Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About robert_miller
robert_miller
Path Finder
Member since:
06-12-2014
10-05-2021
Community Statistics
| Posts | 57 |
| Solutions | 0 |
| Karma Given | 12 |
| Karma Received | 6 |
| Member Since | 06-12-2014 |
Activity Feed
- Got Karma for Re: Are there plans to make the Bit9 Security Platform CIM Compliant?. 02-17-2023 02:26 PM
- Posted Re: Search head bundle replication failed due to 409 http conflict when upgrade to 8.2.1 on Splunk Enterprise. 10-05-2021 09:36 AM
- Posted Re: Sending HEC data to Nullqueue on Getting Data In. 05-24-2021 02:22 PM
- Posted Re: app or macro to summarize unix user and group permissions on Security. 12-24-2020 07:43 AM
- Posted Re: Splunk Add-on for Amazon Web Services: Cannot index AWS config change notifications on All Apps and Add-ons. 09-23-2020 11:43 AM
- Posted Re: How to fix problem with attribute errors due to split in ldapgroup.py on All Apps and Add-ons. 07-01-2020 07:54 AM
- Posted Re: Why are the wineventlogs:security indexing in different indexes and sourcetypes from single host. on Dashboards & Visualizations. 06-11-2020 10:22 PM
- Karma Re: How do you change the ownership of saved reports in 6.5.2? for Rob2520. 06-05-2020 12:50 AM
- Got Karma for Re: ERROR Regex - Failed in pcre_exec: Error PCRE_ERROR_MATCHLIMIT for regex: \|.*?summarize.*?action\=. 06-05-2020 12:50 AM
- Got Karma for Re: ERROR Regex - Failed in pcre_exec: Error PCRE_ERROR_MATCHLIMIT for regex: \|.*?summarize.*?action\=. 06-05-2020 12:50 AM
- Karma Re: Analytic Story Detail "Unusual Processes" - whitelist_process.csv for bpatel_splunk. 06-05-2020 12:49 AM
- Karma Bug during applyPendingMetadata, header processor does not own the indexed extractions confs for sandipan11. 06-05-2020 12:48 AM
- Karma Re: Splunk Enterprise Security: After upgrading from Splunk 6.3.3 to 6.5.0, why are these threat lists failing to download? for jwelch_splunk. 06-05-2020 12:48 AM
- Karma Re: How to configure XML data parsing? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run? for andygerber. 06-05-2020 12:47 AM
- Karma Re: Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations? for mookiie2005. 06-05-2020 12:47 AM
- Karma Re: Collecting to a summary index not working for jizzmaster. 06-05-2020 12:47 AM
- Karma Re: How to resend lost data between two splunk servers? for ohoppe. 06-05-2020 12:47 AM
- Karma Splunk Enterprise Security - Incident Review dashboard returning "Unknown" for qtu_scalar. 06-05-2020 12:47 AM
- Karma Re: Why is the S.o.S - Splunk on Splunk auditd.service giving errors when running rlog.sh in the Splunk Add-on for Unix and Linux? for elvisior. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
10-05-2021
09:36 AM
@ambrosesuenDid you ever figure this out?
... View more
05-24-2021
02:22 PM
@sun1000 Did you ever figure this out? I am running into the same issue with nullqueue not working with HEC.
... View more
12-24-2020
07:43 AM
@wfskmoneyCan you share the script you created? We need to do the same. Thanks
... View more
09-23-2020
11:43 AM
@D2SI , did you have to do any other changes in your AWS account for it to know which SQS queue to use for config vs notification?
... View more
07-01-2020
07:54 AM
Did you ever figure this out?
... View more
06-11-2020
10:22 PM
Did you ever figure out the culprit? I am actually trying to figure out how to send the Windows event logs in xml and non-xml formats. The xml format is going to be sent to a 3rd party system, but we use the non-xml format at my company.
... View more
05-13-2020
02:38 PM
Did you figure out the culprit, or how to increase the timeout?
... View more
04-30-2020
12:35 PM
Hey @skyelowryvancity , I can't get that lookup command to work. What version of the app are you using?
... View more
04-23-2020
02:21 PM
You ever get this to work?
... View more
04-23-2020
02:07 PM
I also can't get this to work. Hopefully, someone has a solution.
... View more
03-19-2020
02:25 PM
I could never get it to work. I ended up having to use the FLAREclient.
... View more
08-30-2019
01:00 PM
Did you ever figure this out because we are also seeing these errors.
... View more
07-01-2019
10:36 AM
2 Karma
I just heard from support about this issue, and its a known bug (internal bug SPL-160983) that they have decided to not fix. There is no impact to the system and there isn't a way to stop the error from triggering. Support said to ignore these errors going forward.
... View more
06-10-2019
12:05 PM
It does appear to be when I go to the job_manager. Looks like @tommoore and I have the same issue.
... View more
06-07-2019
12:05 PM
Were you able to figure out how to get ES to read the .xml files?
... View more
06-07-2019
11:59 AM
Has anyone been able to configure the taxii feeds for AIS and CISCP in Enterprise Security? In the arguments, I have to provide a cert_file and key_file. DHS already provided me with their certs, but I am not certain how to put it all together.
... View more
06-05-2019
01:02 PM
I see this error on our SH running Enterprise Security.
... View more
06-04-2019
12:05 PM
Same error for us and we are running 7.2.4. Maybe this is an issue with 7.2.x.
... View more
06-04-2019
10:03 AM
Did you ever figure this out? We are seeing the exact same error message in our splunkd log.
... View more
11-01-2018
12:10 PM
When the script runs as long as 20s, how much logs do you think are possibly not being captured? I noticed in your script you have "LoggingPausedMs" which might help answer this question. I am trying to determine if rolling the log file vs pausing/clearing is the right solution.
... View more
11-01-2018
12:04 PM
We are using Stream, but we noticed the logs are not capturing the originating source which is why we are looking at the PS scripts suggested in this thread. It makes it hard using these logs when you don't know which server is making the DNS request.
... View more
11-01-2018
11:13 AM
Hey @hughkelley ,
Since you are clearing out the log file via this script, how often are you running this? (i.e. every x seconds, minute, five minutes, 10 minutes, etc.)
... View more
07-13-2018
11:40 AM
I am surprised this didn't work because the Add-On for Unix and Linux have the lines below in Splunk_TA_nix/default/inputs.conf. These stanzas work for us but we do see odd behavior where it doesn't know how to line break the results which causes some of our events to be 257 lines.
bash history
[monitor:///root/.bash_history]
disabled = true
sourcetype = bash_history
[monitor:///home/*/.bash_history]
disabled = true
sourcetype = bash_history
... View more
02-27-2018
07:05 AM
Hey @gijsvdwoerd, did your error go away after making the change suggested by kchamplin? I am seeing this error also appearing and only for any threatlists that are local.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-05-2021
05:57 PM
|
Karma given to
