Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About asmyth1995
asmyth1995
Explorer
Member since:
05-12-2023
06-21-2023
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 05-12-2023 |
Activity Feed
- Posted Re: For Splunk API requests are authentication tokens needed on Getting Data In. 06-21-2023 04:17 AM
- Posted For Splunk API requests, are authentication tokens needed? on Getting Data In. 06-21-2023 01:51 AM
- Posted Re: Can you forward logs from a windows machines using a universal forwarder to both Splunk Cloud and a syslog server on Security. 05-24-2023 08:46 AM
- Posted Re: Can you forward logs from a windows machines using a universal forwarder to both Splunk Cloud and a syslog server on Security. 05-24-2023 08:25 AM
- Posted Re: Can you forward logs from a windows machines using a universal forwarder to both Splunk Cloud and a syslog server on Security. 05-24-2023 06:04 AM
- Posted Re: Can you forward logs from a windows machines using a universal forwarder to both Splunk Cloud and a syslog server on Security. 05-24-2023 04:00 AM
- Posted Re: Can you forward data from a Splunk Enterprise instance to both Splunk Cloud and a syslog server? on Security. 05-24-2023 02:55 AM
- Posted Re: Can you forward data from a Splunk Enterprise instance to both Splunk Cloud and a syslog server? on Security. 05-24-2023 02:43 AM
- Posted Re: Can you forward data from a Splunk Enterprise instance to both Splunk Cloud and a syslog server? on Security. 05-24-2023 02:16 AM
- Posted Re: Can you forward data from a Splunk Enterprise instance to both Splunk Cloud and a syslog server? on Security. 05-24-2023 01:57 AM
- Posted Can you forward logs from a windows machines using a universal forwarder to both Splunk Cloud and a syslog server? on Security. 05-24-2023 01:37 AM
- Posted Can you forward data from a Splunk Enterprise instance to both Splunk Cloud and a syslog server? on Security. 05-23-2023 07:27 AM
- Posted Is there a way to forward raw active directory logs to Splunk Cloud using only forwarders and using no add on apps? on Security. 05-22-2023 06:34 AM
- Posted Missing files on Splunk Cloud trial? on Security. 05-16-2023 06:55 AM
- Karma Re: Haven't received a cloud instance login email about details for gcusello. 05-16-2023 06:50 AM
- Posted Haven't received a cloud instance login email about details? on Security. 05-12-2023 03:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-21-2023
04:17 AM
Thank you very much for answering that. I was also checking the status codes for the REST API and it doesn't include a 429 status code. Does the GET requests to the saved/search query have any rate limits or is there a max number of API calls that you can do in a day?
... View more
06-21-2023
01:51 AM
Hello
I was reading about making requests to the Splunk API. When I was reading this link below and when making a request the username (admin) and password (pass) need to be included in the request which is seen below:
curl -k -u admin:pass https://localhost:8089/servicesNS/admin/-/alerts/alert_actions
https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/RESTREF/RESTsearch#search.2Fjobs
However there was another link mentioning that authentication tokens are needed to make API requests.
curl -H "Authorization: <type> <token>" -X <method> https://<instance host name or IP address>:<management port>/<REST endpoint> -d <data...> [-d <data...>...]
https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Security/UseAuthTokens
Is the first API request can only be used by admins and is the second request only given to users granted access by admins where they are given authentication tokens?
... View more
- Tags:
- authentication
- tokens
Labels
- Labels:
-
other
05-24-2023
08:46 AM
Hi Sorry if it is frustrating but I'm fairly new at setting up Splunk. My architecture atm is using heavy forwarders but the group don't want to download the app to integrate with the domain controller and we really only need the raw data from the domain controllers. I want to forward my events using a universal forwarder instead. Also I don't want to forward AD data to just Splunk Cloud, I would also like to forward it to a third party system like a Syslog server, or QRader. Can I forward AD logs to both Splunk Cloud and to a third party system using only a universal forwarder and without using the Windows Add on?
... View more
05-24-2023
08:25 AM
Hi Giuseppe Sorry if that wasn't clear. Can you forward AD logs to the Splunk Cloud pltaform using just the universal forwarder and not using the AD app?
... View more
05-24-2023
06:04 AM
Hi Giuseppe So to confirm, the only way to forward Active Directory data using a universal forward to Splunk Cloud is to use an app like the one below: https://splunkbase.splunk.com/app/3207?_ga=2.254075720.1764184667.1684141793-122258331.[…]ga_5EPM2P39FV*MTY4NDMzNDcwNS4xOC4xLjE2ODQzMzY3MjQuNTUuMC4w Can you still forward the same Active Directory data by modifying the outputs.conf file in the local folder like how it describes below: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Forwarding/Forwarddatatothird-partysystemsd#Forward_all_data
... View more
05-24-2023
04:00 AM
Hi Giuseppe I was just wondering if the link below can be applied to Universal forwarders? In the link it mentioned using Splunk Enterprise as an indexer. Can an Indexer set up in Splunk Cloud perform the same role? If it can do I just use the name of the indexer in Splunk Cloud instead of using an ip address? https://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Routeandfilterdatad?_gl=1*a8lfv4*_ga*MTIyMjU4MzMxLjE2ODM4ODIzNDE.*_ga_5EPM2P39FV*MTY4NDkxNjU4NC4zNy4xLjE2ODQ5MjU4NzUuNDUuMC4w&_ga=2.261050189.1526028494.1684745972-122258331.1683882341&_gac=1.12807493.1684925140.CjwKCAjw67ajBhAVEiwA2g_jEF7d3fTGKzr0D5HhyadXkuFeekh_DSLaw7xIMrS4Y5wii5F8pAVPbRoCT0YQAvD_BwE#Replicate_a_subset_of_data_to_a_third-party_system
... View more
05-24-2023
02:55 AM
Hi Giuseppe I don't remember using an app when I signed up on the Splunk Cloud Trial. I usually accessed Splunk Cloud on my browser. I did download a universal forwarder which I can see in a folder on my machine and the credentials at the start of the trial. Also in the documentation it did mention those conf files but they were not present in etc/system/local/ folder. I remembered reading on a post that the conf files have to be written and then SplunkForwarder restarted. I did something similar in the Splunk Enterprise folder where I wrote the conf files and restarted Splunk Enterprise in server controls but it gave an error on the UI where it said the forwarder stopped working. I think it is because I didn't put in the right IP address for the Splunk Enterprise indexer and I didn't have the syslog receiver setup properly.
... View more
05-24-2023
02:43 AM
Thanks for responding back. How do I find the IP address for both the Splunk Enterprise Instance, I noticed the ip address is present in the URL bar of the browser but it is 127.0.0.1. i just wanted to confirm if that is the correct way to find the ip address? Also how do I do the same for the syslog server after setting it up? One more thing, say if I didn't decide to use a heavy forwarder and instead wanted to use a universal forwarder, how do I find the ip address for the universal forwarder since it doesn't have a UI like Splunk Enterprise which I think is meant to act as a Heavy Forwarder.
... View more
05-24-2023
02:16 AM
Hi Just to confirm is the Splunk indexer the same as the Splunk Enterprise instance that is setup collecting active directory logs? Also is there a syslog receiver that you would recommend for anyone on a Splunk Cloud trial?
... View more
05-24-2023
01:57 AM
Hi Giuseppe Thanks for responding back, for clarification the instructions mentioned two ip addresses Splunk Enterprise indexer (10.1.12.1:9997) third-party machine (10.1.12.2:1234) For this to work do I need to set up my Splunk Enterprise indexer and third party machine before setting this up?
... View more
05-24-2023
01:37 AM
Hi
I setup a universal forwarder on a Windows VM to send Active Directory logs to the Splunk Cloud. I also want to send these logs to a syslog server. Can I send logs to both the Splunk Cloud instance and a syslog server at the same time?
... View more
Labels
- Labels:
-
other
05-23-2023
07:27 AM
Hi I setup a Splunk Enterprise instance on a windows vm to collect active directory logs. I wanted to forward these logs to both Splunk Cloud and a syslog server. I set up a universal forwarder on the vm and I installed the credentials on both the Splunk enterprise instance and the universal forwarder. I also made the changes to the output.conf file to send data from the 514 port. I see the events coming into Splunk Cloud but there doesn't seem to be events leaving the 514 port. I also noticed that Splunk Enterprise instance isn't receiving any events after setting this up, is that meant to happen? Do I need more than one universal forwarder to forward the logs in multiple places?
... View more
Labels
- Labels:
-
other
05-16-2023
06:55 AM
Hi, I have been working on configuring a universal forwarder on a free Splunk Cloud trial. I have been using the the link below to setup the forwarder: https://docs.splunk.com/Documentation/Forwarder/9.0.4/Forwarder/Configuretheuniversalforwarder?ref=hk#Configuretheuniversalforwarder#Configure_the_universal_forwarder
There are three files that are missing from the folder specified under Find the configuration files which are:
inputs.conf
outputs.conf
deploymentclient.conf
Is that meant to happen in a free Splunk Cloud trial?
... View more
Labels
- Labels:
-
other
05-12-2023
03:30 PM
Hi I have recently signed up to a free trial to use Splunk Cloud. When I accessed my instance it was asking for a username and password. After looking at similar situations, I realised other users have received an email to access their instance. I have only 13 days left on this trial and I have not received a single email with these details. I have checked both my spam and my trash, and i can't see this email. Why have I not received this email yet?
... View more
Labels
- Labels:
-
authentication
