Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mikefg
mikefg
Communicator
Member since:
07-24-2019
03-15-2024
Community Statistics
| Posts | 78 |
| Solutions | 6 |
| Karma Given | 4 |
| Karma Received | 7 |
| Member Since | 07-24-2019 |
Activity Feed
- Posted Re: How to edit my WinRegMon configuration to filter out certain Windows registry events? on Getting Data In. 03-15-2024 09:17 AM
- Karma Re: CentOS migration to Ubuntu for isoutamo. 02-08-2024 12:38 PM
- Posted Re: CentOS migration to Ubuntu on Installation. 02-08-2024 12:37 PM
- Posted Re: CentOS migration to Ubuntu on Installation. 02-08-2024 12:35 PM
- Karma Re: CentOS migration to Ubuntu for richgalloway. 02-08-2024 12:35 PM
- Posted CentOS migration to Ubuntu on Installation. 02-07-2024 01:52 PM
- Posted Re: o365 Add-On error can't complete tenant edits on Getting Data In. 10-05-2023 12:31 PM
- Posted o365 Add-On error can't complete tenant edits on Getting Data In. 10-05-2023 09:42 AM
- Got Karma for Re: Where can I disable kvstore?. 09-25-2023 09:43 AM
- Posted Re: Where can I disable kvstore? on Monitoring Splunk. 09-25-2023 07:34 AM
- Posted Re: Where can I disable kvstore? on Monitoring Splunk. 09-22-2023 07:43 AM
- Posted Where can I disable kvstore? on Monitoring Splunk. 08-29-2023 11:39 AM
- Got Karma for Re: coldtofrozen stopped working how to troubleshoot. 08-29-2023 12:51 AM
- Posted Re: coldtofrozen stopped working how to troubleshoot on Monitoring Splunk. 08-28-2023 01:56 PM
- Posted Re: coldtofrozen stopped working how to troubleshoot on Monitoring Splunk. 08-28-2023 11:35 AM
- Posted Re: coldtofrozen stopped working how to troubleshoot on Monitoring Splunk. 08-28-2023 09:25 AM
- Posted Re: coldtofrozen stopped working how to troubleshoot on Monitoring Splunk. 08-25-2023 01:39 PM
- Posted Re: coldtofrozen stopped working how to troubleshoot on Monitoring Splunk. 08-25-2023 07:29 AM
- Posted How to troubleshoot when coldtofrozen stops working? on Monitoring Splunk. 08-24-2023 02:08 PM
- Posted Re: Why is Splunk missing forwarder on endpoints alerts? on Splunk Enterprise. 03-30-2023 07:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
03-15-2024
09:17 AM
I've been working on an issue where I need to be able to filter out a registry entry as well, but this solution doesn't get me there. I need to filter out the languagelist entry, just can't get the regex to work. Anyone else have success filtering reg entries? I need to filter out this entry.
HKU\.default\software\classes\local settings\muicache\2c4\52c64b7e\languagelist
... View more
10-17-2023
12:28 PM
I just ran into this issue and as an easy alternative you can also add: disable_splunk_cert_check = true to every input you have under the stanza. It is mentioned in their guide but for some reason they did not include it in the GUI option like they suggest it is there. https://techdocs.akamai.com/siem-integration/docs/siem-splunk-connector Yet another case where companies think software engineers can be SE's and tech writers.
... View more
10-05-2023
12:31 PM
Figured it out, just didn't enter anything into the optional Cloud App Security Token, Tenant Subdomain, or Tenant Data Center fields and that got it working again.
... View more
09-25-2023
07:34 AM
1 Karma
Found another app that needs kvstore, but this one is a vendor TA. kvstore was not referenced in any documentation and I only found out after I stopped getting data. Fixed now, just keep an eye out for missing data after disabling kvstore on a HF.
... View more
08-28-2023
01:56 PM
1 Karma
I got it working again. I had to recopy the coldtofrozenexample.py and edit for my environment. I was missing some sections from the script.
... View more
03-30-2023
07:40 AM
I'll give this a try, thank you!
... View more
02-09-2023
07:55 AM
What was your conclusion? Which method did you use?
... View more
01-24-2023
07:03 AM
I display licensing in a dashboard using the licensing search for Previous 60 Days split by index. This shows a line with my license, all days, and stacked indexes. It works on classic dashboards, but in the new Dashboard Studio it doesn't work correctly and I don't see column settings for interval, etc. in Studio.
Is there another way to display this using Studio? Or am I missing some settings?
... View more
Labels
- Labels:
-
Dashboard Studio
01-12-2023
11:24 AM
I'm getting these same errors when running the upgrade readiness app. Do these need to be fixed prior to upgrading to 9.0? I'm on 8.2 today.
... View more
11-09-2022
12:31 PM
I got it to work. Here's what's working for me. blacklist = dir1|dir2|\.log$
... View more
08-19-2022
10:55 AM
Thanks! I will proceed.
... View more
07-25-2022
07:22 AM
1 Karma
Thank you, this helps. Just wanted to make sure there wasn't any newer recommended way to setup Stream. I'll proceed with a standalone server.
... View more
08-26-2021
12:14 PM
Per this the app is end of life in 2 months. https://docs.splunk.com/Documentation/MSApp/2.0.3/MSInfra/TroubleshoottheSplunkAppforWindowsInfrastructure Is there a migration path to the "content pack in Data Integrations" ?
... View more
Labels
- Labels:
-
configuration
07-30-2021
07:43 AM
AFAIK, queueing within the UF hasn't changed.
... View more
04-20-2021
10:00 AM
@mikefg Thanks for this. Don't know why this isn't in the installation portion of the documentation instead of finding it in the Troubleshooting section. Splunk Gods should fix that (or use a relative path in props.conf instead so no manual changes needed).
... View more
03-17-2021
07:02 PM
1 Karma
1. create an identity in splunk with an account that has access to SQL Server - account will require server Control (USE master; GRANT CONTROL SERVER TO SplunkUSER;) 2. Create a new connection using identity created in step1 3. Create a data lab and specify your Connection created in step 2. In the data lab you specify your query SELECT * FROM sys.fn_get_audit_file ('\\\<servername>\<sharename>\*.sqlaudit',null,null);
... View more
01-07-2021
12:37 PM
Hi @mikefg, You don't need to change these parameters, max concurrent search number is calculated dynamically using below formula. When you add cpu Splunk will take new number of PCU count and Maximum number of concurrent historical searches = (max_searches_per_cpu * number of CPU) + base_max_searches If this reply helps you an upvote is appreciated.
... View more
12-29-2020
10:59 AM
It looks like HEC is the wrong way to go since it sends data from an application to Splunk. Is creating my own add-on the right way to go?
... View more
12-23-2020
02:05 PM
Gotcha, thanks!
... View more
12-08-2020
07:21 AM
I am working on a fresh install of ES 6.4. I already have a Splunk Ent environment with an indexer tier, apps, single search head, etc. ES has been installed on a standalone search head, but not configured. I have configured ES before, but it was a few versions and a few years back. What are some good resources to get ES configured besides the install docs? Since I already have a Splunk environment with forwarders, add-ons, etc. it looks like my next step might be 'Create the Splunk_TA_ForIndexers and manage deployment manually'. If I go to this step am I skipping something I shouldn't skip? https://docs.splunk.com/Documentation/ES/6.4.0/Install/InstallTechnologyAdd-ons
... View more
Labels
- Labels:
-
configuration
08-11-2020
07:51 AM
Hello, What was the process you followed to fetch logs from Dell Switches?
... View more
07-23-2020
08:50 AM
Using systemd without specifying a user seems to run it as 'root'.
... View more
06-30-2020
04:53 PM
As I understand it, .sqlaudit files are binary rather than text, which is why Splunk won't read them.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-15-2024
01:48 PM
|
