Hello friends! i hope you guys can help me. I have installed UF on windows server but i need to know the following: Is the installation per session? What happens if the user who made the installation is removed? Will it be necessary to have a dedicated user? Thank for your help ... View more

Hello Splunkers. I am in doubt i hope you can help me, i just updated my Splunk to version 7.2.6, and suddenly the alert email stopped sending empty reports. I need to recieve the reports even if they're empy. what can i do to resolve this issue? Thanks ... View more

Hello Splunkers! i'm in doubt, i have installed UF on windows server but when i list forward-server it says that there are no active fordware but is configurated, on port 9997 and also de deploy with 8088. What issue do you think it is? is there a way to active the forwarder? Thanks ... View more

Hello Splunkers! I have a question, i really need to monitor etc/shadow file and be able to read the information about password´s users. i have the follow script that i loaded in splunk but it does not showing the information i think that root password needed to be indexed, is there a way to read this file in splunk without root password? script: "account in $(cut -f1 -d: /etc/passwd); do echo "ACCOUNT: $account , EXPIRES: chage -l $account | grep 'Account expires' | awk '{print $4, $5, $6}' , CHANGED: chage -l $account | grep 'Last password change' | awk '{print $5, $6, $7}' "; done" ... View more

Hello Splunkers! I really need your help, is there a way to know the antiquity of user passwords in Linux / Unix / AIX OS on Splunk? and what can i do to recieve this kind of logs and how to see it on Splunk? Thanks ... View more

Hello Splunkers i have a question for you. i hope you really help me! I need to integrate tripwire and splunk by downloading the add on for splunk, what do i need to do? is there a manual to do that? thank you ... View more

Hello Splunkers How can i see logs from tripwire on Splunk using Syslog port 514? ... View more

Hello friend, I've got the next issue trying to run ./splunk start or status. How can i fix it? i think it is a user permission issue. [root@cerr500810 bin]# ./splunk start Warning: cannot create "/monitoreo/splunk/var/log/splunk" Warning: cannot create "/monitoreo/splunk/var/log/introspection" Pid file "/monitoreo/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/Splunk_TA_nix/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/TA-tripwire_enterprise/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/launcher/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/lookup_editor/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/search/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/splunk_instrumentation/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/system/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/learned/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/Splunk_TA_nix/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/TA-tripwire_enterprise/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/launcher/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/lookup_editor/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/search/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/splunk_instrumentation/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/system/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/learned/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/Splunk_TA_nix/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/TA-tripwire_enterprise/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/launcher/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/lookup_editor/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/search/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/splunk_instrumentation/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/system/metadata/local.meta: Permission denied Cannot initialize: /monitoreo/splunk/etc/apps/learned/metadata/local.meta: Permission denied Pid file "/monitoreo/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied Pid file "/monitoreo/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied ... View more

Hello Splunkers, I need your help once again. Is there a way to restart Splunk automatically when it goes down? Unfortunately, we don't have permission to use CRON, but we are making a test with a shell (.sh) into the server to call the "./splunk restart" command, but it doesn't work for itself. I need to put manually the shell using " sh XXX.sh" command. Thanks for your help ... View more

Hello splunkers, I need your help. I have an alert about a bucket on my Splunk. This it the message that I have: "The percentage of small of buckets created (50) over the last hour is very high and exceeded the yellow thresholds (30) for index=_internal, and possibly more indexes, on this indexer" What does it mean, and how can i fix it? ... View more