About nmensah

nmensah · ‎03-01-2019

Was this issue ever resolved? We are experiencing a similar problem.

nmensah · ‎07-27-2018

Do you have your Splunk management port open to manage Splunk forwarders. If so what's the risk you are accepting and what compensating controls do you have in place to reduce the risk?

nmensah · ‎05-22-2018

Thank you! I realized that after making the corrections, I just needed to restart the Splunk service for the deployment server and everything updated. I'm no longer seeing Mac devices in Windows server classes.

nmensah · ‎05-21-2018

Hello everyone. I am managing Windows and Mac devices via the Splunk DMC. Because of an error I made in the Splunk Server Class whitelist policy, some of the Mac devices received the Windows Apps to forward logs to a Windows index. I have corrected the whitelist IP policy, but what's the best way to remove the Mac device from the wrong server classes since it's still showing up? Do I just want to just log into the Mac devices and delete the wrong Apps?

nmensah · ‎12-16-2016

SSL Question: What is the difference between TcpOutputProc and TcpOutputFd? I am getting an error message on my forwarder saying TcpOutputFD - Connection to host ip:port failed. On the flip side, I am getting a confirmation message on the forwarder saying TcpOutputProc - Connected to idx ip:port. These are the exact same ip address and ports. I am getting all the logs that I should be on the index server but I'm not sure why I'm getting this error message on the forwarder. This is all from the Splunkd logs.

nmensah · ‎11-18-2016

Thank you for the answer. So does this mean that if I change the initial password on the deployment server or indexer, I don't need to drop the user-seed.conf file in the forwarder?

nmensah · ‎11-18-2016

Thank you everyone! It worked out perfectly! I used this document to create the app that would allow the deployment server to tell the Forwarder which data to collect and which index to send it to: http://docs.splunk.com/Documentation/Splunk/6.5.0/Updating/Extendedexampledeployseveralstandardforwarders

nmensah · ‎11-17-2016

I'm a bit confused about the user-seed.conf. Based on the documentation provided by Splunk, it seems this is to set up the initial password. Does this apply to Splunk universal forwarders? I am using the Splunk Enterprise version, and when I got to log into the web portion, I do change the default admin password. Do I still need to create a user-seed.conf file and then drop different credentials in there? Splunk doesn't really provide a good context for what this is used for in my opinion. Here is the documentation I looked at: https://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/User-seedconf Thanks in advance!

nmensah · ‎11-16-2016

Thank you everyone very much for the help. This worked great. One issue though. When configure the deployment server app and the forwarder receives the configurations, how long does it take for the configuration to go into effect on the forwarder? Do I need to manually restart the forwarder every time?

nmensah · ‎11-15-2016

Hello everyone, I have in theory a very simple question. Hopefully this is as simple as I think it is. I have a deployment server and a Universal Forwarder (UF). I also have an indexer and search head. My question is, how do I configure my deployment server to have the UF forward all logs to a certain index? I have the server class and "apps" folder set up but do I drop a config file in there or what? I can't find any good documentation. Thank you so much!

nmensah · ‎03-14-2016

Hello everyone. I'm just trying to get a ball park estimate here. Granted everything is set to default, what do you think is the general log file size for the following logs: Window 2012 Server log size: Unix Server log size: ESX log size:

Posts	11
Solutions	0
Karma Given	13
Karma Received	4
Member Since	‎03-14-2016

Online Status	Offline
Date Last Visited	‎10-29-2020 05:42 PM

Are You Using the Splunk Management Port?

How Do I Remove Device From Splunk Server Class?

What is the difference between TcpOutputProc and T...

What is the user-seed.conf file?

How do I configure the Deployment Server to have a...

What's the average size for a log file?

Re: Palo Alto Dashboard (URL Filtering) not popula...