About mcweens

mcweens · ‎07-09-2021

We ended up routing this data to the HF instead of it going straight to splunk cloud. We heard that the approval process for an app to get accepted is painful and also apparently Splunk Cloud doesn't want you having inputs on your search head anyways (it had been there for like 3 years though before they said anything). Thanks!

mcweens · ‎07-09-2021

Hello, we use the AWS AddOn for Splunk for all of our AWS Inputs. For a few months, after many years of this showing correctly, we no longer see data under this search: sourcetype=aws:config:notification configurationItem.resourceType = AWS::S3::Bucket The thing is, nothing changed other than updates to the AWS AddOn. AND we still get data under here for every resourceType that I can think of EXCEPT S3, so the AWS side configuration and the inputs I have to assume are set fine. sourcetype=aws:config:notification I have looked over this in every facet I can think possible and have had a support case open for a while now. Any thoughts or similar cases? Thanks!

mcweens · ‎06-29-2021

Ok so I would just make an app that has altered transforms and props and then upload that? Just confusing because on a HF you would just alter the props and transforms for splunk.

mcweens · ‎06-29-2021

Hi all, So my Splunk architecture consists of just 1 Heavy Forwarder and Splunk Cloud. I have some logs that do not go through the HF (straight to Splunk Cloud) that I want to drop based on their IP and to do so was wanting to modify props and transforms on the Cloud (like you would do on a forwarder to drop logs). Support is telling me in order to do this I should make a custom app and modify props and transforms there and not giving me much more than that. Has anyone done something like this and what did you end up doing? Thanks!

mcweens · ‎05-08-2019

Note: I just noticed I also need to use this since we have Pipeline jobs: https://wiki.jenkins.io/display/JENKINS/Splunk+Plugin+for+Pipeline+Job+Support I need to have someone else install that and I will update this ticket when I get to try the addiontal plugin. I will note that for some reason the Connection Test is no longer working, the only change was Splunk Support making the HEC public facing.

mcweens · ‎05-07-2019

Hello, I know there are a few questions on there on this already, I have taken all the advice I can find from forums and documentation. I will try to provide lots of detail. I am trying to get Jenkins to send all logs to Splunk, I am trying to go straight to our Splunk Cloud instance (I could go to the HF first if that would make sense). Currently none of the Jenkins dashboards on the Splunk app are populating. Using the Jenkins Splunk Plugin (latest version) with no customization, I do get a successful connection test entering just the required parameters which I can see in Splunk search from the new HEC input I configured. 5/7/19 12:27:04.625 PM ping from jenkins plugin raw event ping host = xxxxxx source = http:jenkins sourcetype = httpevent From research I found that with the latest version of the Splunk Plugin on the Jenkins side that you do not need to customize any of the events or metadata and then everything will be sent. Here are some other things I could not find documented anywhere: - What are the indexes supposed to be on the HEC Input config? I originally had just main but then added all the Jenkins related ones, not sure how that is supposed to work.

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-12-2018

Online Status	Offline
Date Last Visited	‎12-06-2023 03:47 PM

awsAddOn sourcetype=aws:config:notification config...

Dropping Logs Sent Straight to Splunk Cloud

Jenkins to Splunk, Only Connection Test Success

Re: Dropping Logs Sent Straight to Splunk Cloud

awsAddOn sourcetype=aws:config:notification config...

Re: Dropping Logs Sent Straight to Splunk Cloud

Dropping Logs Sent Straight to Splunk Cloud

Re: Jenkins to Splunk, Only Connection Test Succes...

Jenkins to Splunk, Only Connection Test Success