Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About elend
elend
Communicator
Member since:
02-23-2023
12-17-2025
Community Statistics
| Posts | 50 |
| Solutions | 3 |
| Karma Given | 11 |
| Karma Received | 1 |
| Member Since | 02-23-2023 |
Activity Feed
- Posted Re: Splunk WEF proper inputs conf on Splunk Enterprise. 11-16-2025 06:22 PM
- Posted Re: Splunk WEF proper inputs conf on Splunk Enterprise. 11-13-2025 11:28 PM
- Posted Re: Splunk WEF proper inputs conf on Splunk Enterprise. 11-05-2025 12:43 AM
- Posted Re: Splunk WEF proper inputs conf on Splunk Enterprise. 10-30-2025 11:26 AM
- Posted Splunk WEF proper inputs conf on Splunk Enterprise. 10-30-2025 03:43 AM
- Got Karma for Re: Forwarder Management shows 0 agents. 10-16-2025 01:43 AM
- Posted Re: Forwarder Management shows 0 agents on Getting Data In. 10-16-2025 01:38 AM
- Karma Re: Splunk Core threat intelligence feed data for livehybrid. 09-01-2025 08:11 PM
- Karma Re: Splunk Core threat intelligence feed data for PickleRick. 09-01-2025 08:11 PM
- Posted Re: Add Mitre Att&ck TTP data to splunk core on Splunk Enterprise. 09-01-2025 07:54 PM
- Posted Add Mitre Att&ck TTP data to splunk core on Splunk Enterprise. 09-01-2025 02:30 AM
- Posted Re: Splunk Core threat intelligence feed data on Splunk Enterprise. 09-01-2025 01:55 AM
- Posted Splunk Core threat intelligence feed data on Splunk Enterprise. 09-01-2025 01:16 AM
- Karma Re: Splunk Indexes data pointing to different storage for PrewinThomas. 08-04-2025 02:25 AM
- Karma Re: Splunk Indexes data pointing to different storage for livehybrid. 08-04-2025 02:25 AM
- Posted Re: Splunk Indexes data pointing to different storage on Splunk Enterprise. 07-31-2025 11:19 PM
- Posted Splunk Indexes data pointing to different storage on Splunk Enterprise. 07-31-2025 09:47 AM
- Posted Re: Splunk Primary data not auto rolled to secondary after configuration change on Deployment Architecture. 07-24-2025 07:20 AM
- Posted Re: Splunk Primary data not auto rolled to secondary after configuration change on Deployment Architecture. 07-23-2025 12:32 AM
- Posted Re: Splunk Primary data not auto rolled to secondary after configuration change on Deployment Architecture. 07-22-2025 11:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-16-2025
06:22 PM
Sorry, its my fault not paste the latest config from inputs. Clearly i already enable it but it still not come.
... View more
11-13-2025
11:28 PM
Sorry for late update. Listing the inputs with btool show all the config and it also include the forwarded event stanza. Also when search for Event Log Reader permission i check this one. Am i need to add the user to the Event Log Reader group?
... View more
11-05-2025
12:43 AM
Listing the inputs status give no eventlog listed. After some exploration, the forwarded eventlog is different with windows common eventlog (security, system) that can automated sent to the splunk. I also try to match the user service that run splunkforwarder with the Event Log Readers permission. And there is no user has the permission. Maybe this one is the reason.
... View more
10-30-2025
11:26 AM
oh yeah, that disabled set true because i try the monitor options. So there's no need to update from the props.conf too or other config except enabling the inputs?
... View more
10-30-2025
03:43 AM
Hi everyone Im on process ingesting WEF event that collected on a server folder, let said D:\WEF\ForwardedEvents.evtx. Which one is the proper inputs? 1. Follow the TA-windows default [WinEventLog://ForwardedEvents]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=true
host=WinEventLogForwardHost
index=win_wef Or using monitor stanza like [monitor://D:\WEF\ForwardedEvents.evtx]
disabled = 0
index = win_wef
sourcetype = XmlWinEventLog:ForwardedEvents
host = WinEventLogForwardHost it consumed on clustered indexer and I already make sure the index exist and distributed properly, but still no data ingested to the indexer. Anny suggestions? Thank you.
... View more
Labels
- Labels:
-
administration
-
splunk-assist
10-16-2025
01:38 AM
1 Karma
Did you use a custom apps for manage the clients? i have same simmilar case with this. If there another config file (in my case, there is a restmap config with [broker:broker] stanza). After i remove this file, and restart the service the deployment server show all the forwarders.
... View more
09-01-2025
07:54 PM
yes, i think it tag and trigger by created alert that have been made before. But still wonder how to store it. I've read some documentation like using Splunk Security Essentials
... View more
09-01-2025
02:30 AM
Hi, I'm exploring several possibilities in Splunk Core for security purposes without using Splunk Enterprise Security. I'm currently trying to add TTP information from Mitre to Splunk Core. Is that possible or some of you ever did this before? really appreciate for any information given.
... View more
Labels
- Labels:
-
development
-
splunk-assist
09-01-2025
01:55 AM
thankyou for the response. do you have some techinal reference about that points? i want to try it
... View more
09-01-2025
01:16 AM
Hi, I was wondering if it is possible to incorporate threat intelligence data without using enterprise security? I've done it using Splunk ES, and it was pretty easy. But what if I don't have ES and only Splunk Core in my environment?
... View more
Labels
- Labels:
-
splunk-assist
07-31-2025
11:19 PM
Oh thankyou. so thats just point the bucket like the sample right?
... View more
07-31-2025
09:47 AM
Hi there, I want to point the secondary storage of my splunk indexer to mix with another storage, like point it to cloud storage? so it will like this one is the common: [volume:hot1]
path = /mnt/fast_disk
maxVolumeDataSizeMB = 100000 [volume:s3volume]
storageType = remote
path = s3://<bucketname>/rest/of/path is there a mechanism or reference to did this?
... View more
Labels
- Labels:
-
administration
-
configuration
-
splunk-assist
07-24-2025
07:20 AM
actually additional step is just to rolling restart after the config changes. and it will rebalanced
... View more
07-23-2025
12:32 AM
yeah, im not set it up on default folder. so it should be same with that condition. Additionaly, this is distributed indexer (3 instance).
... View more
07-22-2025
11:46 PM
yes sure. also based on this HOW TO: Reduce the Amount of Hot and Warm Buckets. | Splunk, i already meet with the condition. and the changes will trigger the bucket change whenever one of the following is reached. And on my condition one of the trigger already reached, but the data(DB) still not moved.
... View more
07-22-2025
11:40 PM
Additionaly, i also check and reduce the maxsize too for sampling one index. So I change the value from homePath.maxDataSizeMB, maxWarmDBCount. I did it last week, but when i check the total db or the size from the index data, there is still no data moved.
... View more
07-22-2025
09:36 PM
I wanna ask something on my lab clustered indexer. I got max primary capacity on my indexer. Last time i just reduce the maxWarmDBCount based on the existing db created, and after 1-2 day, it rolled to secondary storage. But this time i apply this modification again but it not rolled until one week. I also already crosscheck on the DB created on the index created and it still above the limit i set, i also check if the config already distributed. Anyone faced this scenario? #splunk
... View more
Labels
07-15-2025
12:56 AM
yeah, but for now just want to know if it able to disable from the stream conf. I know its better for the full visibility, but again beside because the license limits, also want to know the posibilities.
... View more
07-14-2025
09:52 AM
Currently I have setup Splunkstream, but there is a condition where I want to disable some data sources from certain protocols because they consume licenses. Is this possible? my case is i want to disable the stream:udp sourcetype. when i investigating the data it still come from source stream:ES_UDP_RAW.
... View more
Labels
- Labels:
-
data
-
inputs.conf
-
source
-
sourcetype
11-04-2024
08:37 PM
this /cold part
... View more
11-04-2024
07:45 PM
as i know, the result is same
... View more
11-03-2024
08:34 PM
but the restart process already done and it still show same value
... View more
11-02-2024
03:36 AM
Its on monitoring console, Disk Usage part. If we see there, there is a bar show the storage used. I already restart the service too, but the value still like the picture. I also inspect search from the panel, and the value are same, i copy it on excel like this one.
... View more
10-31-2024
08:52 PM
Hi, i made changes on my indexer storage but when i see on monitoring console part disk usage, the value is negative. Have anyone face this?. I already refresh the asset with monitoring console refresh and restart the instance but nothing changed.
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-17-2025
03:52 AM
|
Karma given to
