About Hudond

Hudond · ‎06-13-2023

Thank you for the information, but as you mentioned you are not a PS-expert, I have to also admit I am not well versed in scripting either. But I would appreciate some guidance, if you could, allowing me an opportunity to learn a little more about it. You mentioned "whereas if you call the cmdlet directly" and "write a script iterating over the results of Get-IISSite and printing interesting properties" Could you provide a short sample of what that would look like so that I could review? I am uncertain what you meant when you wrote write the cmdlet directly?

Hudond · ‎06-12-2023

Good afternoon I was able to come up with the following process but I am having difficulty figuring out one issue. I added the following powershell scriot to the inputs.conf file on the IIS server that send the data to the index on the indexer. [powershell://IISSites] script = Get-IISSite schedule = 0 0 0 * * ? source = powershell sourcetype = custom-sourcetype index=Index-Name When observing the index entries I am seeing the data I need with the following exception for the bindings field: the binding entry seems to have one of the bindings listed from script but the remainders are all identified as System.Object[] and that I must admit has me stumped. When I run the powershell script on the IIS server it gives me all the data I am interested in without issue. It is just when running it in splunk that I see the System.Object[] in the index. Thank you for any guidance you can provide.

Hudond · ‎06-09-2023

Hello Giuseppe I have been given permission to share the following scrubbed information. I did review the web analytics app but found that it did not meet the requirements for other thing we needed. We used to use the Windows infrastructure application before we transitioned to ITE works. But I did not think of that, I will review our old information we had. I did consider using powershell as a possibility but I am still researching that approach. Thank you ----------------- #Software: Microsoft Internet Information Services 10.0 #Version: 1.0 #Date: 2023-06-07 03:01:03 #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status time-taken https 2023-06-07 03:01:00 W3SVC2 ServerNameHere 0.0.0.0 GET / - 80 - 0.0.0.0 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - - SiteNameHere 303 0 0 1421 off 2023-06-07 03:01:00 W3SVC2 ServerNameHere 0.0.0.0 GET / - 80 - 0.0.0.0 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - - SiteNameHere 303 0 0 0 off 2023-06-07 03:01:03 W3SVC2 ServerNameHere 0.0.0.0 GET / - 80 - 0.0.0.0 HTTP/1.1 - - - SiteNameHere 303 0 0 0 off 2023-06-07 03:02:51 W3SVC2 ServerNameHere 0.0.0.0 GET / - 80 - 0.0.0.0 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - - SiteNameHere 303 0 0 0 off 2023-06-07 03:02:51 W3SVC2 ServerNameHere 0.0.0.0 GET / - 80 - 0.0.0.0 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - - SiteNameHere 303 0 64 0 off 2023-06-07 03:02:51 W3SVC2 ServerNameHere 0.0.0.0 GET / - 80 - 0.0.0.0 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - - SiteNameHere 303 0 0 0 off

Hudond · ‎06-09-2023

Thank you, I was not 100% certain of that point but you did clarify it for me.

Hudond · ‎06-08-2023

Hello We currently have multiple IIS servers with multiple websites and our goal is to setup a dashboard “overview” panel with a list of the following in a table format: - servers names with IP addresses - websites installed on the servers - status of the website (up or down) -apppool used by the website and its status (running or not) -IIS bindings for each website we have installed the the Splunk Windows IIS addon and data is being imported into the index using the ms:iis:auto sourcetype I am struggling to find information how best to setup the panel and what the best search query to use or approach is for something like this. Any advice / information on best approaches would be appreciated at least to get us started, In order to learn how best to proceed. Thank you

Hudond · ‎02-15-2023

Good Afternoon I wanted to reach out to the community for some assistance/clarification on the best approach to change a search head with 2 index peers to a new windows server? We currently have one search head acting as the license master with two index peers that it is connected to. The search head server is being decommissioned so I will need to swap out the search head and license master to the new server. Is there a recommended best approach to this? I found the following information: How to migrate When you migrate on *nix systems, you can extract the tar file you downloaded directly over the copied files on the new system, or use your package manager to upgrade using the downloaded package. On Windows systems, the installer updates the Splunk files automatically. Stop Splunk Enterprise services on the host from which you want to migrate. Copy the entire contents of the $SPLUNK_HOME directory from the old host to the new host. Copying this directory also copies the mongo subdirectory. Install Splunk Enterprise on the new host. Verify that the index configuration (indexes.conf) file's volume, sizing, and path settings are still valid on the new host. Start Splunk Enterprise on the new instance. Log into Splunk Enterprise with your existing credentials. After you log in, confirm that your data is intact by searching it. here: https://docs.splunk.com/Documentation/Splunk/7.2.3/Installation/MigrateaSplunkinstance?_ga=2.79344788.1455755630.1676483895-73379229.1676483895&_gl=1*xs5dk1*_ga*NzMzNzkyMjkuMTY3NjQ4Mzg5NQ..*_ga_5EPM2P39FV*MTY3NjQ4Mzg5NS4xLjEuMTY3NjQ4NDUzNi4yOC4wLjA. But this seems a little to simple. I am unable to keep the same server name and IP address that the search head has now. So that got me thinking this maybe simple but I just wanted to ensure I am not missing a critical step. Thank you Dan

Hudond · ‎08-12-2022

Good afternoon I am uncertain which location to post this kind of question. We are currently using Splunk IT essentials work to monitor some windows servers in our environment only. under the infrastructure overview tab there is an option to activate hiding empty entity types. By default it is off, is there a way to change this to on by default? See attached screen shot for clarification. Thank you

Hudond · ‎08-09-2022

Good Morning The only reference I could find to assist in avoiding performance issues was the following entry in the ITE Integrations manual, by disabling saved searches.

Hudond · ‎01-19-2022

Hello I have a question about installing and configuring IT Essentials Works 4.11.3 and removing some of the out of the box functions in a windows environment. History: We currently have Splunk running on a windows 2012 server that is being decommissioned. So we are looking at moving it to a new MS 2019 server. One of the apps we used in the past was Windows add on infrastructure and we noticed that it has been "decommissioned" for lack of a better word and replaced with IT essentials works. We noticed after installing the add-on there were many functions that out of the box we will never need, eg: VMWare, Nix, etc.... We wish to focus on the Windows components of IT essentials and remove the rest. Because of the many components of IT essentials ( eg: DA_ITSI_EUEM.... DA_ITSI_LB.... SA_ITSI_ATSA.... etc) It is unclear what is the best approach to remove the unnecessary components. We were unable to find any data online or in the answers as to how to best approach this. Any information that can be provided would be beneficial Thank you Dan Is there anyone that has edited the IT essentials add on to use just what they need and remove the unnecessary components for efficiency?

Hudond · ‎02-17-2021

Thank you for the information that worked so in this case it was best to use lookup not inputlookup, need to review the difference use case scenarios

Hudond · ‎02-17-2021

Good Morning As I am new to Splunk, sometimes I need to try things that are beyond my comprehension at this time. This is one of those cases: I have the following search that lists the hosts with system information: index="index1" OR index="index2" sourcetype=WinHostMon (source=operatingsystem os="*" TotalPhysicalMemoryKB="*") OR (source=processor NumberOfProcessors="*") OR (source=disk DriveType=fixed TotalSpaceKB) | eval RAM = round (((TotalPhysicalMemoryKB)/1000000),1) | eval DiskSpace = round (((TotalSpaceKB)/1000000),1) | stats values(os) as OS, values(NumberOfProcessors) as CPU, values(RAM) as "RAM (GB)", values(DiskSpace) as TotalDiskSpace by host | eventstats sum(TotalDiskSpace) as "LogicalDiskSpace (GB)" by host | table host, OS, CPU, "RAM (GB)", "LogicalDiskSpace (GB)" ==================================================== I need to add an inputlookup command to display other fields associated to each host that is displayed in the search above. I have setup the input lookup table and the definition and I am able to run the lookup and extract the fields i need. | inputlookup otherinfo.csv host field1 field2 field3 The difficult part that I have been struggling with is trying to add that step into the search above. Any guidance or information that can be provided to help me learn would be appreciated. Thank you

Hudond · ‎02-10-2021

Thank you Giuseppe, that helped lead me in the right direction.

Hudond · ‎02-06-2021

Hello I wanted to request some assistance with the topic of combining different searches from the same index and same sourcetype but different sources into a table or report even. I struggle with the concept of combining them. I have researched joins, stats, charts etc. but I am trying to implement them and am getting errors for which I am missing a point making me unsure of how to combine effectively to get the results I need. So any guidance or information that may assist me to learn properly would be very helpful. I have the following separate searches that give me the results I need: ==================================== Storage index="SRV" sourcetype=WinHostMon source=disk DriveType=fixed TotalSpaceKB="*" | eval TotalSpaceKB = round (TotalSpaceKB/100000000) | stats sum(TotalSpaceKB) as "TotalSpace (GB)" by host OS index="SRV" sourcetype=WinHostMon source=operatingsystem os="*" | dedup host | table host os CPU index="SRV" sourcetype=WinHostMon source=processor NumberOfProcessors="*" | dedup host | table host NumberOfProcessors Memory index="SRV" sourcetype=WinHostMon source=operatingsystem TotalPhysicalMemoryKB="*" | dedup host | eval "TotalPhysicalMemory (GB)" = round (((TotalPhysicalMemoryKB)/1000000),1) | table host "TotalPhysicalMemory (GB)" ============================= My end goal is to provide a single table or report with the following columns Host, OS, Number of Processors, total physical memory, total storage Thank you Dan

Hudond · ‎11-02-2020

Good afternoon I have a question about identifying the type of environment the servers are in by their hostnames being extracted using the Microsoft-add on for splunk. The server hostnames are being indexed as follows: servername"DV" servername"TV" Servername"DV"serverName Servername"TV"servername So server names that have the DV and TV designations are identified as belonging to the development and test environments. Sometimes the characters are at the end and sometimes they are in the middle of the server names. I am looking at running a search that will identify the hostname as being in the development or test environments and adding that as a column to the search results fro the hostnames. If the hostname does not have those designations I would like to identify them as "other" I would appreciate any guidance of the best approach to use for the search string, that way I can research it and learn how to do it. Thank you Dan

Hudond · ‎06-15-2020

Good Afternoon I am fairly new to splunk and I am trying to figure out the best way to approach this. I am running the windows TA add on to monitor systems on a small number of servers. I would like to monitor those servers that could have resource limitations that present with % _total Processor times of greater than 80% within a 24 hour period but with a sustained timing of 5 mins or more. It is that 5 min window that I am getting caught on. Most, if not all servers will present with more than 80% processor times for spurts during use a min or less but it is the sustained processor times that I want to try and capture that could indicate a resource issue. Any advise or guidance on a good approach to try and capture that information would be appreciated. Thank you

Hudond · ‎05-27-2020

Good Afternoon We are looking at a pilot project to use Splunk to help manage our desktop inventory using the Microsoft_windows_TA add-on and a universal forwarder installed on the desktops. The only information we will be extracting at this time is the Windows host information: System Name, OS, IP address, and logged-on user. We are wondering how we can set up the universal forwarders on the desktops so that when they phone home to the deployment server, and we access the forwarder management page under settings (Settings>forwarder Management), we can segregate the desktops from the universal forwarders currently on the servers, if this is possible that is? Just wondering if there was an easy way to do this so there are not pages and pages of desktops and servers phoning home making it hard to separate the two when accessing the forwarder management page. We are a small shop therefore no clustering. Any guidance would be appreciated. Thank you

Hudond · ‎04-28-2020

Good Morning Not sure if this is an answerable question. I am investigating using the Splunkbase "Splunk App for Windows Infrastructure" to gather resource information from our servers for management purposes. I like the interface and it is very informative for us. The one issue I have is we cannot connect our Splunk deployment to AD (Active Directory) because it is a managed solution exterior to our organization. We have access to our servers as needed, but the support infrastructure behind the servers is outside of our purview. That said, is there a way to edit the "Splunk App for Windows Infrastructure" so that the server information (names, etc.) is not extracted from AD, but maybe from a file? I am fairly new to Splunk so this is a bit of a learning curve. Thank you, Dan

Hudond · ‎02-13-2020

Good Morning I wanted to ask if i could get some assistance/clarification on setting up the Windows Host Information gathering function in Splunk not just for local hosts but remote hosts also, via the universal forwarder. I am trying to follow the following document but I am not clear on how to set things up with a remote server and the Universal forwarder: Splunk® Enterprise - Getting Data In- Monitor Windows host information located here: "https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/MonitorWindowshostinformation" In the section called Use Splunk Web to configure host monitoring subsection Select the input source It describes choosing the Local Windows host monitoring option. I have performed the steps outlined and indeed I am getting information from my Splunk server but it is not entirely clear in the documentation on how to perform this on remote servers. When going into Settings> data inputs> Forwarded Inputs (as opposed to local inputs) > Files and directories > New remote file and trying to setup a new data input there is no option to setup windows host information, it appears to be available under the local inputs only. I am sure I am missing something but I am not sure what that step is? Any guidance/information on how to set this up would be helpful Thank you Dan

Posts	22
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎02-16-2019

Online Status	Offline
Date Last Visited	‎06-26-2024 03:08 PM

How to get a list of websites from IIS servers wit...

What is the best approach to migrating search head...

ITE Essentials work Hide empty entities to on by d...

How do I Install/configure IT essentials Work and ...

Add an inputlookup from a csv to an existing searc...

Combining different searches into one search with ...

identify server host names as developemnt or test ...

find servers in 24 hour period that have sustained...

Microsoft Windows TA Add-on: How to segregate desk...

Can I use Splunk App for Windows Infrastructure wi...

Re: How to get a list of websites from IIS servers...