Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About damo66a
damo66a
Explorer
Member since:
04-29-2021
08-23-2023
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-29-2021 |
Activity Feed
- Posted Re: Preventing duplicate alerts using field conditions and time on Alerting. 08-23-2023 02:43 PM
- Posted Re: Powershell Stops Working on All Apps and Add-ons. 11-30-2022 08:46 AM
- Posted Powershell Stops Working- How to resolve this error? on All Apps and Add-ons. 11-30-2022 08:42 AM
- Tagged Powershell Stops Working- How to resolve this error? on All Apps and Add-ons. 11-30-2022 08:42 AM
- Tagged Powershell Stops Working- How to resolve this error? on All Apps and Add-ons. 11-30-2022 08:42 AM
- Posted Re: Why are certain Powershell scripts running and others not? on Getting Data In. 11-07-2022 01:02 AM
- Posted Re: Why are certain Powershell scripts running and others not? on Getting Data In. 11-01-2022 03:18 AM
- Posted Why are certain Powershell scripts running and others not? on Getting Data In. 10-31-2022 05:40 PM
- Posted Dropdown for Core Hours on Dashboards & Visualizations. 05-17-2021 06:14 AM
- Posted Re: Incorrect Timestamp on Getting Data In. 05-17-2021 06:09 AM
- Posted Re: Incorrect Timestamp on Getting Data In. 05-13-2021 02:03 AM
- Posted Re: Incorrect Timestamp on Getting Data In. 05-10-2021 01:42 AM
- Posted Re: Incorrect Timestamp on Getting Data In. 05-10-2021 01:21 AM
- Posted Re: Incorrect Timestamp on Getting Data In. 05-06-2021 08:17 AM
- Posted Re: Using UF to forward data to local Heavy Forwarder and then on to Cloud on Getting Data In. 05-06-2021 07:56 AM
- Posted Re: Incorrect Timestamp on Getting Data In. 05-06-2021 06:04 AM
- Posted Incorrect Timestamp on Getting Data In. 05-06-2021 03:52 AM
- Posted Re: How can I monitor VMware Horizon View with Splunk? on Splunk Enterprise Security. 04-30-2021 02:05 AM
- Posted Using UF to forward data to local Heavy Forwarder and then on to Cloud on Getting Data In. 04-29-2021 05:19 AM
- Posted Re: Deployment Server Separate from Heavy Forwarder on Deployment Architecture. 04-29-2021 05:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-23-2023
02:43 PM
this is a pretty good solution to something i am having experience with. how do you get the alert to recognise a different MD5 hash? i dont see anywhere in the settings of the alert that i can specify that (or i cant see the wood for the trees).
... View more
11-30-2022
08:46 AM
just to add, there is no point in my script that calls "Clear" or sets the ErrorPreference. It simply just stops working until a restart of the service
... View more
11-30-2022
08:42 AM
Im seeing errors whereby powershell inputs just stop for some random reason. The only error I get is the following
failed with exception=The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Exception calling "Clear" with "0" argument(s): "Index was outside the bounds of the array."
A simple restart of the SplunkForwardingService on the system makes it work again so theres nothing wrong with the script.
Anyone got any ideas why its doing this? its not just one script or one particular system. Its 2 scripts across 2 different scripts. Same error though
... View more
Labels
- Labels:
-
troubleshooting
11-07-2022
01:02 AM
so i changed the variable and it made no difference. we're still getting the same "cannot find file specified" error. we do have other scripts running on this server by Splunk so its somewhat confusing.
... View more
11-01-2022
03:18 AM
Hi @gcusello Thanks for your input. In terms of correct variables, this is what is in the instructions on the Splunk Documentation located here I will try what you say but I have simply followed the instructions. D
... View more
10-31-2022
05:40 PM
I'm trying to get data in from a server via a powershell script. I have another app already doing similar on the same server but for some reason (that is driving me up the wall) i constantly get the error:
ERROR Executing script=. "$SplunkHome\etc\apps\vmwareinventory\appserver\static\vmguests.ps1" for stanza=VMWare-Guests failed with exception=The system cannot find the path specified.
I have checked and double checked the spellings, the system variables (for Splunk_Home), renamed the files, the directories and still it comes up with this error. I have followed the instructions to the letter from the Splunk Documentation and still the error persists.
This is my input stanza:
[powershell://VMWare-Guests]
script = . "$SplunkHome\etc\apps\vmwareinventory\appserver\static\vmguests.ps1"
schedule = 30 0 * * *
sourcetype = vm:inventory
index = vmware
disabled = false
Can someone please tell me why this would be happening with this script but not others on the same server?
TIA
... View more
Labels
- Labels:
-
scripted input
05-17-2021
06:14 AM
Is there any way I can use a dropdown to specify days but have it be the same time period ever day? So for example, it would appear in the dropdown like: Mon - 9am to 5pm Tue - 9am to 5pm Wed - 9am to 5pm Thurs- 9am to 5pm Fri - 9am to 5pm and have it reference those days and times ?
... View more
05-10-2021
01:42 AM
i dont beleive i have any transforms. certainly not any i've put in myself. I have a props.conf that contains the time format as stated above. other than that, nothing.
... View more
05-10-2021
01:21 AM
i have tried to use the btool and its not jumping out with any errors or anything. to be fair im not 100% im doing it right.
... View more
05-06-2021
08:17 AM
i have been doing some more testing and structured the inputs.conf file as per splunk docs but the input is completely ignoring the fact that i'm telling it to use a particular source type and as such ignoring the format behind that. from what i can tell its only marking the first event (or 2) with the required sourcetype and then stating xml as the sourcetype for the rest when there actually isn't a sourcetype named that. what am i doing wrong? i've followed the documentation
... View more
05-06-2021
07:56 AM
worked a treat. thanks for your help
... View more
05-06-2021
06:04 AM
i think perhaps i may have done this wrong then. my inputs.conf is as follows: [fschange:E:\Logs\*]
pollPeriod = 60
signedaudit=false
fullEvent=true
sendEventMaxSize=-1
index = ccure_sitedata
sourcetype = ccure_site_journal looking at sourcetypes in my cloud instance, the above mentioned sourcetype does have a TIME_FORMAT flag set. as part of the app i have also done a props.conf file but presumably from what you have said, that is incorrect? (im using splunk cloud so presumably i cant edit the props file) props.conf TIME_FORMAT = %d/%m/%Y %H:%M:%S i am fairly new at this so please forgive me for the formatting of these.
... View more
05-06-2021
03:52 AM
hello, I have some xml files coming in which is working fine, however, despite setting the TIME_FORMAT to %d/%m/%Y %H:%M:%S it is still putting some events into indexes with MM/DD/YYYY. the time format is set in a props.conf file for my input but it appears to me ignoring it. I've also noticed that despite me telling it to use a particular source type its making up its own that isnt in my instance. could that be the reason? if so why? any ideas? thanks in advance
... View more
Labels
- Labels:
-
source
-
sourcetype
-
time
-
universal forwarder
04-30-2021
02:05 AM
This is awesome. thanks for spending the time. Quick question from me....do you have a rough idea on the amount of data this is sending to splunk? looking to do something similar to this and dont want to blow our license for splunk cloud. cheers
... View more
04-29-2021
05:19 AM
I may have missed a topic in my search but is there a way to do the following (im also fairly new to Splunk so be gentle 😁 ) We have a server locked down on our network and has no outside access but we can configure internal (server to server) access. Is there a way to use a Universal Forwarder on that server to forward to the local on prem Heavy Forwarder and then relay those to our Splunk Cloud? Thanks in advance
... View more
Labels
04-29-2021
05:14 AM
that did it. thanks very much for your help
... View more
04-29-2021
04:05 AM
thanks for the suggestion. ive looked over that link and cant see how it tells me to do that. my understanding of a deployment client is that you install the UF on the destination machine (auto configured by script) and it "dials home" to the deployment server, then we add it to a server class as needed. As ive already configured this server as a Heavy Forwarder, how would I go about adding it to a server class on the deployment server? Also, My deployment server is a windows based machine, the heavy forwarder is linux based - not sure if that would have any baring at all.
... View more
04-29-2021
03:33 AM
Hi everyone, Our deployment consists of an on prem deployment server, on prem heavy forwarder and Splunk Cloud. Is there a way of getting our separate Heavy Forwarder to recognise our deployment server, specifically so we can configure file inputs on the heavy forwarder using the deployment clients. I know they can be one in the same but we chose to have separate servers for operational reasons. Appreciate anyone's view/help
... View more
- Tags:
- ver
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-23-2023
06:08 PM
|
