Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About aydinmo
aydinmo
Explorer
Member since:
10-17-2019
04-01-2024
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 10-17-2019 |
Activity Feed
- Posted Re: Data Model Acceleration Issue in ES Instance on Splunk Enterprise Security. 04-01-2024 05:28 AM
- Karma Re: Data Model Acceleration Issue in ES Instance for meetmshah. 04-01-2024 05:28 AM
- Posted Data Model Acceleration Issue in ES Instance on Splunk Enterprise Security. 03-28-2024 10:00 AM
- Got Karma for Re: Cisco eStreamer eNcore 4.0.9 Add-on for Splunk 8.1.0.1. 06-20-2023 08:16 AM
- Posted Re: Cisco eStreamer eNcore 4.0.9 Add-on for Splunk 8.1.0.1 on All Apps and Add-ons. 06-13-2022 06:59 PM
- Posted Critical Syslog Server Tricks on Getting Data In. 06-16-2021 09:42 AM
- Tagged Critical Syslog Server Tricks on Getting Data In. 06-16-2021 09:42 AM
- Tagged Critical Syslog Server Tricks on Getting Data In. 06-16-2021 09:42 AM
- Tagged Critical Syslog Server Tricks on Getting Data In. 06-16-2021 09:42 AM
- Karma Re: Cisco eStreamer eNcore 4.0.9 Add-on for Splunk 8.1.0.1 for gurlest. 05-01-2021 10:01 PM
- Posted Re: Cisco eStreamer eNcore 4.0.9 Add-on for Splunk 8.1.0.1 on All Apps and Add-ons. 05-01-2021 10:00 PM
- Karma Re: The impact of Universal Forwarders communication with Deployment Server on network bandwidth for richgalloway. 04-23-2021 05:16 AM
- Posted Re: The impact of Universal Forwarders communication with Deployment Server on network bandwidth on Splunk Dev. 04-22-2021 05:07 PM
- Karma Re: The impact of Universal Forwarders communication with Deployment Server on network bandwidth for richgalloway. 04-22-2021 05:07 PM
- Posted Re: Cisco eStreamer eNcore 4.0.9 Add-on for Splunk 8.1.0.1 on All Apps and Add-ons. 04-22-2021 04:54 PM
- Posted The impact of Universal Forwarders communication with Deployment Server on network bandwidth on Splunk Dev. 04-22-2021 03:27 PM
- Tagged The impact of Universal Forwarders communication with Deployment Server on network bandwidth on Splunk Dev. 04-22-2021 03:27 PM
- Tagged The impact of Universal Forwarders communication with Deployment Server on network bandwidth on Splunk Dev. 04-22-2021 03:27 PM
- Tagged The impact of Universal Forwarders communication with Deployment Server on network bandwidth on Splunk Dev. 04-22-2021 03:27 PM
- Posted What is the solution for real-time dataset to be ingested in Splunk Enterprise Security? on Splunk Enterprise Security. 01-14-2020 10:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-01-2024
05:28 AM
Thank you for the inputs. I checked and this is not the root cause. I need to identify the root cause to prevent such cases happening in the future.
... View more
03-28-2024
10:00 AM
Hello Splunkers, I'm encountering an issue with data model acceleration in my ES instance . A few weeks ago, I enabled several data models in my ES instance to support correlation searches. However, I recently noticed that there hasn't been any increase in SVC usage, and upon checking today, I found that the acceleration status for these models was disabled. I'm puzzled by this and would appreciate any insights into why this occurred and how to identify the root cause. Thank you.
... View more
Labels
06-13-2022
06:59 PM
1 Karma
Hi, Try following steps to clear out the memory so FMC logs start to flow again: Go to: /opt/splunk/etc/apps/TA-eStreamer/bin/encore Remove "A.A.A.A-8302_proc.pid" $ ps aux | grep estreamer pkill -9 -f service.py Restart Splunk services I hope it helps! With Regards
... View more
06-16-2021
09:42 AM
Hi all, I have a large environment to deploy Splunk cloud and trying to leverage the syslog server (Rsyslog) in front of a load balancer, with UF on top. As per my research, I have found a wonderful document which automates the inputs.conf and props.conf creation based on an excel sheet, relying on separation based on devices hostnames. The link for documentation is here: https://conf.splunk.com/files/2017/slides/the-critical-syslog-tricks-that-no-one-seems-to-know-about.pdf I'm wondering if anyone has used the provided scripts for this automation? I couldn't find any explanation on how the python scripts work? link to gitlab: https://gitlab.com/rationalcyber/splunk_syslog_inputs link to script: https://gitlab.com/rationalcyber/splunk_syslog_inputs/-/tree/master/src Thanks in advance!
... View more
Labels
05-01-2021
10:00 PM
Hi, Actually I've installed the new released version (4.2.2) and only changed the monitor stanza to monitor the right path: [monitor://$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/data/splunk] the new version is working well now, except the clean stanza, which even changing the path doesn't seem to work. I also reduced the time to +10 minutes, but still no joy: clean() {
# Delete data older than 12 hours -> 720mins
# find ../../data -type f -mmin +720 -delete
# correcting path to new path in new version 4.2.2 of TA
find $SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/data/splunk -type f -mmin +10 -delete
} I'm wondering if there is any recommended work around to fix this. Thank you in advance.
... View more
04-22-2021
05:07 PM
Thank you @richgalloway ! --- Is there any reference available from Splunk documentation to address this?
... View more
04-22-2021
04:54 PM
Apparently there is a new version of eStreamer available (4.2.0).. wondering if anyone used that version? I'm using 4.0.9 and it stops working every 2, 3 days. when I run the status command below: /opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh status getting this error: Traceback (most recent call last):
File "./estreamer/configure.py", line 38, in <module>
import estreamer.common.convert as convert
File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/__init__.py", line 28, in <module>
from estreamer.connection import Connection
File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/connection.py", line 23, in <module>
import ssl
File "/opt/splunk/lib/python3.7/ssl.py", line 98, in <module>
import _ssl # if we can't import it, let the error propagate
ImportError: libssl.so.1.0.0: cannot open shared object file: No such file or directory any recommendation to solve this? 🙂
... View more
04-22-2021
03:27 PM
Hello All, Actually I have Deployment Server in my environment and wondering to know the impact of Universal Forwarders communication with Deployment Server on network bandwidth, when they are phoning home. The total size of deployed apps (10 apps) are <1200KB and I have 500 Universal Forwarders installed (mainly on Windows devices). Is there any recommendation to calculate the volume of this type of traffic? Thanks in advance. A.
... View more
01-14-2020
10:03 AM
Thank you all in advance! Actually, I have built a lab environment (AWS) and installed the ES APP (Enterprise Security). Now, I am looking for a solution to have access to the required data (real-time) which can be used in ES. I tried to install the Eventgen and make it work, but it does not seem to be an easy procedure. Could you please provide me a straight forward solution.
... View more
