About Am

Am · ‎05-13-2021

Hi, We have installed and configured Splunk in a Linux machine with the objective of receiving data from an AD in a Windows Server 2019. After installing the "Splunk Universal Forwarder" and following the steps in the documentation we see the following output with the netstat command: "splunk:8089 SYN_SENT". The Splunk installed in the Linux machine has the "Splunk Add-on for Microsoft Windows" and both services (the UF in the Windows machine too) were restarted after adding it. Then, when the "Data Inputs - Windows Event Logs" option is selected we can see the following error: "Select Forwarders This feature is not available with your installed set of licenses" Therefore, we can't receive any logs. Are we missing something here?

Am · ‎05-07-2021

Hi @gcusello, We're not receiving any kind of logs, and the receiving is enabled as mentioned in the documentation (which we feel is deep enough, but also a bit tough to start from scratch with). Is there any way to reconfigure the UF in the AD machine ? (In case we mess something up and want to recover the working configuration that was there before). Thanks !

Am · ‎05-07-2021

Hi @gcusello , Ain't sure if we missed any step, the thing is, the UF was already installed in the AD machine, so could it be that the AD machine is sending the logs correctly to the Splunk machine, but the last doesn't then have any index set up since the reinstallation ? If so (or otherwise and we're missing some point) is there any step by step guide on how to set up an indexer to receive the logs ? Many thanks.

Am · ‎05-07-2021

Hi @gcusello , Thanks again for your answers. The installation went smoothly, and now we're facing the issue with the input data received from an AD, the Universal Forwarder had been already installed in the AD machine before reinstalling the Splunk. The configuration it had was correct and the logs were received correctly, but now they aren't. Did reinstalling the Splunk Software change the configuration in any way which made the forwarder to stop sending data ? The Splunk is installed in a Linux machine. Any info would be appreciated. Thanks !

Am · ‎05-06-2021

Hi! Thanks for your fast answer. Since we're trying to understand how the platform works and performs in our environment, we're using the free version for now, it will be of course upgraded in case we finally decide to use it in our enterprise. Now we have another issue, we don't know how to reinstall Splunk and add the data inputs so, is there any guide decently explained for beginners about installing Splunk and adding data inputs such as AD in order for us to follow ? Many thanks.

Am · ‎05-06-2021

Hello, Two months ago we had the trial for the Enterprise version but now we are using the free version. Since the free version was selected we're prompted with an error, and we can't solve it. The error when we try to do a new search is the following: "Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK." Any ideas? It'd be nice not reinstalling the whole platform as the data stored is needed. Thanks in advance

Posts	7
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎05-06-2021

Online Status	Offline
Date Last Visited	‎06-03-2021 08:43 AM

Can't receive logs from AD W2019

Issue with searches and free version

Can't receive logs from AD W2019

Re: Issue with searches and free version

Re: Issue with searches and free version

Re: Issue with searches and free version

Re: Issue with searches and free version

Issue with searches and free version