About wbolten

wbolten · ‎05-06-2021

I accepted your post as the solution as it directed me to a direction that got me there. 😉

wbolten · ‎09-22-2020

Hi, For some reason, I am failing to get any network monitoring data into my environment. I can successfully retrieve perfmon, script data, REST, and HEC. But as soon as I create a stanza with [WinNetMon://bla] nothing happens. This is the stanza I am now using. I am actually looking for a different process but this process is always present. [WinNetMon://lsass] disabled=0 addressFamily=ipv4 direction=inbound;outbound interval=60 protocol=udp;tcp index=uf_process process=lsass packetType=accept;connect;LostPacket I even tried the minimum. [WinNetMon://lsass] disabled=0 index=uf_process The app is deployed with the Windows Deployment server and it lands on the client just nicely. On the client, I pulled the following from the splunkd.log. 09-22-2020 13:57:29.780 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"" splunk-netmon - NetmonStartDriver - StartService failure for splknetdrv! Error = -2144206839 09-22-2020 13:57:29.780 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"" splunk-netmon - NetmonAppDoMonitoring: Failed to open monitor device: 0x80320009 09-22-2020 13:57:29.780 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"" splunk-netmon - NetmonAppDoMonitoring: Error 0x80320009 occurred during execution This shows up after the restart of the UF on the client. I can't seem to find the solution to this one? I tried to change the service the UF is running under from LOCAL SYSTEM ACCOUNT to a named account with local admin rights but it did not make any difference. It almost looks like the Windows client is missing something. This morning I removed the universal forwarder and installed the latest version. Still nothing.

wbolten · ‎08-20-2020

Hi, I am using the UF to collect data from the system. Using the following stanza I seem to receive all the information in regards to the bytes sent and received. That is too much information for me. I am interested in traffic generated by a specific process, or processes. To be able to do this I have currently the following stanza live but it seems to be still sending everything. Not using the whitelist option. I also don't see the option in the documentation so that would not surprise me. [perfmon://Network Adapter WebEx] counters = Bytes Received/sec;Bytes Sent/sec instances = * whitelist = *.webex.com interval = 60 mode = single object = Network Interface index = xxxyyyzzz useEnglishOnly = true sourcetype = xxxyyyzzz:Network Adapter disabled = 0 What would be the best way, if even possible, to only catch and the network traffic for a specific process or processes? Besides traffic I am also interested in other metrics such as errors, dropped packets etc. Maybe I am going about this the wrong way. Any help would be appreciated.

wbolten · ‎08-11-2020

I did not know that 😉 With your suggestion I did get a single row but the 0 values where in there as well. Replaced them with isnull and now I only have values and a single two per server. | stats latest(Value) as Value by host, counter | eval "CPU Time" = if(counter="% Processor Time",Value,isnull) | eval "RAM Available" = if(counter="Available MBytes",Value,isnull) | eval "C Free Space" = if(counter="% Free Space",Value,isnull) | stats Values(*) as * by host | table host, "CPU Time", "RAM Available", "C Free Space" Thanks

wbolten · ‎03-26-2020

Yep, that has done it. Many thanks. Did not occur to me to use case for this. I corrected a typo in the CRITICAL part. The status number is 14 and not 4 but it works perfectly.

wbolten · ‎03-30-2020

Right, eventually found something that works for me. Not sure if it is the best way but it does work. Below is the query to get the result shown above. I simply added in the alert the line | search Prediction < 2000 Just above the last one where I removed the fields I don't want to see. The result is two dates in the future. the 11th and the 12th of April. So it works and returns the dates to focus on. For the alert itself the end result needs to be cleaned up but it does what I need. index=xxxxx host=xxxxx source="Perfmon:Memory" counter="Available MBytes" | eval Value=round(Value,0) | timechart span=1d avg(Value) as "Available MBytes", latest(host) as host, latest(counter) as counter partial=false | lookup resource_thresholds.csv resource_name AS host, resource_metric AS counter OUTPUTNEW resource_threshold_warning,resource_threshold_critical | eval Warning=resource_threshold_warning | eval Critical=resource_threshold_critical | predict "Available MBytes" as Prediction future_timespan=14 | eval Prediction = round(Prediction,0) | fields - lower95(Prediction), upper95(Prediction) resource_threshold_warning resource_threshold_critical host counter

wbolten · ‎02-07-2020

Thank you, I have done so.

Posts	14
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎12-02-2019

Online Status	Offline
Date Last Visited	‎10-19-2021 11:26 AM

Calculate Delta for a value for all hosts

WinNetMon stanza not working when trying to get ne...

Whitelist network traffic

Join SPL result to a single line?

GEOSTATS Rename value in piechart

Trigger alert on value from predict calculation

Too much annotations

Re: Calculate Delta for a value for all hosts

WinNetMon stanza not working when trying to get ne...

Whitelist network traffic

Re: Join SPL result to a single line?

Re: GEOSTATS Rename value in piechart

Re: Trigger alert on value from predict calculatio...

Re: Too much annotations

Join the Conversation