About Mai_splunk

Mai_splunk · ‎02-01-2021

Thanks for your quickly response @richgalloway Imagine that a client has UTM+2 and other with UTM+3. I configure their UF with that timezone, but my indexer has summer time and winter time UTM+1 and UTM+2 How can I manage this?

Mai_splunk · ‎02-01-2021

Hi all! I have a problem with the time my logs arrive. There is an hour difference. how can I solve that? If I have data from different clients with different timezone on the same server, how can I align them? Thanks a lot!

Mai_splunk · ‎12-10-2020

Hi @woodcock I'm triying this solutions without good results. I'm receiving message info after config the props.conf. In deploy server, into the app, in local/props.conf I configure the parameters. Do i Need anymore things? Thanks!

Mai_splunk · ‎10-19-2020

Thanks so much @Richfez you have been a great help. Take care.

Mai_splunk · ‎10-19-2020

Thanks so much, it's exactly that i want! One more doubt, now, How I can reduce the serarch only a public IP? I'm trying this: srcip!="10.*" AND srcip<"172.16.*" AND srcip>"172.31.*" AND srcip!="192.168.*" but in the 3th parameter i get any results.

Mai_splunk · ‎10-19-2020

Hi team! How can I optimize the following search? I want to find ips that have made an attack and have been blocked by the UTM but that have registered any allowed connection. index=xxxx type=utm action=blocked | table srcip | join type=inner [search index=xxxx type=traffic action=allowed] | stats count by srcip Thanks in advance!

Mai_splunk · ‎07-22-2020

For some months we have been having problems sending email alerts. The message is as follows: 2020-07-22 12:00:16,226 +0200 INFO sendemail:1146 - sendemail pdfgen_available = 1 2020-07-22 12:00:16,227 +0200 INFO sendemail:1286 - sendemail:mail effectiveTime=1595412000 2020-07-22 12:00:19,150 +0200 INFO sendemail:1306 - Generated PDF for email 2020-07-22 12:00:20,298 +0200 ERROR sendemail:137 - Sending email. subject="Splunk Report: License Usage PRODUCTION", results_link="https://xxxxx/app/search/@go?sid=scheduler__admin__search__RMD569643b83e5ae4406_at_1595412000_82981", recipients="[u'xxxx@xxxcom', u'xxxx@xxx.com']", server="smtp.office365.com:587" 2020-07-22 12:00:20,298 +0200 ERROR sendemail:458 - (554, '5.2.0 STOREDRV.Submission.Exception:SendAsDeniedException.MapiExceptionSendAsDenied; Failed to process message due to a permanent exception with message Cannot submit message. 0.35250:02016A81, 1.36674:0A000000, 1.61250:00000000, 1.45378:02000000, 1.44866:96510000, 1.36674:0E000000, 1.61250:00000000, 1.45378:9B510000, 1.44866:B4030000, 16.55847:67100000, 17.43559:0000000024020000000000000000000000000000, 20.52176:140F7B8C1B00103100000000, 20.50032:140F7B8C8B17000000000000, 0.35180:140F7B8C, 255.23226:0A007081, 255.27962:0A000000, 255.27962:0E000000, 255.31418:0A007181, 0.35250:00000000, 1.36674:0A000000, 1.61250:00000000, 1.45378:02000000, 1.44866:5E000000, 1.36674:32000000, 1.61250:00000000, 1.45378:63000000, 1.44866:01000000, 16.55847:CA000000, 17.43559:0000000070030000000000000100000000000000, 20.52176:140F7B8C1B00101053000000, 20.50032:140F7B8C8B1700006E2C0000, 0.35180:58000000, 255.23226:4800D13D, 255.27962:0A000000, 255.27962:32000000, 255.17082:DC040000, 0.27745:782C0000, 4.21921:DC040000, 255.27962:FA000000, 255.1494:7D2C0000, 0.38698:05000780, 0.37692:01000000, 0.37948:00400600, 5.33852:00000000534D545000040480, 7.36354:0100000000000109302E3331, 4.56248:DC040000, 7.40748:010000000000010B3A396133, 7.57132:00000000000000003932612D, 1.63016:32000000, 4.39640:DC040000, 8.45434:EC100AF9E504794BA48473AAD7EDE1BB3932612D, 5.10786:0000000031352E32302E333139352E3032373A414D36505230354D42363238303A39613361313639312D333266342D343932612D623232622D62303463366135373834316200201000000000, 7.51330:1B0F0A0B262ED80818000000, 0.39570:00000000, 1.55954:0A000000, 0.49266:02000000, 1.33010:0A000000, 2.54258:00000000, 0.40002:07000000, 1.56562:00000000, 1.64146:32000000, 1.33010:32000000, 2.54258:DC040000, 255.1750:AF000000, 255.31418:0A005D36, 0.22753:4F2E0000, 255.21817:DC040000, 0.64418:0A00F565, 4.39842:DC040000, 0.41586:B9000000, 4.60547:DC040000, 0.21966:852E0000, 4.30158:DC040000 [Hostname=AM6PR05MB6280.eurprd05.prod.outlook.com]') When I use the sendemail command with the from option it works correctly, but dede alerts does not. Can someone help me? Thanks a lot!!

Mai_splunk · ‎07-09-2020

Yes, because i want monitor only some counters and not all of them. The selected mode there is not a problem to ingest the data, but i tried both and the same problem, no data ingested. Thanks!

Mai_splunk · ‎07-08-2020

Hi @richgalloway Yes i have checked it and have not found any error about perfmon. 07-08-2020 18:14:00.521 +0200 INFO SpecFiles - Found external scheme definition for stanza="perfmon://" from spec file="C:\Program Files\HomeOffSec\etc\system\README\inputs.conf.spec" with parameters="object, counters, instances, interval, mode, samplingInterval, stats, disabled, showZeroValue, useEnglishOnly, useWinApiProcStats, formatString, usePDHFmtNoCap100" 07-08-2020 18:14:01.402 +0200 INFO ModularInputs - Introspection setup completed for scheme "perfmon". 07-08-2020 18:14:01.838 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\HomeOffSec\bin\splunk-perfmon.exe" Thanks a lot.

Mai_splunk · ‎07-08-2020

Hi @gcusello yes, im working with the last version available in splunkbase 8.0.0

Mai_splunk · ‎07-08-2020

I have a Splunk Deployment Server that pull the apps to UF. I have create an app WinPerfmon and inside of inputs.conf: [perfmon://LogicalDisk] counters = % Free Space; Free Megabytes disabled = 0 instances = * interval = 10 object = LogicalDisk useEnglishOnly=true ## Memory [perfmon://Memory] counters = Available MBytes disabled = 0 interval = 10 object = Memory useEnglishOnly=true The app is created on UF but splunk-perfmon.exe is running one second and after is closed and not send any data to the indexer. In splunkd.log: 07-08-2020 16:57:32.423 +0200 DEBUG ExecProcessor - Running: "C:\Program Files\HomeOffSec\bin\splunk-perfmon.exe" on PipelineSet 0 07-08-2020 16:57:32.423 +0200 DEBUG ExecProcessor - PipelineSet 0: Created new ExecedCommandPipe for ""C:\Program Files\HomeOffSec\bin\splunk-perfmon.exe"", uniqueId=5 07-08-2020 16:57:32.423 +0200 DEBUG QueueManager - Failed to parse memory queueSize for path=perfmon and conf=inputs. 07-08-2020 16:57:32.423 +0200 DEBUG QueueManager - Failed to parse queueSize for path=perfmon and conf=inputs. 07-08-2020 16:57:32.423 +0200 DEBUG QueueManager - Memory queueSize for path=perfmonand conf=inputs and queueName=execProcessorInternalQ set to 512000. I have other app WinEventlog and splunk-wineventlog.exe is working. UF has been installed as Windows local admin user. Could any help me please? Should I do something else in Windows?

Posts	11
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎07-08-2020

Online Status	Offline
Date Last Visited	‎06-03-2021 09:39 AM

Different timezone

Optimize my search

554, '5.2.0 STOREDRV.Submission.Exception:SendAsDe...

splunk-perfmon.exe not run

Re: Different timezone

Different timezone

Re: How to remove the Windows message description

Re: Optimize my search

Re: Optimize my search

Optimize my search

554, '5.2.0 STOREDRV.Submission.Exception:SendAsDe...

Re: splunk-perfmon.exe not run

Re: splunk-perfmon.exe not run

Re: splunk-perfmon.exe not run

splunk-perfmon.exe not run