Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About daniaabujuma
daniaabujuma
Explorer
Member since:
03-31-2023
12-19-2023
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 03-31-2023 |
Activity Feed
- Posted Splunk Upgrade to 9.1.x Not Working on Splunk Enterprise. 12-18-2023 10:48 PM
- Tagged Splunk Upgrade to 9.1.x Not Working on Splunk Enterprise. 12-18-2023 10:48 PM
- Tagged Splunk Upgrade to 9.1.x Not Working on Splunk Enterprise. 12-18-2023 10:48 PM
- Tagged Splunk Upgrade to 9.1.x Not Working on Splunk Enterprise. 12-18-2023 10:48 PM
- Tagged Splunk Upgrade to 9.1.x Not Working on Splunk Enterprise. 12-18-2023 10:48 PM
- Posted MITRE ATT&CK Posture for Enterprise Security Notables on Splunk Enterprise. 10-29-2023 11:38 PM
- Tagged MITRE ATT&CK Posture for Enterprise Security Notables on Splunk Enterprise. 10-29-2023 11:38 PM
- Tagged MITRE ATT&CK Posture for Enterprise Security Notables on Splunk Enterprise. 10-29-2023 11:38 PM
- Posted Re: Notables Are Not Getting Created on Other Usage. 09-06-2023 05:25 AM
- Posted Re: Notables Are Not Getting Created on Other Usage. 09-06-2023 05:05 AM
- Posted Notables Are Not Being Created on Other Usage. 09-06-2023 04:57 AM
- Karma Re: reinstalling splunk enterprise - RESOLVED for klaxdal. 08-23-2023 04:31 AM
- Posted Re: Changing Timezone for Events on Splunk Enterprise. 08-21-2023 06:45 AM
- Posted How to change Timezone for Events? on Splunk Enterprise. 08-21-2023 01:03 AM
- Tagged How to change Timezone for Events? on Splunk Enterprise. 08-21-2023 01:03 AM
- Tagged How to change Timezone for Events? on Splunk Enterprise. 08-21-2023 01:03 AM
- Tagged How to change Timezone for Events? on Splunk Enterprise. 08-21-2023 01:03 AM
- Posted Re: Using "transaction" Command on Splunk Enterprise. 07-25-2023 05:39 AM
- Posted Using "transaction" Command on Splunk Enterprise. 07-25-2023 04:41 AM
- Tagged Using "transaction" Command on Splunk Enterprise. 07-25-2023 04:41 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-18-2023
10:48 PM
Hello Splunkers! I'm trying to upgrade my Splunk Enterprise from 9.0.x to 9.1.x . After checking the release notes, I saw that I need to add the following: Reference link: https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/AboutupgradingREADTHISFIRST I have done that and proceeded to perform the upgrade, but I received an error regarding the UTF8 even though I added the required line. Any suggestions for what I might do to overcome this issue?
... View more
Labels
10-29-2023
11:38 PM
Hello Splunkers! I was wondering where I can turn on and view the MITRE ATT&CK posture for every notable in Enterprise Security as shown in the picture:
... View more
09-06-2023
05:05 AM
Hi @gcusello , Thanks for the reply. This is what I did, it works every time without issues but I noticed that recently the newly created correlations aren't creating notables when triggered.
... View more
09-06-2023
04:57 AM
Hi Splunkers! I am using Splunk Enterprise Security, and creating correlation searches, one of them I have created and tested manually by running the search over a specific period of time, many events matched, but no notable events are being created. To test my correlation, I have added another action (send email) when the correlation is triggered, and sure enough, an email was sent to me. Can anyone help me solve this issue?
... View more
Labels
- Labels:
-
alert action
-
alert condition
-
throttling
08-21-2023
06:45 AM
Hi @PickleRick How can I modify the metadata (_time) to match my timezone (the needed timezone)? For example, my environment is distributed over multiple locations (countries), some assets in USA and some in the middle east, I want to normalize all events to match only 1 timezone. I hope this makes the situation more clear, please let me know if you have any recommendations.
... View more
08-21-2023
01:03 AM
Hello Splunkers!
I am collecting logs from multiple devices, a couple of them have different timezones, so I followed the instructions listed in the following link:
https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Applytimezoneoffsetstotimestamps#:~:text=To%20determine%20the%20time%20zone,TZ%20attribute%20set%20in%20props.
What I did was:
[source::cisco] TZ = US/Eastern
The timestamp after this change is like this:
Instead of becoming 10:00 AM it did 7:00 AM +3:00
How can this be changed?
... View more
07-25-2023
05:39 AM
Hello @richgalloway , Thank you for your reply! I tried your recommendation but unfortunately it didn't work. Do you have any other suggestions?
... View more
07-25-2023
04:41 AM
Hello Splunkers! I am using "transaction" command to merge multiple logs based on a mutual field between them. To clarify, I have email logs, the issue is that for 1 email I receive 4 logs in the following order: from subject attachment to They all have one field in common: id. I am using the following transaction command: | transaction id startswith=from endswith=to The issue is that it merges only the two logs containing "from" and "to". Can you please verify if I am using the command correctly because I need it to also merge the logs in between not only "from" and "to".
... View more
Labels
07-06-2023
01:20 AM
Hello,
I have a question regarding forwarding and receiving in Splunk. Can I configure the deployment client to send logs to another log collector in case the first one is not responding or receiving logs? To be more specific, is there any kind of configuration that can be done so the deployment client will automatically switch to another log collector if the first one isn't available?
Thank you.
... View more
07-06-2023
12:42 AM
Hi @isoutamo , Thanks for your reply. The IP showing for all clients is the deployment server IP. Do you have any idea what could be the issue?
... View more
07-06-2023
12:24 AM
Hello, I know this was a while ago but were you able to find a solution for this issue?
... View more
06-21-2023
01:58 AM
Hello, is there a way to upgrade Splunk universal forwarder to all onboarded endpoints using the deployment server? I was looking for answers but I didn't find anything helpful. Thank you.
... View more
Labels
06-11-2023
02:46 AM
Hi @ITWhisperer , Unfortunately, that is not an option for me. All I can do is look for a walkaround or a way edit syslog configuration settings to receive logs in the appropriate form, do you have any recommendation?
... View more
06-11-2023
01:23 AM
Hi all, I have an issue with the logs I am receiving from Proofpoint. The issue is that I am receiving logs with either (from) or (to) field, but they are never associated together. This is due to the fact that every time an email is sent or received, it goes to quarantine in Proofpoint to be scanned, and is then sent to the recipient. This is an issue for me because I can't see the sender and receiver for each email.
I have reached out to Proofpoint but they said there's nothing we can do. I am receiving the logs through syslog, is there anything that I can change or edit to receive the logs with both fields?
... View more
Labels
- Labels:
-
fields
05-31-2023
12:25 AM
Thank you @isoutamo this worked perfectly!
... View more
05-30-2023
11:54 PM
Hi @isoutamo Thank you for your reply! I tried your recommendation but unfortunately it didn't work. Do you have any other recommendation that might work? Thank you.
... View more
05-30-2023
11:26 PM
Hello, I am running multiple Splunk instances on the same machine, located in /opt as follows: /opt/splunk1 /opt/splunk2 /opt/splunk3 ... etc I need to upgrade Splunk Enterprise to a newer version, I tried using the following RPM command: sudo rpm -Uvh --relocate=/opt/splunk=/opt/splunk1 splunk.rpm But I received the following error message: path /opt/splunk in package splunk is not relocatable I tried using a .tgz file instead, but it's also not working. sudo tar -xzf splunk.tgz -C /opt/splunk1 Can anyone recommend a way to upgrade Splunk on all my instances?
... View more
Labels
- Labels:
-
heavy forwarder
-
Linux
05-11-2023
12:18 AM
Hi @PickleRick Thank you for your reply. The weird thing is that the server itself didn't shutdown, only Splunk service. And regarding crash log, no I didn't find crash log in any of the servers facing this issue.
... View more
05-08-2023
02:34 AM
Dear @PickleRick and @SanjayReddy Thanks for replying. I have checked the following: Splunk Universal Forwarder for Windows version: 9.0.4 . The release notes state that one of the fixed issues is UF crash on EventLoop::run assert rv > 0 ( https://docs.splunk.com/Documentation/Splunk/9.0.4/ReleaseNotes/Fixedissues ). I have checked splunkd.log on one of the servers where Splunk has crashed, but unfortunately, I haven't found something reasonable. Here is a part of the logs: 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\etc\splunk.version. 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\var\log\splunk. 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\var\log\watchdog. 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\var\run\splunk\search_telemetry. 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\var\spool\splunk. 04-16-2023 09:23:34.493 +0300 INFO TcpOutputProc [12564 parsing] - _isHttpOutConfigured=NOT_CONFIGURED 04-16-2023 09:23:34.493 +0300 ERROR TcpOutputProc [12564 parsing] - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. 04-16-2023 09:23:34.493 +0300 INFO ConfigWatcher [11140 SplunkConfigChangeWatcherThread] - SplunkConfigChangeWatcher initializing... 04-16-2023 09:23:34.493 +0300 INFO ConfigWatcher [11140 SplunkConfigChangeWatcherThread] - Watching path: C:\Program Files\SplunkUniversalForwarder\etc\system\local, C:\Program Files\SplunkUniversalForwarder\etc\system\default, C:\Program Files\SplunkUniversalForwarder\etc\apps, C:\Program Files\SplunkUniversalForwarder\etc\users, C:\Program Files\SplunkUniversalForwarder\etc\peer-apps, C:\Program Files\SplunkUniversalForwarder\etc\instance.cfg 04-16-2023 09:23:34.493 +0300 INFO ConfigWatcher [11140 SplunkConfigChangeWatcherThread] - Finding the deleted watched configuration files (while splunkd was down) completed in duration=0 secs 04-16-2023 09:23:34.493 +0300 INFO loader [6504 HTTPDispatch] - Limiting REST HTTP server to 3333 sockets 04-16-2023 09:23:34.493 +0300 INFO loader [6504 HTTPDispatch] - Limiting REST HTTP server to 1365 threads 04-16-2023 09:23:34.493 +0300 WARN X509Verify [6504 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: <http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates> 04-16-2023 09:23:34.540 +0300 INFO UiHttpListener [10672 WebuiStartup] - Web UI disabled in web.conf [settings]; not starting 04-16-2023 09:23:40.524 +0300 WARN TailReader [5296 tailreader0] - Could not send data to output queue (parsingQueue), retrying... 04-16-2023 09:23:58.338 +0300 INFO loader [6504 HTTPDispatch] - Shutdown HTTPDispatchThread 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - Shutting down splunkd 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_Begin" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_NoahHealthReport" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_FileIntegrityChecker" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_JustBeforeKVStore" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_KVStore" 04-16-2023 09:23:58.338 +0300 INFO CollectionCacheManager [10296 CollectionCacheBookkeepingThread] - CollectionCacheBookkeepingThread finished eloop 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_DFM" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_Thruput" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_FederatedHeartBeat" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_TcpInput1" 04-16-2023 09:23:58.338 +0300 INFO TcpInputProc [3020 Shutdown] - Running shutdown level 1. Closing listening ports. 04-16-2023 09:23:58.338 +0300 INFO TcpInputProc [3020 Shutdown] - Done setting shutdown in progress signal. 04-16-2023 09:23:58.338 +0300 INFO TcpInputProc [10636 TcpListener] - Shutting down listening ports
... View more
05-04-2023
12:53 AM
Hello, I have an issue with my Splunk Universal Forwarder as it keeps randomly stopping on Windows server without any explanation. The error found in the logs is "The SplunkForwarder Service service terminated unexpectedly. It has done this 1 time(s)." Does anyone have any idea what might be causing this issue?
... View more
Labels
03-31-2023
12:02 PM
1 Karma
Hi everyone, I have implemented Splunk for my architecture at work, to give you an insight, the architecture is pretty big, consisting of 3 sites. So, I have 3 heavy forwarders in total (1 for each site), and 2 indexers. The alert (forwarder ingestion latency) is showing on all the HFs and the 2 indexers. I have reviewed all the recommendations that were given by the community as well as Splunk documentation, with no luck. The issue is that now some logs are being lost because of this issue. I have increased the queue size on all servers up to 100MB and turned ACK off. Still, I am facing issues. Does anyone have any recommendation that might be useful?
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-19-2023
06:48 AM
|
