About mustafag1

mustafag1 · ‎11-25-2019

It seems that my mistake was multiplying the number of days. I did suspect that the 30 would be the overkill for the calculations. Thanks!

mustafag1 · ‎11-24-2019

Hello all, I will be contacting the sales team as well but for now I wanted to get some clearer idea of the actual cost breakdown for Splunk with anyone who may have firsthand knowledge. On the Pricing Calculator page we can see that a 100 GB/day connection costs $63 per GB and multiplying that by 12 for each month gives us $756 shown as $750 on the same page Now using this if we multiply this by 30 for each day of the month and multiply that by 100 for the 100 GB, is it fair to assume the total cost (which includes service as it is the annual license) is at least $2,250,000 per year. Cost per GB/Day - 63 Days per Month - 30 Months per Year - 12 GB Used per day - 100 63*30*12*100 = 2268000 Please correct me if I have misinterpreted the breakdown as I need to present the estimated yearly costs for using Splunk to our team. Thanks.

mustafag1 · ‎10-28-2019

Yeah that is what I thought as well, from the docs and other questions that seems to be the main (and only) issue. Regardless wanted to be sure.

mustafag1 · ‎10-28-2019

I am having trouble understanding whether there are any issues caused by violating a non enforcement license. All Splunk enterprise editions after 6.5 have a non-enforcement license automatically. You get a violation after 5 warnings and indexing continues even after violation of license. Since the there is no enforcement, the search features are still enabled. I am confused on whether there is any issue for someone simply using Splunk with a violated license and if so what are they? I know free license can give you a 30 day lockout but enterprise does not seem to have any.

mustafag1 · ‎10-08-2019

Hi I seem to have found what I required from https://answers.splunk.com/answers/614054/how-to-index-all-locally-and-forward-specific-sour.html Here we have work around to changing inputs.conf which did not allow us to filter sourcetypes. We are still using Selective Forwarding except now we can divert any specific sourcetype by identifying it in props.conf and giving it a transform in the stanza [<sourcetype>] TRANSFORMS-toindex = selectiveIndex And we define this Transform in transforms.conf [selectiveIndex] REGEX = . DEST_KEY = _INDEX_AND_FORWARD_ROUTING FORMAT = local We also add a stanza to transforms.conf [accepted_keys] is_valid = _INDEX_AND_FORWARD_ROUTING This takes away the invalid key error from the selectedIndex stanza. Now we are Indexing that sourcetype only. The ones that need to be forwarded can be defined as usual when forwarding to 3rd party Indexers (https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Forwarddatatothird-partysystemsd). Since we are using selective Indexing we need to add a stanza to outputs.conf as well [indexAndForward] index = true selectiveIndexing = true

mustafag1 · ‎10-07-2019

Also it seems that that the REGEX = [sshd] is designed for sshd events (as written in the documentation). If we set it to "." to apply to all events, nothing is indexed for that transform, but this also removes all forwarding. Is this designed to for both forwarding and discarding (what I require) or is it a one or the other case (which it seems to be).

mustafag1 · ‎10-07-2019

Hello Giuseppe, Thank you for answering my question. As per your suggestion I am adding two transforms to [Wineventlog:Security] In props.conf on Splunk Enterprise Server: [wineventlog:Security] TRANSFORMS-null= setnull TRANSFORMS-routing=send_to_syslog And in transforms.conf I have two stanzas [send_to_syslog] and [setnull]. Can you please confrim that this is a valid operation? So far it seems that Splunk is no longer Indexing any security events (No security events on the Web GUI) but also it is not forwarding any events to third party system. Also Note for clarity: We do not want to alter the Forwarders. The idea is that we change the configurations on the Indexer so that it handles the indexing for most logs and forwards the logs with relevant sourcetypes, without indexing, to a third party. This way we do not have to modify the series of forwarders that may be sending logs to a main Splunk Indexer. Mustafa

mustafag1 · ‎10-02-2019

Hi I am new to Splunk and am trying to forward a specific sourcetype of data out. That part is successful but now I am having trouble with the next part; indexing the remaining sourcetypes. I am using a Windows Universal Forwarder to forward all logs to a Splunk Enterprise Instance. I want to Index the Perfmon logs but forward the Security and Application logs to a third Party source. How can I achieve this? So far all the documentation seems to indicate using Selective Indexing but there the information suggests setting the entire log to either be indexed or forwarded or both, not just the specific sourcetype.

Posts	8
Solutions	1
Karma Given	5
Karma Received	0
Member Since	‎10-02-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Is this the actual total cost of Splunk?

What are the effects of License violation?

Can you index a certain sourcetype and forward the...

Re: Is this the actual total cost of Splunk?

Is this the actual total cost of Splunk?

Re: What are the effects of License violation?

What are the effects of License violation?

Re: Can you index a certain sourcetype and forward...

Re: Can you index a certain sourcetype and forward...

Re: Can you index a certain sourcetype and forward...

Can you index a certain sourcetype and forward the...