Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ceichhorn
ceichhorn
Engager
Member since:
10-31-2013
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 10-31-2013 |
Activity Feed
- Karma Re: Splunk for Windows and OSSEC for treinke. 06-05-2020 12:46 AM
- Posted Re: Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:51 AM
- Posted Re: Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:27 AM
- Posted Re: Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:17 AM
- Posted Re: Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:06 AM
- Posted Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:00 AM
- Tagged Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:00 AM
- Tagged Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:00 AM
- Tagged Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:00 AM
- Tagged Monitoring files on a local Windows 2008 R2 server, why aren't new files getting indexed? on Getting Data In. 04-24-2015 07:00 AM
- Posted Re: Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs? on Getting Data In. 04-22-2015 12:37 PM
- Posted Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs? on Getting Data In. 04-22-2015 07:08 AM
- Tagged Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs? on Getting Data In. 04-22-2015 07:08 AM
- Tagged Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs? on Getting Data In. 04-22-2015 07:08 AM
- Tagged Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs? on Getting Data In. 04-22-2015 07:08 AM
- Posted Re: Logging Splunk enterprise sign ins? on Getting Data In. 04-02-2015 07:48 AM
- Posted Logging Splunk enterprise sign ins? on Getting Data In. 04-02-2015 06:27 AM
- Tagged Logging Splunk enterprise sign ins? on Getting Data In. 04-02-2015 06:27 AM
- Tagged Logging Splunk enterprise sign ins? on Getting Data In. 04-02-2015 06:27 AM
- Tagged Logging Splunk enterprise sign ins? on Getting Data In. 04-02-2015 06:27 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-24-2015
07:51 AM
Thanks Noum, I see it now. I think, however, that option was already chosen. Now I have to figure out why it's not actually updating.
... View more
04-24-2015
07:27 AM
This is splunk 6.2.
... View more
04-24-2015
07:17 AM
Hi Noumssi,
Where is the "continuously indexing a file" option? I think that's my problem; I can't find that option in Splunk. I am not changing the file name and I have waited 24 hours.
... View more
04-24-2015
07:06 AM
Yes, I'm sorry -- just edited. These are Windows files. The Splunk Enterprise instance is installed on a Windows 2008 R2 server. These files are stored locally.
... View more
04-24-2015
07:00 AM
Hi Everyone,
I'm looking to monitor some files locally on the Splunk instance, and I am able to add them as data inputs. However, this monitoring does not seem to be continuous; it logs those files once and then doesn't continue to monitor them even as data is added. Am I doing something wrong? How do I get these to monitor changes to the files? Thanks very much!
This is a Splunk for Windows instance running on Windows 2008 R2.
... View more
04-22-2015
12:37 PM
Thanks very much Meno, this got it.
... View more
04-22-2015
07:08 AM
I'm running Splunk Enterprise on a Windows 2008 R2 server and I'm looking to index the local security logs for the server in to splunk. I can't seem to figure out how to do this: can someone help me with that? I'm sure it's rather simple, I just can't find it. Thanks!
... View more
04-02-2015
06:27 AM
This question has likely been asked, but the language makes it difficult to search for.
I'm looking to create a search which lists every time someone has logged in to the Splunk Enterprise interface. Is there a simple search that outputs this data? Thanks very much!
... View more
05-07-2014
10:30 AM
Thanks very much Anthony Reinke, this resolved my problem. Logs are now recognized from OSSEC.
... View more
05-07-2014
07:05 AM
Thanks Anthony. Yes, I have 514 open and ready, and other hosts/agents are passing logs through it already. I have tried to add OSSEC as a data input, but (not surprisingly) Splunk is unable to pull the wmi configuration as OSSEC is a Linux box.
... View more
05-07-2014
06:23 AM
Okay, so here is my situation: I am running a Splunk for Window Enterprise Server along with a separate OSSEC server built on the OpenSUSE distribution. I am trying to send alerts and errors from OSSEC HIDS to my Windows Splunk instance. Inside OSSEC, I have syslog_output enabled and set to the correct IP with the splunk chosen. The two servers can see each other (at least, via ping). What else is necessary to get these alerts sent to splunk? Thanks in advance for any help.
... View more
04-29-2014
02:32 PM
I'm testing whether event logs in Splunk can be edited and, if so, if those changes are themselves logged. For instance, if Splunk service is turned off, can the logs be edited? And if so, when Splunk turns back on, does it alert in any way that the logs have been changed? Thanks in advance for any information.
... View more
