About ssubhani

ssubhani · ‎11-29-2022

I was facing similar Problem and I had to comment the inputs (even though they were disabled). After commenting the inputs and restarting the Splunk service, issue was resolved, and the warning disappeared.

ssubhani · ‎10-12-2022

I am facing similar issue these days with many Servers as Splunk forwarder was installed on Template Server . I was not able to find guid in server.conf however there is surely an instance.cfg . What do you all recommend . Should I try below command OR just remove the instance.cfg file .However those cloned serves are getting wrong host name as well so I need to remove two things . $SPLUNK_HOME/bin/splunk clone-prep-clear-config

ssubhani · ‎07-26-2021

I saw this solution today after almost 4 years and it works for me too . However I do get a trailing dot OR a number before each . Original 7/26/2021 4:14:02 PM 1498 PACKET 0000020027AD4070 UDP Rcv 10.38.2.63 e92f Q [0001 D NOERROR] A (5)ctldl(13)windowsupdate(3)com(0) 7/26/2021 4:14:02 PM 1498 PACKET 000002002D51DCC0 UDP Rcv 10.34.23.50 7494 Q [0001 D NOERROR] A (5)ctldl(13)windowsupdate(3)com(0) 7/26/2021 4:14:02 PM 1498 PACKET 0000020024F70D10 UDP Rcv 10.38.5.167 30e6 Q [0001 D NOERROR] A (4)pypi(3)org(0) After applying Sedcmd ,notice the dot 7/26/2021 4:14:02 PM 1498 PACKET 0000020027AD4070 UDP Rcv 10.38.2.63 e92f Q [0001 D NOERROR] A .ctldl(13)windowsupdate.com. 7/26/2021 4:14:02 PM 1498 PACKET 000002002D51DCC0 UDP Rcv 10.34.23.50 7494 Q [0001 D NOERROR] A .ctldl(13)windowsupdate.com. 7/26/2021 4:14:02 PM 1498 PACKET 0000020024F70D10 UDP Rcv 10.38.5.167 30e6 Q [0001 D NOERROR] A .pypi.org.

ssubhani · ‎04-14-2021

Update ====== Earlier I had upgraded from 6.2.0 to 6.5.1 and then rolled back to 6.5.0 . I guess that caused some Problem . So I uninstalled the App and Add on from the Server . Installed them again from Scratch and Populated the data model from scratch . Now it is is showing perfectly .

ssubhani · ‎04-14-2021

This is a good suggestion and I was thinking about it . But I thought to try it here first .

ssubhani · ‎04-14-2021

Once PaloAlto firewall was upgraded to Version 9.1.6 , Our PaloAlto App Version 6.2.0 stopped showing the Global Protect logs . I Upgraded the Palo Alto Networks Add-on for Splunk and Palo Alto Networks App for Splunk to 6.5.0 . I installed the App+Add-on on Search Heads whereas I installed the Add-on on Indexers and Heavy Forwarders . All the dashboards under Operations are Working but The dashboard for GlobalProtect (PANOS >= 9.1) is not working at all . The App documentation does not mention on what changes were done for Global protect logs and what to do if you are unable to see it . Please note that data model pan_firewall is fully build and has data . All other data models are disable as we do not have those products . Any Ideas .

ssubhani · ‎02-17-2021

Thanks a lot . It really helped me as well . I was trying to do it with stats but tstats is much better .

ssubhani · ‎01-02-2017

Just a question though , the data in thaweddb is uncompressed whereas the data in frozen is compressed (Just a journal.gz file) so If I move the data from thaweddb to frozen ,will it be compressed after a while or not . Also , should I move or Copy . I was thinking to copy it and once finished ,delete all data in Thawed db. Please advise .

ssubhani · ‎10-18-2015

Hi I need help finding the Splunk sourcetype for the Symantec Brightmail Gateway 10.X. Syslog or sendmail_syslog is not working...pls share the sourcetype.

Posts	9
Solutions	1
Karma Given	6
Karma Received	4
Member Since	‎10-18-2015

Online Status	Offline
Date Last Visited	‎11-30-2022 12:59 AM

Global Protect Logs are not showing

What is the proper sourcetype for Symantec Brightm...

Re: Detected deprecated Threat Intelligence Manage...

Re: Duplicate GUIDs for cloned forwarders - how to...

Re: How to modify format of MS DNS server debug lo...

Re: Global Protect Logs are not showing

Re: Global Protect Logs are not showing

Global Protect Logs are not showing

Re: How to search a list of sourcetypes by index a...

Re: After Thawing Data, how do you "Re-Freeze" it?

What is the proper sourcetype for Symantec Brightm...

Are you a member of the Splunk Community?