About abhic25

abhic25 · ‎12-23-2021

thanks @isoutamo and @scelikok I will keep /opt/splunk/var/lib/splunk + /opt/splunk/etc) to safe place.

abhic25 · ‎12-22-2021

hi Experts, We are planning to decommission on-prem Splunk Ent 8.0. can anyone advise on how to backup and archive existing Splunk Indexed data for future reference? also if we have to open this archived data in the future then how we can open it without Splunk. We have 1xSH, 1xIndexer, 2 HF all are 8.0.

abhic25 · ‎08-25-2021

Hi All, Can anyone advise me on below I have Windows Application logs disabled already but I need one event ID that should be allowed.

abhic25 · ‎06-14-2021

I have added blackliste3 as per below in "Splunk_TA_Windows" on one Universal Forwarder it worked. Now want to update on all Universal Forwarder then do i need to manually edit this app on all servers? I tried, editing "Splunk_TA_Windows" on the deployment server where this app installed-restarted splunk, restarted UF too but no luck, any idea? blacklist3 = EventCode="(4634|4672)" Message="(?m)Account\sName:[^\n]+\$$"

abhic25 · ‎04-15-2021

Hi How should I set TLS settings to compatible with HF or cert for Universal Forwarder to send data to HF because my UF suppose to send data to HF in my environment but I see the below error in splnkd.log I am getting "ssl3_get_client_hello wrong version number" This UF server was down for a long time and i renamed it after power-on, so might need a new cert to do a handshake with HF but I am not getting exact steps to follow.

abhic25 · ‎04-06-2021

@aasabatini thanks for reply, Its not distributed environment. 1 SH 1 Indexer 2 HF Also, need to understand. how to upgrade HF.

abhic25 · ‎04-06-2021

I have two queries Here - 1. I am planning to upgrade my Environment to 8.0, I am not 100% sure about my upgrade plan, can anyone confirm if this would be the correct strategy? 2. Also, I am not sure on How upgrading Heavy Forwarder. Any steps will help here. Role Current Version Intermediate update Target Version Search Head, Deployment, License Mgr. 7.2.6 NA 8.0 Indexer 7.2.6 NA 8.0 Heavy Forwarder 6.5.2 7.2 8.0 Heavy Forwarder 6.5.2 7.2 8.0 Universal Forwarders 6.5.2 7.2 8.0 Upgrade Heavy Forwarder to 7.2 Upgrade UF to 7.2 Upgrade all Splunk Apps. Upgrade Search Head to 8.0 Upgrade Indexer to 8.0 Upgrade Heavy Forwarders to 8.0 Upgrade Heavy Forwarders to 8.0 Upgrade Universal Forwarders to 8.0

abhic25 · ‎03-22-2021

@isoutamo Thanks for your response, I have pasted both XML files here "SAmple_search.xml" <view onunloadCancelJobs="False" autoCancelInterval="100">  <label>Sample search</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="SearchBar" layoutPanel="splSearchControls-inline"> <param name="useAssistant">true</param> <param name="useTypeahead">true</param> <param name="useOwnSubmitButton">False</param> <module name="TimeRangePicker"> <param name="selected">All time</param> <param name="searchWhenChanged">True</param> <module name="SubmitButton"> <param name="allowSoftSubmit">True</param> <module name="Message" layoutPanel="graphArea"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">2</param> <module name="JobStatus"> <param name="resultsLink"> <param name="popup">True</param> <param name="viewTarget">report_builder_define_data</param> <param name="transformedResultsViewTarget">report_builder_format_report</param> </param> <module name="FlashTimeline" layoutPanel="graphArea"> <param name="height">180px</param> <param name="width">100%</param> <module name="TitleBar" layoutPanel="viewHeader"/> <module name="FieldPicker" layoutPanel="sidebar"> <param name="fields">host sourcetype source</param> <param name="link"> <param name="view">report_builder_format_report</param> </param> <module name="Message" layoutPanel="resultsAreaLeft"> <param name="filter">pageControls</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="Count" layoutPanel="pageControls"> <param name="options"> <list> <param name="text">10</param> <param name="value">10</param> </list> <list> <param name="text">20</param> <param name="value">20</param> </list> <list> <param name="text">50</param> <param name="selected">True</param> <param name="value">50</param> </list> </param> <module name="ButtonSwitcher" layoutPanel="pageControls"> <param name="mode">independent</param> <param name="selected">splIcon-events-list</param> <param name="disableOnNull">True</param> <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List"> <param name="entityLabel">events</param> <param name="entityName">events</param> <module name="Paginator" layoutPanel="pageControls"> <param name="entityName">events</param> <param name="maxPages">10</param> <module name="SoftWrap" layoutPanel="resultsOptions"> <param name="enable">True</param> <module name="RowNumbers"> <module name="MaxLines"> <param name="options"> <list> <param name="text">5</param> <param name="selected">True</param> <param name="value">5</param> </list> <list> <param name="text">10</param> <param name="value">10</param> </list> <list> <param name="text">20</param> <param name="value">20</param> </list> <list> <param name="text">50</param> <param name="value">50</param> </list> <list> <param name="text">100</param> <param name="value">100</param> </list> <list> <param name="text">200</param> <param name="value">200</param> </list> <list> <param name="text">All</param> <param name="value">0</param> </list> </param> <module name="Segmentation" > <param name="options"> <list> <param name="text">inner</param> <param name="selected">True</param> <param name="value">inner</param> </list> <list> <param name="text">outer</param> <param name="value">outer</param> </list> <list> <param name="text">full</param> <param name="value">full</param> </list> <list> <param name="text">raw</param> <param name="value">raw</param> </list> </param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> <param name="reportFieldLink">report_builder_format_report</param> </module> </module> </module> </module> </module> </module> </module> <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table"> <param name="entityLabel">events</param> <param name="entityName">events</param> <module name="Paginator" layoutPanel="pageControls"> <param name="count">50</param> <param name="entityName">events</param> <param name="maxPages">10</param> <module name="RowNumbers" layoutPanel="resultsOptions"> <module name="DataOverlay" layoutPanel="resultsAreaLeft"> <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft"> <param name="entityName">events</param> </module> </module> </module> </module> </module> <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table"> <param name="entityLabel">results</param> <param name="entityName">results</param> <module name="EnablePreview" group="show" layoutPanel="resultsOptions"> <param name="enable">True</param> <module name="Paginator" layoutPanel="pageControls"> <param name="count">50</param> <param name="entityName">results</param> <param name="maxPages">10</param> <module name="RowNumbers" layoutPanel="resultsOptions"> <module name="DataOverlay" layoutPanel="resultsAreaLeft"> <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft"> <param name="entityName">results</param> </module> </module> </module> </module> </module> </module> </module> </module> <module name="MultiFieldViewer"> <param name="link"> <param name="view">report_builder_format_report</param> </param> </module> <module name="SuggestedFieldViewer"> <param name="minDistinctCount">1</param> <param name="minFrequency">0.5</param> <param name="maxFields">50</param> <param name="exclude"> <list>^date_.*</list> </param> <param name="link"> <param name="view">report_builder_format_report</param> </param> </module> </module> </module> </module> </module> </module> </module> </module> </view> "sample_notimeline.xml"  <view onunloadCancelJobs="False" autoCancelInterval="100"> <label>Sample no timeline</label>  <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/>  <module name="SearchBar" layoutPanel="splSearchControls-inline"> <param name="useOwnSubmitButton">False</param> <module name="SubmitButton"> <param name="allowSoftSubmit">True</param>  <module name="Paginator" layoutPanel="mainSearchControls"> <param name="entityName">events</param>  <module name="EventsViewer" layoutPanel="mainSearchControls"/> </module> </module> </module> </view>

abhic25 · ‎03-21-2021

I am planning to upgrade Splunk 7.2.6 to 8.1 and before that, i am planning a Python upgrade from 2.7 to 3. So when I ran the Splunk platform upgrade readiness app I got one private app called "Forward to Indexer" in our environment getting blocker and which shows Advance XML - Remove all usage of advance XML File path - \Local/data/ui/view\sample_search.xml \local/data/ui/view\sample_notimeline.xml As i am not understanding How to deal with this XML, even I am not able to understand where is this app getting used and what is impact if that XML gets removed.

abhic25 · ‎10-01-2020

Hi, I have existing set of prod servers sending logs to splunk which has 10GB license capacity, is this possible to exclude upcoming staging servers which will be sending logs to existing licensing, might in future when we upgrade the license then we are planning to send some security logs to indexing and search for audit purpose.

Posts	10
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎10-01-2020

Online Status	Offline
Date Last Visited	‎12-23-2021 09:28 PM

Splunk instances decommission and backup/archive

Disable Windows application Events and allow only ...

Splunk_TA_Windows - input.conf update

UF not sending data to HF on 9997

Upgrade plan and path From 7.2 to 8.0

Splunk Enterprise 7.2.6 upgrade to 8.1 and python ...

How to exclude staging servers logs counting in da...

Re: Splunk instances decommission and backup/archi...