About daniaabujuma

daniaabujuma

Hello @gcusello , Yes everything is the exact same

daniaabujuma

Hi @gcusello , Thanks for the reply. This is what I did, it works every time without issues but I noticed that recently the newly created correlations aren't creating notables when triggered.

daniaabujuma

Hi Splunkers! I am using Splunk Enterprise Security, and creating correlation searches, one of them I have created and tested manually by running the search over a specific period of time, many events matched, but no notable events are being created. To test my correlation, I have added another action (send email) when the correlation is triggered, and sure enough, an email was sent to me. Can anyone help me solve this issue?

daniaabujuma · ‎08-21-2023

Hi @PickleRick How can I modify the metadata (_time) to match my timezone (the needed timezone)? For example, my environment is distributed over multiple locations (countries), some assets in USA and some in the middle east, I want to normalize all events to match only 1 timezone. I hope this makes the situation more clear, please let me know if you have any recommendations.

daniaabujuma · ‎08-21-2023

Hello Splunkers! I am collecting logs from multiple devices, a couple of them have different timezones, so I followed the instructions listed in the following link: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Applytimezoneoffsetstotimestamps#:~:text=To%20determine%20the%20time%20zone,TZ%20attribute%20set%20in%20props. What I did was: [source::cisco] TZ = US/Eastern The timestamp after this change is like this: Instead of becoming 10:00 AM it did 7:00 AM +3:00 How can this be changed?

daniaabujuma · ‎07-25-2023

Hello @richgalloway , Thank you for your reply! I tried your recommendation but unfortunately it didn't work. Do you have any other suggestions?

daniaabujuma · ‎07-25-2023

Hello Splunkers! I am using "transaction" command to merge multiple logs based on a mutual field between them. To clarify, I have email logs, the issue is that for 1 email I receive 4 logs in the following order: from subject attachment to They all have one field in common: id. I am using the following transaction command: | transaction id startswith=from endswith=to The issue is that it merges only the two logs containing "from" and "to". Can you please verify if I am using the command correctly because I need it to also merge the logs in between not only "from" and "to".

daniaabujuma · ‎07-06-2023

Hello, I have a question regarding forwarding and receiving in Splunk. Can I configure the deployment client to send logs to another log collector in case the first one is not responding or receiving logs? To be more specific, is there any kind of configuration that can be done so the deployment client will automatically switch to another log collector if the first one isn't available? Thank you.

daniaabujuma · ‎07-06-2023

Hi @isoutamo , Thanks for your reply. The IP showing for all clients is the deployment server IP. Do you have any idea what could be the issue?

daniaabujuma · ‎07-06-2023

Hello, I know this was a while ago but were you able to find a solution for this issue?

daniaabujuma · ‎06-21-2023

Hello, is there a way to upgrade Splunk universal forwarder to all onboarded endpoints using the deployment server? I was looking for answers but I didn't find anything helpful. Thank you.

daniaabujuma · ‎06-11-2023

Hi @ITWhisperer , Unfortunately, that is not an option for me. All I can do is look for a walkaround or a way edit syslog configuration settings to receive logs in the appropriate form, do you have any recommendation?

daniaabujuma · ‎06-11-2023

Hi all, I have an issue with the logs I am receiving from Proofpoint. The issue is that I am receiving logs with either (from) or (to) field, but they are never associated together. This is due to the fact that every time an email is sent or received, it goes to quarantine in Proofpoint to be scanned, and is then sent to the recipient. This is an issue for me because I can't see the sender and receiver for each email. I have reached out to Proofpoint but they said there's nothing we can do. I am receiving the logs through syslog, is there anything that I can change or edit to receive the logs with both fields?

daniaabujuma · ‎05-31-2023

Thank you @isoutamo this worked perfectly!

daniaabujuma · ‎05-30-2023

Hi @isoutamo Thank you for your reply! I tried your recommendation but unfortunately it didn't work. Do you have any other recommendation that might work? Thank you.

daniaabujuma · ‎05-30-2023

Hello, I am running multiple Splunk instances on the same machine, located in /opt as follows: /opt/splunk1 /opt/splunk2 /opt/splunk3 ... etc I need to upgrade Splunk Enterprise to a newer version, I tried using the following RPM command: sudo rpm -Uvh --relocate=/opt/splunk=/opt/splunk1 splunk.rpm But I received the following error message: path /opt/splunk in package splunk is not relocatable I tried using a .tgz file instead, but it's also not working. sudo tar -xzf splunk.tgz -C /opt/splunk1 Can anyone recommend a way to upgrade Splunk on all my instances?

daniaabujuma · ‎05-11-2023

Hi @PickleRick Thank you for your reply. The weird thing is that the server itself didn't shutdown, only Splunk service. And regarding crash log, no I didn't find crash log in any of the servers facing this issue.

daniaabujuma · ‎05-08-2023

Dear @PickleRick and @SanjayReddy Thanks for replying. I have checked the following: Splunk Universal Forwarder for Windows version: 9.0.4 . The release notes state that one of the fixed issues is UF crash on EventLoop::run assert rv > 0 ( https://docs.splunk.com/Documentation/Splunk/9.0.4/ReleaseNotes/Fixedissues ). I have checked splunkd.log on one of the servers where Splunk has crashed, but unfortunately, I haven't found something reasonable. Here is a part of the logs: 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\etc\splunk.version. 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\var\log\splunk. 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\var\log\watchdog. 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\var\run\splunk\search_telemetry. 04-16-2023 09:23:34.477 +0300 INFO TailingProcessor [12784 MainTailingThread] - Adding watch on path: C:\Program Files\SplunkUniversalForwarder\var\spool\splunk. 04-16-2023 09:23:34.493 +0300 INFO TcpOutputProc [12564 parsing] - _isHttpOutConfigured=NOT_CONFIGURED 04-16-2023 09:23:34.493 +0300 ERROR TcpOutputProc [12564 parsing] - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. 04-16-2023 09:23:34.493 +0300 INFO ConfigWatcher [11140 SplunkConfigChangeWatcherThread] - SplunkConfigChangeWatcher initializing... 04-16-2023 09:23:34.493 +0300 INFO ConfigWatcher [11140 SplunkConfigChangeWatcherThread] - Watching path: C:\Program Files\SplunkUniversalForwarder\etc\system\local, C:\Program Files\SplunkUniversalForwarder\etc\system\default, C:\Program Files\SplunkUniversalForwarder\etc\apps, C:\Program Files\SplunkUniversalForwarder\etc\users, C:\Program Files\SplunkUniversalForwarder\etc\peer-apps, C:\Program Files\SplunkUniversalForwarder\etc\instance.cfg 04-16-2023 09:23:34.493 +0300 INFO ConfigWatcher [11140 SplunkConfigChangeWatcherThread] - Finding the deleted watched configuration files (while splunkd was down) completed in duration=0 secs 04-16-2023 09:23:34.493 +0300 INFO loader [6504 HTTPDispatch] - Limiting REST HTTP server to 3333 sockets 04-16-2023 09:23:34.493 +0300 INFO loader [6504 HTTPDispatch] - Limiting REST HTTP server to 1365 threads 04-16-2023 09:23:34.493 +0300 WARN X509Verify [6504 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: <http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates> 04-16-2023 09:23:34.540 +0300 INFO UiHttpListener [10672 WebuiStartup] - Web UI disabled in web.conf [settings]; not starting 04-16-2023 09:23:40.524 +0300 WARN TailReader [5296 tailreader0] - Could not send data to output queue (parsingQueue), retrying... 04-16-2023 09:23:58.338 +0300 INFO loader [6504 HTTPDispatch] - Shutdown HTTPDispatchThread 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - Shutting down splunkd 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_Begin" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_NoahHealthReport" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_FileIntegrityChecker" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_JustBeforeKVStore" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_KVStore" 04-16-2023 09:23:58.338 +0300 INFO CollectionCacheManager [10296 CollectionCacheBookkeepingThread] - CollectionCacheBookkeepingThread finished eloop 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_DFM" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_Thruput" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_FederatedHeartBeat" 04-16-2023 09:23:58.338 +0300 INFO Shutdown [3020 Shutdown] - shutting down level="ShutdownLevel_TcpInput1" 04-16-2023 09:23:58.338 +0300 INFO TcpInputProc [3020 Shutdown] - Running shutdown level 1. Closing listening ports. 04-16-2023 09:23:58.338 +0300 INFO TcpInputProc [3020 Shutdown] - Done setting shutdown in progress signal. 04-16-2023 09:23:58.338 +0300 INFO TcpInputProc [10636 TcpListener] - Shutting down listening ports

daniaabujuma · ‎05-04-2023

Hello, I have an issue with my Splunk Universal Forwarder as it keeps randomly stopping on Windows server without any explanation. The error found in the logs is "The SplunkForwarder Service service terminated unexpectedly. It has done this 1 time(s)." Does anyone have any idea what might be causing this issue?

daniaabujuma · ‎03-31-2023

Hi everyone, I have implemented Splunk for my architecture at work, to give you an insight, the architecture is pretty big, consisting of 3 sites. So, I have 3 heavy forwarders in total (1 for each site), and 2 indexers. The alert (forwarder ingestion latency) is showing on all the HFs and the 2 indexers. I have reviewed all the recommendations that were given by the community as well as Splunk documentation, with no luck. The issue is that now some logs are being lost because of this issue. I have increased the queue size on all servers up to 100MB and turned ACK off. Still, I am facing issues. Does anyone have any recommendation that might be useful?

Posts	21
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎03-31-2023

Online Status	Offline
Date Last Visited	4 weeks ago

Notables Are Not Being Created

How to change Timezone for Events?

Using "transaction" Command

Deployment Client Sending Logs to Backup Log Colle...

Upgrade Splunk Universal Forwarder from Deployment...

Proofpoint sending logs with missing information, ...

Upgrade Multiple Splunk Instances on the Same VM

Why is Splunk universal forwarder crashing randoml...

Forwarder Ingestion Latency Issue Losing Logs?

Re: Notables Are Not Getting Created

Re: Notables Are Not Getting Created

Notables Are Not Being Created

Re: Changing Timezone for Events

How to change Timezone for Events?

Re: Using "transaction" Command