About Nrsch

Nrsch · ‎07-17-2026

Thank you very much for your response. I have a follow-up question. If I have two Search Head Clusters (SHCs), one dedicated to Enterprise Security (ES) and another for general Splunk use, is there a way to provide users with a single access point (one URL) where they can work with data and content from both environments? Ideally, I would like users to log in only once and have access to everything they need, including ES dashboards, investigations, and searches, as well as general Splunk apps, dashboards, and searches. Is there a recommended architecture or best practice for achieving this?

Nrsch · ‎07-15-2026

If we have two separate Search Head Clusters, one dedicated to Splunk Enterprise Security (ES) and another for general Splunk searches and apps, is there a way for users to access and work with both environments through a single Search Head Cluster? Or do Splunk users need to log in to and work with each Search Head Cluster separately? What is the recommended architecture and user access model in this scenario?

Nrsch · ‎09-29-2025

Hi everyone, I’ve recently been exploring Splunk in more depth. I managed to install UBA on my laptop, and I also worked with DSDL by adding it to Splunk. I was able to activate four models that are tied to the ES correlation rules included with the ESCU app. Now I have a question: since I already have a background in machine learning and deep learning (and I’ve built Python projects in this area before), I’d like to understand how I can start creating practical SOC-related projects in Splunk that make use of AI. Any guidance, examples, or suggestions would be greatly appreciated. Thanks in advance!

Nrsch · ‎09-07-2025

Hi, I am installing Splunk UBA 5.4.2 on my laptop in a virtual machine (RHEL 8.8) for testing. I followed the installation steps up to “Install Splunk UBA: Run the setup script /opt/caspida/bin/Caspida setup” as described here: Splunk UBA 5.4.2 Single Server Installation Guide. The setup runs for a few minutes, but then I receive the following error: waiting on impala containerized service to come up Running CaspidaCleanup, resetting rules Cleaning up node uba.mysplunk checking if zookeeper is reachable at: uba.mysplunk:2181 zookeeper reachable at: uba.mysplunk:2181 checking if postgres is reachable at: uba.mysplunk:5432 postgres server reachable at: uba.mysplunk:5432 checking if impala is reachable at: jdbc:impala://uba.mysplunk:21050/;auth=noSasl /opt/caspida/bin/CaspidaFunctions: line 4277: 126717 Killed timeout -k ${TIMEOUT} -s 9 ${TIMEOUT} beeline --silent=true --fastConnect=true -u ${jdbcURL} -e "show databases;" >> ${CASPIDA_OUT} 2>&1 impala jdbc server at:jdbc:impala://uba.mysplunk:21050/;auth=noSasl not reachable, aborting required services not up, aborting cleanup CaspidaCleanup failed, exiting Could someone help me understand why this error occurs?

Nrsch · ‎05-26-2025

Thank you for your answer. We are using HAProxy as a load balancer because we want to have two Heavy Forwarders, so if one fails, the other remains active. I have researched and found that the PROXY protocol in HAProxy adds a header containing the client's IP address. However, it seems that Splunk Heavy Forwarder does not natively support or understand this header. As you mentioned, does this mean there is no reliable way to use HAProxy as a load balancer and still have access to the original client IP in the Splunk Heavy Forwarder? Also, I have one more question: Is it true that the log format of each client (when HAProxy is acting as a middle-man sending logs to the HF) may be different, depending on the client source? Thank you very much for your help.

Nrsch · ‎05-26-2025

You're very welcome for the help. I believe both the Splunk Base app and the log format you referred to are related to HAProxy's internal logs. However, what I'm looking for is a method to capture the IP addresses of external clients connecting through HAProxy. In fact we have an HAProxy server that receives logs from various clients and forwards them to a Splunk Heavy Forwarder. Each client have its own log format. The problem is that HAProxy replaces the client's IP address with its own (in TCP). The question is: how can we have the client's IP address for each log in the Splunk Heavy Forwarder?

Nrsch · ‎05-26-2025

Thank you for your answer. Since the HAProxy collects logs from different clients, their log formats are different. So, do we need to parse the logs twice — once to extract the hostname, and again to extract other fields depending on the log type? Also, is it possible to extract the host IP address instead of the hostname? Thank you very much for your help.

Nrsch · ‎05-26-2025

I have a serious problem, please help me. We have an HAProxy server that receives logs from various clients and forwards them to a Splunk Heavy Forwarder. The problem is that HAProxy replaces the client's IP address with its own (in TCP). The question is: how can we have the client's IP address for each log in the Splunk Heavy Forwarder?

Nrsch · ‎03-03-2025

Thanks, as you said the key indicator searches are designed to display metrics, so exactly where and how I can see these metrics? Thank you very much for your answer 🌹

Nrsch · ‎03-02-2025

Thank you for reply, it’s very useful. I can explain more my question : I have some “Key Indicator Search” like “Access - Total Access Attempts” , “Malware - Total Infection Count” , “Risk - Median Risk Score By Other” , you said if they trigger I can see their related notable event in “Incident Review” . It’s OK, But my main question is: Dose this searches have any effects on any a value in some dashboard in ES? For example may be they change the value of the “aggregated user risk” in “ES -> Security Intelligence -> Risk Analysis -> aggregated user risk” . Thank you very much for your reply 😊

Nrsch · ‎03-02-2025

Hi, there are some security saved search and key indicator in ES, if I activate these searches, if they trigger, in which dashboard in ES i can see the result? For example if the search "Malware- total infection count " trigger, in which dashboard in ES can I see the result? # ES # enterprise security

Posts	12
Solutions	0
Karma Given	14
Karma Received	0
Member Since	‎03-01-2025

Online Status	Offline
Date Last Visited	‎07-17-2026 09:05 PM

How Do Users Access Multiple Search Head Clusters ...

Looking for Ideas: Applying AI/ML in SOC with Splu...

a problem in Splunk UBA Installation

HAProxy server client IP

Spkunk ES security search results

Single URL Access to Both ES and General Search He...

How Do Users Access Multiple Search Head Clusters ...

Looking for Ideas: Applying AI/ML in SOC with Splu...

a problem in Splunk UBA Installation

Re: HAProxy server client IP

Re: HAProxy server client IP

Re: HAProxy server client IP

HAProxy server client IP

Re: Spkunk ES security search results

Re: Spkunk ES security search results

Spkunk ES security search results

Join the Conversation