About fahimeh

fahimeh · ‎11-18-2024

I want to import Adaudit logs into Splunk but I don't know how The important thing is that I want to do this from the oldest logs, not from now on.

fahimeh · ‎09-23-2024

The error message is generated only for these specific event codes

fahimeh · ‎09-22-2024

hi @gcusello No, I use the classic format

fahimeh · ‎09-22-2024

hi @gcusello No, I use the classic format

fahimeh · ‎09-18-2024

Hello, Some of the logs coming from the Windows Universal Forwarder to Splunk show the following error in the message field for certain events: "Splunk could not get the description for this event." I have reviewed [https://community.splunk.com/t5/Getting-Data-In/Why-quot-FormatMessage-error-quot-appears-in-indexed-message-for/td-p/139980?_gl=1*1qz5els*_gcl_au*MjMzMzQwMzM3LjE3MjAzNTUzMDY.*FPAU*MjMzMzQwMzM3LjE3MjAzNTUzMDY.*_ga*MTExMjgzNTE2OC4xNzIwMzU1MzA2*_ga_5EPM2P39FV*MTcyNjY0MTY4NC4xNDQuMS4xNzI2NjQxODA1LjAuMC4xODMzMzUzNTE5*_fplc*T0RRcU4zWGc1THpWUFVQeVBxTTQ1T0JVanhWSVVpMmdLTVNzYjNMZSUyQjZUMXBEb0NsY3NTSm45MlpQaFVnbUtsR1MwQWdjdlVyM25peCUyRkozUnZmQ1UlMkJzUE9tSTBFd3kzbjV6diUyQmJoQzQxUlM5alphRUhIVXQ1V0I4M3hRZVElM0QlM0Q.] , but it doesn't solve the issue, as this problem only occurs for a few specific events at specific times. I am using Splunk version 9.2. What could be the issue?

fahimeh · ‎09-07-2024

hi @vr2312 Thank you for your response; it was completely correct.

fahimeh · ‎09-01-2024

I have the same problem as you how did you solve it

fahimeh · ‎09-01-2024

I have the same problem What did you do to solve it?

fahimeh · ‎09-01-2024

Hello, As an admin, I deleted a user in Splunk Web, but when I try to add a user during an investigation, I still see the deleted user in the list. Why is this happening? Is there a conflict between deleting users in Splunk Enterprise and Splunk ES?

fahimeh · ‎08-27-2024

thank you🌸 I will test and tell you exactly how it worked.

fahimeh · ‎08-27-2024

Thank you for your reply Which time rules can I use in a search? Most time-related commands include | (like eval).

fahimeh · ‎08-27-2024

Hello, I want to write a suppression in Splunk ES that suppresses an event if a specific process occurs at 11 AM every day. This limitation should be applied to the raw logs because the ES rules execute within a specific time cycle and create notable events. My goal is to suppress the event when the rule runs, but only if the specific process exists at 11 AM. How can I apply this time constraint in the suppression? Can I do this through the search I write? How? How can I implement this time constraint on raw data? I need to limit the time in the raw event.

fahimeh · ‎01-20-2024

Where exactly do you see this error?

Posts	13
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎01-20-2024

Online Status	Offline
Date Last Visited	‎09-20-2025 11:01 PM

import Adaudit logs into Splunk

ٍError "Splunk could not get the description for t...

How can I completely delete a user in Splunk ES?

Suppression in Es by applying time limit

import Adaudit logs into Splunk

Re: ٍError "Splunk could not get the description f...

Re: ٍError "Splunk could not get the description f...

Re: ٍError "Splunk could not get the description f...

ٍError "Splunk could not get the description for t...

Re: How can I completely delete a user in Splunk E...

Re: Users still showing after being deleted

Re: Disabled/Deleted users are appearing in Invest...

How can I completely delete a user in Splunk ES?

Re: Suppression in Es by applying time limit

Re: Suppression in Es by applying time limit

Suppression in Es by applying time limit

Re: Why am I getting "This path does not exist or ...

Join the Conversation