Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rishrai
rishrai
New Member
Member since:
01-27-2015
06-05-2020
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-27-2015 |
Activity Feed
- Posted Re: Splunk Forwarder support by Splunk on Getting Data In. 11-19-2019 10:32 AM
- Posted Splunk Forwarder support by Splunk on Getting Data In. 11-19-2019 07:23 AM
- Tagged Splunk Forwarder support by Splunk on Getting Data In. 11-19-2019 07:23 AM
- Tagged Splunk Forwarder support by Splunk on Getting Data In. 11-19-2019 07:23 AM
- Posted Splunk Enterprise creating lookup in user folder on Splunk Dev. 04-08-2019 08:42 AM
- Tagged Splunk Enterprise creating lookup in user folder on Splunk Dev. 04-08-2019 08:42 AM
- Posted Re: Splunk Upgrade best methodology or approach for Enterprise and ES on Splunk Enterprise Security. 04-04-2019 02:42 PM
- Posted Splunk Infoblox data seggregation on All Apps and Add-ons. 03-07-2019 01:03 PM
- Tagged Splunk Infoblox data seggregation on All Apps and Add-ons. 03-07-2019 01:03 PM
- Tagged Splunk Infoblox data seggregation on All Apps and Add-ons. 03-07-2019 01:03 PM
- Posted Splunk Upgrade best methodology or approach for Enterprise and ES on Splunk Enterprise Security. 03-06-2019 07:28 PM
- Tagged Splunk Upgrade best methodology or approach for Enterprise and ES on Splunk Enterprise Security. 03-06-2019 07:28 PM
- Tagged Splunk Upgrade best methodology or approach for Enterprise and ES on Splunk Enterprise Security. 03-06-2019 07:28 PM
- Tagged Splunk Upgrade best methodology or approach for Enterprise and ES on Splunk Enterprise Security. 03-06-2019 07:28 PM
- Tagged Splunk Upgrade best methodology or approach for Enterprise and ES on Splunk Enterprise Security. 03-06-2019 07:28 PM
- Posted Re: How to parse windows data from wincollect (Qradar)? on All Apps and Add-ons. 12-06-2018 09:21 AM
- Posted How to parse windows data from wincollect (Qradar)? on All Apps and Add-ons. 12-05-2018 08:00 AM
- Tagged How to parse windows data from wincollect (Qradar)? on All Apps and Add-ons. 12-05-2018 08:00 AM
- Tagged How to parse windows data from wincollect (Qradar)? on All Apps and Add-ons. 12-05-2018 08:00 AM
- Tagged How to parse windows data from wincollect (Qradar)? on All Apps and Add-ons. 12-05-2018 08:00 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-19-2019
10:32 AM
Thanks... My questions was more towards Splunk able to provide support if in future the are issues. Keeping older version of Splunk forward will cover under Splunk Support policy?
... View more
11-19-2019
07:23 AM
Hi - We are upgrading Splunk to 7.2.8 since 7.0 is out of support. the Universal forwarders are not mentioned in the Splunk support page and refers only to the Splunk enterprise. Does the UF need to be upgraded to be covered under Splunk Support?
https://www.splunk.com/en_us/legal/splunk-software-support-policy.html
... View more
04-08-2019
08:42 AM
I received this error below when i created a lookup and want to change permission to not private. It looks like the splunk instance is creating lookups in user folder rather than the apps folder. What configuration change needs to be done to create a lookup in app folder than user foler (/opt/splunk/etc/users/admin/) ?
ERROR: Splunk could not update permissions for resource data/lookup-table-files [HTTP 500] Splunkd internal error; [{'code': None, 'type': 'ERROR', 'text': "\n In handler 'lookup-table-files': Data could not be written: /nobody/EXAMPLE_it_security/lookups/EXAMPLE_ip.csv: /opt/splunk/etc*/users*/admin/EXAMPLE_it_security/lookups/EXAMPLE_ip.csv"}]
Thanks,
Rish
... View more
- Tags:
- splunk-enterprise
04-04-2019
02:42 PM
Thanks! I will keep you posted once the upgrade is done and any lessons learnt.
... View more
03-07-2019
01:03 PM
There are two zones and infoblox versions are different in the environment as below. The issue is the data does not parse for Zone 2 correctly and the data gets logged as sourcetye infoblox:file, which leads to data not being segregated into DNS and DHCP source types respectively. The fields extractions do not work either as a result.
Zone1= 6.10
Zone2= 8.3.3
Is the add-on built for 8.3.3 version? What is the resolution to fix the issue?
RR
... View more
03-06-2019
07:28 PM
I am looking to upgrade the following and the approach below. My question is this upgrade optimal and will sustain? The storage, ram and cores are way below Splunk recommendation for SH. Will this effect performance?
Upgrade Splunk ES from 5.0.1 to 5.2.x (latest)
Upgrade Splunk servers from 7.0.x to 7.2.4.2 (latest)
1. Take backup of all SH and Indexers
2. Make a list of apps installed in SH and indexers, check for compatibility with 7.2.4.2
a. Identify splunk ES customizations, and document steps that needs to be configured post migration
3. Upgrade SHC https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/UpgradeaSHC
a. Perform a member-by-member upgrade
4. Upgrade Indexer cluster
5. Upgrade Splunk ES
Do you have any lessons learnt? Better method or documents?
-RR
... View more
12-06-2018
09:21 AM
Format is as below:
Dec 5 13:08:47 XXXXXXX AgentDevice=XXXXXXX AgentLogFile=XXXXXXX PluginVersion=7.2.8.91 Source=Microsoft-Windows-Security-Auditing Computer=XXXXXXX OriginatingComputer=XXXXXXX User= Domain= EventID=4728 EventIDCode=4728 EventType=8 EventCategory=13826 RecordNumber=XXXXXXX TimeGenerated=XXXXXXX TimeWritten=XXXXXXX Level=Log Always Keywords=Audit Success Task=XXXXXXX_ACCOUNTMANAGEMENT_SECURITYGROUP Opcode=Info Message=A member was added to a security-enabled global group. Subject: Security ID: XXXXXXX Account Name: XXXXXXX Account Domain: XXXXXXX Logon ID: XXXXXXX Member: Security ID: XXXXXXX Account Name: CN=XXXXXXX,OU=XXXXXXX,OU=XXXXXXX XXXXXXX XXXXXXX,OU=XXXXXXX,DC=XXXXXXX,DC=XXXXXXX,DC=XXXXXXX Group: Security ID: XXXXXXX Group Name: XXXXXXX Group Domain: XXXXXXX Additional Information: Privileges: -
... View more
12-05-2018
08:00 AM
Hi,
I have windows data coming into a Splunk instance from a specific domain "DC XYZ". The data from DC XYZ is sent from wincollect. So the format is different. Is there an app or has any solved this before. Installing Splunk Windows TA is not an option.
Fields extraction needs to be build for this format which is single line. is there a way to get the data from wincollect in XML format?
Is there an app built to parse windows data from Wincollect?
Thanks,
Rish
... View more
11-02-2017
07:37 AM
thanks for the response!
Currently Web access data and Audit data. I am want to onboard all data relevant to user activity , access, logon, logoff. How is data stored in tableau? is there a plugin to get the data generated from tableau?
... View more
11-01-2017
06:11 PM
I am looking to onboard data from Tableau into Splunk. has anyone performed this activity?
... View more
04-11-2017
08:22 AM
Hi Is this bug fixed? We have the same issue.
thanks,
Rish
... View more
03-31-2017
11:29 AM
Hi Can you let me know what is the name of the App that works from Splunk ES install folder? Thanks
... View more
07-20-2016
02:00 PM
I am looking to continuously update the asset list from CMDB. DB connect is installed in the heavy forwarder. i got the part of running dbquery in dbconnect to generate the lookup file. now how do i get the lookup file to the ES search head and place it in the SAidentity management? I am not familiar with rsync. Can you please explain more?
... View more
07-06-2016
08:44 AM
Hi,
I am implementing the Splunk Enterprise Security app. I have DNS logs which are in Solaris. I went through the DNS app for linux. Can I use the same app?
DNS logs will be brought in as syslog. There are three types of DNS logs queries: security and transfers.
I would appreciate if I could get some clarification as to how to bring in the data, what data is required for theES app, and make the ES app work? Also, do we need Stream app to be installed for the same?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
