About Ruben_sb1

Ruben_sb1 · ‎08-31-2022

Hello I have a question, I would like to know if there is any way to incorporate my dashboard on my website. and it is able to update by itself. Thanks a lot!

Ruben_sb1 · ‎09-27-2021

Hi everyone. I try to explain you. For example: I can detect when a user has been connected form a X country, in this moment splunk send me a email, and I need to starting a investigation to determinate if that event is known. My question is: How can i configure a second search when that alert has been trigged? I would like Splunk run a search whit the information that it got from the alert. I wouldn’t like to modify my original search because if a add this second search in my firs search My performance could be affected, thanks and regards.

Ruben_sb1 · ‎09-23-2020

I tried to fix it with forwarding the 514 port to 5514 but I can see only one log source I have validated that I receive the log source with tcpdump

Ruben_sb1 · ‎09-23-2020

Hello everyone I have a problem with spluk enterprise(8.0.2) Centos 07 I have 3 log source (all forward logs for 514) in the picture, we can see data input with diferent port includ 514 and que black screem we can see that the port 514 is not listeing Please help me

Ruben_sb1 · ‎09-12-2020

Ruben_sb1 · ‎09-12-2020

hello. I tried but I haven't gotten result the result was 0

Ruben_sb1 · ‎09-11-2020

i have the same error 😞

Ruben_sb1 · ‎09-08-2020

Hello, I would like to know how to build a search with using lookup result I mean I have a list(assent_server.csv) with my servers with the follow filds (ip,priority,nt_host) Ejemple: ip,priority,nt_host 10.10.1.1,critical,SERVER01 10.10.1.2,critical,SERVER02 10.10.1.2,critical,SERVER02 So I need to create the next to: Search any servers that I have in the file assent_server.csv and get the log fiels. I had tried with this search 1)index="win*" host=[|inputlookup asset_list | fields ip] 2)index="win*" | search host=[|inputlookup asset_list | fields nt_host] but I get this result: Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side:

Posts	8
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎09-08-2020

Online Status	Offline
Date Last Visited	‎09-01-2022 07:31 PM

How can I incorporate Splunk dashboard on my own w...

how to run a second search based on an alert that ...

Splunk can´t set up port 514

how to build a search with lookup file

How can I incorporate Splunk dashboard on my own w...

how to run a second search based on an alert that ...

Re: Splunk can´t set up port 514

Splunk can´t set up port 514

Re: how to build a search with lookup file

Re: how to build a search with lookup file

Re: how to build a search with lookup file

how to build a search with lookup file

Join the Conversation