Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jamie1
jamie1
Communicator
Member since:
03-22-2023
01-22-2024
Community Statistics
| Posts | 48 |
| Solutions | 2 |
| Karma Given | 18 |
| Karma Received | 3 |
| Member Since | 03-22-2023 |
Activity Feed
- Posted Re: CPU Performance Monitoring in Splunk Cloud on Getting Data In. 01-22-2024 07:48 AM
- Posted CPU Performance Monitoring in Splunk Cloud on Getting Data In. 01-19-2024 06:06 AM
- Posted Critical Bucket size and range on Getting Data In. 01-16-2024 02:24 AM
- Posted Re: Consequences of not using default ports on Installation. 10-23-2023 04:57 AM
- Karma Re: Consequences of not using default ports for tej57. 10-23-2023 04:57 AM
- Posted Consequences of not using default ports on Installation. 10-23-2023 02:38 AM
- Posted Strange Dashboard Behaviour (Manage Bookmarks) on Dashboards & Visualizations. 10-20-2023 05:06 AM
- Got Karma for Re: Changing from XML format to "Normal" format.. 09-01-2023 11:56 AM
- Posted Why is there Splunk Cloud Monitoring Console Inaccuracy? on Monitoring Splunk. 07-31-2023 07:48 AM
- Posted Re: Sending Specific Events to Separate Indexes on Getting Data In. 07-26-2023 08:54 AM
- Posted Re: Sending Specific Events to Separate Indexes on Getting Data In. 07-26-2023 08:46 AM
- Posted Re: Sending Specific Events to Separate Indexes on Getting Data In. 07-26-2023 08:30 AM
- Posted Re: Sending Specific Events to Separate Indexes on Getting Data In. 07-26-2023 07:25 AM
- Posted Re: Sending Specific Events to Separate Indexes on Getting Data In. 07-26-2023 07:19 AM
- Posted Sending Specific Events to Separate Indexes on Getting Data In. 07-26-2023 06:20 AM
- Posted Re: Splunk Not Monitoring File on Getting Data In. 06-20-2023 05:48 AM
- Posted Splunk Not Monitoring File on Getting Data In. 06-20-2023 02:41 AM
- Posted Re: How to resolve error when installing Splunk Credentials Package (splunkclouduf.spl)? on Installation. 06-06-2023 08:40 AM
- Karma Re: How to resolve error when installing Splunk Credentials Package (splunkclouduf.spl)? for isoutamo. 06-06-2023 08:40 AM
- Karma Re: How to resolve error when installing Splunk Credentials Package (splunkclouduf.spl)? for isoutamo. 06-06-2023 08:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-22-2024
07:48 AM
Hi There, I appreciate the generic guidance, but it isn't really relevant to my question. I am trying to find out how I can display CPU performance metrics, via the perfmon stanza. Sorry if my question wasn't clear, Jamie
... View more
01-19-2024
06:06 AM
Hi There, I use a Splunk Cloud instance with Universal Forwarders installed on each server. From here I have edited the inputs.conf file to enable the [perfmon://CPU] stanza. I am wondering if there are any out-of-the-box dashboards or recommended searches for putting this monitoring to use. All information I have been able to find online is in regards to an EOL add-on (Splunk App for Infrastructure) or Splunk On-Premise instances (This is a problem I have faced since beginning work on Splunk, huge lack of documentation for Splunk Cloud vs On-Prem) Thank you for any help in advance, Jamie
... View more
Labels
- Labels:
-
inputs.conf
-
monitor
-
universal forwarder
01-16-2024
02:24 AM
Hi There, I have noticed that the cloud monitoring console is reporting a critical bucket. I only have one and have attached a screenshot. The small % is 100. Unfortunately, I am not certain as to what this really means and whether it is something to worry about or not. Any help would be appreciated, Jamie
... View more
10-23-2023
04:57 AM
Hey, Thanks for the info, it was just the management port that needed changing, I picked a different port, finished the installation and everything seems to be working as expected. Thanks again for the information 🙂 Jamie
... View more
10-23-2023
02:38 AM
Hi There, I am currently trying to set up a universal forwarder on a CentOS 7 server. I have extracted the package and am attempting to start the service but receive the following: ERROR: mgmt port [8089] - port is already bound. Splunk needs to use this port. The port is in fact in use and thus the only solution seems to be using a non-default port. Will this cause any issues in the long run or is running Splunk on different ports completely supported? As I have only ever used the default ports for previous installations. Any help/info would be appreciated, Jamie
... View more
Labels
- Labels:
-
Linux
-
universal forwarder
10-20-2023
05:06 AM
Hi There, I have noticed that since the most recent update (that changed the UI) the manage bookmarks dashboard is displaying incorrectly when set as my home page. Has anyone else experienced this / know of a fix? I have also attached an image that shows what the page is meant to look like (Normal Behaviour, Bottom Half of image) and what it looks like when set as the homepage (Strange behaviour on Home Page, Top half of image). Any help/info would be appreciated, Jamie
... View more
Labels
- Labels:
-
dashboard
07-31-2023
07:48 AM
Hi There,
I have just checked the Cloud Monitoring Console after receiving an email that noted some apps were ready to be upgraded to Python 3. I am using Splunk Cloud and saw the following information about my universal forwarders.
I have attached a screenshot, but the date doesn't appear to make sense and the newer version is showing as being outdated.
Any help would be appreciated,
Jamie
... View more
Labels
07-26-2023
08:54 AM
From what you're saying it seems like setting up the Heavy Forwarders seems to be the best long term solution. In your opinion, which sort of device would be most suited for being a Heavy Forwarder? Thanks for your help so far, Jamie
... View more
07-26-2023
08:30 AM
Hi Giuseppe, I am using Splunk Cloud, would this make a difference to this process? Jamie
... View more
07-26-2023
07:25 AM
Hi Rich, That reply was not to your message. I am yet to try your solution. Thanks for the advice though. Jamie
... View more
07-26-2023
07:19 AM
I want events to be put in either the main index or and index called "risks" based on Windows event ID. I have created an index named "risks" but am not sure how to filter the events there. I attempted to implement the commands you recommended, but searching index="risks" shows nothing. Jamie
... View more
07-26-2023
06:20 AM
Hi There, I am currently trying to set up specific events to be sent to a separate index. The documentation on how to do this was quite confusing for me. I assume I am making a very obvious mistake. I can provide any necessary information, Any help would be appreciated, Jamie
... View more
Labels
06-20-2023
05:48 AM
Issue was the space in "Program Files", used "PROGRA~1" instead and the problem was fixed.
... View more
06-20-2023
02:41 AM
Hi There, I am attempting to ingest data from the WindowsUpdateLog using the Splunk Windows TA. I have attached a screenshot of the inputs.conf stanza relating to this file and demonstrated that the file path is correct. Any help would be appreciated, Jamie
... View more
Labels
- Labels:
-
monitor
-
sourcetype
-
universal forwarder
06-06-2023
08:40 AM
Thanks for your help!!
... View more
06-06-2023
08:14 AM
Hi There, Switching to the splunk account using the command you recommended me worked, however I had to add it to sudoers. Would I be safe to remove the splunk account from sudoers or is it better to leave it there? Jamie
... View more
06-06-2023
07:46 AM
I'm using the root user to run the command and the splunk local account for the credentials. Ideally I don't want to switch accounts as it will require me to fiddle with our MFA software to allow the local user to sign in.
... View more
06-06-2023
07:17 AM
The service appears to be functioning normally, so I'm not sure why uninstalling and reinstalling the forwarder would make a difference?
... View more
06-06-2023
07:16 AM
Hi There, I stopped the service, enabled the bootstart for the splunk user, started it again and received the same error. Jamie
... View more
06-06-2023
07:06 AM
The forwarder is already installed, the error is with the credentials package.
... View more
06-06-2023
06:58 AM
It's a normal Linux server and the first link you sent (https://www.splunk.com/en_us/download/universal-forwarder.html?locale=en_us&_ga=2.140976370.1562358827.1686037631-1490055446.1686037631&_gl=1*1hq0oat*_ga*MTQ5MDA1NTQ0Ni4xNjg2MDM3NjMx*_ga_5EPM2P39FV*MTY4NjA1NjQ3OS41LjEuMTY4NjA1OTgyMy4zOC4wLjA.) is the guide that I have been following. I get to step 5 and then it throws the error.
... View more
06-06-2023
06:48 AM
Hi There,
I am currently trying to install a Splunk Universal Forwarder on a Linux server (Ubuntu 18.04).
I have installed the forwarder but am receiving the following error when trying to install the credentials pacakge:
Error during app install: failed to extract app from /tmp/splunkcloud.spl to /opt/splunkforwarder/splunkforwarder/var/run/splunk/bundle_tmp/08fff82e60ae81e9: No such file or directory
I transferred the file to the server using WinSCP and I have confirmed that the splunkcloud.spl file exists in the /tmp folder. I have also made sure that the permissions are correct on the directory.
Any help would be appreciated,
Jamie
... View more
Labels
- Labels:
-
Linux
-
universal forwarder
06-05-2023
02:06 AM
1 Karma
For anyone that might be interested, I found a way to achieve this using an app called "MS Teams Alert Action". The link to the add-on is here: Microsoft Teams messages publication addon | Splunkbase
... View more
05-31-2023
05:57 AM
Hi There,
I am attempting to set up alerts to send a message to a teams channel.
However, I can't seem to find a way to edit the request and the only option is to enter a URL.
Any help would be appreciated,
Jamie
... View more
Labels
- Labels:
-
alert action
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-22-2024
12:05 PM
|
