Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Jeff_Lightly_Sp
Jeff_Lightly_Sp
Communicator
Member since:
03-18-2014
06-05-2020
Community Statistics
| Posts | 40 |
| Solutions | 4 |
| Karma Given | 83 |
| Karma Received | 36 |
| Member Since | 03-18-2014 |
Activity Feed
- Got Karma for Re: Search for a field not containing a specific pattern.. 07-02-2022 02:43 AM
- Got Karma for Re: How do I trigger the re-indexing of events from a locally collected Windows Event Log channel?. 04-01-2021 07:48 AM
- Karma HTTP Event Collector: Is there a working example with cURL on Windows? for fdarrigo. 06-05-2020 12:48 AM
- Karma Re: How to exclude equal values at the same field? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to search for two source types, each in different time ranges without using join or a subsearch? for gkanapathy. 06-05-2020 12:47 AM
- Karma Re: When should I use Report or Transform on props.conf? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: What happened to the IRC channel? for piebob. 06-05-2020 12:47 AM
- Karma Re: What is the compression ratio of raw data in Splunk? for strive. 06-05-2020 12:47 AM
- Karma Re: Splunk does not listen on specified port for piebob. 06-05-2020 12:47 AM
- Karma Re: Inputs.conf configuration to monitor 2 catalina log files in same directory with different formats and sourcetypes? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Why am I receiving 500 error on the dashboard configuring Splunk App for Unix and Linux? for araitz. 06-05-2020 12:47 AM
- Karma Re: How to measure vacation compliance issue without electronic PTO tracking? for Lucas_K. 06-05-2020 12:47 AM
- Karma Re: How to test REST calls by embedding a report? for barakreeves. 06-05-2020 12:47 AM
- Karma Re: If-statement does not work for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: reading an xml file in splunk for martin_mueller. 06-05-2020 12:47 AM
- Karma Google Maps not working after upgrade to 6.1.2 for jodros. 06-05-2020 12:47 AM
- Karma Re: Is there any way to manually load a Windows event log into Splunk? for barakreeves. 06-05-2020 12:47 AM
- Karma Re: Share a search for multiple widgets in a Dashboard for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: This script shows all servers with any RDC sessions open. i need it to just show me a specific username that is logged into any of the listed servers. Could someone help me? for richgalloway. 06-05-2020 12:47 AM
- Karma Re: How to get two universal forwarders running from one Linux box? for gkanapathy. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
02-23-2015
09:20 AM
I agree, HAL, I will do the upgrade as that needs done anyway. Thank you for the links, I'll keep those handy.
... View more
02-18-2015
05:39 AM
Yes, I've got ~20 other ADs in the same Server Class that are all 2012R2. For now I'm just terminating the batch file. I still get AD data - it just bypasses the 3 powershell scripts, ad-health.ps1,ad-repl-stat.ps1 and siteinfo.ps1. I'm guessing I can live with this until I upgrade the TA.
... View more
02-17-2015
01:56 PM
1 Karma
Was wondering "What the heck does hair9000 mean?". So, now I am enlightened AND off to my optometrist.
... View more
02-17-2015
01:03 PM
Still using TA-DomainController-NT6. Upgrading to the newer TA is on our to-do list.
I was initially told this was consuming disk space but after using Process Explorer, it is actually MEMORY being consumed. After the script runs for 5 minutes it will utilize nearly 3GB of Private Bytes and continue to grab more until the process is killed or the box becomes nearly unusable.
Sorry for that confusion but thanks for the Powershell technique harir9000.
I have changed the tags and title for this question.
... View more
02-17-2015
09:45 AM
Thanks hair9000, makes sense!
... View more
02-17-2015
09:36 AM
1 Karma
Running 6.1.3 on a 2012 AD server which is running the runpowershell.cmd script that contains the following line:
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -executionPolicy RemoteSigned -command ". '%SPLUNK_HOME%\etc\apps\%SplunkApp%\bin\powershell\%1'"
Looks like the %1 parameter being passed is ad-repl-stat.ps1.
If left to its own devices, this will consume ALL RAM.
Perusal of logs show nothing.
Exact script running on 20 other identical AD boxes without the excessive disk usage.
Anyone seen this type of behavior before? Any direction on where to look is appreciated.
... View more
01-08-2015
01:13 PM
2 Karma
I'm seeing them at: Program Files-SplunkUniversalForwarder-var-lib-splunk-modinputs-WinEventLog
... View more
12-04-2014
09:26 AM
When I first tried this, there was just the first date button visible. I selected a date, applied it, went out of the date range picker and went back in then the second date button was available. May be a bug but that worked for me.
... View more
11-05-2014
01:16 PM
1 Karma
Martin Mueller also recently posted a nice solution that may help you too. See:
http://answers.splunk.com/answers/183473/how-to-find-the-daily-average-of-indexed-data-by-h.html
... View more
11-05-2014
01:08 PM
3 Karma
Got to Settings-System-Licensing. Click on Usage Report button,select Previous 30 days tab and from the Split by tab Split by Host from the dropdown. This may show the offending host if its not lumped in with "Other".
... View more
10-28-2014
07:27 AM
Does this get close to what you need? i just used 'eventtype' as an example.
index=windows | stats count by user,eventtype | sort - user,eventtype | where count > 3 | top limit=3 eventtype by user
... View more
10-27-2014
02:09 PM
I do see some iplocation search references in SPLUNKD.LOG. Perhaps there are errors there? I do know that iplocation is now built in to Splunk (used to be a Python script) so that would make sense that it is there.
... View more
10-27-2014
12:44 PM
2 Karma
I can do this search:
index=firewall | iplocation src_ip and it returns values such as City & Country.
Be sure you are matching up the src_ip argument on iplocation with a valid field on your first search.
... View more
09-23-2014
01:59 PM
Ahh, I've tried that too and get the same results. Editing the dashboard and modifying the domain did no good. I'll keep looking too.
... View more
09-23-2014
01:43 PM
FWIW, my props and tranforms.conf are identical to yours and I'm not seeing that behavior. My REGEX experience is slight too but I don't think these examples are blacklisting. To clarify, you are looking at .conf's in the default folder but they could be superceded by conf's in the local folder..I'm just sayin'.
... View more
09-23-2014
12:52 PM
Could you provide some context please, such as use-case? Thanks
... View more
09-23-2014
12:20 PM
In my limited time using splunk, I've not seen an app automatically do blacklisting.
I've done blacklisting in inputs.conf like:
[WinEventLog://Security]
blacklist1 = EventCode=4662 Message="Object Type:\s+(?!groupPolicyContainer)"
... View more
09-23-2014
11:32 AM
Is your inputs.conf for the HF blacklisting this field?
... View more
09-23-2014
10:07 AM
3 Karma
This is a very generic error message. The first place I would look would be /splunk/var/log/splunk/web_service.log for further details.
... View more
09-19-2014
10:06 AM
Thanks for the flowchart link - this will come in handy!
... View more
09-19-2014
08:46 AM
I don't have data to test this right now but would usenull=f work?
chart count as Quantity by Time usenull=f span=1d
... View more
08-08-2014
08:35 AM
1 Karma
If possible, consider marking somesoni2's comment as an answer and accepting that answer. This will help others who may have similar issues in the future and it helps spread karma 🙂
... View more
08-05-2014
02:05 PM
3 Karma
Take a look at this excellent blog post:
http://blogs.splunk.com/2014/05/23/controlling-4662-messages-in-the-windows-security-event-log/
... View more
07-31-2014
01:50 PM
Didn't see (or at least comprehend) the words 'contain'. That certainly could matter!
... View more
07-31-2014
01:37 PM
3 Karma
How about:
Your_SourceType (FieldX=ABC AND FieldY!=123)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
