About saeed

saeed · ‎02-02-2021

Hi, I have one index for Palo Alto and there are other Palo Alto already integrated and indexed to this index. i want to integrate and add one more Palo Alto to this index. How can i do it?

saeed · ‎02-01-2021

Thanks a lot @gcusello My problem is the current retention period is 52 days and i want to increase the cold storage for Palo Alto index to be searchable for the last 6 months , i only found time setting under [ default ]: frozenTimePeriodInSecs = 4492800 i didn't find time period for index [pa]

saeed · ‎01-31-2021

Thanks a lot I will add it and it will be like this: [pa] repFactor = auto homePath = volume:hot/pa/db homePath.maxDataSizeMB = 512000 coldPath = volume:cold/pa/colddb coldPath.maxDataSizeMB = 512000 thawedPath = $SPLUNK_DB_THAWED/pa/thaweddb coldToFrozenDir = $SPLUNK_DB_FROZEN/pa/frozendb frozenTimePeriodInSecs = 15552000 Correct?

saeed · ‎01-30-2021

Hi, I would like to increase the cold retention period for index [pa] to 180 days, but when i get into indexes.conf i only see below configuration there is no frozenTimePeriodInSecs = for index pa # Index for Palo Alto Networks # This index is required by Splunk_TA_paloalto [pa] repFactor = auto homePath = volume:hot/pa/db homePath.maxDataSizeMB = 512000 coldPath = volume:cold/pa/colddb coldPath.maxDataSizeMB = 512000 thawedPath = $SPLUNK_DB_THAWED/pa/thaweddb coldToFrozenDir = $SPLUNK_DB_FROZEN/pa/frozendb where can i find the time setting for this index?

saeed · ‎01-12-2021

@General_Talos Could u please explain how can I do it with Splunk API?

saeed · ‎01-10-2021

Hi, i would like to send Alert from Splunk to specific folder in File Server instead of sending to my Email is there any way? Thanks

saeed · ‎01-05-2021

Hi When i search in Splunk I only find logs in last 52 days I need to increase the retention period to be available and searchable for 6 mounths how can I do it? Should I increase the Cold data ? I have 3 indexers(Clustered) should I do it for 3 Indexers? any advice please thanks

saeed · ‎01-05-2021

Thanks a lot

saeed · ‎01-03-2021

Hi, (My Splunk Apps are installed on Linux Servers) I would like to restore logs from frozen data and read them So please I need the steps to do it.

saeed · ‎01-03-2021

Thanks a lot

saeed · ‎12-31-2020

All Splunk Apps are installed on Linux Servers and we will apply OS patch. And i have 3 Indexers, 4 Search Heads, 1 Deployment Server and 1 Heavy Forwarder (an Indexer Cluster is integrates with a SHC) Could you please advise me what should i stop first or can i stop them at the same time? will i loss Data in this Activity?

Posts	11
Solutions	1
Karma Given	4
Karma Received	0
Member Since	‎12-31-2020

Online Status	Offline
Date Last Visited	‎02-08-2021 01:23 AM

How can i intgrate Palo Alto with Splunk

Increase Cold retention period

Send Alart to shared folder

retention period

Steps to restor Frozen Data

Restart activity

How can i intgrate Palo Alto with Splunk

Re: Increase Cold retention period

Re: Increase Cold retention period

Increase Cold retention period

Re: Send Alart to shared folder

Send Alart to shared folder

retention period

Re: Steps to restor Frozen Data

Steps to restor Frozen Data

Re: Restart activity

Restart activity