About wmazur-splunk

wmazur-splunk · ‎01-18-2023

Splunk covers that as well. Select "Monitor" instead of "Upload". https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/MonitorfilesanddirectorieswithSplunkWeb. https://youtu.be/b2Kztj03hBc

wmazur-splunk · ‎01-18-2023

Probably it won't work. Try "regular" approach: Settings -> Data Input -> Upload files from computer, select `XmlWinEventLog:WEC-Sysmon` as a source type in second step (Set Source Type). You can select source type from any installed add-on. Splunk will try to digest the input according to the expected source type.

wmazur-splunk · ‎01-16-2023

https://www.splunk.com/en_us/blog/platform/splunking-your-conf-files-how-to-audit-configuration-changes-like-a-boss.html TL;DR: index="_configtracker" data.path=*splunk_app_db_connect*

wmazur-splunk · ‎01-04-2023

Db Connect is using KV Store to remember id/timestamp of the latest processed row (whatever was used). Getting the data from DB, storing it in Splunk and saving the timestamp - it is not an atomic operation so it is possible that KV Store is unavailable when it's needed. I would suggest to disable scheduled job via script, do restart, enable job - it will start from the latest processed row (if it's still in the database)

wmazur-splunk · ‎01-04-2023

Direct reads from SCOM Database was introduced in Splunk Add-on for Microsoft SCOM 4.3.0 (https://docs.splunk.com/Documentation/AddOns/released/MSSCOM/Direct)

wmazur-splunk · ‎12-20-2022

HI do you see any “Content-Length of XXXXX too large (maximum is 1000000) “ errors? Maybe you will find these links useful: https://www.splunk.com/en_us/blog/tips-and-tricks/handling-http-event-collector-hec-content-length-too-large-errors-without-pulling-your-hair-out.html?locale=en_us https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/TroubleshootHTTPEventCollector

wmazur-splunk · ‎12-20-2022

1. https://community.splunk.com/t5/Getting-Data-In/how-to-set-TIME-PREFIX-for-a-json-file/m-p/464284 (so, I guess TIME_PREFIX = authdevice.timestamp ) 2. You may also need TIME_FORMAT = %s (https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Configuretimestamprecognition#Enhanced_strptime.28.29_support)

wmazur-splunk · ‎10-20-2022

Sub-search: | table ID, MgrName Hint: Depending on event size: drop this part of the search or replace with | fields ID, MgrName

wmazur-splunk · ‎10-20-2022

join version (please check the performance): <base search for user> |join type=outer left=L right=R where L.MgrID = R.ID [search <sub-search for managers>] `type=outer` to get results even if no manager was found. Note: If you are going to use custom time ranges in base query ('earliest', 'latest') - these filters are not applied to sub-search, so be careful there. Probably you want to add the same time range criteria to the sub-search

Posts	9
Solutions	1
Karma Given	0
Karma Received	3
Member Since	‎10-06-2022

Online Status	Offline
Date Last Visited	‎03-08-2023 06:06 AM

Re: Can the Splunk Add-on for Sysmon work with a f...

Re: Can the Splunk Add-on for Sysmon work with a f...

Re: How to monitor DB connect activities?

Re: Why DB Connect duplicates events on indexer cl...

Re: How to get SCOM data to Splunk without Windows...

Re: What is the reason for an incomplete data HTTP...

Re: Pls help: JSON timestamp parsing

Re: Populate an event with data from another event

Re: Populate an event with data from another event