Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Daniel28
Daniel28
Explorer
Member since:
04-18-2021
01-05-2022
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 04-18-2021 |
Activity Feed
- Tagged Configuration Replication Port SSL to Indexer Cluster on Security. 01-04-2022 07:47 PM
- Tagged Configuration Replication Port SSL to Indexer Cluster on Security. 01-04-2022 07:46 PM
- Posted Configuration Replication Port SSL to Indexer Cluster on Security. 01-04-2022 02:24 AM
- Posted Using Trend Micro Deep Security for Splunk to parsing log on All Apps and Add-ons. 05-28-2021 12:42 AM
- Tagged Using Trend Micro Deep Security for Splunk to parsing log on All Apps and Add-ons. 05-28-2021 12:42 AM
- Posted Re: How to manage a lot of forwarder agents on Monitoring Splunk. 04-29-2021 08:01 AM
- Posted Re: How to manage a lot of forwarder agents on Monitoring Splunk. 04-29-2021 07:49 AM
- Karma Re: How to manage a lot of forwarder agents for gcusello. 04-29-2021 07:40 AM
- Posted How to manage a lot of forwarder agents on Monitoring Splunk. 04-29-2021 03:27 AM
- Posted How to install Unified Forwarder Monitoring App for Splunk ? on Deployment Architecture. 04-18-2021 07:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-04-2022
02:24 AM
Hello everyone, I'm trying to config SSL to indexer cluster's replication port. I have followed this link to create my SSL cert. https://community.splunk.com/t5/Security/How-do-I-set-up-SSL-forwarding-with-new-self-signed-certificates/td-p/57046 But it wasn't working when I config on my 2 indexers. I'm using Splunk 8.2.4 version and my configuration in file server.conf of indexer 01 same like as: [general] serverName = indexer01 pass4SymmKey = $7$HQ2TzhHg23gLrg+/+ScnhxM9sWIunYIUH07h6YVnt48KdK+zxDO75w== [sslConfig] sslPassword = $7$ok1uDkFNGR57BNpNpzjg7wMPWc6uAng9lvIQPj3YX5MZwhccbVOZWw== [replication_port-ssl://8080] acceptFrom = IP's indexer02 rootCA = /opt/splunk/etc/certs/cacert.pem serverCert = /opt/splunk/etc/certs/indexer.pem sslPassword = P@ssw0rd sslCommonNameToCheck = indexer requireClientCert = true So I would like to ask our community to the correct configuration when I want to enable SSL to Replication Port between Indexers Server ? Please help me Thanks for your concerns !
... View more
Labels
- Labels:
-
SSL
05-28-2021
12:42 AM
Hello everyone I have used Trend Micro Deep Security for Splunk to parsing log from Trend Micro DeepSecurity. Link App : https://splunkbase.splunk.com/app/1936/#/overview Base on installation guide, i have configured sourcetype deepsecurity when i forward this log from Heavy Forwarder. But i didn't see other sourcetypes which have been parsing base on this app (same as sourcetype deepsecurity-antimalware, sourcetype deepsecurity-log_inspection, ...) Have anyone used this app before can help me to install it ? Thanks for your concern !
... View more
- Tags:
- Splunk App
Labels
- Labels:
-
installation
04-29-2021
07:49 AM
Many thanks to you, @gcusello I will follow your guide. But I have other question. Now, i'm using Distributed Mode with 2 Heavy Forwarder and 4 Indexer. So what the best location which i can run your command (as above) to show the results ? Because all of UF agent will forward data to 2 Heavy Forwarder. And then, HF will forward to Indexer. So I have tried some commands before. But it just show Heavy Forwarder's information. Please help me clarify it. I really appreciate your help !
... View more
04-29-2021
03:27 AM
Hi team I have problems when i monitoring many UF (~ 400 agents) with Distributed Architechture (UF --> HF --> Indexer) as below: 1. When a new UF agent connect to Deployment Server, i can't know it. 2. How to prevent local users from uninstalling UF agent on Client host ? 3. Monitoring, alert status UP/DOWN of UF agent. 4. Agent have been deployed Splunk apps or not ? Please give me some solutions in my cases. Thanks for your concerns !
... View more
Labels
04-18-2021
07:42 AM
Hello everyone I'm looking for how to monitor status of forwarders. I have seen this app " Unified Forwarder Monitoring App for Splunk" in Splunkbase. https://splunkbase.splunk.com/app/3805/#/details When i try use it on my Splunk system, i can see only the dashboard Deployment Summary working. In Details tab on Splunkbase, this app need to run manually Rebuild Asset Table to build/create "ufma_asset_list". Actually, I can't run this step so other dashboards as Forwarder Summary, Forwarder Resource Usage which didn't show any results. Anyone have been install, using this app before ? Please let me know how i can install and use this app to monitoring my forwarder/deployment server? Thank you in advance !
... View more
