About aivarson_splunk

aivarson_splunk · ‎01-03-2020

Call Splunk support and have them help you clear the license error.

aivarson_splunk · ‎08-07-2018

Is this your own Splunk running in the cloud or SplunkCloud (our SaaS product)? If it is your Splunk in the cloud (Bring your own license) then you can do it from the SH. If it is our SplunkCloud the current solution is to configure an on-premise Search Head and put it in Hybrid Search Mode to perform your alert actions. Correction to #2 above. You don't need to specify a port on Splunk to use. It's a REST API input. That is a pull from your ServiceNow system so it's whatever port (likely 443) that your ServiceNow site uses. Just follow the instructions from our add-on and you should be good. http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/About

aivarson_splunk · ‎08-07-2018

The Add-ons contain lookups and field extractions that happen at search time. If you have it at the Heavy Forwarder layer it will handle the inputs (data onboarding) and some index time field extractions but won't do the search time extractions or lookups. You don't need to specify a port on Splunk to use. It's a REST API input. That is a pull from your ServiceNow system so it's whatever port (likely 443) that your ServiceNow site uses. Just follow the instructions from our add-on and you should be good. http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/About That is a correct statement for most Add-on vs App discussions. Some add-ons like this one will also do a little more than just inputs. This add-on also contains lookups to convert any cryptic field values to human readable text and do the field extractions which make the dashboards populate nicely. The Add-on also contains a few pre-built panels if you want to build your own dashboards and it contains some alerts actions if you want to send data back to ServiceNow.

aivarson_splunk · ‎08-02-2018

Currently, the best way to do this is with a Splunk Heavy Forwarder. The HF can be at your site or in any Cloud provider (AWS, Azure, etc.) then push the data to your SplunkCloud instance.

aivarson_splunk · ‎07-30-2018

When you add a monitor from the CLI it goes to the search app, local, inputs config. $SPLUNK_HOME\etc\apps\search\local\inputs.conf

aivarson_splunk · ‎03-28-2018

You're welcome! Please upvote the answer if it is helpful.

aivarson_splunk · ‎03-28-2018

Hopefully soon. I have contacted Qualys and told them what to fix. In version 1.0.1 they have a .pkg in the app that is not approved for SplunkCloud. Once they remove this text file the app will be approved. Also, keep in mind that you can modify apps and submit for approval via a support ticket. That way you aren't stuck waiting on the vendor to make updates. I've done that on several occasions using the package app command. http://dev.splunk.com/view/SP-CAAAEMY#package Update 5/2/18: Qualys has updated the app to make it compatible with SplunkCloud. version 1.0.2 is available here: https://splunkbase.splunk.com/app/3141/

aivarson_splunk · ‎11-20-2017

Either drive is more than enough for a swap file. What action were you doing when you received this error? How much free memory do you have?

aivarson_splunk · ‎11-20-2017

You can either filter by eventcode or regex. According to Splunk Docs...You can specify one of two formats: One or more Event Log event codes or event IDs (Event Log code/ID format.) One or more sets of keys and regular expressions. (Advanced filtering format.) You cannot mix formats in a single entry. You also cannot mix formats in the same stanza. Examples - event code blacklist blacklist1 = 1100,1101,4624,4634,4647-4649 regex blacklist blacklist1 = EventCode=%^200$% User=%drodman% You can specify up to 10 blacklist per input stanza. If you need more than this you might want to consider a whitelist strategy instead. You just whitelist the codes you need instead of blacklisting the ones you don't. More details here: http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf#Event_Log_whitelist_and_blacklist_formats

aivarson_splunk · ‎01-10-2017

Just created an add-on for this in case you don't want to change your sourcetype from the out of the box access_combined: https://splunkbase.splunk.com/app/3434/

aivarson_splunk · ‎02-04-2016

I'd recommend starting a ticket with Splunk. This is a supported app.

aivarson_splunk · ‎02-04-2016

Are you seeing Events 4662 in your EventLog if you go direct to the Windows Event Log?

aivarson_splunk · ‎01-26-2016

Your best bet is to follow the instructions here: https://answers.splunk.com/answers/200924/formatmessage-error-appears-in-indexed-message-for.html

aivarson_splunk · ‎01-20-2016

Make sure your GPO is auditing those events. http://docs.splunk.com/Documentation/MSApp/1.2.0/MSInfra/ConfigureActiveDirectoryauditpolicy . Specifically make sure that you are auditing policy change. Once you do that, any changes to GPO will be written to the Windows Security Event Log. Those are logged as event code 4662. You can search your Splunk instance for sourcetype="WinEventLog:Security" EventCode=4662 . To see if any events are there. Once they show up, the dashboard should start populating.

aivarson_splunk · ‎03-25-2014

You could always change the access controls for which indexes get searched by default. You can do this either by role or by user. In Version 6 you go to Settings, Access Controls, Pick Users or Role (whichever you want to modify) then scroll down to Indexes searched by default and add the ones you need. If you want to add them all just add All non-internal indexes to searchable. Then you can run a search like this to verify that the indexes are being searched without having to specify them: * | stats values(index)

Posts	15
Solutions	4
Karma Given	9
Karma Received	3
Member Since	‎10-29-2013

Online Status	Offline
Date Last Visited	‎02-05-2026 09:53 AM

Re: splunk licence error message

Re: Why do we need a ServiceNow add-on on a search...

Re: Why do we need a ServiceNow add-on on a search...

Re: How can I ask HTTP/HTTPS GET request to REST a...

Re: Where is my monitor stanza?

Re: 6.6 Cloud Support

Re: 6.6 Cloud Support

Re: Windows version of Splunk installed on E: driv...

Re: How do I blacklist multiple events on same lin...

Re: Easy way to add access_combined to the Web Dat...

Re: Splunk App for Windows Infrastructure: Why is ...

Re: Splunk App for Windows Infrastructure: Why is ...

Re: Why Windows Event Logs show "Splunk could not ...

Re: Splunk App for Windows Infrastructure: Why is ...

Re: Technology Add-on Default Index other than Mai...

Join the Conversation