About thkwon

thkwon · ‎04-14-2022

In-memory technology refers to a technology that stores data in RAM rather than disk. Because processing speed is up to 10,000 times faster than disk storage methods, it is developed as a data storage, processing, and analysis solution centered on database (db) companies such as SAP and Oracle. Is the same in-memory technology applied to Splunk? Does Splunk's Queue (parsing Queue, index Queue...) processing also correspond to in-memory?

thkwon · ‎04-13-2022

Hello Does Splunk in-memory technology work? Big data systems are using in-memory technology across Splunk platforms (data collection/transmission, storage, retrieval, etc.) I wonder if in-memory technology is applied. If you have in-memory technology, is Splunk self-developed? Or I wonder if open-source was used. If you have any data to refer to, please share it with us.

thkwon · ‎12-21-2021

Hello The server cannot be accessed directly. Can I set up a delpoyment-client on a remote forwarder? The 8089 port is open.

thkwon · ‎10-27-2021

Hello Logs are being collected through fschange. Do you know the field description of the fschange log? Particularly curious are isdir, gid, and uid.

thkwon · ‎09-28-2021

Hello Tripwire-enterprise-add-on-for-splunk was installed on Splunk 8.2.1. I referred to the tripwire document, but the settings page does not run. $SPLUNK_HOME/etc/apps/TA-tripwire_enterprise/local/app.conf [install] python.version = python2 Is there anything that needs to be corrected?

thkwon · ‎08-17-2021

Hello I want to save hot/warm and cold separately when I make splunk index. Hot/Warm is stored in /tmp/hotwarm and cold is stored in /tmp/cold path. However, it is time to create an index in the Splunk UI. I know to separate routes from indexes.conf. It's just that I want to save it in the UI as Default in the path I want to save. What should I do? Thanks

thkwon · ‎07-13-2021

Hello My client company uses Splunk and Cybereason. At first, I used the Cybereason For Splunk app 1.1.0. modified the cybereason_rest_client.py file as below. self.session = requests.session() self.session.verify = False Cybereason For Splunk 1.3.0 was released recently, upgrading the app. ERROR occurs in $SPLUNK_HOME/var/log/splunk/cybereason path with modularinput.log and restclient.log. -- modularinput.log ERROR -- 2021-07-13 15:02:21, 354 log_level=ERROR pid=11744 tid=MainThread file="cybereason.py" function="run" line_number="182" version="CybereasonForSplunk.v.1.3.0" Traceback: Traceback (most recent call last): File "/splunk/splunk_test/splunk/etc/apps/CybereasonForSplunk/bin/cybereason.py", line 138, in run events = cyb.get_time_bound_malops(earliest=chk["last_time"], latest=now) File "/splunk/splunk_test/splunk/etc/apps/CybereasonForSplunk/bin/cybereason_rest_client.py", line 420, in get_time_bound_malops raise e File "/splunk/splunk_test/splunk/etc/apps/CybereasonForSplunk/bin/cybereason_rest_client.py", line 358, in get_time_bound_malops severity_dict = self._get_mapped_serverities(earliest, latest) File "/splunk/splunk_test/splunk/etc/apps/CybereasonForSplunk/bin/cybereason_rest_client.py", line 680, in _get_mapped_serverities raise Exception(ret.content) Exception: b'<!DOCTYPE html><html><head><title>Error report</title></head><body><h1>HTTP Status 404 - Not Found</h1></body></html>' 2021-07-13 15:02:21, 354 log_level=ERROR pid=11744 tid=MainThread file="cybereason.py" line_number="181" version="CybereasonForSplunk.v.1.3.0" message=b'<!DOCTYPE html><html><head><title>Error report</title></head><body><h1>HTTP Status 404 - Not Found</h1></body></html>'" filename="cybereason.py" exception_line="138" input="cybereason://cybereason" section="malops" -- restclient.log ERROR -- 2021-07-13 15:02:21, 354 log_level=ERROR pid=11744 tid=MainThread file="cybereason_rest_client.py" function="get_time_bound_malops" line_number="419" version="CybereasonForSplunk.v.1.3.0" message="b'<!DOCTYPE html><html><head><title>Error report</title></head><body><h1>HTTP Status 404 - Not Found</h1></body></html>'" exception_type="Exception" exception_arguments="b'<DOCTYPE html><html><head><title>Error report</title></head><body><h1>HTTP Status 404 - Not Found</h1></body></html>'" exception_type="Exception" exception_arguments="b'<!DOCTYPE html><html><head><title>Error report</title></head><body><h1>HTTP Status 404 - Not Found</h1></body></html>'" filename="cybereason_rest_client.py" line="358" section="get_time_bound_malops" Where is the problem? Thanks

thkwon · ‎02-26-2021

Hello Mus I have a similar question. Script input Do you know how to disable /opt/splunk/bin/scripts/test.sh?

thkwon · ‎02-25-2021

Hello Can I disable the script input setting with CLI? I'm waiting for your answer.

thkwon · ‎02-10-2021

This script uses APIs from other systems to get results.

thkwon · ‎02-10-2021

Hello richgalloway Splunk can run scripts with crontab and second. Error message is 02-09-2021 09:24:19.099 +0900 ERROR ExecProcessor - message from "/home/splunk/splunk/bin/scripts/REALTIME.sh" Error Message occurs whenever a script is executed. Then at some point, the result of the script does not occur. click disable to run the script again, enable must click.

thkwon · ‎02-07-2021

I am collecting logs every 5 seconds using a script. However, script execution is suddenly stopped. Why does the script stop? Is it a Splunk bug? My version is 7.3.3.

Posts	13
Solutions	0
Karma Given	2
Karma Received	2
Member Since	‎11-04-2020

Online Status	Offline
Date Last Visited	‎04-22-2022 05:28 AM

Does Splunk in-memory technology work?

Remote forwarder deploymentclient setup

Field description data input as fschange.

How to install Tripwire Enterprise Add-On Splunk 8...

How to Splunk index path change

Cybereason For Splunk Upgrade Error

Disabling script entry using CLI

Data input script stop !

Re: Splunk in-memory processing