Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About akyz
akyz
Explorer
Member since:
02-16-2022
09-19-2023
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-16-2022 |
Activity Feed
- Posted Re: v9.1 upgrade issues - Why does Top tool bar shows Loading? on Splunk Enterprise. 09-19-2023 11:18 AM
- Posted Re: v9.1 upgrade issues - Top tool bar shows Loading.... on Splunk Enterprise. 07-27-2023 11:44 AM
- Posted Blacklisting for Splunk Stream on Windows? on All Apps and Add-ons. 07-13-2023 11:37 AM
- Posted Re: Splunk 5.x App for Microsoft Windows: What is this "app=win:unknown" being captured in 63% of Windows secu on All Apps and Add-ons. 05-12-2022 11:07 AM
- Posted Re: Are there permissions for splunk user on universal forwarder for Windows? on All Apps and Add-ons. 02-24-2022 07:15 AM
- Posted Re: Are there permissions for splunk user on universal forwarder for Windows? on All Apps and Add-ons. 02-16-2022 02:00 PM
- Posted Are there permissions for splunk user on universal forwarder for Windows? on All Apps and Add-ons. 02-16-2022 11:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
09-19-2023
11:18 AM
Only guidance I received was to downgrade however since Splunk doesn't support "downgrades" they provide no guidance. I ended up uninstalling and reinstalling 9.1, confirmed the issue was resolved after a clean install. Then proceeded to restore items/apps/config files 1 by 1.
... View more
07-27-2023
11:44 AM
I'm getting the same thing. Checked permissions, ownership, and issue still stands. Working on downgrading to 9.0.5 now. I have a case open as well 3276705/
... View more
07-13-2023
11:37 AM
Is there a way to blacklist data being ingested via Splunk Stream via src_ip?
I've tried the below but I'm not sure if it's supported or not.
blacklist = src_ip="10.10.10.10"
... View more
Labels
- Labels:
-
configuration
05-12-2022
11:07 AM
Manual intervention. Need lookup the Event ID's that are showing as win:uknown and correlate them with their respective category. Once you look up the Event ID/Category you add them manually to windows_apps.csv.
... View more
02-24-2022
07:15 AM
Thanks for your inputs and replies. I was able to figure it out by granting the gMSA that we have running the Universal Forwarder service read/write permissions to the registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security. Once that was done all the security logs were flowing into our indexer. Thank you.
... View more
02-16-2022
02:00 PM
Yes the data inputs are defined and all event logs are selected. Yeah I See the local event log readers group going to try that out. Does Splunk have any sort of documentation explaining all the permissions that are needed to properly ingest the data?
... View more
02-16-2022
11:01 AM
We're deploying the Windows Universal Forwarder add-on to our environment and are using a gMSA. We have configured the basic permissions outlined here Choose the Windows user Splunk Enterprise should run as - Splunk Documentation. While we are now getting event log data ingested into Splunk Enterprise we do not see all the event log data. I believe we're missing Security. Is there any extra security permissions we're missing?
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-19-2023
03:54 PM
|
