Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Michael_Carlisl
Michael_Carlisl
Explorer
Member since:
04-06-2016
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 04-06-2016 |
Activity Feed
- Got Karma for Re: How do you forward Tripwire log messages to Splunk Cloud?. 06-05-2020 12:48 AM
- Posted Re: Why am I unable to start Splunk Universal Forwarder after installing on Isilon/Linux? on Getting Data In. 10-03-2016 09:48 AM
- Posted Re: Why am I unable to start Splunk Universal Forwarder after installing on Isilon/Linux? on Getting Data In. 10-03-2016 09:15 AM
- Posted Splunk Cloud use static IP? on Splunk Cloud Platform. 09-30-2016 01:38 PM
- Tagged Splunk Cloud use static IP? on Splunk Cloud Platform. 09-30-2016 01:38 PM
- Posted Re: How do you forward Tripwire log messages to Splunk Cloud? on Deployment Architecture. 09-29-2016 09:20 AM
- Posted How do you forward Tripwire log messages to Splunk Cloud? on Deployment Architecture. 09-26-2016 10:16 AM
- Tagged How do you forward Tripwire log messages to Splunk Cloud? on Deployment Architecture. 09-26-2016 10:16 AM
- Tagged How do you forward Tripwire log messages to Splunk Cloud? on Deployment Architecture. 09-26-2016 10:16 AM
- Tagged How do you forward Tripwire log messages to Splunk Cloud? on Deployment Architecture. 09-26-2016 10:16 AM
- Tagged How do you forward Tripwire log messages to Splunk Cloud? on Deployment Architecture. 09-26-2016 10:16 AM
- Posted Re: Why am I unable to forward logs from a FreeBSD machine to our managed Splunk Cloud instance? on Getting Data In. 09-09-2016 07:41 AM
- Posted Why am I unable to forward logs from a FreeBSD machine to our managed Splunk Cloud instance? on Getting Data In. 09-07-2016 12:32 PM
- Tagged Why am I unable to forward logs from a FreeBSD machine to our managed Splunk Cloud instance? on Getting Data In. 09-07-2016 12:32 PM
- Tagged Why am I unable to forward logs from a FreeBSD machine to our managed Splunk Cloud instance? on Getting Data In. 09-07-2016 12:32 PM
- Tagged Why am I unable to forward logs from a FreeBSD machine to our managed Splunk Cloud instance? on Getting Data In. 09-07-2016 12:32 PM
- Tagged Why am I unable to forward logs from a FreeBSD machine to our managed Splunk Cloud instance? on Getting Data In. 09-07-2016 12:32 PM
- Tagged Why am I unable to forward logs from a FreeBSD machine to our managed Splunk Cloud instance? on Getting Data In. 09-07-2016 12:32 PM
- Posted Re: 'Invalid Key in Stanza' errors being generated at startup for inputs.conf whitelist on a 6.1.4 Heavy Forwarder that docs say should work on Getting Data In. 04-06-2016 12:50 PM
- Posted Re: 'Invalid Key in Stanza' errors being generated at startup for inputs.conf whitelist on a 6.1.4 Heavy Forwarder that docs say should work on Getting Data In. 04-06-2016 11:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-03-2016
09:48 AM
Ah Gotcha! I'm assuming you got the correct linux version for the forwarder? Once I ran tar xvzf on the .tgz file, I was able to run ./splunk commands.
... View more
10-03-2016
09:15 AM
Interesting that your splunk executable is not in /opt/Splunk/splunkforwarder/bin. Do you have a bin in SPLUNKHOME?
... View more
09-30-2016
01:38 PM
I've noticed that in our splunkd.log file it will time out using the FQDN that comes with our spl file. It eventually finds an IP address to connect to (although it shoots out a lot of warnings that it cannot connect at first) and everything works fine. We have a FreeBSD instance that is never able to forward using the FQDN, and ONLY works with the IP address. The problem is that the IP seems to not be static, so whenever that IP changes, our forwarder stops working. Has anyone seen this before or know of a solution?
Best,
Michael
... View more
- Tags:
- splunk-cloud
09-29-2016
09:20 AM
1 Karma
Ended up just setting the forwarder to pick up the Tripwire syslog...
https://answers.splunk.com/answers/72901/how-to-convert-a-splunk-universal-forwarder-in-intermediary-syslog-server.html
Best,
Michael
... View more
09-26-2016
10:16 AM
I'm trying to view/send Tripwire logs to my Splunk Cloud instance. There is an option in Tripwire to forward logs to a TCP host and port. I configured this to point to my Splunk instance, but cannot see the logs anywhere. Is there some special repository it goes into to view these logs? Do I need to do something extra (i.e. configure the Splunk forwarder to actually send the log files instead of Tripwire)?
Thanks!
Michael
... View more
09-09-2016
07:41 AM
So it turns out the spl file retrieved from the Splunk Cloud instance set Outputs.conf file in the splunkuniversalforwarder folder to a site it could not resolve. I updated that site to the ip equivalent and it started working. Not sure why this works in our non-unix environments.
... View more
09-07-2016
12:32 PM
Hi All,
I'm trying to forward logs from a FreeBSD machine to our Splunk Cloud instance. I've downloaded the spl file that is located within the site, but when I try to install the app, it is still not connecting. I validated that the port is open, and I have not done anything with the conf files other than using the CLI commands to add monitoring. One thing I did notice is that our Windows machines have (ssl) beside their "Active forwards" where as my "Inactive forwards" do not have (ssl) beside them. I had assumed the certificate was part of the .spl install. Any ideas?
Best,
Michael
... View more
04-06-2016
12:50 PM
I tested it in version 6.3.1. Sorry about putting "\". There's also an issue with [WinEventLog:Application] if you ever use the Citrix Add Ons and use their inputs.conf file.
... View more
04-06-2016
11:47 AM
So it seems that the issue is missing "\". If you update your inputs.conf file to be [WinEventLog://Security] it should work.
... View more
04-06-2016
11:16 AM
I'm hitting a 1067 error (process terminated unexpectedly) when starting the service. If I make the user a local admin or a domain admin, everything works fine. I don't want to do this for security reasons. Is there a way to just grant the rights the service account needs to get this service started?
Thanks!
Michael
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
