Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rgaleone1
rgaleone1
Path Finder
Member since:
06-06-2013
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 8 |
| Member Since | 06-06-2013 |
Activity Feed
- Got Karma for Does Splunk App for Enterprise Security support multi-site cluster architecture?. 11-25-2020 11:17 AM
- Got Karma for Does Splunk App for Enterprise Security support multi-site cluster architecture?. 06-05-2020 12:47 AM
- Got Karma for Does Splunk App for Enterprise Security support multi-site cluster architecture?. 06-05-2020 12:47 AM
- Got Karma for Does Splunk App for Enterprise Security support multi-site cluster architecture?. 06-05-2020 12:47 AM
- Karma What's the maximum data throughput per second can a single indexer handle? for jichen. 06-05-2020 12:46 AM
- Karma Re: Google Maps and Splunk 6 - limited results graphing. for howyagoin. 06-05-2020 12:46 AM
- Karma Re: FireEye App and Splunk version 6 for TonyLeeVT. 06-05-2020 12:46 AM
- Karma Re: Parallel data monitor/transmission - inputs.conf precedence for kristian_kolb. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk Add-on for Netflow Windows compatibility. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk Add-on for Netflow Windows compatibility. 06-05-2020 12:46 AM
- Got Karma for Re: Newb trying to use regex to extract fields. 06-05-2020 12:46 AM
- Got Karma for Re: Universal Forwarder - setting maxKBps via cli. 06-05-2020 12:46 AM
- Posted Is it possible to restrict index replication from specific sites? on Deployment Architecture. 04-20-2015 08:49 PM
- Tagged Is it possible to restrict index replication from specific sites? on Deployment Architecture. 04-20-2015 08:49 PM
- Tagged Is it possible to restrict index replication from specific sites? on Deployment Architecture. 04-20-2015 08:49 PM
- Posted I'd like to search on the decode output from the base64 command; could someone point me in that direction on All Apps and Add-ons. 03-13-2015 08:48 AM
- Tagged I'd like to search on the decode output from the base64 command; could someone point me in that direction on All Apps and Add-ons. 03-13-2015 08:48 AM
- Tagged I'd like to search on the decode output from the base64 command; could someone point me in that direction on All Apps and Add-ons. 03-13-2015 08:48 AM
- Tagged I'd like to search on the decode output from the base64 command; could someone point me in that direction on All Apps and Add-ons. 03-13-2015 08:48 AM
- Posted Does Splunk App for Enterprise Security support multi-site cluster architecture? on Splunk Enterprise Security. 08-05-2014 12:56 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-20-2015
08:49 PM
Environment with:
- 6 sites
- 4 sites with peer nodes
- 2 sites, 'alpha' and 'bravo' with only search heads
Is it possible to restrict index replication from occurring at sites 'alpha' and 'bravo'?
-OR-
Will this restriction occur automatically, due to sites 'alpha' and 'bravo' not having any peer nodes?
... View more
03-13-2015
08:48 AM
I am decoding fields and appending or replacing them in events. I would like to search on the newly appended or replaced values, but I am having difficulty forming the search. Has anyone gotten this to work? An example would be excellent.
... View more
08-05-2014
12:56 PM
4 Karma
Splunk documentation for the Enterprise Security App lists support for single-site cluster architectures. I am planning a large ES installation across multiple geographical locations and wanted to know if the ES app (latest version) was able to support a multi-site cluster architecture.
Source: Splunk Enterprise Security App Installation and Configuration Manual
... View more
03-20-2014
07:46 AM
Context:
When attempting to index a massive log (>30GB) I am not seeing Splunk log percent complete, status, or errors in the _internal index. I see the tailingprocessor adding watch on my path, but I never see an end log when/if the file indexing in complete.
Ask:
Is the _internal index the location I should be looking for errors/success/status logs?
... View more
- Tags:
- file-upload
- index
02-14-2014
08:18 AM
2 Karma
Jim -
This TA relies on NFDUMP tools to capture, and translate NetFlow off the wire, from binary data into flat files for indexing into Splunk. NFDUMP tools are only available for *nix systems at this time and I don't see them being ported to Windows anytime soon. This is out of the control of Splunk, but I would point you to NetFlow for Splunk powered by NetFlow Integrator. NetFlow Integrator is compatible with Windows, although I've never used it on a Windows box. A link to NFDUMP tools should you consider spinning up a *nix box.
Hope this helps.
[Edit]: Additional answers to similar questions.
... View more
12-18-2013
05:35 PM
1 Karma
mrjsnook -
Your question is tagged with a universalforwarder tag; so two solutions, depending on your deployment.
Small deployments, use sed (assuming you are using *nix) to read in the current value of maxKBps from limits.conf and update the value. Alternatively, use the large deployment solution.
Large deployments, create an app for specifically updating maxKBps in limits.conf and push the conf file out to the nodes which require the update.
Remember regardless of the path you choose, you must restart Splunk to enable configurations.
To verify values Splunk is reading from all limits.conf files use:
$SPLUNK_HOME/bin/splunk cmd btool limits list --debug
... View more
12-17-2013
10:17 AM
1 Karma
Yes, the Splunk Interactive Field Extractor is available in Splunk 5
Update for Spunk 5.x
Documentation here: Knowledge Users Manual and here: Extract fields interactively with IFX
You can change the documentation version (from 6.x to 5.x or w/e) in the upper right of the web page.
... View more
12-17-2013
10:11 AM
johnmackey -
Have you tried looking in to using the built-in Splunk Interactive Field Extractor?
Documentation here: Knowledge Users Manual and here: Extract fields interactively with IFX
... View more
12-17-2013
10:03 AM
Splunk:
Indexer <- series of tubes -> Forwarder
App:
fwdtosplunk/default/inputs.conf
[monitor:///path1/]
[monitor:///path2/]
Question:
Both path1 are path2 are large directories. Will the Forwarder need to completely send all data in path1 before beginning to sending data from path2?
... View more
12-03-2013
10:14 PM
Big Picture: I need to extract a time stamp from my data and pass it in a specific format in a URI GET request to a third party appliance. My issue arises with the format Splunk uses for _time.
Splunk: _time = 2013-12-03T00:46:32.000-05:00
I need: mytime= 2013-11-26T23:59:59-0500
Year-Month-DayT24Hour:Minute:Second-UTCoffset
I came up with a work around macro to get around the extraction and transformation issue. The macro I used is eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S%z"). Downside to using a macro is that it needs to be called at search time by the user. I'd like to use something transparent. I am asking the Splunk community for help. Can this extractions/transformation be done invisibly behind to scenes? Could I use transforms.conf and props.conf?
... View more
11-25-2013
11:12 AM
collins -
The output you posted does not appear to be XML. I didn't change anything with Splunk or FireEye after upgrading to Splunk 6 Enterprise.
Double check your FireEye appliance. Check the Server URL, Default Provider, and Provider Parameters. Reference http://apps.splunk.com/app/409/
... View more
11-25-2013
08:35 AM
Yes, I've been running the FireEye app on Splunk 6 since just after Splunk 6 was released.
... View more
11-04-2013
03:32 PM
I agree, its quite odd. I'll update later when I find more information.
... View more
11-04-2013
01:22 PM
Is it possible for Splunk to stop creating tsidx files? My Splunk instance was happily indexing and creating tsidx files, until something happened. I believe it to no longer be creating tsidx files, as I can no longer use the tstats command.
... View more
10-18-2013
11:07 AM
sunrise - Have you attempted to restart the splunkforwarder to which the apps are being downloaded?
... View more
10-18-2013
10:56 AM
gdavid - Are you asking if changing the default of 30 second down to say 15 seconds before switching indexes is good practice? I am confused what you mean about fail-over time, could you please clarify?
... View more
09-18-2013
10:11 AM
Have you installed the Palo Alto App?
... View more
09-18-2013
10:02 AM
I have a question about a query within the Palo Alto App. As shipped the app displays total traffic grouped by egress and ingress interfaces. I just want to see the total egress traffic and the total ingress traffic.
How would I modify the query below (from Palo Alto App) in order to show just total traffic out of the PAN?
"search">|tstats sum(bytes) As sb FROM pan_traffic where log_subtype=end $action$ $src_ip$ $dst_ip$ $dst_port$ $src_user$ $app$ groupby egress_interface | eval sumBytes = sb/(1024*1024) | stats values(sumBytes) AS MegaBytes engress_interface
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
