About sankardevarajan

sankardevarajan

Run these to confirm: Do the events really have a source at index time? | metadata type=sources index=<your_windows_index> `` If you see WinEventLog:Security, WinEventLog:Microsoft-Windows-PowerShell/Operational, etc., that proves the indexers know the true source. Compare what search-time shows vs metadata index=<your_windows_index> sourcetype=WinEventLog* | stats count by source sourcetype | head 20 If source is blank or looks wrong here while (1) shows real sources, you have an override at search time. Where to fix it 1) Field Extractions & Aliases Go to Settings → Fields → Field Extractions Filter for: sourcetype=WinEventLog:* or XmlWinEventLog:* Output field equals source (case-insensitive) Also check Settings → Fields → Field Aliases for any: FIELDALIAS-... = Provider_Name AS source FIELDALIAS-... = Source AS source Fix: Disable or change the target field to something else (e.g., event_source, win_provider, provider_name).

sankardevarajan · ‎11-17-2025

how to validate Heavy forwarder certificate installation successful on linux platform? what are commands to verify?

sankardevarajan · ‎08-12-2025

Yes. i know that, i am asking study materials to understand concepts. sure definitely i will follow the official splunk guide.

sankardevarajan · ‎08-12-2025

Thanks for information. May i know when did you cleared the exam?

sankardevarajan · ‎08-11-2025

Now i am looking for study materials (SPLK-3001)Splunk Enterprise Security Certified Admin, can any one share resource link, much appreciated.

sankardevarajan · ‎08-11-2025

Thanks for your inputs. now i cleared the exam.

sankardevarajan · ‎08-11-2025

Thank you for comments. Yes i follow official splunk documentation, and you tube videos, cleared the exam..!

sankardevarajan · ‎08-01-2025

I have completed Splunk Enterprise Certified Admin course in Udemy, & have done Practical test 220 questions, is that enough to write the exam? Much appreciated anyone help mock test materials & study resources. Please advise which thrid party study resources is good enough pass the exam?

sankardevarajan · ‎07-03-2025

I am looking for learning splunk ITSI training & certification, can any one guide and share the resource materials.?

sankardevarajan · ‎05-16-2025

i want to onboard application logs into splunk cloud. Hyland.Logging can be configured to send information to Splunk as well as the Diagnostics Console by modifying the .config file of the server. To configure Hyland.Logging to send information to Splunk: <Route name="Logging_Local_Splunk" > <add key="Splunk" value="http://localhost:SplunkPort"/> <add key="SplunkToken" value="SplunkTokenNumber"/> <add key="DisableIPAddressMasking" value="false" /> </Route> Configuring Hyland.Logging for Splunk • Application Server • Reader • Product Documentation i am not understanding where we need to configure above config in Splunk. Much appreciated anyone guide me.

sankardevarajan · ‎05-14-2024

No. i dont have customized dasboard, can you please share some reference query?

sankardevarajan · ‎05-14-2024

Need a report based on previous day I have source ip segment xx.xx.xx.xx/28, & destination ip segment xx.xx.xx/24 outcome of query should provide below Date and start + end time of the connection USERNAME APPLICATION:PORT & PROTOCOL APPLICATION SEGMENTS ACCESS POLICY NAME ACTION how can i create customized dashboard, please suggest.

sankardevarajan · ‎03-21-2024

We have multiple firewalls and different locations and each location we have syslog collector server and its forward the logs to splunk indexer. Pan: traffic count 27,644,629 83% Pan:threat count 3,224,543 9.77% Pan:firewall_cloud 2,034,183 6.18% last one hour data. it looks like over utilization, so we want to validate receiving logs are legitimate or not? Planning to reduce consumption of firewall logs. Please guide me how can i validate firewall logs we are reciving correct logs or any excessive or not needed?

sankardevarajan · ‎03-21-2024

Yes. you are correct. working with windows team, but we are looking for solution in the forum.

sankardevarajan · ‎03-18-2024

Hello Freinds, Current setup - we have multiple locations in Europe, and each location we have multiple windows servers and those servers' forwarding logs to windows log collector server. from log collector to collect the logs on splunk cloud. few sites we are not receiving logs from windows servers, we checked in the GPO policy and its properly configured. while checking gpresult some of the settings not properly applied. i tried gpupdate and tried again. but issue still to be continued.

sankardevarajan · ‎01-25-2024

I have enterprise network and we have Splunk enterprise license. Question: while troubleshooting source type or host if checking, it needs to show past history of particular user or source in the dashboard. Past history like how many alerts triggered the same user, those alert details if click the link it must be show past troubleshooting history.

Posts	16
Solutions	1
Karma Given	3
Karma Received	1
Member Since	‎01-18-2024

Online Status	Offline
Date Last Visited	2 weeks ago

Heavy forwarder validate certificate installation ...

SPLK-3001: Splunk Enterprise Security Certified Ad...

Splunk Enterprise Certified Admin Exam

SPLUNK ITSI course

onbase application log onboarding into splunk

Splunk Customized dashboard creation

Firewall logs validation in SPlunk

Windows event logs not sending to splunk log colle...

Splunk dashboard customization

Re: Source metadata disappeared from Windows Event...

Heavy forwarder validate certificate installation ...

Re: SPLK-3001: Splunk Enterprise Security Certifie...