About refahiati

refahiati · ‎03-22-2025

Hi everyone, I am trying to configure Kaspersky Security Center to forward logs to Splunk using Syslog over TLS. However, I need some guidance on the following points: How can I configure Kaspersky Security Center to send logs via Syslog over TLS? What are the steps to generate the necessary certificates for this setup? Which certificate formats or file extensions does Kaspersky Security Center accept for TLS encryption? Are there any specific configurations required on the Splunk side to properly receive and parse these logs over TLS? I would appreciate any insights, best practices, or documentation references that could help. Thank you in advance!

refahiati · ‎11-05-2024

Thank you for the information! Currently, I'm receiving logs from the ePO server via Syslog, but the logs aren’t being received in full. To improve this, I’m considering using the ePO API for more reliable log collection. Could you guide me on how to configure log ingestion from the ePO server using its API instead of Syslog? I would appreciate details on: Steps for setting up ePO API integration with Splunk Any authentication requirements or best practices for secure data transfer Example scripts or configurations, if available Thank you in advance for any guidance!

refahiati · ‎10-29-2024

Hello everyone, I'm currently collecting logs from a Fortigate WAF using Syslog, but I've encountered an issue where, after running smoothly for a while, the Splunk Heavy Forwarder (HF) suddenly stops receiving and forwarding the logs. The only way to resolve this is by restarting the HF, after which everything works fine again, but the problem eventually recurs. Could anyone advise on: Possible causes for this intermittent log collection issue Any specific configurations to keep the Syslog input stable Troubleshooting steps or recommended best practices to prevent having to restart the HF frequently Any insights or similar experiences would be much appreciated! Thank you!

refahiati · ‎10-29-2024

Hi everyone, I'm currently working on integrating Trellix ePolicy Orchestrator (ePO) logs into Splunk for better monitoring and analysis. I would like to know the best approach to configure Splunk to collect and index logs from the Trellix ePO server. Specifically, I’m looking for details on: Recommended methods (e.g., syslog, API, or other tools/add-ons) Any Splunk add-ons or apps that facilitate ePO log ingestion Best practices for configuration and parsing these logs in Splunk Any guidance or references to documentation would be greatly appreciated! Thank you!

refahiati · ‎10-19-2024

Hello, I have a WSUS server that is using the Windows Internal Database (WID). I would like to ingest WSUS service logs into Splunk, store them, and then parse them for further analysis. Could someone guide me on the best approach to achieve this? Specifically: What is the best way to configure Splunk to collect logs from the WSUS service (and database if necessary)? Are there any best practices or recommended add-ons for parsing and indexing WSUS logs in Splunk? Thanks in advance for your help!

refahiati · ‎08-13-2024

Hi Splunk community, I'm facing an issue with my Splunk deployment server, running on version 9.2.1 (splunk-9.2.1-78803f08aabb-linux-2.6-x86_64-manifest). I’ve added new configurations to the inputs.conf file for a WebLogic server within a specific deployment class. After making these changes, I pushed the configurations to the target WebLogic server and triggered a restart. Unfortunately, the new settings in the inputs.conf file are not being applied to the WebLogic server, even though the deployment server logs indicate that the service was successfully restarted. Has anyone experienced this issue or can offer advice on what might be causing the problem and how to resolve it? Thanks in advance!

refahiati · ‎08-05-2024

Hi everyone, I am referring to the documentation on High Availability Clustering Configuration, and I came across the following statement: "An eligible 'standby' cluster manager will not set its redundancy state to 'active' upon consecutive loss of heartbeat to the manager which is currently in active state. The administrator must manually change the cluster manager redundancy state to 'active' or 'standby'." Could someone please guide me on how to manually change the cluster manager redundancy state to 'active' or 'standby' in Splunk? What are the exact steps or commands required to perform this operation? Thank you in advance for your help!

Posts	7
Solutions	0
Karma Given	7
Karma Received	0
Member Since	‎08-05-2024

Online Status	Offline
Date Last Visited	‎03-23-2025 01:19 PM

How to Receive Kaspersky Security Center Logs via ...

Splunk HF Stops Receiving Fortigate WAF Logs via S...

How to Ingest Trellix ePO Logs into Splunk

How to Ingest and Parse WSUS Logs from WID Databas...

New inputs.conf Settings Not Applied After Pushing...

How to Manually Change Cluster Manager Redundancy ...