About jbleich

jbleich · ‎05-27-2021

Thanks for that info, I'm not "scared" of linux it's just I dont use it a ton so when I have to work on it i have to retrain myself.......are there any options w/ a windows syslog server?

jbleich · ‎05-27-2021

I have a windows 2019 SRV and will be installing splunk forwarder 8.0.4 I have a firewall and I have set the IP of this new server as it's syslog server. It's my understanding that the sonicwall sends this syslog information over port 514. So how do I setup my syslog server w/ the Universal Forwarder to ingest and forward this data on to the indexer. Or do I need to setup a "listener" outside of splunk on the new syslog server to get the data to a log file and then simply use the forwarder to grab that log file and send to indexer?

jbleich · ‎02-19-2016

So i could load the UF on all of my servers and then just set it to report disk utilization to an index i create in splunk? the UF on every box isnt a concern as long as it doesnt require a lotof resources, having it on all boxes could open a pandoras box of stuff I'd like to do from each server so that might be good 🙂

jbleich · ‎02-19-2016

Do I have to have the Splunk forwarder loaded on every server, or is there a way to send that info to a syslog server and have Splunk read it from there? I'm basically wanting to get an alert anytime an HD on any of my servers reaches 10% or less..... Anybody done this?

jbleich · ‎08-04-2015

I had just scheduled a PDF to run monthly, and now I don't know where to find it so I can go back and edit it.

jbleich · ‎04-22-2015

Thank you everybody for your help, i marked the first answer that worked 🙂 Looks nice!

jbleich · ‎04-17-2015

Tony has got me going in the right direction with timechart, but it stinks the way it displays, it has the days going down the side and the events as a column with an "other" as the last column, what i want is the events where count>1 to list the date going down the side and then a total count column.... Here is what i have right now with the | timechart span=1d count by time _time................04-01-2015........04-02-2015..........04-02-2015.........04-04-015..............OTHER 2015-01-17.............0...........................0...........................0..........................0...........................0.... 2015-01-18.............0...........................0...........................0..........................0...........................0.... 2015-01-19.............0...........................0...........................0..........................0...........................0.... 2015-01-20.............0...........................0...........................0..........................0...........................0.... and so on.......

jbleich · ‎04-17-2015

hello all, relative newbie here, so bare with me. I have a table output with 3 columns Failover Time, Source, Destination (This data is being sent over via syslog from a sonicwall) Anyways, I would like to do a count by events by day. Below is the first 19 entries from the Failover Time column. If I do a [stats count by "Failover Time"] i just get each of the entries and a count of 1. I dont kow how to count by the DAY within the "Failover Time" field....looking at the below example you see there was 1 on 4-1, 2 on 4-2, 3 on 4-3, that's what i want in a chart..... 2015-04-01 02:13:48 UTC 2015-04-02 09:56:50 UTC 2015-04-02 13:18:25 UTC 2015-04-04 02:27:02 UTC 2015-04-04 02:27:57 UTC 2015-04-04 02:53:27 UTC 2015-04-07 11:42:01 UTC 2015-04-08 05:03:57 UTC 2015-04-09 18:13:54 UTC 2015-04-13 15:04:14 UTC 2015-04-13 18:29:59 UTC 2015-04-13 23:09:14 UTC 2015-04-16 05:00:42 UTC 2015-04-16 05:25:42 UTC 2015-04-16 05:30:33 UTC 2015-04-16 05:30:52 UTC 2015-04-16 05:47:48 UTC 2015-04-16 05:55:38 UTC 2015-04-16 05:55:57 UTC What I would like to see is Failover Time........................................Count 2015-04-01............................................1 2015-04-02............................................2 2015-04-04............................................3 2015-04-07............................................1 etc....

jbleich · ‎03-11-2015

I have most dashboards in search and reporting, and a few in my other apps, is there a way to see them all in one spot so i dont have to jump around to the seperate apps? Just a page with links to all my dashboards, my created ones anyways.

jbleich · ‎02-02-2015

The Type of database is SQLlite

jbleich · ‎01-30-2015

I'm getting this error when trying to save my external database Encountered the following error while trying to save: In handler 'databases': Directory /opt/splunk/var/dbx does not exist! What next?

jbleich · ‎01-26-2015

Yeah I'm not sure what happened, it was working when we had our indexer on a windows box, but we reloaded our splunk onto a linux box and when i reloaded this app I'm now getting The lookup table 'monitored_indexes.csv' is invalid. so it's kind of a bummer....

jbleich · ‎10-27-2014

You have a doc or instructions on how to enable just access from within our network?

jbleich · ‎10-27-2014

It was iptables, just shut that off and boom! it worked 🙂

jbleich · ‎10-27-2014

I've just finished installing splunk on a new box w/ CentOS installed. I think everything went well, but I'm kinda new to CentOS CLI. Anyways, I can ping new box from my PC and can ping my PC from new box....but when I go to http://ip_of_new_box:8000 it doesnt bring up the UI. I use 8000 because it's the default and I dont remember doing anything else. Where do I start?

jbleich · ‎10-20-2014

I am a splunk newbie, so keep that in mind 🙂 I have copied the FB and FBTA both version 2 as I have splunk 6.1 into my etc/apps and restarted splunk. Some of the dashboards are working, but a lot are not and none of the dropdowns work either. I cant seem to find a "setup app" page within the app which tells me it should just work? Either way the one error that does come up is in the title. I cant find that in any of the folders, need some help here.

jbleich · ‎10-13-2014

I've also tried this search string which will work with any machine names individually, however if I try NOT Account_Name="*$" it doesnt work. I tried that because all machine names have the $ sign at the end. EventCode=4625 NOT Account_Name="*$" | eval Account_Name =mvindex(Account_Name,1) It's pulling the right account name field, but i cannot ommit the ones i dont want. If I replace the *$ with a specific machine name it will go ahead and take it out.

jbleich · ‎10-13-2014

Hello fellow splunkers... I am very new to splunk and currently what I'm trying to do is filter out windows event 4625 to see when my users are not getting their passwords correct. The event details comes up w/ 2 Account_Name's so I'm trying to use mvindex to omit the 1st one and only grab values in the second one. I'm going on the assumption that field 1 is actually 0 and field 2 is 1.....Here is the string I'm using. EventCode=4625 | eval Account_Name=if(Account_Name="*$", (mvindex(Account_Name,1)), Account_Name) Below is an example of the details in an event (Note: All computer names end in a $) Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: ComputerName$ Account Domain:

jbleich · ‎08-29-2014

I'm very much a splunk newbie, can you be a bit more specific or point me to some documentation w/ some steps to do this task.

jbleich · ‎08-29-2014

I have a forwarder in which we forgot the admin password. Right now it's causing the vmware app to only partially work. Before submitting a ticket on that I really need to know if i can get that password changed. I'm using >splunk edit user admin -password "new_password" -auth admin:current_password, but obviously dont know the current.

jbleich · ‎08-05-2014

I know what server it's coming from I'm trying to find out if it's some default data from the universal forwarder, from the windows infrastructure app, or from the VMware app we have loaded. I dont think it's the vmware app because it splits their sourcetypes into vmware:something... So I think it's either the default or the infrastrcture app. I have suspicions it's the default forwarder actions, but if that's the case why wouldnt every server i have the forwarder on send perfmon data, unless it's because these 2 are my DCs. In any event Im more interested in blocking it.

jbleich · ‎08-04-2014

I'm a new splunk user, so be kind 🙂 I have about 80% of my daily volume coming in what i believe to be un-needed informaton. I cant tell where the data is coming from, all i know is index=main and sourcetype=Perfmon:process Now i thought it was the universal forwarders on my DC's, I have 2 of them and pushed out the app via the deployment server and i changed the .conf file to disable Perfmon:process, but apparently that wasnt it...it must be coming from somewhere else. Any help would be appreciated.

jbleich · ‎08-04-2014

I just purchased Splunk and got the new licenses uploaded, but since the trial ran out about 10 days ago I have 10 days worth of warnings and still can't search after putting in the new license. Anybody know how I can refresh or clear the warnings and go back to searching? Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK. Obviously from exceeding too many times.

jbleich · ‎07-03-2014

Thank you, that did work, but now I'm back to square one on my original problem. On the indexer when trying to add the node within the vmware app, i just get "host could not be reached"

jbleich · ‎07-03-2014

I'm trying to setup a collection node for the vmware app and am following the instructions on this page - http://docs.splunk.com/Documentation/VMW/3.1/Install/Getacollectionnode On Step 20 it asks you to change the password for the splunk admin user on the collection node with this command ./splunk edit user admin -password newpassword -role admin -auth admin:changeme When i try this i get "-bash: ./splunk: No such file or directory" Then i tried sudo ./splunk edit user admin -password newpassword -role admin -auth admin:changeme Then it asks me for the password for splunkadmin and after i provide it i get "sudo: ./splunk: command not found" I cant seem to figure out how to change the "admin" user's password on this Cent OS OVA

Posts	32
Solutions	0
Karma Given	0
Karma Received	5
Member Since	‎06-05-2014

Online Status	Offline
Date Last Visited	‎06-01-2021 09:16 AM

How to setup a Universal Forwarder to forward sysl...

How to monitor HD free space on servers?

If I have scheduled a PDF to run monthly, where ca...

How to timechart the count of a field by day?

Is there a way to see all of your dashboards accro...

newbie needs help on db connect app

Why can't I access the UI on new Splunk install on...

The lookup table 'monitored_indexes.csv' is invali...

How to use eval mvindex in a search to pull values...

Can you change the admin user password on forwarde...

Re: How to setup a Universal Forwarder to forward ...

How to setup a Universal Forwarder to forward sysl...

Re: How to monitor HD free space on servers?

How to monitor HD free space on servers?

If I have scheduled a PDF to run monthly, where ca...

Re: How to timechart the count of a field by day?

Re: How to timechart the count of a field by day?

How to timechart the count of a field by day?

Is there a way to see all of your dashboards accro...

Re: newbie needs help on db connect app

newbie needs help on db connect app

Re: The lookup table 'monitored_indexes.csv' is in...

Re: Why can't I access the UI on new Splunk instal...

Re: Why can't I access the UI on new Splunk instal...

Why can't I access the UI on new Splunk install on...

The lookup table 'monitored_indexes.csv' is invali...

Re: How to use eval mvindex in a search to pull va...

How to use eval mvindex in a search to pull values...

Re: Can you change the admin user password on forw...

Can you change the admin user password on forwarde...

Re: Help locating what forwarder data is coming fr...

Help locating what forwarder data is coming from

How to clear indexer overage warnings so i can per...

Re: Trying to change password on collection node i...

Trying to change password on collection node in ce...