About dc17

dc17 · ‎05-23-2024

Hi, I am having some trouble understanding the right configuration for collecting the Logs from the Event Hub of the App "Microsoft Cloud Services". From the documentation: Configure Event Hubs it is not clear how to set these three parameters for a Log Source that collect A LOT of logs every minute. interval --> The number of seconds to wait before the Splunk platform runs the command again. The default is 3600 seconds. There is a way in the _internal logs to check when the command is executed? max_batch_size --> The maximum number of events to retrieve in one batch. The default is 300. This is pretty clear, but can we increase this value as much as we want? I believe we encounter some performance issue on that. max_wait_time --> The maximum interval in seconds that the event processor will wait before processing. The default is 300 seconds. Processing what? Waiting for what? Anyone know a configuration of values between these three fields that could optimize an Event Hub with thousands and thousands of Logs ??

dc17 · ‎04-16-2024

Hi @VatsalJagani , I am not looking in any logs specifically because I need to create multiple Custom View and configure them with different Xpath queries. So I am looking on an approach to monitor with WinEventLog these CustomViews. In the photo an example of CustomView is "Test" folder. But in the path C:\Windows\System32\winevt\Logs I could not find any reference to this "Test" CustomView. To recap: "Test" CustomView works fine in the EventViewer and it is updated live with the execution of my query. It contains all the events I am interested (not important which one). However I could not find any path connected to it, where the logs are stored and ready to be collected by a Splunk WinEventLog monitor. Thanks,

dc17 · ‎04-16-2024

Hi @VatsalJagani , Thanks for the reply, could you help me find the full path of the file/.evtx from the EventViewer? I could not find any reference from the EventViewer in my CustomViews of a full path where the Logs are stored. If I recollect this full path, I could perform some tests on the solution you kindly proposed to me, Thanks

dc17 · ‎04-12-2024

Hello, I am trying to create a custom view (also via Xpath) from EventViewer and later insert it into Splunk via a "WinEventLog" and leveraging the Windows Addon. Can it be done using "WinEventLog" or some other way in inputs.conf as it is for Application/Security/System? [WinEventLog://MyCustomLog] As suggested here I tried this configuration but no logs were onboarded and it returned no error also in _internal logs. Has anyone found a custom solution for inserting these newly created custom views from the EventViewer to Splunk? Thanks

dc17 · ‎09-28-2023

Hi @isoutamo, thanks for your reply. I have seen the topics you've sent me. Unfortunately I noticed that these can not be applied to my case mainly because the errors are not on a custom Dashboard but on the Splunk Monitoring Console, so any modifications would be more complicated. It seems that my problem is strictly correlated to the folder "search_mrsparkle" that contains all the scripts giving me the error messages. This folder ended up to the path /opt/splunk/quarantined_files/share/splunk/ instead of its original path. Thanks,

dc17 · ‎09-22-2023

HI, I am trying to learn more about the certificates found within the document /etc/auth/appsCA.pem . I'm referring to Splunk's default certificates, Global Sign Root CA, Global Sign ECC, DigiCert Global Root, ISRG Root, IdenTrust Commercial Root. Are they safe? After changing the certificate configuration with my self-signed certificates and merging the CA Splunk certificates to make Splunkbase work properly ( This case here ), I wondered if they are all necessary for Splunk to work successfully or only some of them. Is there a documentation page or can someone explain the use of each of the certificates? Thanks in advance,

dc17 · ‎09-20-2023

Hi @willsy , I know this is an old topic but did you find any solution for this ? I have to send data in XML to a third party and maintain the data flow to Splunk indexers. It is possible to separate the "renderXML=true" command and "renderXML=false" in some way? Thank you,

dc17 · ‎09-01-2023

Hi, In some of the Dashboards of my Splunk Monitoring Console, it returns this error "A custom JavaScript error caused an issue loading your dashboard. See the developer console for more details" Error in Dashboard: The console in the developer details specifies a 404 Not Found Error on many scripts: The same error is issued for also other js like PopTart.js or Base.js. Searching for all these files in the Splunk folder I notice these scritpts are all stored in a folder called quarantined_files, an odd folder placed directly in the /opt/splunk/ path. Any ideas on how to debug this error?

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎09-01-2023

Online Status	Offline
Date Last Visited	‎10-02-2025 06:15 AM

Tuning Configuration Event Hub in Microsoft Cloud ...

Splunk onboarding Custom Views from EventViewer

Learning about certificates in appsCA.pem

Splunk Monitoring Console does not load all visual...

Tuning Configuration Event Hub in Microsoft Cloud ...

Re: Splunk onboarding Custom Views from EventViewe...

Re: Splunk onboarding Custom Views from EventViewe...

Splunk onboarding Custom Views from EventViewer

Re: Splunk Monitoring Console does not load all vi...

Learning about certificates in appsCA.pem

Re: winEventLogs and XmlWinEventLogs _TCP_ROUTING

Splunk Monitoring Console does not load all visual...

Join the Conversation