Greetings!   I need your support on how I can create Splunk SIEM rules to detect future attack as requested to this below link:   https://thehackernews.com/2021/04/detecting-next-solarwinds-attack.html   Your help will be most appreciated, thanks in advance! Best Regards Pacy     ... View more

Greetings!! I need help on the below message error that pops up in the message and how I can fix it, here's the message; Search peer indexer2 has the following message: Too many bucket replication errors to target peer=x.x.x.x:8080. Will stop streaming data from hot buckets to this target while errors persist. Check for network connectivity from the cluster peer reporting this issue to the replication port of the target peer. if this condition persists, you can temporarily put that peer in manual detention. Search peer indexer3 has the following message: Too many bucket replication errors to target peer=x.x.x.x:8080. Will stop streaming data from hot buckets to this target while errors persist. Check for network connectivity from the cluster peer reporting this issue to the replication port of the target peer. if this condition persists, you can temporarily put that peer in manual detention. Search peer indexer1 has the following message: Too many bucket replication errors to target peer=x.x.x.x:8080. Will stop streaming data from hot buckets to this target while errors persist. Check for network connectivity from the cluster peer reporting this issue to the replication port of the target peer. if this condition persists, you can temporarily put that peer in manual detention. NB: I also see that "Search Factor is Not Met" and "Replication Factor is Not Met" are displaying red warning error? I have also checked the networking is working well, help me to understand what was the problem? and how to fix this?  Thank you in advance.      ... View more

Greetings All !! Hope you are doing well, I need your guidance/advice on the best way to implement zero trust security specifically on the Splunk servers and users to enforce strict access controls? Thank you in advance. ... View more

Greetings!!   How to restart udp port 514 that is configured on public ip x.x.x.x  all the syslogs sender are configured to send the data to x.x.x.x 514 , where this public IP(x.x.x.x) is the splunk log server collector. BUT now , I can't recive logs into splunk log collector, and if I test this public IP by pinging is replying good, but port is not listening when I test with telnet it is not connecting, how May I solve this???? I need your help?  how to do to put again this service to listening? so that even if I do telnet can respond as usual?   Thank you in advance!     ... View more

Hi ALL!! Help me on how I can use the table function in query with percent |table  field-1, field-2, field-3  |stats count by  field-1, field-2, field-3 | eval  percentage=round(count/total*100,2)."%" |fields - total  This is the query I used but there's no percentage columns appeared, what query can I use to displ Kindly help me out???? here's the column i want to have: host       signature   action    count     percentage    I need your help?   - Other Question , what makes the query to take long time loading or more time to display after pressing search button? Thanking you in advance.           ... View more

Hi All! I need your help ! After checking that we're receiving logs into splunk mgt, I wanted to do Configuration in splunk, Actually I use to do this without running into the issue, but today I have run into the issue after configuration where I was seeing an error saying: 4 errors occured while the search was executing. Therefore, search results might be incomplete. Hide errors . [indexer1] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk. . [indexer3] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk. . [indexer4] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk. . [indexer5] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.   Kindly help me on how ,I can fix this and what is the root cause of this error occur? Thank you in advance!! ... View more

Greetings!! how to create index of the new device data source in Splunk enterprise 7.2.6 in Linux? and how to create its fields by extracting fields using regex from events that come from the Web application Firewall to fetch relevant information fields?how to extract using regex and get meaningful information in fields, I really need your help, thanks in advance! ... View more

Greetings!!! Anyone may help me on how i can fix the below issue, I have been installed the new license BUT before i had the valid trial license which was still valid, then i have installed the new license, then after i got the below error that tells me: (((((( Licensing alerts notify you of excessive indexing warnings and licensing misconfigurations. )))) I have seen that after installing new one and I have excessive because of two valid license, then i removed one valid license for trial. Kindly let me know if I did well by removing the license trial after getting the above message in parenthesis or i might not deleted it? or I still miss other thing to fix all problem? kindly advise me to this matter and the way i could fix the issue. Thank you in advance! ... View more

Greetings!! how to check if your license has been well installed? thank you in advanced. ... View more

what are the query to use by lookup an IP information like country only for source_IP and destination_IP in your search? ex: index =xxxx action=allowed severity=* src-ip=* dest-ip=* |table host, signature,src-ip, dest-ip, action, severity Q/ in the above query, what are the query i can use to fetch src-ip country name and dest-ip country name Thank you in advance! ... View more