is sent to Splunk. Thanks.

kkossery · ‎08-22-2014

Thank you. I didn't know you could do this. I'll see if I can build from here. Any helpful docs for us beginners for writing queries like these?

kkossery · ‎08-22-2014

This will run every day or will be scheduled at 8 AM, 12 PM and 4 PM and send the reports

kkossery · ‎08-22-2014

Thanks so much. This is the base search I'm doing. sourcetype="WinEventLog:Security" "eventcode=4767" OR "eventcode=4777" OR "eventcode=4741" OR "eventcode=4742" OR "eventcode=4742" Based on your query, I'm going to get a large output as we have historical data which I want to eliminate. I only want output that has happened between those times and not past events. Your query has really helped it narrow down but I'm stuck with ignoring past historical data.

kkossery · ‎08-22-2014

I was not clear on my question. It is the same search for these 3 different time periods.

kkossery · ‎08-22-2014

I'm new to Splunk and being asked to configure it to submit a report generated at 8,12 and 4 PM weekdays to the management. How do I design the rule to first search for events happened 12PM-8AM, between 8AM and 12 PM and between 12 PM and 4 PM. I'm getting Splunk to search Event ID's during the above time period if that helps. Thank you for your help.

kkossery · ‎03-24-2014

False alarm. This was fixed after doing a Splunk service restart on the client.

kkossery · ‎03-24-2014

We are trying to setup our Linux boxes to forward OS specific metrics to the Splunk box and were deploying Splunk Add On on the Splunk server. The installation involved deploying the unzipped package to the etc/apps directory of $Splunk_Home However, after enabling and trying to set it up on the Web portal we see this error, The path '/en-US/custom/Splunk_TA_nix/taunixsetup/Splunk_TA_nix/setup' was not found. Any suggestions

kkossery · ‎02-12-2014

Thanks a lot!

kkossery · ‎02-12-2014

Hi Experts, I'm trying to setup the Windows Forwarder on different servers to forward the status of Windows Updates to the Splunk Server. I may have missed the document on how to do this. Can you help?

kkossery · ‎01-28-2014

Installing on a different Windows box worked with the above settings. Thanks.

kkossery · ‎01-27-2014

i have tried doing this again on another Windows box and I'm unable to install the program that will forward logs to the Splunk box. Can someone help?

kkossery · ‎01-23-2014

Thank you for these links. However, I see some things are missing here, Configure remote event log monitoring 1. Click Settings in the upper right-hand corner of Splunk Web. Under Data, click Data Inputs. Click Remote event log collections. Click Add new to add an input. I do not see Remote event log collections under Data Inputs. Do I need to activate something on my Linux box Splunk to show this.

kkossery · ‎01-23-2014

I have installed Splunk on a Linux box and is listening for incoming on 9997. Our linux boxes send its syslog to it and work fine. The Windows boxes however do not send any event viewer logs. I installed SplunkForwarder on it and followed the prompts where I entered the Receiver server and port 9997. Also restarted the splunk service just in case. What additional configurations are to be done to ensure Event Viewer logs/AD monitoring start to populate my Splunk sitting on the Linux box. I'm able to telnet to 9997 from Windows to Linux so it is not an access issue.

kkossery · ‎01-22-2014

I followed this link and was able to install the forwarder http://answers.splunk.com/answers/46988/splunk-installer-was-unable-to-create-splunk-services Need to install on a different drive other than the C drive. I'm not sure why this happens. Maybe a Windows Admin can throw some light.

kkossery · ‎01-22-2014

thanks lukejadamec. I tried doing this. On right click on the MSI package, I do not see an option to select Run As Administrator. I tried doing it from the Administrator Command line, again no luck. I didn't see an option to install this as a user or a system account. I did get an option though to install Splunk as Local Data Only Remote Windows Data Selected Option 1. It gives me the same error. Is there a different Splunkforwarder executable that I need to use to install?

kkossery · ‎01-22-2014

I tried installing Splunk Forwarder splunkforwarder-6.0.1-189883-x64-release on a Domain Controller. The user is part of Domain Admins and is also on the Administrator's group. I get the following error, Splunk Installer was unable to create Splunk services. Please make sure the user running the installer has the correct privileges, including being able to create Windows Services. Exitcode='1 I have gone through this link on splunk and gone through the steps listed by the expert but it doesn't seem to help. http://answers.splunk.com/answers/42112/splunk-install-error-on-windows I've also tried running the MSI as Run As Administrator but do not see the option listed after I right click on the package. Tried the Administrator command line, no luck.

kkossery · ‎01-14-2014

Thank you for getting back. I tried these settings. I hoped the auth details would be incorrect but it isn't. I'm going to work with Splunk support on this one after we purchase the product and update this thread if we find a fix. For now, I'm switching to the local MTA. Thanks again.

kkossery · ‎01-14-2014

jbrodsky_splunk - We are trying to move away from the local MTA and instead direct the application to directly connect to SES. All our apps including Bugzilla does this and wanted Splunk to do so too.

kkossery · ‎01-14-2014

There is nothing on /var/log/maillog. A follow up question. Would Splunk while sending e-mails externally (like in this case SES) log to /var/log/maillog. I thought it would only log to splunkd.log as /var/log/maillog is used by MTA on the system. Correct me if I'm wrong here.

kkossery · ‎01-14-2014

I'm trying to get our Splunk to integrate with Amazon SES but I'm not have had any luck so far. E-mails can be sent out on the Linux box using sendmail so there is nothing wrong with Authentication and the e-mail delivery part. Somehow Splunk refuses to send the e-mail and fails on Authentication failed. This is the error I'm seeing on /usr/local/splunk/var/log/splunkd.log 01-10-2014 19:31:10.319 -0500 ERROR ScriptRunner - stderr from '/usr/local/splunk/etc/apps/search/bin/sendemail.py': ERROR:root:(535, 'Authentication Credentials Invalid') while sending mail to: email@email.com

kkossery · ‎01-09-2014

Thank you. I guess I'll have to do the hard way of deploying the agent on all my systems.

kkossery · ‎01-09-2014

Experts, We have a enterprise product running on Red Hat Linux running on about 40 servers and want to forward logs from a non-standard location quickly and efficiently. I know we can use Splunk Forwarder to push logs out. Is there a way to pull logs from splunk rather than push from the clients. I'm looking for a way out where we don't have individually log in to each system and install the forwarder. Thank you.

Posts	75
Solutions	4
Karma Given	20
Karma Received	7
Member Since	‎01-08-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to edit the "From" address field for email not...

Question on Line Breaker for XML log

How to monitor an existing directory and upload al...

Is it good practice to run an rsync script to take...

No data on eventtype=msad-dc-health

Is there a way to get the current retention and ar...

How to get the missing eventtype hostmon_windows i...

Splunk App for Windows Infrastructure: Can we sche...

AWS Add on unable to parse CloudTrail data

Extract multiple lines from search output

Re: How to extract a field in a search and table i...

Re: How to extract a field in a search and table i...

How to extract a field in a search and table it wi...

Re: How to schedule 3 reports only on weekdays?

Re: How to schedule 3 reports only on weekdays?

Re: How to schedule 3 reports only on weekdays?

Re: How to schedule 3 reports only on weekdays?

How to schedule 3 reports only on weekdays?

Re: Splunk Add On installation issues

Splunk Add On installation issues

Re: How do I get to know the status of Windows Upd...

How do I get to know the status of Windows Updates...

Re: Forwarding windows event viewer logs to Splunk

Re: Forwarding windows event viewer logs to Splunk

Re: Forwarding windows event viewer logs to Splunk

Forwarding windows event viewer logs to Splunk

Re: Unable to install Splunk Forwarder on Windows ...

Re: Unable to install Splunk Forwarder on Windows ...

Unable to install Splunk Forwarder on Windows Serv...

Re: Integrating Splunk with Amazon SES to send e-m...

Re: Integrating Splunk with Amazon SES to send e-m...

Re: Integrating Splunk with Amazon SES to send e-m...

Integrating Splunk with Amazon SES to send e-mails

Re: Forward logs from multiple Linux servers

Forward logs from multiple Linux servers