Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About scottroymcse
scottroymcse
New Member
Member since:
06-14-2012
09-24-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-14-2012 |
Activity Feed
- Posted Splunk running on Linux version 6.4.1 to 8.05 Upgrade on Installation. 09-23-2020 05:20 PM
- Posted How to define specific Splunk indexers for different applications on the universal-forwarder? on Getting Data In. 04-01-2015 02:16 PM
- Tagged How to define specific Splunk indexers for different applications on the universal-forwarder? on Getting Data In. 04-01-2015 02:16 PM
- Tagged How to define specific Splunk indexers for different applications on the universal-forwarder? on Getting Data In. 04-01-2015 02:16 PM
- Tagged How to define specific Splunk indexers for different applications on the universal-forwarder? on Getting Data In. 04-01-2015 02:16 PM
- Tagged How to define specific Splunk indexers for different applications on the universal-forwarder? on Getting Data In. 04-01-2015 02:16 PM
- Tagged How to define specific Splunk indexers for different applications on the universal-forwarder? on Getting Data In. 04-01-2015 02:16 PM
- Posted Re: Splunk for Palo Alto App - Peer Splunk Indexers on All Apps and Add-ons. 06-19-2014 01:25 PM
- Posted Splunk for Palo Alto App - Peer Splunk Indexers on All Apps and Add-ons. 06-19-2014 11:15 AM
- Tagged Splunk for Palo Alto App - Peer Splunk Indexers on All Apps and Add-ons. 06-19-2014 11:15 AM
- Posted Re: Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 05-02-2014 03:20 PM
- Posted Re: Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 05-01-2014 10:26 AM
- Posted Re: Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 05-01-2014 04:54 AM
- Posted Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 04-30-2014 08:06 PM
- Tagged Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 04-30-2014 08:06 PM
- Tagged Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 04-30-2014 08:06 PM
- Tagged Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 04-30-2014 08:06 PM
- Tagged Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 04-30-2014 08:06 PM
- Tagged Export Splunk Results and push to Palo Alto API to populate a dynamic group on Reporting. 04-30-2014 08:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-23-2020
05:20 PM
I am looking for the Splunk 7.0 RPM to upgrade from my running 6.4.1. I am unable to find this listed in the older releases. 7.1.1 seems to be the oldest one listed on the site. The upgrade docs mention 6.4 to 7.0 and then to 8.0. Does anyone know if 7.0 is still downloadable?
... View more
Labels
- Labels:
-
heavy forwarder
-
Linux
04-01-2015
02:16 PM
I have a requirement to log the default Windows logs using the universal forwarder to our main Splunk server, and then we have another application that needs to send logs to a different set of Splunk indexers.
I am pushing the applications to the UF host via a deployment server, however how do I specify that Application B use a different set of indexers?
I think I have a conflict in the outputs.conf when I have both Application A and Application B deployed to the UF host. The outputs.conf files are located in each of the /apps/ApplicationA/default and /apps/ApplicationB/default folders.
If I have just Application A or Application B pushed on their own, the required data is pushed to the correct Splunk indexer(s). Both installed at the same time ceases to send out anything.
... View more
06-19-2014
01:25 PM
Thanks for the response. After some investigation, it was better to take to transforms and props and bundled them into an application and deployed the files to the indexers. If I add additional indexers in the future, these changes will be pushed out automagically ..
... View more
06-19-2014
11:15 AM
We've recently started to change our splunk topology from a single search head / indexer, to search head and remote peer indexers.
The PAN splunk app will stay installed on the search head, however now with the traffic going to the indexers, all traffic is indexed as pan_log, however I recall a transforms.conf file that was setup in the application that would use some regex values to split up the traffic / threat / system traffic into different sourcetypes (?).
How is the PAN app supposed to work in this type of topology? Do I need to install the app on each of the indexers and have the transforms.conf copied over from the search head (original install point)?
... View more
05-02-2014
03:20 PM
Brian, Thanks for reaching out. Tags are use in the PAN 6.x stream, just need to upgrade to 6.x to take advantage.
How can I dynamically remove items from the dyn-obj group?
As I am actively scanning and creating a list to be pushed, is there a way to clear out the existing objects on the PAN and then push the new objects compiled from the splunk search without having to know what already exists in the dyn-obj list to begin with?
... View more
05-01-2014
10:26 AM
my syntax seems to work as planned however fails to push to the PANs due to the devicegroup= requirement. I don't have Panaroma but trying to push directly to the PANs itself.
2014-05-01 11:21:09,025 -0600 WARNING panoramaUserUpdate:134 - Traceback (most recent call last):
File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/panoramaUserUpdate.py", line 129, in getKey
sm = re.search(r"success",result).group(0)
AttributeError: 'NoneType' object has no attribute 'group'
Without the devicegroup, the logs state that I haven't specified the IP address of the Panorama device.
... View more
05-01-2014
04:54 AM
Thank you for responding, this was the detail I was looking for. I'll give it a try this morning when I'm back on the office and let you know how it goes.
... View more
04-30-2014
08:06 PM
I am using the asset discovery app to run nmap scans on my network. I am able to collect the results based on specific Operating Systems and should be able to export the results. I want to take these results (host IPs) to then push to a dynamic group on a Palo Alto firewall using its API.
Has anyone had any experience doing this? I recall the older version of the PAN App was able to do this, however the results were contained in this app.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-24-2020
11:45 AM
|
