About chans28

chans28 · ‎03-28-2022

This wouldn’t have happened in the cloud

chans28 · ‎09-18-2020

Ah ok do you know when SPL2 was launched?

chans28 · ‎09-16-2020

Let me start by saying I know we should be using the coalesce command. I didn't write this query, it has been running fine for a year and it broke after we upgraded to 8.0.5.1. So just making sure I'm not crazy. Sample CSV Host_File_1.csv abc.com,1.1.1.1 Host_File_2.csv xyz.com,2.2.2.2 Splunk 7.2.5.1.. | inputlookup Host_File_1.csv | inputlookup Host_File_2.csv append=true | rename host_file_1_name as hostname | rename host_file_2_name as hostname | table hostname, ip Output Hostname IP abc.com 1.1.1.1 xyz.com 2.2.2.2 Splunk 8.0.5.1 | inputlookup Host_File_1.csv | inputlookup Host_File_2.csv append=true | rename host_file_1_name as hostname | rename host_file_2_name as hostname | table hostname, ip Output Hostname IP xyz.com 2.2.2.2 abc.com in this case gets overwritten by xyz.com it seems. Anyone know why this is happening?

chans28 · ‎08-04-2020

Ok I will try the GUI instructions again but go from 5.2.2 ->5.3.x->6.1.1 just for my own curiosity but the CLI way seems to work without and adjustments. Thx for all the feedback.

chans28 · ‎08-04-2020

So if I understand you correctly, you had an older version of ES deployed to your SH Cluster (Curious what version was the old one?). Then you went through the GUI steps and your SH Members were updated with the new version of ES while maintaining all the old config from your older version?

chans28 · ‎08-04-2020

I did catch that part of the instructions too. So I did update the max_upload_size. Everything went smooth installing ES 6.1.1 as a singular app on the SH Deployer. I was able to bring it up and it looked fine. Just the next step of pushing it out to the SH Members that didn't work. 5.2.2 was still on the SH Members after the push. So the GUI way of upgrading in the docs is not clear to me. At what point during the GUI instructions does the newly installed ES 6.1.1 in ../etc/apps get merged with the old ES 5.2.2 in ../etc/shcluster/apps so it can be pushed out to the SH Memebers?

chans28 · ‎08-02-2020

So I ended up using the command line instructions and that worked https://docs.splunk.com/Documentation/ES/6.1.1/Install/InstallEnterpriseSecuritySHC#Installing_Splunk_Enterprise_Security_from_the_command_line_in_a_search_head_cluster_environment The GUI instructions don't work as I expected. After installing ES 6.1.1 as an app, the merg of ../etc/apps and /etc/shcluster/apps doesn't seem to happen after running: splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password> https://docs.splunk.com/Documentation/ES/6.1.1/Install/InstallEnterpriseSecuritySHC#Installing_Enterprise_Security_in_a_search_head_cluster_environment

chans28 · ‎08-02-2020

In my case it was manually deployed to the HF and I couldn't see any windows carriage returns or line feeds but I still ran dos2unix on my local.meta anyways and restarted the HF and the log entries disappeared. I had to install it first. >yum install dos2unix >dos2unix local.meta

chans28 · ‎07-23-2020

I'm on Splunk Enterprise 8.0.5 for this question. Upgrading ES from 5.2.2 to 6.1.1: The Splunk docs say install 6.1.1 on the Deployer via the GUI first which will put ES 6.1.1 app in the $SPLUNK_HOME/etc/apps directory. I'm clear here so far Then it says choose a MODE before pushing 6.1.1 out using splunk apply shcluster-bundle Which we know will take the apps in $SPLUNK_HOME/shcluster/apps on the deployer and create a bundle to push out to the SH Members. So here is my question: When does the 6.1.1 I deployed using the GUI in $SPLUNK_HOME/etc/apps get copied to $SPLUNK_HOME/shcluster/apps on the Deployer so it can be pushed out in the bundle??? Am I supposed to do that manually?

chans28 · ‎10-24-2019

Oh I see. My apologies. So we had to throw away the SQL Server addon and just build our own CIM compliant addon. We used action_id, class_type and succeeded to map to Authentication CIM.

chans28 · ‎10-24-2019

We had the same challenge here is what we ended up doing: Get your DBA to deploy database and server audit objects for the events you want to monitor. https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/create-a-server-audit-and-server-audit-specification?view=sql-server-2017 Have those events sent to Win Event Log under Application Deploy a UF on the SQL servers to collect all the Win Event Logs.

chans28 · ‎08-05-2019

For us it turned out to be the the AWS TA has 4 cacert files that need updating if your companies network has their own SSL certs. 3 of 4 are named conventionally as cacert.pem. However, 1 is named cacert.txt in this directory /opt/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/boto/cacerts/cacerts.txt Once we updated that with our company's certs everything started working.

chans28 · ‎06-15-2019

Did you ever figure out why this was happening? I have the exact same issue.

chans28 · ‎04-21-2019

Because Bigger Data is not always Better Data

Posts	14
Solutions	0
Karma Given	4
Karma Received	2
Member Since	‎04-21-2019

Online Status	Offline
Date Last Visited	‎05-05-2025 08:46 AM

rename command seems to work differently in Splunk...

What are the steps to upgrade Splunk Enterprise Se...

Re: What are your Splunk t-shirt ideas?

Re: rename command seems to work differently in Sp...

rename command seems to work differently in Splunk...

Re: What are the steps to upgrade Splunk Enterpris...

Re: What are the steps to upgrade Splunk Enterpris...

Re: What are the steps to upgrade Splunk Enterpris...

Re: What are the steps to upgrade Splunk Enterpris...

Re: BundleArchiver - Filtered nothing out of local...

What are the steps to upgrade Splunk Enterprise Se...

Re: Monitoring MS SQL logs from Windows Event view...

Re: Monitoring MS SQL logs from Windows Event view...

Re: Splunk Add-on for AWS is not working, s3 gener...

Re: Splunk Add-on for AWS is not working, s3 gener...

Re: What are your Splunk t-shirt ideas?

Join the Conversation