About jamie1

jamie1 · ‎01-22-2024

Hi There, I appreciate the generic guidance, but it isn't really relevant to my question. I am trying to find out how I can display CPU performance metrics, via the perfmon stanza. Sorry if my question wasn't clear, Jamie

jamie1 · ‎01-19-2024

Hi There, I use a Splunk Cloud instance with Universal Forwarders installed on each server. From here I have edited the inputs.conf file to enable the [perfmon://CPU] stanza. I am wondering if there are any out-of-the-box dashboards or recommended searches for putting this monitoring to use. All information I have been able to find online is in regards to an EOL add-on (Splunk App for Infrastructure) or Splunk On-Premise instances (This is a problem I have faced since beginning work on Splunk, huge lack of documentation for Splunk Cloud vs On-Prem) Thank you for any help in advance, Jamie

jamie1 · ‎01-16-2024

Hi There, I have noticed that the cloud monitoring console is reporting a critical bucket. I only have one and have attached a screenshot. The small % is 100. Unfortunately, I am not certain as to what this really means and whether it is something to worry about or not. Any help would be appreciated, Jamie

jamie1 · ‎10-23-2023

Hey, Thanks for the info, it was just the management port that needed changing, I picked a different port, finished the installation and everything seems to be working as expected. Thanks again for the information 🙂 Jamie

jamie1 · ‎10-23-2023

Hi There, I am currently trying to set up a universal forwarder on a CentOS 7 server. I have extracted the package and am attempting to start the service but receive the following: ERROR: mgmt port [8089] - port is already bound. Splunk needs to use this port. The port is in fact in use and thus the only solution seems to be using a non-default port. Will this cause any issues in the long run or is running Splunk on different ports completely supported? As I have only ever used the default ports for previous installations. Any help/info would be appreciated, Jamie

jamie1 · ‎10-20-2023

Hi There, I have noticed that since the most recent update (that changed the UI) the manage bookmarks dashboard is displaying incorrectly when set as my home page. Has anyone else experienced this / know of a fix? I have also attached an image that shows what the page is meant to look like (Normal Behaviour, Bottom Half of image) and what it looks like when set as the homepage (Strange behaviour on Home Page, Top half of image). Any help/info would be appreciated, Jamie

jamie1 · ‎07-31-2023

Hi There, I have just checked the Cloud Monitoring Console after receiving an email that noted some apps were ready to be upgraded to Python 3. I am using Splunk Cloud and saw the following information about my universal forwarders. I have attached a screenshot, but the date doesn't appear to make sense and the newer version is showing as being outdated. Any help would be appreciated, Jamie

jamie1 · ‎07-26-2023

From what you're saying it seems like setting up the Heavy Forwarders seems to be the best long term solution. In your opinion, which sort of device would be most suited for being a Heavy Forwarder? Thanks for your help so far, Jamie

jamie1 · ‎07-26-2023

I do indeed use Universal Forwarders, not heavy forwarders.

jamie1 · ‎07-26-2023

Hi Giuseppe, I am using Splunk Cloud, would this make a difference to this process? Jamie

jamie1 · ‎07-26-2023

Hi Rich, That reply was not to your message. I am yet to try your solution. Thanks for the advice though. Jamie

jamie1 · ‎07-26-2023

I want events to be put in either the main index or and index called "risks" based on Windows event ID. I have created an index named "risks" but am not sure how to filter the events there. I attempted to implement the commands you recommended, but searching index="risks" shows nothing. Jamie

jamie1 · ‎07-26-2023

Hi There, I am currently trying to set up specific events to be sent to a separate index. The documentation on how to do this was quite confusing for me. I assume I am making a very obvious mistake. I can provide any necessary information, Any help would be appreciated, Jamie

jamie1 · ‎06-20-2023

Issue was the space in "Program Files", used "PROGRA~1" instead and the problem was fixed.

jamie1 · ‎06-20-2023

Hi There, I am attempting to ingest data from the WindowsUpdateLog using the Splunk Windows TA. I have attached a screenshot of the inputs.conf stanza relating to this file and demonstrated that the file path is correct. Any help would be appreciated, Jamie

jamie1 · ‎06-06-2023

Thanks for your help!!

jamie1 · ‎06-06-2023

Hi There, Switching to the splunk account using the command you recommended me worked, however I had to add it to sudoers. Would I be safe to remove the splunk account from sudoers or is it better to leave it there? Jamie

jamie1 · ‎06-06-2023

I'm using the root user to run the command and the splunk local account for the credentials. Ideally I don't want to switch accounts as it will require me to fiddle with our MFA software to allow the local user to sign in.

jamie1 · ‎06-06-2023

The service appears to be functioning normally, so I'm not sure why uninstalling and reinstalling the forwarder would make a difference?

jamie1 · ‎06-06-2023

Hi There, I stopped the service, enabled the bootstart for the splunk user, started it again and received the same error. Jamie

jamie1 · ‎06-06-2023

The forwarder is already installed, the error is with the credentials package.

jamie1 · ‎06-06-2023

It's a normal Linux server and the first link you sent (https://www.splunk.com/en_us/download/universal-forwarder.html?locale=en_us&_ga=2.140976370.1562358827.1686037631-1490055446.1686037631&_gl=1*1hq0oat*_ga*MTQ5MDA1NTQ0Ni4xNjg2MDM3NjMx*_ga_5EPM2P39FV*MTY4NjA1NjQ3OS41LjEuMTY4NjA1OTgyMy4zOC4wLjA.) is the guide that I have been following. I get to step 5 and then it throws the error.

jamie1 · ‎06-06-2023

Hi There, I am currently trying to install a Splunk Universal Forwarder on a Linux server (Ubuntu 18.04). I have installed the forwarder but am receiving the following error when trying to install the credentials pacakge: Error during app install: failed to extract app from /tmp/splunkcloud.spl to /opt/splunkforwarder/splunkforwarder/var/run/splunk/bundle_tmp/08fff82e60ae81e9: No such file or directory I transferred the file to the server using WinSCP and I have confirmed that the splunkcloud.spl file exists in the /tmp folder. I have also made sure that the permissions are correct on the directory. Any help would be appreciated, Jamie

jamie1 · ‎06-05-2023

For anyone that might be interested, I found a way to achieve this using an app called "MS Teams Alert Action". The link to the add-on is here: Microsoft Teams messages publication addon | Splunkbase

jamie1 · ‎05-31-2023

Hi There, I am attempting to set up alerts to send a message to a teams channel. However, I can't seem to find a way to edit the request and the only option is to enter a URL. Any help would be appreciated, Jamie

Posts	48
Solutions	2
Karma Given	18
Karma Received	3
Member Since	‎03-22-2023

Online Status	Offline
Date Last Visited	‎01-22-2024 12:05 PM

CPU Performance Monitoring in Splunk Cloud

Critical Bucket size and range

Consequences of not using default ports

Strange Dashboard Behaviour (Manage Bookmarks)

Why is there Splunk Cloud Monitoring Console Inacc...

Sending Specific Events to Separate Indexes

Splunk Not Monitoring File

How to resolve error when installing Splunk Creden...

Splunk Webhook Script - Setting up Microsoft Teams...

Is there a way to show a message when no search re...

Re: CPU Performance Monitoring in Splunk Cloud

CPU Performance Monitoring in Splunk Cloud

Critical Bucket size and range

Re: Consequences of not using default ports

Consequences of not using default ports

Strange Dashboard Behaviour (Manage Bookmarks)

Why is there Splunk Cloud Monitoring Console Inacc...

Re: Sending Specific Events to Separate Indexes

Re: Sending Specific Events to Separate Indexes

Re: Sending Specific Events to Separate Indexes

Re: Sending Specific Events to Separate Indexes

Re: Sending Specific Events to Separate Indexes

Sending Specific Events to Separate Indexes

Re: Splunk Not Monitoring File

Splunk Not Monitoring File

Re: How to resolve error when installing Splunk Cr...

Re: How to resolve error when installing Splunk Cr...

Re: How to resolve error when installing Splunk Cr...

Re: How to resolve error when installing Splunk Cr...

Re: How to resolve error when installing Splunk Cr...

Re: How to resolve error when installing Splunk Cr...

Re: How to resolve error when installing Splunk Cr...

How to resolve error when installing Splunk Creden...

Re: Splunk Webhook Script - Setting up Microsoft T...

Splunk Webhook Script - Setting up Microsoft Teams...

Join the Conversation