Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About NJ
NJ
Path Finder
Member since:
01-30-2023
04-02-2023
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 15 |
| Karma Received | 0 |
| Member Since | 01-30-2023 |
Activity Feed
- Posted Re: How to get logs to show fieldnames on Splunk Search. 03-22-2023 10:35 PM
- Karma Re: How to get logs to show fieldnames for gcusello. 03-22-2023 10:35 PM
- Karma Re: How to get logs to show fieldnames for PickleRick. 03-22-2023 10:35 PM
- Karma Re: How to get logs to show fieldnames for yeahnah. 03-22-2023 08:57 PM
- Posted Re: How to get logs to show fieldnames on Splunk Search. 03-22-2023 08:13 PM
- Posted How to get logs to show fieldnames on Splunk Search. 03-22-2023 06:09 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 10:52 PM
- Karma Re: Why am I having trouble with TLS? for michael_bates_1. 03-15-2023 10:51 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 10:17 PM
- Karma Re: Why am I having trouble with TLS? for michael_bates_1. 03-15-2023 10:13 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 09:38 PM
- Karma Re: Why am I having trouble with TLS? for michael_bates_1. 03-15-2023 09:34 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 09:14 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 08:15 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 07:59 PM
- Karma Re: Why am I having trouble with TLS? for michael_bates_1. 03-15-2023 07:59 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 06:44 PM
- Karma Re: Why am I having trouble with TLS? for michael_bates_1. 03-15-2023 06:44 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 06:15 PM
- Posted Re: Why am I having trouble with TLS? on Getting Data In. 03-15-2023 06:00 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-22-2023
10:35 PM
Hi @gcusello I can see the field names on the left side but I was wondering if I would be able to see them in the event list like this: Field name: Value
... View more
03-22-2023
08:13 PM
Hi @yeahnah Thanks for your reply learned something new! However, is there no way to get it like this JSON example:
... View more
03-22-2023
06:09 PM
Hi everyone! I'm still fairly new to Splunk so sorry if it is a simple question. I have some logs that does not show the field names when you have done a search. But when I expand the event, I can see the names. Is it not possible to have the field names shown in the first picture?
... View more
Labels
- Labels:
-
sourcetype
03-15-2023
10:52 PM
Thank you so much for the details response @michael_bates_1 !!! You have really helped my understanding!!!
... View more
03-15-2023
10:17 PM
Thank you that makes a lot more sense for me now. So to configure client verification I can create a new concatenated certificate that uses the same rootCAcertificate. Then tell the server to only accept connections that has a certificate that matches the new concatenated certificate. Is that correct?
... View more
03-15-2023
09:38 PM
Thanks, will keep that in mind! Can you please just confirm for me that the following is correct: On both the client and the server I use the same concatenated certificate or do i need to create one concatenated certificate for the server and one for each client?
... View more
03-15-2023
09:14 PM
Hi @michael_bates_1 Really appreciate your help so far!!! I need to understand the process of setting up TLS so I can do it for future customers.
... View more
03-15-2023
08:15 PM
03-16-2023 02:33:18.457 +0000 ERROR X509 [1969765 TcpChannelThread] - X509 certificate (CN=splunkbase.splunk.com,O=Splunk Inc.,L=San Francisco,ST=California,C=US) common name (splunkbase.splunk.com) did not match any allowed names (apps.splunk.com,cdn.apps.splunk.com)
host = Splunk-SearchHead-RedHat1source = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd 03-16-2023 03:01:02.758 +0000 ERROR X509 [2841646 ApplicationUpdateThread] - X509 certificate (CN=splunkbase.splunk.com,O=Splunk Inc.,L=San Francisco,ST=California,C=US) common name (splunkbase.splunk.com) did not match any allowed names (apps.splunk.com,cdn.apps.splunk.com)
host = Splunk-Indexer-Redhat1source = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
... View more
03-15-2023
07:59 PM
I have found the Splunk documentation quite confusing regarding TLS. When creating the keys, I followed the same naming conventions used in the Splunk documentation: How to create and sign your own TLS certificates - Splunk Documentation Which gave me the following files: myCertAuthCertificate.csr myCertAuthCertificate.pem myCertAuthCertificate.srl myCertAuthPrivateKey.key myServerCertificate.csr myServerCertificate.pem myServerPrivateKey.key I then did the following command cat myServerCertificate.pem myServerPrivateKey.key myCertAuthCertificate.pem > mySplkCliCert.pem In inputs.conf I have the concatenated cert (mySplkCliCert.pem)
... View more
03-15-2023
06:15 PM
Should inputs.conf have serverCert = /opt/splunk/etc/auth/server.pem if yes then what should outputs.conf have in sslCertPath = /opt/splunk/etc/auth/?
... View more
03-15-2023
06:00 PM
So i should change the output.conf to use the /opt/splunk/etc/auth/server.pem?
... View more
03-15-2023
05:49 PM
Thanks for spotting that! However, after fixing the typo and restarting now I don't receive any logs from the forwarder or search head.
... View more
03-15-2023
04:03 PM
Hi @michael_bates_1 Thank for your comment, Output.conf on my Search-Head: [indexAndForward]
index = false
[tcpout]
defaultGroup = my_search_peers
forwardedindex.filter.disable = true
indexAndForward = false
autoLBFrequencyIntervalOnGroupFailure = -1
channelReapInterval = 60000
channelReapLowater = 10
channelTTL = 300000
connectionsPerTarget = 0
dnsResolutionInterval = 300
negotiateNewProtocol = true
polling_interval = 5
socksResolveDNS = false
[tcpout:my_search_peers]
server = 10.1.0.4:9997
useSSL = true
sslCertPath = /opt/splunk/etc/auth/mycerts/myServerCertificate.pem
sslPassword = $7$AipeL1V0nT7oJ9t/qIGBOy0IZ6dBMzQtu8wATkwAwKwfwqd71K1gcGZBkF8= outputs.conf on my UF [tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 10.1.0.4:9997
useSSL = true
sslCertPath = /opt/splunkforwarder/etc/auth/mycerts/myServerCertificate.pem
sslPassword = $7$5+N0oNlLInzoFgzKRvrKrtFlhqrzpc9XwDx60n067DpXWBMYxuK5erjuURg=
[tcpout-server://10.1.0.4:9997] Inputs.conf on the indexer [splunktcp-ssl:9997]
disabled = 0
[SSL}
serverCert = /opt/splunk/etc/auth/mycerts/mySplkCliCert.pem
sslPassword = ********
requireClientCert = false
... View more
03-14-2023
07:03 PM
Hi everyone.
I have followed the documentation for setting up TLS for inter-Splunk communication with self-signed certificates.
I have a small test environment that has an SH, an Indexer and an UF.
However, I get the following error:
03-15-2023 01:23:39.475 +0000 ERROR TcpInputProc [2605538 FwdDataReceiverThread] - Error encountered for connection from src=10.0.0.4:45088. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
I have created the following certificates and keys based on the Splunk documentation:
myCertAuthCertificate.csr
myCertAuthCertificate.pem
myCertAuthCertificate.srl
myCertAuthPrivateKey.key
myServerCertificate.csr
myServerCertificate.pem
myServerPrivateKey.key
mySplkCliCert.pem <- this is the concatenated file.
I copy the myCertAuthCertificate.pem and mySplkCliCert.pem files from the SH to the Indexer.
on the SH and Indexer, I edit the Server.conf to have the following:
[sslConfig]
sslRootCAPath = /opt/splunk/etc/auth/mycerts/myCertAuthCertificate.pem
serverCert = /opt/splunk/etc/auth/mycerts/mySplkCliCert.pem
sslPassword = *****
What am I doing wrong?
... View more
Labels
- Labels:
-
other
02-20-2023
11:40 PM
Yes and that helped but want to know all the possible values under for example the Operation field that 365 and AD logs can produce.
... View more
02-20-2023
08:31 PM
Hi
I am trying to create alerts and dashboards for my o365 and AD logs.
Is there somewhere that has an overview of the different options in for example Operations? Since I dont have a log from when a user is created, I dont know the value the log will say eg, UserCreated, UserWasCreated, CreateUser.
Hope it makes sense
... View more
Labels
- Labels:
-
alert condition
02-07-2023
11:57 PM
Hi @gcusello Yes I have internal Ip address for each of the machines but from most of the online videos I see people using the public ip address to link the machines instead of the internal ip address. So how do I connect it using the internal ip address?
... View more
- Tags:
- hi
02-07-2023
09:18 PM
Hi all.
Through my work I'm building a little distributed test environment.
To make it extra hard on me they have setup the search head, indexer and forwarder on different v-Nets. Also, only the search head has a public IP.
My question then is how do I connect the indexer to the search head when the indexer does not have a public facing IP?
Hope the question makes sense.
Jacob
... View more
Labels
- Labels:
-
distributed search
01-30-2023
02:37 PM
Hi
We are looking into getting some more experience with Splunk Enterprise.
We therefore wanted to create a small distributed deployment.
We are only going to index about 5 gb per day.
The documentation distributed minimum requirements is for 300GB a per day.
So what is the minimum requirements for the search head and indexer for such a small distributed deployment? Thank you for any help
... View more
Labels
- Labels:
-
capacity planning
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-02-2023
10:19 PM
|
Karma given to
