About tdepablo88

tdepablo88 · ‎01-30-2023

Hello Everyone, This time i'm presenting the incompatibility between MSSQL Server 2022 and the Installed on Splunk (11.2). I installed the driver with the official add-on on the Splunkbase, but when i perform the health check the following message appears: "Driver version is invalid, connection: SQL_SERVER, connection_type: generic_mssql." Please help me, because Splunk DB Connect is unstable with the mentioned connection. Best regards, Diego T.

tdepablo88 · ‎08-16-2022

Hello Everyone, Currently i have an Splunk IT Service Manager installed, and i need to monitor que temperature of the CPU and the temperature of the power supply of the server. Anyone can help me to enable those option through the App. Thank you very much. Diego.

tdepablo88 · ‎01-13-2021

Hi, Affirmative I put the same files on the first Heavy forwarder. yes I restart the HF after loading the files. I'll close this question because the fortinets managers applied a filter on his appliances, to solve the issue I applied a filter because Fortinet didn't sent the corrects log files types. thank you again Rich. best regards.

tdepablo88 · ‎01-12-2021

Hi, When i drop traffic events on a Heavy Forwarder (fgt_traffic) my stanza don't work, its weird because in another heavy forwarder i have the same configuration and its works, mi props.conf and transforms.conf are: props.conf # FILTRO Eventos Fortinet Traffic [fgt_log] TRANSFORMS-filtro = filtrado_fortinet_traffic transforms.conf [filtrado_fortinet_traffic] SOURCE_KEY = _raw REGEX = \stype\=\"traffic\"\s DEST_KEY = queue FORMAT = nullQueue best regards. Diego.

tdepablo88 · ‎01-12-2021

Hello, I have an issue with Symantec Bluecoat Proxy SG when i index data to a heavy forwarder. The logs didn't parse correctly and the coverage is less than 5% of the total events, the sourcetype defined is bluecoat:proxysg:access:syslog. What is the correct format of the log?. An example of the log received is attached. Thanks in advance.

tdepablo88 · ‎01-07-2021

I'm very thankful with this help Rich, thanks again.

tdepablo88 · ‎01-07-2021

Hi Rich, i applied the configuration what you mention, but the sourcetype still the same. Here are my new files: props.conf [snmp-traps_cisco-prime] DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom description = Sourcetype Generico SNMP TRAPS CISCO PRIME pulldown_type = true disabled = false TRANSFORMS-reenvioindexes = aruba TRANSFORMS-cambiosourcetype = aruba_stype transforms.conf [aruba] REGEX = \[UDP\:\s\[115\.100\.9\.100\] DEST_KEY = _MetaData:Index FORMAT = aruba [aruba_stype] REGEX = \[UDP\:\s\[115\.100\.9\.100\] DEST_KEY = Metadata:Sourcetype FORMAT = sourcetype:🇦🇼stm And when i restart i have the next message. "Undocumented key used in transforms.conf; stanza='aruba_stype' setting='DEST_KEY' key='Metadata:Sourcetype' Please resolve these problems by correcting typos in key names, or by adding them to [accepted_keys] in transforms.conf if they are intended." Thanks again.

tdepablo88 · ‎01-07-2021

Hi, I'm having an issue with the set of the sourcetype in transforms.conf at the moment of sending the data of a single file to an a index. In first instance the data sends to another index succesfully but with the wrong sourcetype. Here are my conf files: props.conf: [snmp-traps_cisco-prime] DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom description = Sourcetype Generico SNMP TRAPS CISCO PRIME pulldown_type = true disabled = false TRANSFORMS-reenvioindexes_cambiostype = aruba transforms.conf: [aruba] REGEX = \[UDP\:\s\[115\.100\.9\.100\] DEST_KEY = _MetaData:Index FORMAT = aruba DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype:🇦🇼stm P.D: im trying to asign a Aruba Networks sourcetype of a snmptrap. Thanks in advance. Diego

tdepablo88 · ‎01-04-2021

Rich, thanks for the help it works perfectly, now can i define a another sourcetype for the redirection, example: [wlc_pams] REGEX= \[UDP: \[115\.100\.9\.100\] DEST_KEY = _MetaData:Index FORMAT = wlc_pams SOURCETYPE = another? regards. Diego

tdepablo88 · ‎12-27-2020

props.conf [cisco-prime_snmtp-traps] TRANSFORMS-reenvioindexes= wlc_pams, aruba transforms.conf [wlc_pams] REGEX= /\[UDP: \[115\.100\.9\.100\]/g DEST_KEY = _MetaData:Index FORMAT = wlc_pams [aruba] REGEX= /\[UDP: \[172\.22\.175\.102\]/g DEST_KEY = _MetaData:Index FORMAT = Aruba thank you

tdepablo88 · ‎12-24-2020

Hi everyone, I am trying to index data from a single log file to different indexes but i can't do it, i have this data wich need to route to diferent indexes: svr80001.xxxxxx.com [UDP: [172.22.175.102]:27869->[172.22.172.244]:162]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (121711881) 14 days, 2:05:18.81 <UNKNOWN> [UDP: [115.100.9.100]:56090->[172.22.172.244]:162]: I need to filter using the ipaddress, and i follow the next link https://community.splunk.com/t5/Getting-Data-In/How-to-filter-data-from-a-single-file-and-write-to-two-different/m-p/513371 but isn't work to me. Regards, Diego

Posts	11
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎12-24-2020

Online Status	Offline
Date Last Visited	‎01-30-2023 01:25 PM

Help with MSSQL JDBC driver incompatibility error?

How do I enable options to monitor que temperature...

Problem dropping events from fortinet

Problem parsing bluecoat logs

Couldn't set sourcetype on transforms.conf

Index data from a file and send to differents inde...