About Mohanveera1

Mohanveera1 · ‎06-01-2022

Hi @venky1544 Thank you for your response. The events are having the timestamp and the devices from which the events are generating are in other time zone i.e +08:00 UTC. But the splunk time zone is +0:00 UTC. I have searched for the props.conf for the specific sourcetype which are getting the future timestamp error. but there was no file available. the path where is searched for the props.conf is Splunk home/etc/apps/apacinfoblox/local. so please suggest me the way to solve the issue.

Mohanveera1 · ‎06-01-2022

Hello everyone, In Splunk GUI when i run health check its showing one error like One or more source types has been found to present events in the future. All the sources are giving the correct timestamp with timezone UTC +0:00 but when i checked the devices that are configured with the source types with the error, the devices are in the other timezone i.e UTC +08:00, and we are receiving the logs that are also in the future timezone. so how can i overcome this problem with the future timestamp. the Splunk indexer time zone is UTC +0:00 please refer the screenshot. Thanks in advance............

Mohanveera1 · ‎04-21-2022

Thank you @richgalloway for your respose. The TA we are using is Palo ALto Network Add on for splunk and the following link takes you to the add on page Palo Alto Networks Add-on for Splunk | Splunkbase app 2757 and also the error that we are seeing is attached. I have got a suggestion from one of my colleague that if we remove this add-on the problem will get solved. so please take a look and help me with this issue so that the problem can be solved. and tell me that removing the add-on will not cause any issue or not?

Mohanveera1 · ‎04-21-2022

Hello there, Recently i have restarted the splunk from then splunk is showing an error message regarding Palo Alto network add on. And if i removed that add on, the problem will be resolved. But my query is how can i check that the add on is working in background for any purpose or not??? We are using Palo alto firewall, is this add on useful to collect the data from the palo alto firewall?? If i removed this add on does the logs of splunk will not be displayed in splunk? Please help me with this query... Thanks in advance.

Mohanveera1 · ‎03-31-2022

hi @VatsalJagani i have checked the savedsearches.conf for single user attempt and it is as below and everything is normal in it and i didn't find any abnormality in it. please find the screenshot in it and please tell me if you find any abnormality. thanks in advance.....

Mohanveera1 · ‎03-30-2022

Thank you very much @VatsalJagani i have found the savedsearches.conf but i can,t access the file due to privilege issues. i will contact my server team and transfer the duplicate file to my pc. and can you please suggest me what i have to search in the conf file. Thanks in advance.

Mohanveera1 · ‎03-30-2022

Dear @VatsalJagani thank you for your previous reply i have go through it but there are so many files that came up with permission denied. And i haven't found any single user attempt failed in it. please revert me in there is any other way.. thanks in advance....

Mohanveera1 · ‎03-30-2022

hi @VatsalJagani i have checked the path and i do find the savedsearches.conf in mutiple directories. 1. /data/splunk/etc/system/default/savedsearches.conf 2. /data/splunk/etc/apps/search/default/savedsearches.conf 3. /data/splunk/etc/apps/splunk_monitoring_console/default/savedsearches.conf 4. /data/splunk/etc/apps/Splunk_TA_paloalto/default/savedsearches.conf (there are so many savedsearches in different directories with different app name.) Please suggest me in which do i have to look the savedsearches.conf Thanks in advance...

Mohanveera1 · ‎03-30-2022

hi @VatsalJagani thank you for your response. in the splunk instance i have go till opt directory, but in opt directory i cant find splunk. it only contains the backup scripts. is there any other way that i can look into.....

Mohanveera1 · ‎03-30-2022

@ITWhisperer i clicked on the All Configurations in the settings option to get all Knowledge objects and filtered them for the previous owner. Then i reassigned all the alerts and reports from him to the new user.

Mohanveera1 · ‎03-30-2022

hi @ITWhisperer the "Single User Failed Attempt" is setup as an alert type. it was previously owned by the member that left the organisation (mentioned in the above thread ***user name***), after he left i have reassigned the alert to myself. this alert does not run by any user as it was kept as real time alert. Thanks in advance....

Mohanveera1 · ‎03-30-2022

hi @ITWhisperer please find the answers according to your queries... and please revert me incase if any of the info is required. every day? At the same time every day or at random times? -- these events are triggering for every minute What do you mean by "cronjob are like knowledge objects"? -- cronjob in splunk is meant to be knowledge objects such as dashboards, alerts, reports which are scheduled to run on specific time. (As of my knowledge) please share what do you mean by cronjob in your opinion. Do you have shell access to your splunk hosts? -- yes i do have access to shell in splunk host What other processes are running on your splunk hosts? -- there were so many processes are running in splunk host, as i checked by using command ps aux. Is there any specific processes that i have to look at? What other users are logged on to your splunk hosts? -- Is this about the user in the splunk or the users that can access the splunk host. Thanks in advance.....

Mohanveera1 · ‎03-30-2022

Hi @ITWhisperer thank you for your response. This event is generating everyday and its not only with one user, its with multiple users who left the organization. The cronjob are like knowledge objects, but all the knowledge objects created by the user is assigned to the new user. so can you please suggest me how can we check any new cronjobs that are available. and how can we check in local host as well???? thanks in advance..

Mohanveera1 · ‎03-30-2022

Hi splunk experts, Can anyone elaborate this below event and tell me why this event is getting triggered? the user name in this event has left the organization and we removed his access and transferred the knowledge objects to other person also but we are getting his name in the below event. and please help me how to avoid this type type of alerts also. 127.0.0.1 - **User name*** [30/Mar/2022:09:29:54.891 +0000] "POST /servicesNS/nobody/search/saved/searches/Single%20User%20Failed%20Attempt/notify?trigger.condition_state=1 HTTP/1.1" 200 1933 "-" "Splunk/8.1.0 (Linux 4.15.0-1023-azure; arch=x86_64)" - 2ms this event is getting displayed when we search by using the query: index=_internal sourcetype= splunkd_access user=*. thanks in advance.

Mohanveera1 · ‎03-28-2022

hi @dhirendra761 Thank you for responding to my query. As per your instruction, i have checked the Send emails as in Email Settings, and previously we have set a mail id i.e *****@***. For every alerts that is triggered we have given the triggered action as send mail to the receipts. so if an alert triggers we will receive the mail from mail address *****@*** . if i remove the Send emails as (Value) from the Email settings then we cannot receive the mail. And in the Send emails as (value) in Email Settings also the mail id is not the user that left the organization its other mail id and there is no relation between these two. And Next step is to disable the alert, i have reassigned all the knowledge objects of the user that left the organization to my name. And there is no alert on his name to disable it also.... Please help me to get it resolved, Thanks in advance...

Mohanveera1 · ‎03-27-2022

Hi there, One of my colleague having admin access has created a dashboard for audit to know that who logged into Splunk and how many times does the user login into Splunk for the last 7 days for all the users. One of the users left the organization in January and we deleted the account with admin login and transferred all the knowledge objects to the other user also but Now we are seeing his name in the dashboard and alerts were triggering on his name also. We have again checked the user list but his name was not available, but we are still seeing his name in the alerts and dashboard. Can anyone help me with it… the search query used for creating the dashboard is index=_internal sourcetype=splunkd_access | timechart span=6h count by user The Raw Event displaying while searching the query is: 127.0.0.1 - name of the user* [28/Mar/2022:05:28:17.505 +0000] "POST /servicesNS/nobody/search/saved/searches/Single%20User%20Failed%20Attempt/notify?trigger.condition_state=1 HTTP/1.1" 200 1933 "-" "Splunk/8.1.0 (Linux 4.15.0-1023-azure; arch=x86_64)" - 2ms Please help me to resolve it and thanks in advance......

Posts	18
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-27-2022

Online Status	Offline
Date Last Visited	3 weeks ago

How do I fix this error: One or more sourcetypes h...

How to check whether the Palo Alto add on is worki...

How do I Ellobrate this event?

Why are we getting alerts for a disabled user?

Re: One or more sourcetypes has been found to pres...

How do I fix this error: One or more sourcetypes h...

Re: How to check whether the Palo Alto add on is w...

How to check whether the Palo Alto add on is worki...

Re: Ellobrate this event

Re: Ellobrate this event

Re: Ellobrate this event

Re: Ellobrate this event

Re: Ellobrate this event

Re: Ellobrate this event

Re: Ellobrate this event

Re: Ellobrate this event

Re: Ellobrate this event

How do I Ellobrate this event?

Re: Why are we getting alerts for a disabled user?

Why are we getting alerts for a disabled user?