About ahmedragy922

ahmedragy922 · ‎07-08-2019

hi, is there any prerequisite to install or make ES or Essential app work ??? like should I install CIM add-on before deploying ES or Essential app???

ahmedragy922 · ‎06-26-2019

hi, what Splunk Add-on for Box is used for?? is there any app depend on that add-on?

ahmedragy922 · ‎06-24-2019

Hi, I can't find any material for studying Splunk security essential app, is there any documentation or videos explaining that app? How do you get the data into SSE app ??? Do I have to use CIM to change source type to common name that SSE will understand?

ahmedragy922 · ‎06-22-2019

Hi, I'm planning to take power user certificate. I didn't take the training for fundamentals 2 because it will cost me a lot of money. so is there any material/study guide that I can study to prepare for power user certificate ??

ahmedragy922 · ‎06-11-2019

thank you

ahmedragy922 · ‎06-09-2019

thank you for your reply , but if i want to dynamically identify the sourcetype of data the are coming to indexer from forwarder , in this case i need to modify props.conf in indexer (parsing phase) to create regex matching the data and gives it a sourcetype ???

ahmedragy922 · ‎06-08-2019

thank you for the answer , but i think i can override sourcetype,index,source and host in inputs.conf in Universal Forwarder , also i can do the same in indexer and Heavy Forwarder. but i think there is the difference between them , in Universal Forwarder i can just write the index where the data will be stored in indexer but i don't have any power to filter the data as in inputs level splunk can't determine the events. in the opposite in indexer , the splunk can parse the data so i can dynamically override (writing regex to change a subset of data or routing some data to index and other to another index) the sourcetype,index,host,source for the data . can you correct me if i'm wrong ??

ahmedragy922 · ‎06-08-2019

Hello, i'm confused about where configuration files (Search Head or Indexer) should i modify when i want to do filed extraction ?? or when i want to override sourcetype,source,host , should i do that in forwarder or indexer or search head??? is there any reference that map the configuration files to which data pipeline applies ?? for example : if i want to do field extraction >>> i should do that in Search head and configure props.conf and transforms.conf i just found those 2 articles but i still confused. https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Configurationparametersandthedatapipeline https://docs.splunk.com/Documentation/Splunk/7.2.6/Deploy/Datapipeline

ahmedragy922 · ‎06-08-2019

Hi, i'm new to splunk , i just wounder what is the difference between override source type/index from forwarder and from indexer??? and also if i choose to override sourcetype of files in universal forwarder , should i create a sourcetype and regex in transforms.conf on Search head with the new name that i specified in Universal Forwarder inputs.conf file to extract fields???

Posts	9
Solutions	0
Karma Given	0
Karma Received	6
Member Since	‎06-08-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

splunk ES and Esesntial app prequiest

what is Splunk Add-on for Box

Splunk Enterprise Security: How to route data into...

Power user study guide

data pipeline and configuration files location

what is the difference between override source typ...