Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About dharveynswccd
dharveynswccd
Path Finder
Member since:
11-15-2017
11-25-2020
Community Statistics
| Posts | 57 |
| Solutions | 1 |
| Karma Given | 4 |
| Karma Received | 7 |
| Member Since | 11-15-2017 |
Activity Feed
- Karma Re: Can I run the btool command on a universal forwarder without running shell or powershell script? for bandit. 06-05-2020 12:50 AM
- Got Karma for Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '0)'.. 06-05-2020 12:50 AM
- Got Karma for How can I automate the data on-boarding process?. 06-05-2020 12:50 AM
- Got Karma for Requesting Assistance Writing a Search Request. 06-05-2020 12:50 AM
- Got Karma for Re: Requesting Assistance Writing a Search Request. 06-05-2020 12:50 AM
- Got Karma for Re: Requesting Assistance Writing a Search Request. 06-05-2020 12:50 AM
- Karma Re: Not receiving logs from Syslog Server for damode. 06-05-2020 12:49 AM
- Got Karma for Re: why splunk community people not voting and not accepting answer to appreciate. 06-05-2020 12:49 AM
- Got Karma for Re: why splunk community people not voting and not accepting answer to appreciate. 06-05-2020 12:49 AM
- Karma Re: Learning Splunk to perform UBA for smoir_splunk. 06-05-2020 12:48 AM
- Karma Re: Need Help Installing/Configuring Splunk for VMWare App for bbingham. 06-05-2020 12:46 AM
- Posted Re: Generate report for top 10 web category usage on Reporting. 02-18-2020 10:39 AM
- Posted Re: Generate report for top 10 web category usage on Reporting. 02-18-2020 10:09 AM
- Posted Re: Generate report for top 10 web category usage on Reporting. 02-18-2020 09:50 AM
- Posted Re: Generate report for top 10 web category usage on Reporting. 02-18-2020 07:29 AM
- Posted Re: Generate report for top 10 web category usage on Reporting. 02-18-2020 06:03 AM
- Posted Generate report for top 10 web category usage on Reporting. 02-18-2020 05:59 AM
- Tagged Generate report for top 10 web category usage on Reporting. 02-18-2020 05:59 AM
- Posted Re: How to correlate the admin user with a GPO change? on All Apps and Add-ons. 01-10-2020 06:35 AM
- Posted Re: How do I write a search to track all changes performed in a Linux system? on Deployment Architecture. 12-10-2019 08:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
02-07-2019
06:41 AM
Good morning.
Came in today and noticed that no logs were being fed to Splunk from my Linux syslog collector. This collector is configured to receive logs from various systems over UDP 514, then push the logs to the Indexers. Attempts to access the log directory resulted in
"ls: cannot open directory .: Permission denied".
How can I resolve this? Thanks for your assistance.
... View more
01-09-2019
03:39 AM
Michael thanks for your input. Can you provide your reasons for this?
... View more
01-07-2019
10:14 AM
Hi Splunkers,
Last Friday configured Splunk App for VMware, everything appears to work fine, but this morning I came back to work and the VMWare app is not working.
I am running Splunk Enterprise Version:7.2.3 and Splunk App for VMware 3.4.4. Indexers, Search Heads, Syslog Server/Forwarder, and DCN are all configured according to the Splunk documentation (this was actually configured by Splunk PS on Friday). Now the issue is that gauges/clocks graph in the dashboard are a showing 0%? And there's no entity info such like CPU or memory assigned to a VM or a Host. Splunkd is running just fine, my Syslog Server/Forwarder shows data being collected, permissions are fine, and when I perform a search on the Index I am seeing current, up-to-the-minute logs. Can anyone help figure out why the dashboard in the app is not being populated? Thanks
... View more
- Tags:
- splunk-enterprise
11-02-2018
11:29 AM
@fenrisdacat, after making the changes in SPLUNK_HOME/etc/apps/splunk_app_for_nix/local/savedsearches.conf, do you leave the file in that location or do you move it back to SPLUNK_HOME/etc/apps/splunk_app_for_nix/default location? I just installed the app this week and running into the same issue. Thanks
... View more
10-30-2018
08:42 AM
1 Karma
I have Splunk Universal Forwarder installed on RHEL. I have hundreds of stanzas manually written in $SPLUNKHOME/etc/apps//default/ to facilitate log data on-boarding from sources on the network (our Splunk PS configured it this way initially). Can this process be automated so that when new systems are introduced on the network they can be detected, and a new stanza be written/current stanza be updated manually?
... View more
- Tags:
- splunk-enterprise
09-20-2018
07:37 AM
Hi, here is my situation:
My Splunk environment is all Linux which exists of 3 indexers, 2 search heads and 2 log collectors running the UF client. On one of my log collectors I have a stanza written for collecting Websense logs. Here is the stanza:
[monitor:///iscsi/rsyslog_custom/logs/websense/hostname/*/]
index=main
sourcetype=websense:cg:kv
host=HOSTNAME
For some odd reason these websense logs are not being sent to the indexers. However, all other logs collected on that UF are being sent over. Clearly not a network communication issue because all other logs are being sent successfully. When run a search for sourcetype=websense:cg:kv I get diddly squat. Subsequently when do a search for index=main the hostname does not appear in the results. I have been looking through the splunkd.log file but nothing jumps out at me. Any help is appreciated. Thanks
... View more
- Tags:
- splunk-enterprise
09-19-2018
08:03 AM
@harsmarvania57, My syslog server and Forwarder already have the necessary configs to read the logs and ingest the data. The problem does seem to reside on the Websense side so I will have to address that there. Thanks
... View more
09-18-2018
06:37 AM
I ran a sudo netstat -lnup | grep 514 #for udp and received the following output:
udp 0 0 0.0.0.0:514 0.0.0.0:* 1308/rsyslogd
udp6 0 0 :::514 :::* 1308/rsyslogd
Does this indicate that this server is listening on 514 and receives from 1308?
... View more
09-18-2018
06:22 AM
I have tried using DNS-No Joy there
No firewall blocks in place
All other systems are sending to Splunk over UDP successfully
... View more
09-14-2018
08:43 AM
I am running Splunk on Linux and the splunk process is running as splunk
... View more
09-14-2018
07:36 AM
So, I have a Websense server which I've configured to send logs to Splunk but nothing is being fed in.
I'm running Splunk on Linux.
I have verified that I've configured the input correctly by confirming that:
I configured the correct IP address of the Splunk platform node responsible for data collection in my Websense Content Gateway configuration.
The port that I configured in my Websense app is UDP 514.
My syslog input is configured to set the source type to websense:cg:kv.
I am searching the correct index, which is the main index.
The Siem Collector service is running on the Websense server
I had it working a few months ago and had to discontinue log collection due my daily ingestion limitation. Any ideas would be greatly appreciated. Thanks
... View more
08-09-2018
05:44 AM
Hi guys, did anyone get this to display the proper logoff times? I'm running into the same dilemna where the logoff time is the same as the logon time.
... View more
06-25-2018
05:30 AM
Cannot access my forwarders this way, as splunk web was turned off by Splunk PS for security reasons.
... View more
06-25-2018
05:23 AM
Yes, and yes
... View more
06-20-2018
08:05 AM
I just ran the installation for the upgrade from 7.1.0 to 7.1.1 on RHEL 6.9. However, after the installation I did a version check and it says that I have version 7.1.0 installed. I tried to reinstall the 7.1.1 and it flagged saying that this version is already installed. Has anyone seen this and can recommend a fix?
Thanks
... View more
- Tags:
- splunk-enterprise
05-16-2018
09:03 AM
Thanks dude. At least you got me pointed in the right direction.
... View more
05-16-2018
07:47 AM
Was basically what I did.
Did it again this morning and got the error: "Error in 'where' command: The operator at '{noformat}' is invalid."
... View more
05-16-2018
03:50 AM
@kwokkal, unfortunately that did not work for me even though I didn't break Splunk so I may not have effected the workaround correctly. Did you do it the same way I did or was there some other way you performed the workaround?
... View more
05-15-2018
11:22 AM
Thank you kwokkal. I searched in Splunk web for the "Audit - Script Errors" search string. I then modified and saved it according to the workaround suggested in SOLNESS-14947, SOLNESS-15058. Hopefully I've done that correctly and I didn't break Splunk. We will find out soon!
... View more
05-15-2018
10:29 AM
Hi,
I'm wondering if Splunk has a concrete solution to this. I as well would not only like to suppress the messages. I would like to know if these messages are false positive readings or not. If true, how do I resolve? Here is an example of one of the messages I received today: 'Health Check: msg="A script is in an unknown state" input="../bin/collector.path" stanza="default"'.
Thanks Splunkers
... View more
05-14-2018
04:48 AM
Good morning guys. I too upgraded ESS to 5.0 and suddenly started receiving the same alerts that KWOKKAL is receiving. Was not receiving the alerts prior to the upgrade.I am suppressing the messages for now because they are getting outrageous, and my Indexers also meet/exceed the necessary requirements.
... View more
05-02-2018
09:43 AM
I just upgraded to ES 5.0.0 and right after I upgraded and restarted Splunk I started getting similar error: "Health Check: Intelligence download of "iblocklist_logmein" has failed on host......... threat list download failed after multiple retries". I am getting an alert for multiples things, not just iblocklist. I cleared the alerts but they keep coming back. How can I resolve being that I am using a newer version which has the known issue resolved?
... View more
03-30-2018
08:25 AM
Figured it out. Apparently Splunk didn't like me copying over an entire directory and modifying it. I deleted the web.conf file, recreated it then copy and pasted in the stanzas from a sample file. That worked fine.
... View more
03-30-2018
07:05 AM
I have 2 search heads and I've acquired TLS certs from my trusted CA that I'm using to secure web traffic to the search heads. On one search head I configured the web.conf in $SPLUNK_HOME/etc/system/local/ as per documentation. On one search head everything works fine but on the other I am receiving the following error:
Unauthorized
The only way I can get this work is to modify the web.conf in $SPLUNK_HOME/etc/system/default/, which is not the recommended way. Besides, whenever there is a Splunk upgrade that wipes out the settings.
We found out that when Splunk PS set this up last year, this second server did not have a web.conf file in $SPLUNK_HOME/etc/system/local/. I had to copy from the Default directory but something obviously isn't kosher and I am looking for help determining the issue.
Thanks guys!
... View more
- Tags:
- splunk-enterprise
03-22-2018
07:39 AM
That was spot on. Resolved the issue right away
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-25-2020
03:30 PM
|
Karma from
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 3 | |
| 1 | |
| 1 |
