About tiaatim

laurenschwerdt · ‎11-16-2021

Did you ever figure out a solution to this? We are having the same trouble.

tiaatim · ‎07-22-2020

I thought about that too but then the datamodel wouldn't populate and the data wouldn't be CIM compliant.

tiaatim · ‎05-26-2020

Hey guys, we have Enterprise Security and the Endpoint data model never finishes building. I even knocked the backfill range to 4 hours and it still doesn't complete. I know there is a TON of data and even when I run the base macro used in all of the datasets it takes forever to run just in a 15 minute window. We just moved over a to a brand new index cluster with 10 indexers and don't see any performance issues anywhere else other than this one last data model that won't complete building.

tiaatim · ‎05-04-2020

Did you ever figure this out? I'm experiencing the same issue.

tiaatim · ‎04-09-2020

Thanks. One output is UDP/514 and the other is TCP/9997 to Splunk indexers. I've been looking to see how I can performance tune the NIC but where would I see that they are being blocked? I see a bunch of reset errors on the NIC btw.

tiaatim · ‎03-05-2020

I tested this and couldn't get it to work so going a different route.

codebuilder · ‎02-04-2020

You could try the example in the documentation, which will work, and also ensure you don't get duplicate data. # # The following example shows how to route events to syslog server # This is similar to tcpout routing, but DEST_KEY is set to _SYSLOG_ROUTING # # 1. Edit $SPLUNK_HOME/etc/system/local/props.conf and set a TRANSFORMS-routing # attribute: [default] TRANSFORMS-routing=errorRouting [syslog] TRANSFORMS-routing=syslogRouting # 2. Edit $SPLUNK_HOME/etc/system/local/transforms.conf and set errorRouting # and syslogRouting rules: [errorRouting] REGEX=error DEST_KEY=_SYSLOG_ROUTING FORMAT=errorGroup [syslogRouting] REGEX=. DEST_KEY=_SYSLOG_ROUTING FORMAT=syslogGroup # 3. Edit $SPLUNK_HOME/etc/system/local/outputs.conf and set which syslog # outputs go to with servers or groups: [syslog] defaultGroup=everythingElseGroup [syslog:syslogGroup] server = 10.1.1.197:9997 [syslog:errorGroup] server=10.1.1.200:9999 [syslog:everythingElseGroup] server=10.1.1.250:6666 https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf?utm_source=answers&utm_medium=in-comment&utm_term=outputs.conf&utm_campaign=refdoc#outputs.conf.example

tiaatim · ‎11-08-2019

Looks like the reason why is because these settings in local/inputs.conf under the ESS app were disabled. [app_imports_update://update_es] disabled = 1 [app_imports_update://update_es_da] disabled = 1 [app_imports_update://update_es_main] disabled = 1 Thanks again for your help!

Posts	27
Solutions	1
Karma Given	2
Karma Received	2
Member Since	‎05-14-2019

Online Status	Offline
Date Last Visited	‎10-26-2020 02:16 PM

Zoom Logging - Firewall Question

Add result of eval to datamodel field

Endpoint Data model does not finish building.

Heavy Forwarders Dropping Logs

Can I send uncooked data from one HF to another?

Heavy Forwarder Load Balancing syslog data to F5 V...

Splunk Enterprise Security: Cisco ASA logs extract...

Re: Zoom Logging - Firewall Question

Re: Add result of eval to datamodel field

Endpoint Data model does not finish building.

Re: CEF parsing on under Splunk Enterprie Security...

Re: Heavy Forwarders Dropping Logs

Re: Can I send uncooked data from one HF to anothe...

Re: Heavy Forwarder Load Balancing syslog data to ...

Re: Splunk Enterprise Security: Cisco ASA logs ext...