About pc1

pc1 · ‎12-14-2021

Do you have any recommendations of such a device?

pc1 · ‎12-14-2021

Looking for a device that can monitor power usage that is compatible with splunk. Looking to place it connected to an outlet or something like that to detect if the power goes out in a building or not. I see lots of articles about combining Splunk with smart home products that could do something like this but nobody ever says explicitly what to buy if you want to set it up to do something like that. If anyone has any ideas please let me know

pc1 · ‎11-17-2021

Ah, then yes the Windows add on was originally deployed through my deployment server. No manually installation of apps was done - only on the deploy server when I originally set it up to go out. On my clients it does indeed have System with full control for all of the Universal Forwarder.

pc1 · ‎11-17-2021

I think so, if installing the universal forwarder and pointing it towards the deployment server and main enterprise instance is what you mean. The files are owned by my account on the clients. Is there a way to have used my splunk deployment server to say go find these servers and install the universal forwarder? Should I edit the permissions on the client's files to give permission to something else? Not sure how to link to to the deployment server as that is a server, and not a user account. Both are windows environment.

pc1 · ‎11-17-2021

Figured it out for anyone who might come across this in the future: Set the base search to whatever you want like the one I posted above. (Probably store it as a report and run it often, and then call upon it using "| loadjob savedsearch="user:app:reportName" Then in the chain search below, use "| search thisField="test" otherField="exampleServerName" and then from there you can | into a timechart or whatever else you might be generating the visualization with. Note: you must include the field names that you are going to use in the chain search - in the base search. So at the end of your base search include "| fields test, exampleServerName, etc."

pc1 · ‎11-17-2021

When pushing the Windows add on for Splunk using a deployment server, my inputs.conf files on the clients are not updating. The clients are regularly checking in with the deployment server, and splunk has been restarted on both deployment and client servers several times. This is creating an issue because updates to inputs.conf stored in the local folder are not being updated across my clients. If anyone has any further troubleshooting ideas to get the clients to fluently sync up to the proper inputs.conf from the deployment server please let me know. If it matters - The specific changes (simply enabling them by changing disabled=1 to 0) were made to the scripted inputs below. The timestamp on inputs.conf on the client is much older than the changes and still left at disabled=1. ###### Scripted Input (See also wmi.conf) [script://.\bin\win_listening_ports.bat] disabled = 0 ## Run once per hour interval = 3600 sourcetype = Script:ListeningPorts [script://.\bin\win_installed_apps.bat] disabled = 0 ## Run once per day interval = 86400

pc1 · ‎11-01-2021

Here is more or less the barebones of what I have. With the parent base search being what I already posted and my chain search on top of that trying to pull specific fields from that original data. Or if I am doing this wrong altogether in the wrong part of splunk enterprise ui let me know

pc1 · ‎11-01-2021

My base search is trying to show the amount of GB left from servers that I have deployed the windows add-on for splunk to. (Not final - just trying to get it to work. Base search below) source="perfmonmk:logicaldisk" earliest=-7d | eval gb_free=Free_Megabytes/1024 | timechart span=1d max(gb_free) AS GB_Free I want to use a chain search like "host=this_server" and "instance=C:" to target specifc servers and drives to show how much space is on each left in a chart. However, i run into many problems when trying to use chain search to narrow the base search's results down. If anyone has any ideas as to how to can search for specific fields from a base search without error it would help a lot. The specific error is "unknown search command" from the chain search

pc1 · ‎10-08-2021

Yup, found this preexisting alert and was able to edit the Actions on it to integrate with the Slack Notifications add-on. Runs every 5 minutes to check if the server is down so this works perfectly for me. Thanks for the help!

pc1 · ‎10-08-2021

What search can I do to find peers with status=down. Looking to form an alert when this happens but can't find it within a search.

pc1 · ‎10-07-2021

@plaks Can you be more specific as to what steps you followed to do this. Running into the same error on Splunk Enterprise.

pc1 · ‎10-06-2021

I created a new splunk enterprise instance in which I want to connect to my already pre-existing main enterprise instance with the bulk of our data. The intention of having 2 is so I can track the heartbeat messages between each server to one another to alert when one or the other goes down. I already have the new instance connected to the old one through outputs.conf - and this gives me the ability to search for its heartbeat logs in index=_internal. However, connecting the main original instance to the new one is a different story. I have it forwarding to the new instance the same way, using outputs.conf. However, I believe that this is too much for the new instance to handle as it is a ton of data (which i don't even want to go there). Is there a way that I can have it establish the connection so I can monitor for heartbeats, but not send any data? Perhaps what settings can I tweak that disable the sending of anything but keep that connection between the two - without turning off indexing on the new instance so I am able to monitor and alert when the old instance stops sending heartbeats when it goes offline.

pc1 · ‎09-17-2021

You're correct, it does work. It took me a while to found the inputs that I enabled were receiving permission denied when trying to run on the forwarder through checking index=_internal. According to another post above - .sh inputs won't necessarily work easily (which are like the top 4 that I enabled to test out at the top of the inputs.conf file). So it was "working" the whole time, just receiving errors for those specific inputs.

pc1 · ‎09-17-2021

Do you know how to give them execute permission? I now see that the few things I enabled in inputs.conf are .sh - and when checking index=_internal I can see that for each of them it says permission denied (Hence why nothing was showing up in the first place and I thought the add-on wouldn't work at all) Alternatively, if I can't use the .sh monitoring inputs, do you know what else is available from the add-on that would be useful?

pc1 · ‎09-16-2021

@solarboyz1 So, in order to link the data coming in to the InfoSec app, I should add the appropriate tags to correlate to which requirement I want it to fulfill? After adding the tags, the macro should recognize the new data, right? I will do some looking into adding tags - never done that before.

pc1 · ‎09-15-2021

I have set up new data sources already in Splunk that bring in CIM compliant data (from sophos and cisco meraki). Is there a way that I can link them to the InfoSec App? I didn't originally set up the InfoSec app so I am unsure how data gets tied to it. Most documentation online is unhelpful for adding new data sources to the InfoSec App unless its one of the very few listed in the data onboarding guides in the Splunk Security Essentials app. Any help or references to actually helpful documentation on adding a new data source would be greatly appreciated.

pc1 · ‎09-07-2021

So if its an overkill to do it with Splunk - then it definitely should work. Good to know that my methodology checks out.

pc1 · ‎09-07-2021

I want to use splunk to send an alert when the power goes out in our office. The current idea is to set up a machine (probably windows or linux) powered into an outlet, set up as a Universal Forwarder sending a constant stream of info to the Enterprise instance (what this form of info would be I'm not sure yet. probably a script that constantly loops). And then to have the Enterprise instance (on aws so it will still be online if the power goes out) monitor for when the Forwarder machine stops sending information - then send me an alert. So when the power goes out the machine in the office will power down and the Enterprise instance will recognize this and alert me. If anyone has any other ideas of ways that they might monitored for power loss(or can help to outline how I should set up my current idea) please let me know. Thanks! Edit: Can't figure out how to change the forum category of this post from feedback to something else.

pc1 · ‎08-31-2021

Is there a way to list the deployment clients connected to my deployment server that have ever connected to it even once? I've found queries to display it and obviously this information is located on the gui under Forwarder Management > Clients - But, the list of clients resets when you restart splunk on the deployment server. This is making it difficult to keep track of which clients are properly phoning home while I'm making changes to configuration files (which require a splunk restart to go into effect). When splunk is reset, it repopulates the clients list with the ones who are actively phoning home but there is no way to tell if a client should be but isn't because they were erased from this list from the restart. If there is a way that I can find a list of any client that has ever connected, to easier know which clients I have in this environment so far, that would help a lot. Any input at all is appreciated. Thanks !

pc1 · ‎08-18-2021

I am using the Splunk Add-On for Linux on my deployment server (which is a windows server) and trying to use this to collect data from my linux machines that have the universal forwarder connected to my deployment server. I was curious if anyone knows if this is because that add-on isn't compatible - because the server hosting it is Windows? (even though its being deployed to Linux machines). If this is the case - is there any easy work around other than creating another deployment server that is Linux for deploying to my Linux machines?

Posts	23
Solutions	1
Karma Given	21
Karma Received	0
Member Since	‎08-17-2021

Online Status	Offline
Date Last Visited	‎03-31-2022 05:41 PM

Looking for a device to track home power output/da...

deployment server not updating inputs.conf on clie...

Search for fields within base search when creating...

Search for peers with status=down

Enable connection between 2 enterprise instances w...

Adding new data sources to InfoSec App

Alert When Power Goes Out

List Deployment Clients Permanently

Splunk Add-On for Linux Compatability

Splunk Add-On for Windows

Re: Looking for a device to track home power outpu...

Looking for a device to track home power output/da...

Re: deployment server not updating inputs.conf on ...

Re: deployment server not updating inputs.conf on ...

Re: Search for fields within base search when crea...

deployment server not updating inputs.conf on clie...

Re: Search for fields within base search when crea...

Search for fields within base search when creating...

Re: Search for peers with status=down

Search for peers with status=down

Re: Slack notification app setup issue

Enable connection between 2 enterprise instances w...

Re: Splunk Add-On for Linux Compatability

Re: Splunk Add-On for Linux Compatability

Re: Adding new data sources to InfoSec App

Adding new data sources to InfoSec App

Re: Alert When Power Goes Out

Alert When Power Goes Out

List Deployment Clients Permanently

Splunk Add-On for Linux Compatability