Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About OsmanElyas
OsmanElyas
Explorer
Member since:
07-17-2023
10-08-2023
Community Statistics
| Posts | 10 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 07-17-2023 |
Activity Feed
- Posted Re: Some logging are in the _internal index instead of wineventlog on Other Usage. 10-08-2023 11:30 PM
- Posted Re: Some logging are in the _internal index instead of wineventlog on Other Usage. 10-04-2023 01:05 AM
- Posted Some logging are in the _internal index instead of wineventlog on Other Usage. 10-04-2023 12:10 AM
- Tagged Some logging are in the _internal index instead of wineventlog on Other Usage. 10-04-2023 12:10 AM
- Got Karma for Re: I Have Splunk Enterprise (Windows) I want to move my indexes to new drive. 08-22-2023 05:32 AM
- Posted Re: I Have Splunk Enterprise (Windows) I want to move my indexes to new drive on Splunk Enterprise. 08-22-2023 12:23 AM
- Posted Re: I Have Splunk Enterprise (Windows) I want to move my indexes to new drive on Splunk Enterprise. 08-18-2023 06:35 AM
- Posted Splunk Enterprise (Windows): How to move my indexes to new drive? on Splunk Enterprise. 08-18-2023 03:35 AM
- Tagged Splunk Enterprise (Windows): How to move my indexes to new drive? on Splunk Enterprise. 08-18-2023 03:35 AM
- Got Karma for Re: Splunk Account Lockout. 07-24-2023 05:47 AM
- Posted I have the same error "Error in 'TsidxStats': WHERE clause is not an exact query" on Splunk Search. 07-24-2023 12:16 AM
- Posted Re: Splunk Account Lockout on Splunk Enterprise. 07-23-2023 11:43 PM
- Posted Re: Splunk Account Lockout on Splunk Enterprise. 07-17-2023 11:35 PM
- Tagged Re: Splunk Account Lockout on Splunk Enterprise. 07-17-2023 11:35 PM
- Posted Splunk Account Lockout on Splunk Enterprise. 07-17-2023 03:44 AM
- Tagged Splunk Account Lockout on Splunk Enterprise. 07-17-2023 03:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
10-08-2023
11:30 PM
I have stopped and restarted the services (Splunk forwarders) on DCs and it fix the issue
... View more
10-04-2023
01:05 AM
I have checked internal events only logging for 5 of them are in the _internal I have windows eventlog for Dc2 and 5 on the Wineventlog I will check aging the UF to see where is the problem Much appreciate your help @PickleRick
... View more
10-04-2023
12:10 AM
I have configured 5 domain controllers to send log to Splunk by installing UF. I have DC2 and DC5 reporting to Winevenlog as it is configured but I am missing the other 3 DCs. All logging to _internal what should I do to correct the logging.
... View more
- Tags:
- splunk-assist
Labels
- Labels:
-
report acceleration
08-22-2023
12:23 AM
1 Karma
It works but for some app there is time window for the events not as before but I consider it work fine. @richgalloway Thanks
... View more
08-18-2023
06:35 AM
@richgalloway I am already started moving %SPLUNK_DB% files from 😧 to F: What is the reference you referring too ( I am using windows server)
... View more
08-18-2023
03:35 AM
I Have Splunk Enterprise (Windows) single entity and the indexes are in the 😧 drive and it is full and I have added new desk F: drive
I want to move my indexes to the new drive do I need to specify any change related to the new drive
... View more
Labels
- Labels:
-
configuration
07-24-2023
12:16 AM
| tstats summariesonly=true sum(log.bytes) as MBytes_transferred from datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$ $user$ $app$ $vdom$ $device$ $srcintf$ $dstintf$ groupby log.user | eval MBytes_transferred = (MBytes_transferred/(1024*1024)) | sort -MBytes_transferred | head 10
... View more
07-23-2023
11:43 PM
1 Karma
@richgalloway Much appreciate your support, I have implemented the report.
... View more
07-17-2023
11:35 PM
@richgalloway Thank you for the guide I am still facing small issue what should be in the filed Suppress results containing field value when I click on throttle.
... View more
- Tags:
- aa
07-17-2023
03:44 AM
I have just configured Splunk and I have alert running for locked account. It keep generating multiple entries from per lockout account So I want to generate one message incase of account get locked index=wineventlog source="WinEventLog:Security" sourcetype=WinEventLog action=failure Account_Name="*" user="*" AND "taskcategory=Account Lockout"
... View more
- Tags:
- aa
Labels
- Labels:
-
using Splunk Enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-08-2023
11:32 PM
|
