About haliakbar_splun

haliakbar_splun · ‎01-14-2021

Rather than deleting the Eventtype. Check the permission and see if it is set to global which most are by default. Change it to be within app and the search that runs will not use that Knowledge Object.

haliakbar_splun · ‎08-02-2017

If you have a monitor that you do not want to run. You need to add "-1" to the interval [WinRegMon] interval = -1 Within windows TA there are several scripts and monitors. You can add interval = -1 to them and it will run once and then it will stop. Then it will run once every time you restart splunk.

haliakbar_splun · ‎04-18-2017

Hi From what I am reading you are opening this within Windows. Please open a command prompt as administrator. Then run the command and you will get the results.

haliakbar_splun · ‎06-21-2016

Can you confirm that the summary search is running is using the # enable summary indexing action.summary_index = 1 or is the search using the search collect command? Can you paste the search if possible?

haliakbar_splun · ‎06-24-2015

Turn's out that the macro.conf is not pushed out via the bundle. Therefore it does not support distributed search. To temporarily fix the issue you need to change the eventtype "dfb_activity" search string dfbindex to index=dfb and then it will work. I have emailed the publisher to resolve the issue.

haliakbar_splun · ‎06-24-2015

The Splunk App for Dropbox for Business was installed on our indexer clustering environment and I am getting events. I see no error, but the dashboards do not populate.

haliakbar_splun · ‎03-05-2015

WAS 8.5 is not supported yet, but is on the road map for another release. Splunk app for JMX is another app that also works like WAS. https://apps.splunk.com/app/668/. The first release does not support all the fields, but the next release will support multiple fields with the same name in the same event.

haliakbar_splun · ‎12-17-2014

That is correct, upgrade does not install the latest version of Splunk_TA_windows, only new installs do. I have seen cases like yours and upgrading Splunk_TA to the latest version has resolve issues with High CPU/Mem. To find out what version you are on go to the etc/apps/splunk_TA_Windows/default/app.conf and look at the build. ex 4.6.3 = build 172675 4.7.1 = build 226229 latest 4.7.3 = build 237290 https://apps.splunk.com/app/742/

haliakbar_splun · ‎12-16-2014

Do you have Splunk_TA_Windows installed? If so check the version, if its old I would upgrade to 4.7.3

Posts	9
Solutions	3
Karma Given	18
Karma Received	17
Member Since	‎10-20-2014

Online Status	Offline
Date Last Visited	‎04-12-2021 03:07 PM

Why are the dashboards in the Splunk App for Dropb...

Re: Eventtype 'wg_traffic_allow' does not exist or...

Re: Splunk registry monitor (splunk-regmon) genera...

Re: Bit9 Security Platform: How to troubleshoot wh...

Re: What causes this scheduler failure? "Error in ...

Re: Why are the dashboards in the Splunk App for D...

Why are the dashboards in the Splunk App for Dropb...

Re: When will Splunk support Websphere Application...

Re: Why is an older Windows universal forwarder us...

Re: Splunkd using all memory after upgrade from 5 ...

Join the Conversation