About umesh

bowesmana · ‎08-21-2024

The developer made a release available and gave a talk on it some months ago at one of the user groups. I tried it then and it generally worked OK, but didn't give it some hard problems to look at. It's running in a Cloud instance I have access to.

DanielPi · ‎04-15-2024

Hi @mbozbura, I’m a Community Moderator in the Splunk Community. This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!

ITWhisperer · ‎07-19-2023

The simple answer to the generic question is: yes, you probably can have these things. However, for a more specific answer, you will need to provide more detail - what events do you already have? what have you already tried?

gcusello · ‎07-10-2023

Hi @umesh, this message seems that there's a block in the communication between the UF and its destination. Check (using e.g. telnet) if the route between the UF and its destination is open. Ciao. Giuseppe

gcusello · ‎07-04-2023

Hi @umesh, here you can find the configuration to send your logs to two different indexers groups: https://docs.splunk.com/Documentation/Splunk/9.0.5/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups in addition, in this url I answered to the same question of another people and you can take the needed information: https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-for-HF-double-forward-to-Splunk-On-Prem-and-Cloud/m-p/648171#M27231 Ciao. Giuseppe

PickleRick · ‎07-04-2023

My additional two cents 😉 If you use the same forwarder license on several HFs you might run into trouble with duplicated license detected in your environment. I'm not sure if it affects only MC or is it "deeper" than that but it's worth noting that it can happen.

VatsalJagani · ‎06-26-2023

@umesh - Adding to @gcusello 's 1st point on the collect via DB Connect, you have two options: Install Splunk HF and DB Connect App locally on Azure VM You don't have to expose the database outside of Azure You will have the overhead of Splunk locally on Azure VM Enable Splunk to Splunk SSL connectivity on data port (generally 9997) to ensure security Install Splunk HF on a separate machine on-prem or Azure and install DB Connect App there You have to expose the database port for external connection You don't have to install anything on the database server Enable DB Connect to database connection only on SSL to ensure security Both have tradeoffs, and can be used based on your environment's requirement. I hope this helps!!!

gcusello · ‎03-28-2023

Hi @umesh, try the Tenable Add-On for Splunk (https://splunkbase.splunk.com/app/4060). Ciao. Giuseppe

richgalloway · ‎03-24-2023

These two components help with the handling of monitor:// inputs. WatchedFile detects when the file changes and TailingProcessor reads the new data. The first message says the component will detect changes using the file modification time. The second message says it's asked WatchedFile to keep an eye on the specified file path.

gcusello · ‎01-31-2023

Hi @umesh, you can use two apps from Splunkbase: for nix Forwarders https://splunkbase.splunk.com/app/5004 for windows Forwarders https://splunkbase.splunk.com/app/5003 Ciao. Giuseppe

SanjayReddy · ‎01-30-2023

Hi @umesh you can set TZ=IST in props.conf in UF you can apply timezone seeting based on host/source/sourcetype according to your data please use relevant name and once changes are done restart the UF to take effect [host::<hostname>] TZ = IST

gcusello · ‎12-21-2022

Hi @umesh, it should be analyzed in your installation, but probably because the search has latest=now, so in the meantime other events arrived. Ciao. Giuseppe

gcusello · ‎11-08-2022

Hi @umeshm, when I speak of location I don't mean on file system, that isn't relevant, but the server where i located: they must be on Indexers or, when present on Heavy Forwarders (as I suppose you have). Is it clear for you how to configure your filter? Ciao. Giuseppe

richgalloway · ‎11-06-2022

No, you do not need to create indexes on the HF. You would need to do that only to satisfy the UI (to populate a drop-down of index names, for instance). You search on an HF the same you do on a SH. The difference is an HF will never find anything because it does not store data and (usually) has no search peers. What's the problem you are trying to solve?

bowesmana · ‎11-03-2022

Here's an example - you need the rex and eval statements | makeresults | eval file_size=split("1.56 KB,5.03 MB,1.06 B,1MB,4.95 GB,5.13TB", ",") | mvexpand file_size | rex field=file_size "(?<size>\d+(\.\d+)?)\s?(?<mul>\w+)?" | eval file_size=case(mul="KB", size * 1024, mul="MB", size * 1024 * 1024, mul="GB", size * 1024 * 1024 * 1024, mul="TB", size * 1024 * 1024 * 1024 * 1024, 1==1, size)

umesh · ‎10-19-2022

@bowesmana I am doing this drill down in enterprise security notable events not in the dashboards the drill down search for getting contributing events for the notable. I am using tokens in the drill down search as index=xxx |search Dest=$dest$

richgalloway · ‎10-10-2022

The Monitoring Console has such a search. See Indexing->License Usage->Historic License Usage. Here is a slightly modified version of that search that should more close meet your requirements. index=_internal source=*license_usage.log* type="Usage" earliest=-7d | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, idx | timechart limit=5 span=1d sum(b) AS volumeB by idx fixedrange=false | fields - _timediff | foreach "*" [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

johnhuang · ‎09-29-2022

You can approximate license utilization by counting the number of events instead of calculating the exact size. This is faster and could meet your use case. For example, windows event log: <base search> | top 100 EventCode

Posts	24
Solutions	0
Karma Given	9
Karma Received	1
Member Since	‎09-29-2022

Online Status	Offline
Date Last Visited	‎10-03-2024 12:00 AM

Splunk query to use lookup data as a field value

What is causing Splunk Universalforwarders errors?

Heavy forwarder logs - Splunk Cloud & Test Indexer...

Deployment server connection to License Master

Can we use DB connect to send Azure Database Logs ...

Splunk Enterprise security Custom Threat intel fe...

What is the best Add-on forNessus Profession integ...

Analyzing Splunk Internal Logs- What is Tailing Pr...

Upgrading UF using deployment server

Why are we getting all the logs in IST timezone wh...

Re: Dashboard Chart Display issue when exporting t...

Re: Splunk Enterprise security Custom Threat intel...

Re: Splunk query to use lookup data as a field val...

Re: Splunk Universalforwarders errors

Re: Heavy forwarder logs - Splunk Cloud & Test Ind...

Re: Deployment server connection to License Master

Re: Azure Databse Logs to Splunk

Re: What is the best Add-on forNessus Profession i...

Re: Analyzing Splunk Internal Logs

Re: Upgrading UF using deployment server

Re: Splunk Time zone issue

Re: Why is there an increase in security notables ...

Re: Excluding firewall events in splunk

Re: Index at Heavy forwarder

Re: convert String to Integer search

Re: Is there a drill down search variable substitu...

Re: How to create a search to calculate top5 licen...

Re: How to write a Splunk search for License Utili...

Join the Conversation