Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About o_calmels
o_calmels
Communicator
Member since:
10-26-2012
06-21-2023
Community Statistics
| Posts | 58 |
| Solutions | 6 |
| Karma Given | 5 |
| Karma Received | 16 |
| Member Since | 10-26-2012 |
Activity Feed
- Posted Going to Splunk 9 : Does CPU and RAM usage increase after migration? on Splunk Enterprise. 06-20-2023 05:40 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 02-22-2023 06:56 PM
- Posted Maxmind | How to use 5 different mmdb databases? on Splunk Enterprise. 10-05-2022 06:02 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 01-03-2021 10:52 PM
- Got Karma for Re: Creation of one pdf file for 2 dashboard views using rest API. 10-23-2020 06:15 AM
- Posted Re: Creation of one pdf file for 2 dashboard views using rest API on Dashboards & Visualizations. 10-22-2020 11:27 PM
- Posted McAfee Web Gateway socks logs on All Apps and Add-ons. 10-22-2020 11:16 PM
- Tagged McAfee Web Gateway socks logs on All Apps and Add-ons. 10-22-2020 11:16 PM
- Got Karma for Re: How to configure Splunk Heavy Forwarder and Splunk Searchhead on the same machine?. 06-05-2020 12:50 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 06-05-2020 12:48 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 06-05-2020 12:48 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 06-05-2020 12:48 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 06-05-2020 12:48 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 06-05-2020 12:48 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 06-05-2020 12:48 AM
- Got Karma for Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4?. 06-05-2020 12:48 AM
- Got Karma for Re: start and finish time to be set for summary index to get data for last 24 hours. 06-05-2020 12:48 AM
- Karma Re: Why is syslog right into Splunk so bad/wrong? for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: Why is syslog right into Splunk so bad/wrong? for donald_mccarthy. 06-05-2020 12:47 AM
- Karma Re: Why am I getting https error "ssl_error_rx_record_too_long" when logging into my Indexers? for juvetm. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-21-2017
01:06 AM
Hi, thank's for you answer.
I try this option, but it's not running like I need.
Splunk pdfserver is running till V6.0.1, and after 😞
So, i found an other solution, build another splunk server with a 5.0.18 install, reinstall pdfserver, and import my data with restAPI from my main cluster.
Then, I will leave this Splunk 5 server running alone, I would be able to upgrade my main cluster like I want with no problem with pdf printing.
.
Olivier
... View more
07-18-2017
01:59 AM
Hi splunkers.
I recently upgrade one of my old splunk server to splunk 6.1.
This server must use the "pdf server" app because I need to export multiple panels in one A4 page and this apps is doing the job.
My problem in 6.1 is that pdf server seams to generate pdf before html rendering is finished, then, some panels are missing.
Do you know something pour make pdf server slepping some seconds before generating the PDF file?
Thank's, Cheers
Olivier
... View more
06-20-2017
11:40 PM
Hi, did you find any solution to your export ?
Olivier
... View more
07-12-2016
06:50 AM
Hi Trross33, I going to make a POC with NSX, because I'm very hapy with Splunk, I Wonder if you found any clue ?
Thank's !
... View more
05-02-2016
05:33 AM
9 Karma
Hi Splunkers,
Has anyone found a way to generate a PDF file that has the same layout as the Dashboard with multiple panels? When I generate a PDF in Splunk 6.4, each panel is printed in a single page, so the entire layout is ignored and all the data is shown in 7 pages. This document is generated for my CIO, so I need all the panels in a single A4 page only!
Like this post https://answers.splunk.com/answers/67071/new-pdf-generation-limitations.html, this feature is missing.
I run actually Splunk 5.0.11 and plan to migrate to 6.4, but if I can't generate PDF files as my dashboards layout, the migration is compromised.
Thanks.
You can find the dashboard on the following link : XML Dashboard File
... View more
04-22-2016
01:19 AM
hi splunkers !
I Begin to work on Windows EMET logs.
From scratch, this software gives a lots of information.
Does anyone began to get relevant information from EMET logs ?
Thank's.
Olivier.
... View more
02-24-2016
05:12 AM
Hi, Have you found a solution, I got exactly the same error ,
Thank's.
Olivier.
... View more
02-08-2016
12:05 PM
Hi, I did it 3 days ago.
Thanks for your answer.
Cheers.
Olivier
... View more
02-04-2016
11:43 PM
Hi Splunkers;
I need to install Add-on for Check Point OPSEC LEA 2.0.4 on my Splunk 5.0.11 instances.
Does anyone know where I can find this release?
Thank's a lot.
Cheers !
... View more
12-17-2015
12:43 AM
Hi,
My main index has a maximum size of 620 GB approx. So my index size was about 615 ~ 619 GB as it should be.
4 weeks ago, I got more disk space, so I extend this maximum size to 1450 GB. But now, my index is still about 615 ~ 619 GB since 4 weeks.
The architecture is distributed over two indexers, my two indexers have the same problem.
I index about 10 GB to 15 Gb per day per indexer, so my main index index should have grown since these 4 weeks !
I check my disk space, it is free and available.
I tried to restart splunkd, restart the entire server.
Do you know where I could find logs about this problem, or why my index doesn't fit all the space available for it.
thank's a lot !
... View more
06-09-2015
10:48 PM
Hi, you ve got two solutions :
- Tell SEPM to send logs to syslog server, this server being your splunk instance (be carefull if your instance is distributed and you are using universal forwarder, the sourtype association will no work properly because universal forwarder doesn't modify any data, it just forward to indexers.)
- So the second solution is to install a universal fowarder on your SEPM server directly, install the Splunk For Symantec TA on it and configure the props.conf to match each file created by SEPM.
.
Cheers,
Olivier
... View more
06-09-2015
10:35 PM
I,
In reporting, Splunk For Symantec add more features than the reporting in the SEPM console. Nevertheless, the SEPM console is absolutely indispensable to manage the SEP Solution.
Splunk For Symantec is best for:
Get all the logs from a single client (the console just display a category of log for a client, not all at the same time)
Associate SEPM logs with other security products of your compagny, like FireWall Gateways, DNS, proxy Etc ... in a way that you can make relations between these events and find relevent risk.
Make your own reports, SEPM do not allow you to create your reports, just using the proposed one.
List item
Cheers
Olivier.
... View more
04-22-2015
07:47 AM
Closed : Thank's for yours anwsers, I change the web.conf file to have http access, then https and everything is OK now.
Bye.
... View more
04-22-2015
02:17 AM
Hi, I'm using something like that:
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="search">index=test-index | head 1 | stats max(_time) as headTime | convert timeformat="%m-%Y" ctime(headTime)</param>
<param name="latest">-0mon@mon</param>
<param name="earliest">-1mon@mon</param>
<module name="SingleValue">
<param name="field">headTime</param>
<param name="classField">low</param>
</module>
</module>
this search let me know the date of the first event.
This i not exaclty what you expect, but I hope that helps.
Cheers,
Olivier
... View more
04-22-2015
02:11 AM
I, Ihave the same problem.
You wrote that you fond a solution, please, can you tell us what is it ?
Thank's, Olivier.
... View more
04-22-2015
02:03 AM
1 Karma
Hi splunkers,
I recently found a problem while logging in on one of my splunk instances.
Everything is ok with my Search Head, but logging in on the indexers is results in the error : ssl_error_rx_record_too_long
This logging was OK last week.
Any idea where I can find any logs (where is http server conf and log), or why I Get this error?
Alternatively, anybody can help me to find the file where https is enabled, so I Could disable it to let me log in on my indexer, then reenable it ?
Thank you.
Olivier.
... View more
02-25-2015
02:16 AM
Hi, I write this question in English to allow evry users to access it.
I get logs from Windows application installed on a french Windows system.
When Splunk indexes these logs, french caracters are displayed with there code not the caracter itself.
I Found that it should be du to the character encoding utf-8 instead of latin-1.
Does somedy knows where I can change this encoding and what should be the result over my splunk install ?
Thanks.
... View more
01-06-2015
01:16 AM
As jwalzerpitt said, you have to change the destination index in the app Set Up in the the manage section.
Olivier
... View more
01-06-2015
01:08 AM
Hi, on your SEPM server, install the universal forwarder
On this install,
Configure the file SplunkUniversalForwarder\etc\system\local to send data to your indexer(s) Mine look like this:
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 192.168.1.20:9997,192.168.1.21:9997
[tcpout-server://192.168.1.20:9997]
[tcpout-server://192.168.1.21:9997]
Then, for the Symantec part:
Copy the TA Under
$InstallPath\SplunkUniversalForwarder\etc\apps\TA-sepapp12
Rename the file TA-sepapp12\defaukt\inputs.conf.local to inputs.conf Modify
Then, modify your new inputs.conf to fit to your log directory on your SEPM files upon each monitor block (default directory in SEP12 for files is Symantec Endpoint Protection Manager\data\dump) Mine looks like this (be carefull of the index name, it must be the same that you define in the app configuration):
A default listener
[udp:516]
sourcetype=sep
Leave as sep; subsequent transforms will revise to correct sub-sourcetype. Anything
searchable with sourectype of sep is an error
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\scm_admin.tmp]
sourcetype = sep12:admin
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\agt_behavior.tmp]
sourcetype = sep12:behavior
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\scm_agent_act.tmp]
sourcetype = sep12:agt_system
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\scm_policy.tmp]
sourcetype = sep12:policy
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\scm_system.tmp]
sourcetype = sep12:system
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\agt_packet.tmp]
source = agt_packet.tmp
sourcetype = sep12:packet
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\agt_proactive.tmp]
sourcetype = sep12:proactive
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\agt_risk.tmp]
sourcetype = sep12:risk
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\agt_scan.tmp]
sourcetype = sep12:scan
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\agt_security.tmp]
sourcetype = sep12:ids
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\agt_system.tmp]
sourcetype = sep12:scm_system
index=symantec
[monitor://D:\Symantec Endpoint Protection Manager\data\dump\agt_traffic.tmp]
sourcetype = sep12:traffic
index=symantec
Cheers.
... View more
01-06-2015
12:47 AM
Hi, from witch app do you send your querry?
... View more
12-22-2014
12:54 AM
Hi, what is your Platform ?
If Linux, do you know if Xvfb X server, xauth, and base fonts are installed properly.
I had the same problem several years ago with splunk 4 and my problem was on the version of Xvfb .
Olivier.
... View more
12-22-2014
12:51 AM
Hi, if still applicable on december 2014
Can you post your search request please ?
Olivier.
... View more
Hi,
The only way I found to create pdf rendreing exactly what I want was to use Advanced XML.
By this way, It' possible to format page, but, it's not really possible to create a pdf document like a pdf editor.
If you are intersted, I can send you exemple of PDF generated with associated XML code.
Olivier.
... View more
12-19-2014
02:22 AM
1 Karma
Hi, I finally found the solution:
The stage when the add-on modifies the sourcetype is during the parsing process (through props.conf and transforms.conf).
Détails herre ==> http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Advancedsourcetypeoverrides
My architecture has a universal forwarder and the parsing process is done only on indexers or heavy forwarder. So my universal forwarder sets a sourcetype during he tparsing stage, then forwards data to the indexers that index without any transformations.
The solution in this case is
install universal forwarder on my Windows SEPM server
configure SEPM to export logs as files (instead of syslog)
modify input.conf.local with SEPM install path
Hope that helps.
Olivier
... View more
12-18-2014
04:32 AM
1 Karma
Hi, I've just set up the Splunk For Symantec App in my distributed architecture.
On the forwarder, set an inputs.conf listening on port TCP 514 and forwarding data to index Symantec with sourcetype sep12:log
tcp://X.X.X.X:514]
connection_host = ip
index=symantec
sourcetype = sep12:log
disabled = 0
On each indexer (2 indexers)
set the sep12 TA
On my Search Head, installed the app and configured it to read data in index symantec
When I received data from SEPM, the data are indexed in index Symantec with sourcetype sep12:log.
The app is looking for sourcetypes like sep12:agent or sep12:policy Etc ... as they are defined in Props.conf and transform.conf.
I think field extraction is not running as desired.
Has somebody tried to use this app in a distributed environment ?
Thank's a lot.
Olivier.
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-21-2023
08:39 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
