About RDAVISS

RDAVISS · ‎04-03-2020

I engaged splunk support and there was a code change around version 8.x that might have caused this to stop working. Once I have a workaround I will post it here.

RDAVISS · ‎03-26-2020

We double-checked the outputs and don't see any errors. The indexer is getting some events (e.g failed logins are showing up, just not the successful logins. ) I will take a look at the inputs again just to make sure there are no problems with our blacklisting. What's strange is the successful events aren't actually on the local search heads logs (/$SPLUNK_HOME/var/splunk/log/audit.log) That's why I leaning towards a change in functionality with the 8.0 release.

RDAVISS · ‎03-12-2020

I just noticed that our Redhat splunk servers are missing audit log data for users logging in to Splunk. For example, this query no longer returns data: index=_audit action="login attempt" "info=succeeded" I do have some audit data, just not the login attempts. The data seems to of stopped after upgrading to version >=8.0.0 I only have one windows splunk server, and ALL the audit data appears to be there.

RDAVISS · ‎02-01-2020

@oangarita I did not resolve it directly, I ended up migrating it to a different host that had a fresh install @pscsmoke Thanks for posting - maybe that will help someone else.

RDAVISS · ‎12-30-2019

I created a ticket with splunk support and they logged it as a defect with the latest version of DB connect. So a future release should resolve it. You can always revert to the previous version until then.

RDAVISS · ‎10-30-2019

First time user of DB connect here, we had the same problem on version 3.2 and reverted back to 3.1.4. The java path is now recognized (had to restart splunkd though.)

RDAVISS · ‎04-03-2019

Can anyone tell me where the "Destination app" can be set for a SourceType? When we try to change it in the GUI, we get a red circled restriction icon.

RDAVISS · ‎03-21-2019

I am trying to generate a new cert for my kv store to work properly (I am having this problem - https:// answers.splunk.com/answers/397029/kv-store-lookup-failing-with-error-about-kv-store.html) But when I attempt to generate a new cert it just returns the output below. Is there a log or something I can change to figure out what I am doing wrong? C:\Program Files\Splunk\bin>.\splunk createssl server-cert -l 1024 -d "C:\Program Files\Splunk\etc\auth\" -n server.pem -c {IP Address} Parameters: -d: Directory where rootCa and other certs are stored. (required) -n: The name of the cert. (required) -c: The CommonName for the cert. This should match the DNS name. If DNS is not available then the IP will suffice. -l: Length of the RSA key to generate (default 1024). -p: Prompt for optional arguments. Server 2012 running dev license splunk version 7.2.5

RDAVISS · ‎07-31-2017

We just installed the app and are getting data. However, we are seeing this error message: "message from "python /opt/splunk/etc/apps/duo_splunkapp/bin/duo_input.py" Failed to get endpoint logs, Admin API call failed" I don't think we subscribe to the service level that allows us to have endpoint logs. Is there a place to turn this off so we aren't generating an error every 2 minutes? R.J.

RDAVISS · ‎08-19-2016

That certainly makes sense, thanks for posting!

RDAVISS · ‎06-24-2016

I know this old but I had the same problem. I had configured the Windows TA inputs file vs the local inputs.conf and one host was eating up 15GB's of our license. I knew it was duplicating events because the same RecordNumber was showing hundreds of times. I wanted to comment on this so the solution is easier to find (the final comment was truncated on this thread.) To correct the problem I removed the "start_from = newest" parameter AND configured the local inputs.conf. Not sure which, or maybe both, caused the problem. Hope this saves someone else some time.

RDAVISS · ‎12-02-2015

I know this is old but I was hung up on the differences in syntax. Looks like hyper-v event logs don't use the commonly used forward slash but uses a dash instead. Example: Microsoft-Windows-Hyper-V-Hypervisor/Operational Microsoft-Windows-Hyper-V-Hypervisor/Admin VS Microsoft-Windows-Hyper-V-Hypervisor-Operational Microsoft-Windows-Hyper-V-Hypervisor-Admin This stanza works for me. I am using a universal forwarder on a remote machine. [WinEventLog://Microsoft-Windows-Hyper-V-Hypervisor-Operational] disabled = 0 Also, make sure there are actual event entries in the Admin; mine was zero and took me a minute to figure that one out.

Posts	12
Solutions	0
Karma Given	10
Karma Received	8
Member Since	‎05-06-2014

Online Status	Offline
Date Last Visited	‎11-03-2020 08:38 AM

Missing Audit logs

Can anyone tell me where the "Destination app" can...

createssl server-cert on windows server 2012 index...

Duo - Endpoint Logs

Re: Missing Audit logs

Re: Missing Audit logs

Missing Audit logs

Re: createssl server-cert on windows server 2012 i...

Re: DBConnect: OSError: [Errno 2] No such file or ...

Re: DBConnect: OSError: [Errno 2] No such file or ...

Can anyone tell me where the "Destination app" can...

createssl server-cert on windows server 2012 index...

Duo - Endpoint Logs

Re: I have Windows Universal Forwarder that is sen...

Re: I have Windows Universal Forwarder that is sen...

Re: Windows Analytic and Debug Events not showing ...