Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About gitau_gm
gitau_gm
Explorer
Member since:
06-05-2025
3 weeks ago
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 06-05-2025 |
Activity Feed
- Posted Re: Inconsistent Windows Security Events on Getting Data In. 3 weeks ago
- Posted Re: Inconsistent Windows Security Events on Getting Data In. 3 weeks ago
- Posted Re: Inconsistent Windows Security Events on Getting Data In. 3 weeks ago
- Posted Re: Inconsistent Windows Security Events on Getting Data In. 3 weeks ago
- Posted Inconsistent Windows Security Events on Getting Data In. 3 weeks ago
- Posted Splunk Add-on for Stream on Splunk Cloud Platform. 01-08-2026 12:12 PM
- Tagged Splunk Add-on for Stream on Splunk Cloud Platform. 01-08-2026 12:12 PM
- Posted Access to splunkd.log and ta_rapid7_insightvm_insightvm_asset_import.log on Splunk Cloud Platform. 12-18-2025 12:43 PM
- Posted Re: upgrade from 9.3.8 to 10.0.2 on Splunk Enterprise. 12-16-2025 07:37 AM
- Karma Re: upgrade from 9.3.8 to 10.0.2 for inventsekar. 12-16-2025 07:37 AM
- Posted Re: upgrade from 9.3.8 to 10.0.2 on Splunk Enterprise. 12-16-2025 05:18 AM
- Posted upgrade from 9.3.8 to 10.0.2 on Splunk Enterprise. 12-15-2025 01:35 PM
- Posted Re: Logs not showing up in Splunk cloud on Splunk Cloud Platform. 08-25-2025 07:30 AM
- Posted Logs not showing up in Splunk cloud on Splunk Cloud Platform. 08-25-2025 04:45 AM
- Karma Re: Search Peer unreachable for richgalloway. 07-11-2025 01:07 PM
- Posted Search Peer unreachable on Monitoring Splunk. 07-11-2025 11:38 AM
- Posted Re: ExecProcessor Error on Getting Data In. 06-05-2025 08:38 AM
- Posted Re: ExecProcessor Error on Getting Data In. 06-05-2025 08:20 AM
- Posted ExecProcessor Error on Getting Data In. 06-05-2025 08:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
3 weeks ago
Hey PickeRick In both instances, the messages are consistent Checking conf files for problems... Done Checking default conf files for edits... Validating installed files against hashes from 'C:\Program Files\SplunkUniversalForwarder\splunkforwarder-10.2.2--windows-x64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... SplunkForwarder: Starting (pid 32356) Done
... View more
3 weeks ago
Some devices are forwarding all windows events and some are not. Checked confs and they are identical in both instances.
... View more
3 weeks ago
@livehybrid The 4624s are the ones that made me realize there was an issue These are the events being forwarded by the "good" devices (forwarding 4624s) Authentication / Logon Activity User Rights & Privileges Service Control Manager System & Service Lifecycle Credential Validation (Kerberos/NTLM) IPsec / Network Security These are the only events being forwarded by the "other" devices Service Control Manager System & Service Lifecycle
... View more
3 weeks ago
Hey @livehybrid we are migrated to splunk cloud a couple of months ago so we have ufs sending directly to the cloud. All configs are the same, and yes, I do see security events from the endpoints directly for both instances. We have a DS pushing content.
... View more
3 weeks ago
I am observing inconsistent forwarding of Windows Security Event ID 4624 (Successful Logon) from multiple Windows hosts running Splunk Universal Forwarder, despite the hosts having identical configurations. Some devices forward Event ID 4624 reliably, while others do not forward 4624 at all. This inconsistency persists even though configuration, versions, and OS‑level settings are the same.
... View more
Labels
- Labels:
-
universal forwarder
-
Windows
01-08-2026
12:12 PM
In our Splunk cloud instance, we recently had Stream installed and we are testing on one of the servers. Getting a 401 error, that points to an authentication issue. What is the correct position? Do we create a HEC token for Stream or does the app have a preconfigured key?
... View more
- Tags:
- steam
Labels
- Labels:
-
configuration
-
troubleshooting
12-18-2025
12:43 PM
Would I have access to referenced logs related to Rapid7 in my cloud instance or would I have to reach out to Splunk support?
... View more
Labels
- Labels:
-
administration
-
using Splunk Cloud
12-16-2025
05:18 AM
@inventsekar Thank you for this. I think the right question ought to have been, about going directly to v10.0.2 from pre 9.4.x versions. I have a few hundred ufs at 9.3.8. Can I go directly to 10.0.2?
... View more
12-15-2025
01:35 PM
What is the correct position on upgrading UFs from 9.3.8 to 10.0.2?
... View more
Labels
- Labels:
-
upgrade
08-25-2025
07:30 AM
This is the current set up. Device has been on the network for a while but we don't seem to get logs to the cloud
... View more
08-25-2025
04:45 AM
Description: We are having issues with one of our Cisco devices. We have set logging to a syslog server that should then forward to the cloud. While looking at the syslog-ng file, noticed this # udp(ip(0.0.0.0) port(514));. Removing the comment rendered several indexes idle but returning to prior state reinstated the indexes. Wondering what we could be missing. Any assistance would be great.
... View more
Labels
- Labels:
-
configuration
-
using Splunk Cloud
07-11-2025
11:38 AM
How do I resolve authentication or pass4SymmKey mismatch between search head and peer? Also getting a situation where 0 clients phone home.
... View more
Labels
06-05-2025
08:38 AM
@livehybrid , drilling further, saw this message message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/cloud_administration/bin/aging_out.py" Cannot extract stack id from host, reason=File at /opt/splunk/etc/system/local/data_archive.conf does not exist.
... View more
06-05-2025
08:18 AM
Good day team. Getting this error. That is date corresponds to the last day the host was seen. 05-28-2025 11:51:03.469 +0000 ERROR ExecProcessor [9317 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/server.sh" com.splunk.modularinput.Event.writeTo(Event.java:65)\\com.splunk.modularinput.EventWriter.writeEvent(EventWriter.java:137)\\com.splunk.DefaultServerStart.streamEvents(DefaultServerStart.java:66)\\com.splunk.modularinput.Script.run(Script.java:66)\\com.splunk.modularinput.Script.run(Script.java:44)\\com.splunk.dbx.server.bootstrap.TaskServerStart.main(TaskServerStart.java:36)\\
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
