About tthonest

tthonest · ‎08-29-2022

Not sure if anyone is using this script to pull logs from salesforce ecommerce, hoping to get some input from similar cases. URL: https://github.com/Pier1/sfcc-splunk-connector This script is installed on a server with a UF installed. I know the UF is pushing logs because I have other inputs.conf that's pushing logs to Splunk cloud. However in this case, the sfcc runs off a python script. That script runs okay on the server, however i'm not sure why the UF isn't forwarding it into Splunk.

tthonest · ‎08-13-2019

running CentOS 7 journalctl -fu syslog-ng shows Unit syslog-ng.service entered failed state. syslog-ng.service failed. syslog-ng.service holdoff time over, scheduling restart. start request repeated too quickly for syslog-ng.service Failed to start System Logger Daemon. Unit syslog-ng.service entered failed state. syslog-ng.service failed. trying to get Cisco ASA to forward logs over but can't seem to get it to work. syslog-ng.conf: # syslog-ng configuration file. # # @include "/opt/syslog-ng/scl.conf" options { chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); perm(0644); time_reopen (10); use_dns(yes); use_fqdn(yes); }; source s_network { udp(port(514)); }; #Destinations destination d_cisco_asa { file(“/var/syslog/logs/cisco/asa/$HOST/$YEAR-$MONTH-$DAY-cisco-asa.log” create_dirs(yes)); }; # Filters filter f_cisco_asa { match(“%ASA” value(“PROGRAM”)) or match(“%ASA” value(“MESSAGE”)); }; filter f_all { not ( filter(f_cisco_asa) ); }; # Log log { source(s_network); filter(f_cisco_asa); destination(d_cisco_asa); }; log { source(s_network); filter(f_all); destination(d_all); }

tthonest · ‎07-30-2019

Hello, okay I dont see an outputs.conf file under local.

tthonest · ‎07-29-2019

Hey Guiseppe, apologies, to clarify... 07-29-2019 10:37:42.100 -0700 INFO TcpOutputProc - Connected to idx=x.x.x.x:9997, pset=0, reuse=0. 07-29-2019 10:37:58.589 -0700 WARN TcpOutputFd - Connect to x.x.x.x:8000 failed. No connection could be made because the target machine actively refused it. 07-29-2019 10:37:58.589 -0700 ERROR TcpOutputFd - Connection to host=x.x.x.x:8000 failed 07-29-2019 10:38:14.324 -0700 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_x.x.x.x_8089_ip-x-x-x-x-.ec2.internal_myWorkStation_... 07-29-2019 10:38:16.034 -0700 WARN TcpOutputFd - Connect to x.x.x.x:8000 failed. No connection could be made because the target machine actively refused it. 07-29-2019 10:38:16.034 -0700 ERROR TcpOutputFd - Connection to host=x.x.x.x:8000 failed I've validated the logs, it does say 9997 is connected and to my multiple indexer clusters which is what I want. I dont know why it's trying to connect to my splunkcloud.com web UI, i just assume since it's failing i should make sure it's successfully establish a connection. Regardless I dont see logs under my splunk cloud instance at all. my inputs file is quite straight forward... inputs.conf (SPLUNKHOME\etc\apps\Splunk_TA_windows\local) [WinEventLog://Security] index=security current_only=1 evt_resolve_ad_obj=0 renderXml=1 disabled=0 so when I go into SplunkCloud i expect to see index=* or index=security, i've manually created the index in splunk cloud already.

tthonest · ‎07-28-2019

Unable to see any logs even after configuring inputs.conf under Splunk_TA_Windows > local. I should at least see perfmon. here's my config to keep it basic. [WinEventLog://Security] disabled = 0 index = security start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 renderXml=0 my logs are showing success to connecting to indexers but 07-28-2019 13:43:19.292 -0700 ERROR TcpOutputFd - Connection to host=x.x.x.x:8000 failed (splunk cloud)

tthonest · ‎07-19-2019

Receiving this error below... C:\Program Files\SplunkUniversalForwarder\bin>splunk install app splunkclouduf.spl -auth admin:changeme Login failed documentation states forwarders and indexers have the same credentials and admin:changeme is the default. I haven't changed anything but since my indexers are on splunkcloud not managed by us, do we need to contact support??

tthonest · ‎07-11-2019

thanks! is the serverclass.conf created manually?

tthonest · ‎07-11-2019

add deploymentclient.conf file to a couple systems from a few serverclasses is this config file automatically shown under /etc/ by default? I wasn't sure about your last statement whether inputs vs props, what do you mean by props? if your systems need indexes vs not, if they're not indexed then why do you have logs going into splunk? thanks!!

tthonest · ‎07-11-2019

anybody doing this on prem or preferably AWS? How did you start? did you follow these steps below? 1: Stand Up a new Search Head to use as DS. 2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/ 3: Create a serverclass.conf file on the DS (put your forwarder and app details in there). 4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.

tthonest · ‎07-09-2019

Anybody share the flavor they're using? did you turn encryption on your root or EBS volume? How to I obtain licensing after purchasing SplunkCloud?

Posts	10
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-09-2019

Online Status	Offline
Date Last Visited	‎08-30-2022 12:23 AM

sfcc Splunk connector salesforce

syslog-ng systemctl not starting the service

Windows_TA_addon inputs

splunkclouduf.spl failed login

Deployment Server on Linux (CentOS)

Deployment Server on AWS