About paola92

paola92 · ‎07-08-2021

The correct form to solve the issue without downgrade the app is using the bulk action. In the inputs tab click Bulk Actions and select create or edit and continue the process.

paola92 · ‎11-19-2019

Does anyone know how to do this integration?

paola92 · ‎11-01-2019

I have installed splunk forwarder for a windows servers and the service must be initialized when the server starts but some times the service doesn't start so I need to know how to see why the service doesn't start or how I must configure the service.

paola92 · ‎10-17-2019

The issue was solved when I put the timezone in the connection configuration.

paola92 · ‎10-17-2019

Hi, I integrated my firewall sonicwall using the guide for Dell Sonicwall Analytics and this applications is working fine and I see information but the Security Enterprise Application wasn't showing nothing so I modiffied some search and now I see information in Traffic Center but all is unknown. I think this is because the sonicwall logs has not action field so I need your help to show the information in Enterprise Security or some guide to integrated the firewall sonicwall with Enterprise Security Application. Thank you.

paola92 · ‎08-23-2019

Hi, Thank you for your response. I found that a firewall was blocking my splunk IP.

paola92 · ‎08-23-2019

Hi, I configured a new input for DB connect and specified used the column end_time for timestamp but when I received the events the timestamps has 5 hours minus like this: I need help!! Others two inputs works fine but the other that I created (5) has the same issue.

paola92 · ‎08-23-2019

Hi, I'm using the Web Monitoring application and now I have a URL that I'm sure that is responding but the response in the application is Connection timed out and the URL respond in 4 or 5 seconds How can I diagnostic what is happening?

paola92 · ‎10-02-2018

Hi, I have several errors related to KV Store as: -Failed to start KV Store process. See mongod.log and splunkd.log for details. -KV Store changed status to failed. KVStore process terminated. -KV Store process terminated abnormally (exit code 100, status exited with code 100). See mongod.log and splunkd.log for details. So when reviewing the mongod.log I see: Detected unclean shutdown - /home/dbindex/kvstore/mongo/mongod.lock is not empty. I STORAGE [initandlisten] I STORAGE [initandlisten] ** WARNING: Readahead for /home/dbindex/kvstore/mongo is set to 4096KB I STORAGE [initandlisten] ** We suggest setting it to 256KB (512 sectors) or less I STORAGE [initandlisten] ** http://dochub.mongodb.org/core/readahead I STORAGE [initandlisten] ************** old lock file: /home/dbindex/kvstore/mongo/mongod.lock. probably means unclean shutdown, but there are no journal files to recover. this is likely human error or filesystem corruption. please make sure that your journal directory is mounted. found 76 dbs. see: http://dochub.mongodb.org/core/repair for more information And, I tried to run the ./mongod --dbpath /DB/kvstore/mongo --repair and obtained the error: ./mongod: error while loading shared libraries: libssl.so.1.0.0: cannot open shared object file: No such file or directory So I need help to solve the problem!

paola92 · ‎06-01-2018

Hi, I have ES and Forescout Adaptive Response Add-on but I have not the alert actions and shows the alert.

paola92 · ‎05-28-2018

I install Forescout App and Add-ons for Splunk Enterprise Security but I receive a alert and the active alerts is not available.

paola92 · ‎01-31-2018

Hi, I'm using Security enterprise but the datamodels intrusion and malware are not working but if I use the app search I see results. Can anyone help me? I upload the result for the same search on different app.

paola92 · ‎09-12-2017

Hi, I want to install Forescout app in my splunk enterprise 6.6 but I see in base splunk that it is compatible but in the documentation https://www.forescout.com/wp-content/uploads/2016/11/ForeScout-App-Splunk-2.5-Guide.pdf I see that is compatible only with version 6.4 and 6.5 so does anyone know if it supports version 6.6?

paola92 · ‎03-14-2017

I disable all inputs but I do not see logs but if I realized a capture with tcpdump i see that the packets is getting in the server.

paola92 · ‎03-13-2017

But if I disable all inputs I will received logs of the other forwarders?

paola92 · ‎03-13-2017

I have a single instance in CentOS 7 and I am interested in receiving and analyzing logs of my Linux server. But when I installed the Splunk App for Unix and Linux in my single instance, I exceeded my license because I received all logs of my Splunk. So I need to know, how to ignore the logs of my single instance Splunk?

paola92 · ‎01-24-2017

I tried to retrieve assets information of ldap so I used the search (I know that I must not to use search nt_host...) "|ldapsearch domain=XXX search="(&(objectClass=computer))" |eval city="" |eval country="" |eval priority="medium" |eval category="normal" |eval dns=dNSHostName |eval owner=managedBy |rex field=sAMAccountName mode=sed "s/\$//g" |eval nt_host=sAMAccountName |search nt_host=segurinfo |makemv delim="," dn |rex field=dn "(OU|CN)\=(?.+)" |table Source_Address,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av" and I have the table but I the IP is not because I do not use static IP so I think is possible to use the security logs that I have but I do not how can i correlate it. I used the next search for nt_host=segurinfo: index="wineventlog" Workstation_Name=segurinfo and I see in the logs the information that I need.

paola92 · ‎10-20-2016

The configuration in the splunk web is the same in the space of File or Directory or can I put C:\Users\paola.sarmiento\Documents\CFA-Splunk\Log\?

paola92 · ‎10-19-2016

The files are XML for example a file has the name LogSwitchLight09-05-2016.txt and the initial line is: 001250 20160905 and other file is LogSwitchLight09-29-2016 and the initial line is: 001179 20160929 I have a inputs.conf in the path: C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local and the text is: [monitor://C:\Users\paola.sarmiento\Documents\CFA-Splunk\Log\] disabled = false recursive = true index=main

paola92 · ‎10-19-2016

Hi, I have a search head and I need to monitor a folder that has a text file in which every day there is a new file. I configured the Splunk forwarder on the host and configured Splunk for monitoring the folder, but I only receive one file and it never shows more. What must I configure to receive the rest of files?

Posts	22
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎09-07-2015

Online Status	Offline
Date Last Visited	‎08-18-2021 11:56 AM

Does not start splunk forwarder service

Sonicwall data Enterprise Security

Bad timestamp DB Connect

Connection timed out web monitoring with a site up

Can you help me with the following KV Store error:...

Why do I have error with ForeScout Adaptative Resp...

Why are the data models intrusion and malware only...

Forescout compatibility with Splunk v6.6

Splunk App for Unix and Linux: How to ignore the l...

Splunk Enterprise Security: How to retrieve ldap a...

Re: DBConnect 3.1.4 Input

Re: How to monitor Oracle Service Bus Console 12.c...

Does not start splunk forwarder service

Re: Bad timestamp DB Connect

Sonicwall data Enterprise Security

Re: Connection timed out web monitoring with a sit...