Hello. Good afternoon.  Looking for some best practices here.  Over the years, we have been using the UF to ingest Windows data.  This is a reliable solution for ensuring the Windows events are being ingested into Splunk indexes.  We now have a new solution called Crowdstrike which seems to also ingest Windows events as well.  Based on the experience from the Splunk Community, can anyone share their experiences (or best practices)?  We would like to have a reliable Windows solution but refrain from having duplicate data. Regards, Max   ... View more

Hello. We are currently utilizing TA-ms-loganalytics from Splunkbase.  Although we are able to ingest data from Log Analytics (Azure), we do encounter situations where the feed stops.  Has anyone else faced similar issues?  Below are some error messages we receive ... message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ERRORlocal variable 'data' referenced before assignment message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" UnboundLocalError: local variable 'data' referenced before assignment message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"     for i in range(len(data["tables"][0]["rows"])): message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"   File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"     input_module.collect_events(self, ew) message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"   File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"     self.collect_events(ew) message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"   File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" Traceback (most recent call last): If you encountered a similar issue/errors, it would be great to learn how you resolved it.  Thanks. Regards, Max   ... View more

Hello. Good afternoon.  We are receiving a "DBX Server did not respond within 310 seconds, please make sure it is started and listening".  Attached is a screenshot of the error message.  What is the best approach to resolving this? Regards, Max   ... View more

Hello. Currently, we are looking to resolve an issue using the TA for Microsoft Cloud Services.  The TA has been installed on our Heavy Forwarder and used to ingest IIS log files from a Storage Blob.  Below are the error messages we receive ... ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=xxx.xxx.xxx.xxx:65138 in streaming mode. Meximum message size allowed=67108864. Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. ERROR ApplicationUpdater - Error checking for update, URL=https://apps.splunk.com/api/apps:resolve/checkforupgrade: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed - please check the output of the 'openssl verify' command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name. ERROR X509Verify - X509 certificate (CN=GlobalSign,O=GlobalSign Root CA - R3) failed validation; error=19, reason="self signed certificate in certificate chain" We have checked the SSL configurations ... server.conf [sslConfig] sslRootCAPath = /opt/splunk/etc/auth/cacert.pem inputs.conf [splunktcp-ssl:9997] disabled = 0 [SSL] serverCert = $SPLUNK_HOME/etc/auth/server.pem sslPassword = password requireClientCert = false And they look fine.  Has anyone else faced something similar?  If so, what did you to resolve this issue.  Thanks. Regards, Max   ... View more

Hello. Currently, we are trying to get a new SQL query to function within DB Connect.  The SQL query runs against a Postgres database.  Although the SQL query runs fine in batch mode, it is not running so well when setting up the same in rising mode.  Attached is a screenshot of the error message we are receiving. We tried setting the rising column as "created_at".  Also, we tried adding the following lines to the SQL query: AND created_at > ? ORDER BY created_at ASC But we receive error messages: org.postgresql.util.PSQLException: No value specified for parameter 1. org.postgresql.util.PSQLException: The column index is out of range: 1, number of columns: 0. Can someone suggest the best approach to resolving this? Regards, Max   ... View more

Hello. Trying to test a sourcetype using "oneshot".  Although we were able to add raw data using "oneshot" the first time, we are not seeing any subsequent updates.  The command we are using is ... splunk add oneshot /tmp/<filename>.txt -index <indexname> -sourcetype <sourcetypename> What are the best approaches to troubleshoot "oneshot"? Regards, Max   ... View more

Hello. We are currently looking to utilize Splunk for monitoring a few configuration files on a server.  To do that, we have added the following stanza to the inputs.conf file ... [fschange:C:\Splunk test\Test File 1.txt] pollPeriod = 30 signedaudit = false index = <index_name> sourcetype = test:file:1 fullEvent=true When searching using the following SPL search ... index=<index_name> | head 10 | table path action modtime host source sourcetype The data ingested looks good.  That is, we are getting details on when the change occurred as well as the changes made from within the file.  But one field seems to be missing.  Using the "fschange" stanza, how can we also get "user" data (ie. who was the one making the update)? Regards, Max ... View more

Hello. Trying to resolve an issue with routing log events.  The goal is to route log events with an "Api" keyword to a separate index.  Here is a log sample of three events (the first has no "Api" embedded, the next two have "Api"): 2020-08-12 23:04:24 W3SVC5 SERVER_1 XX.XX.XX.XXX GET / - 443 - XX.XX.XX.XX HTTP/0.9 - - - - 302 0 0 389 7 10 2020-08-12 23:04:24 W3SVC5 SERVER_1 XX.XX.XX.XXX GET /Api/TopicsUpdate/GetRecalculationServiceTopicsThatMustBeUpdated pageSize=1 443 system.service XX.XX.XX.XX HTTP/1.1 - - - XX.XX.XX.XX 200 0 0 597 175 44 2020-08-12 23:04:22 W3SVC5 SERVER_1 XX.XX.XX.XXX GET /Api/TopicsUpdate/GetRecalculationServiceTopicsThatMustBeUpdated pageSize=1 443 system.service XX.XX.XX.XX HTTP/1.1 - - - XX.XX.XX.XX 200 0 0 597 175 54 Here is the props.conf files: [sourcetype1] TRANSFORMS-set = sourcetype_web_rename_iis,sourcetype_api_rename_iis,web_index_rename_iis,api_index_rename_iis Here is the transforms.conf: [sourcetype_web_rename_iis] REGEX = \d+\-\d+\-\d+\s\d+\:\d+\:\d+\s\w+\s\w+\s\d+.\d+\.\d+\.\d+\s\w+\s\/(?!Api) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::ms:iis [sourcetype_api_rename_iis] REGEX = \d+\-\d+\-\d+\s\d+\:\d+\:\d+\s\w+\s\w+\s\d+.\d+\.\d+\.\d+\s\w+\s\/Api\/ DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::ms:iis [web_index_rename_iis] REGEX = \d+\-\d+\-\d+\s\d+\:\d+\:\d+\s\w+\s\w+\s\d+.\d+\.\d+\.\d+\s\w+\s\/(?!Api) DEST_KEY = _MetaData:Index FORMAT = index1 [api_index_rename_iis] REGEX = \d+\-\d+\-\d+\s\d+\:\d+\:\d+\s\w+\s\w+\s\d+.\d+\.\d+\.\d+\s\w+\s\/Api\/ DEST_KEY = _MetaData:Index FORMAT = index2 Are there any special considerations when using (?!...)? Regards, Max ... View more