About sean193

sean193 · ‎11-01-2023

Did they give you a SPL- number for what bug it is?

sean193 · ‎09-13-2022

Never mind, I was able to get it. Using the volume mounts from the example it requires you to create a configmap first `kubectl create configmap splunk-licenses --from-file=enterprise.lic` then you are able to start licmaster as expected and have the lic applied.

sean193 · ‎09-13-2022

Were you able to get this configured? I'd also be curious to know how to properly configure this or where the lic file should exist.

sean193 · ‎10-19-2021

1. Without changing user roles and what that role has access to I'm not sure you can remove that. 2. You can however remove its funtionality in server.conf under [applicationManagement] setting allowInternetAccess = false. This will keep the UI from showing if apps need updating and will keep the "Browse More Apps" area from returning anything.

sean193 · ‎01-18-2021

Hi All, Does anyone else have an issue where the Crowdstrike Stream modular input stops working? The process is still there but is hung. Killing the process allows Splunk to re-create the .py process and start collecting again. (this happens with other modular inputs too). Why does this happen? Is this being addressed?

sean193 · ‎12-15-2020

Why do Modular inputs like crowdstrike stream hang so often?

sean193 · ‎12-07-2020

Hey All, Having issues getting data in. With the inputs monitor stanza only data comes thru but when I add the props to do indexed time field extractions data stops coming all together. No errors are seen in _internal, anyone got some ideas? Inputs.conf [monitor://C:\file\data\] whitelist = file1.csv$ index = file1 sourcetype = file1 disabled = false Props.conf [file1] INDEXED_EXTRACTIONS = CSV FIELD_DELIMETER=, FIELD_QUOTE=" HEADER_FIELD_DELIMETER=,

sean193 · ‎12-01-2020

Feedback as submitted to the doc team.

sean193 · ‎12-01-2020

Well after testing the explicit stanza wins, atleast in the case below. Secure when to main, not linux. This makes since to me just wish it was documented as I could see other people having questions like this. [monitor:///var/log] index = linux disabled = 0 [monitor:///var/log/secure] disabled = false

sean193 · ‎12-01-2020

Hi, Will Splunk use a more explicit Monitor stanza vs a wildcard stanza. Since the stanza's are not identical I do not believe Splunk merges and applies lexicographical order so which stanze wins for the monitored file? My assumption is the more explicit stanza but I can't fing documentation to back that up. Example: [monitor:///var/log/] index = linux vs. [monitor:///var/log/secure.log] index = main

Posts	10
Solutions	1
Karma Given	5
Karma Received	1
Member Since	‎12-01-2020

Online Status	Offline
Date Last Visited	‎11-01-2023 09:45 AM

Crowdstrike Stream Stops Woking

Why does Modular input script hang

Index time csv monitor

Input Monitor order of precedence

Re: Selected Fields Get Reset

Re: How do I go about configuring Splunk operator ...

Re: Splunk operator and standalone licenese manage...

Re: Remove "Manage Apps" and "Find More Apps

Crowdstrike Stream Stops Woking

Why does Modular input script hang

Index time csv monitor

Re: Input Monitor order of precedence

Re: Input Monitor order of precedence

Input Monitor order of precedence