About mgalos

mgalos · ‎01-22-2019

I will have to look over this script and give it a try. It looks interesting though. is it basically searching indexes for compatible sourcetypes, datamodels, contentupdate, and CIM?

mgalos · ‎01-22-2019

I am using Splunk TA apps for nix, windows, and added one for cisco. The syslog for nix Is rfc5424 for most logs and basic winevent logs. I will definitely take a look through the tags though and see if I can discover any discrepencies. I assume there is something I'm not enabling or configuring correctly but the documentation isn't very particular about the features.

mgalos · ‎01-21-2019

I am trying to use Splunk ES searches and summaries but i'm not sure where to start or what logs are required. My main issues are with the Splunk Domains and Splunk intelligence. I had initially assumed that ingesting the basic win event logs, linux syslog, and cisco ios snmp should be enough data to populate most of the fields making it work out of the box, but it seems that I must be missing something. I have mostly set up the assets and identities (though our AD objects aren't sorted by business unit, priority, or category making it pretty useless). Have I missed a step in configuring ES, or is there more granular documentation/walkthrough about what logs and data it needs to work properly? I have looked through the ES install and admin guide and am still left with many questions.

mgalos · ‎12-03-2018

I am not sure which Splunk ES related apps go where. My deployment looks like the following: Splunk universal forwarder (windows/linux/) + syslog ===> 2 Heavy Forwarders =====> 2 Indexers ======> 1 search head/master I deployed the OS related TA app on the UF and the ES app config on the search head/mater. I am not sure where any of the SA or DA files need to go in addition to this. Do i need to copy the app files into the indexers as well?

mgalos · ‎10-03-2018

After a lot of digging I would have to agree that its easier to manipulate the logs on the receiving syslog end than it is trying to format them from the forwarder. I ended up switching to syslog-ng instead of rsyslog.

mgalos · ‎09-26-2018

I am trying to aggregate our windows and Linux logs from universal forwarders to a heavy forwarder, finally, to our internal Splunk indexer as well as to a third-party syslog server. I was able to split up the routing and ports to enable logs to go where they need to (_TCP_ROUTING and _SYSLOG_ROUTING), but the syslog server receives the windows event logs as multiple events (each key value seems to get its own line). How can I use props.conf/transforms.conf to parse only the data being forwarded from the windows port on the heavy forwarder to the windows syslog port? -windows universal forwarder is using [WinEventLog://Security] in inputs.conf and [tcpout://server:] -heavy forwarder is using inputs.conf [splunktcp://] configure_host = dns _TCP_ROUTING = WindowsTCP _SYSLOG_ROUTING = WindowsSyslog outputs.conf [syslog] defaultGroup = WindowsSyslog [syslog:WindowsSyslog] server = syslogserver:514 type = tcp -receiving Linux server is using rsyslog port 514/tcp.

mgalos · ‎09-21-2018

Thanks for the response! Adding the index= directly to the universal forwarder instead of only on the indexer worked for me.

mgalos · ‎09-20-2018

So my issue is that I am not sure how to get Splunk to separate data on the indexer. I am trying to listen on the forwarder port 514 (for Linux syslog) and 6161 (for windows event logs), I use _tcp_routing to send it to a tcpout targetgroup associated with the indexer ports 9997, and 9998. which allows me to have a splunktcp:// index= for each port. Am I doing this all wrong, and how can I get Splunk to separate the windows and Linux logs into two different indexes? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Forwarder: fwd inputs.conf- [scripts://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled=0 [tcp://514] _TCP_ROUTING=Linux [tcp://6161] _TCP_ROUTING=Windows ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fwd outputs.conf - [tcpout] defaultGroup=Windows, Linux [tcpout:Windows] server=(server ip):9997 [tcpout:Linux] server=(server ip):9998 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ indexer: index inputs.conf - [default] host = somehost1 [tcp://9997] index=windowseventlogs connection_host=dns [tcp://9998] index=linuxauditlogs connection_host=dns

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎09-20-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Enable All Splunk Enterprise Security Features

How do I configure Splunk Enterprise Security in a...

Converting Windows Event Log to rsyslog format

From a Heavy Forwarder to an Indexer, how can I ge...

Re: Enable All Splunk Enterprise Security Features

Re: Enable All Splunk Enterprise Security Features

Enable All Splunk Enterprise Security Features

How do I configure Splunk Enterprise Security in a...

Re: Converting Windows Event Log to rsyslog format

Converting Windows Event Log to rsyslog format

Re: From a Heavy Forwarder to an Indexer, how can ...

From a Heavy Forwarder to an Indexer, how can I ge...