About jg91

jg91 · ‎12-16-2022

Is it possible to configure heavy forwarders to send data to two tcpout groups (A,B) (outputs.conf) and don't block on group B failure? We want to send all data to group A, and a subset of data (specific sourcetypes) to group B, but group B is in a remote location and our link to that location is not fully stable and we don't want to event loss in group A on link failures or group B failures. [tcpout] [tcpout:groupA] server=indexerA1_ip:9997,indexerA2_ip:9997 [tcpout:groupB] server=indexerB_ip:9997

jg91 · ‎09-19-2022

Hi, in a Linux server, a UF is configured to monitor a log directory, and it stops sending data to the indexer after about 2 minutes. When I restart the UF from the deployment server, it will start sending data and then stop sending. Other inputs configuration like running scripts are working fine, and there is no error or warning in the _internal index about this host. Do you have any idea about this problem?

jg91 · ‎05-30-2022

Isn't there any option ?

jg91 · ‎05-11-2022

Hello, I wanna download MS Exchange app but it's not available via https://splunkbase.splunk.com/app/1660 Where can I find version 4.0.4 of this app ?

jg91 · ‎12-06-2021

Is there any solution to protect UF from stopping or uninstalling by users on endpoints? For example, most Antivirus agents are password protected and on uninstallation, users must provide the password, I'm looking for this kind of solution. Thank you.

jg91 · ‎09-11-2021

I want to anonymize one sourcetype before routing it to 3rd party system with Syslog. what is the proper config for props, transforms, and outputs config files? When is use SEDCMD in props.conf, all events (for me and 3rd party system) will be anonymized, and when I use REGEX in transforms.conf for anonymizing, I can't route events to another system at the same transform stanza because FORMAT field should be used with _raw value.

jg91 · ‎05-06-2021

Hello, We want to call a REST API endpoint as the action for an alert and also wish to send some parts of the search result with this API call. Do you have any suggestions?

jg91 · ‎03-13-2021

Hi, Yes, but I want to find a way to forward MC Missing Forwarders Alerts to ES as a Notable Event, not creating a new Correlation search.

jg91 · ‎03-13-2021

Hi, is there any solution to create a notable event for missing forwarders? Now missing forwarders generate an alert on Monitoring Console, which runs on a separate Splunk instance than ES.

jg91 · ‎03-13-2021

My events are firewall events with src, dest, and actions fields, and a firewall log event with allowed action is the connection between two nodes. My events: A -> target (raw event: src=A dest=target action=allow) B -> A (raw event: src=B dest=A action=allow) C -> B (raw event: src=C dest=B action=allow) D -> B (raw event: src=D dest=B action=allow) A -> C (raw event: src=A dest=C action=allow) C -> D (raw event: src=C dest=D action=allow) My goal is to find A, B, C, D nodes (all nodes that have a route/connection to the target node) with a recursive query.

jg91 · ‎03-13-2021

Hello, I want to search for all src hosts that connect to a specific destination with or without intermediary hopes. I want to use a recursive query on the core firewall logs and its dest and src fields to find all sources. Would you please help me with this query?

jg91 · ‎03-09-2021

How can I find users who stopped a service? I have tried [WinHostMon://service] and [WinEventLog://System] But the first option lists the status of services and for second option log doesn't have a User field.

jg91 · ‎09-20-2020

Hello friends, We have Splunk ES and we stored our data in different indexes (OS logs, Network logs, ...) I have a question about correlation searches. Some correlation searches didn't use Data Models and just used simple search commands, how I can change these correlation rules to use our indexes? at first, is it needed to change anything? My second question is which permission or user will ES use to run Correlation Searches? I mean I have to grant access to our indexes to which Roles/Users? thanks.

jg91 · ‎08-23-2020

I Have the same problem, did you solved it?

jg91 · ‎08-23-2020

I have the same problem with MonitorNoHandle for dns.log. Did you solved it?

Posts	33
Solutions	0
Karma Given	5
Karma Received	2
Member Since	‎11-22-2019

Online Status	Offline
Date Last Visited	‎12-16-2022 06:35 PM

Configure forwarding data to two tcpout groups wit...

Why does Splunk UF stop sending data a few minutes...

How to download Splunk App for MS Echange?

Protecting UF from stopping and Uninstallation

how to anonymize and route specific events

Alert Action to call a Rest API

create notable event for missing forwarders

Recursive query with unlimited depth

How to find users who stopped a windows service

ES Correlation Search index configuration

Configure forwarding data to two tcpout groups wit...

Why does Splunk UF stop sending data a few minutes...

Re: How to download Splunk App for MS Echange?

How to download Splunk App for MS Echange?

Protecting UF from stopping and Uninstallation

how to anonymize and route specific events

Alert Action to call a Rest API

Re: create notable event for missing forwarders

create notable event for missing forwarders

Re: Recursive query with unlimited depth

Recursive query with unlimited depth

How to find users who stopped a windows service

ES Correlation Search index configuration

Re: Troubleshoot a MonitorNoHandle input

Re: Microsoft DNS Debug and monitorNoHandle