About kannu

kannu

@kprior201 : Thank you for prompt response

gcusello · ‎03-06-2024

Hi @kannu, I understand: there aren't eventtypes.conf and tags.conf, (I don't understand how it was declared CIM compliant!). The only way is consider them as custom and follow the normalization process using the Add-On builder or the SA-CIM Vlaidator. Ciao. Giuseppe

FlorianScho · ‎07-12-2022

Hi @kannu, did this fix your problem? Currently im facing the same, set DATETIME_CONFIG = Current - this inserts the file now in my configured schedule but only the headers of the CSV file.. Any suggestions?

bsezari · ‎06-30-2022

@harsmarvania57 I found your solution more relevant to my case. I need to renew the RSA password; is it possible to change RSA password during server.pem renewal?

kannu · ‎02-03-2022

Hello All, I am working on building use cases for PCI compliance , Just got to know that splunk has an PCI compliance app for checking that clients data is PCI compliant or not . Just wondering if i can get sample data from somewhere to test My use cases and run the PCI compliance app as well . Thanks in advance Manish Kumar

splunkreal · ‎07-22-2021

This seems wrong now, support answer: Upgrade will no renew the default certificates. You will have to do it on your own.

kannu · ‎04-28-2021

Well , I have figured out the answer of my problem , Which is first I have extracted the inner json , from main json event , then i have used props.conf to index them using seprate event in that way splunk is taking all field with separate events . [azure] LINE_BREAKER=((?<=\}),(?=\{)|[\r\n]+) TRUNCATE = 0 SHOULD_LINEMERGE = false SEDCMD-remove_prefix=s/{"body":{"records":.?\[//g SEDCMD-remove_suffix=s/\]}.*}//g

jianw223 · ‎10-16-2020

This is an endorsement by a Cribl employee. As a previous user of Cribl, I would not recommend it.

calcometer · ‎07-09-2020

The app is limited to 3. If you want to have more you need to edit the code.

kannu · ‎04-15-2020

Thank you ravikumar

kannu · ‎08-14-2019

Hello Splunkers , Good day I am stuck with one problem where i am monitoring .gz files using UF and getting the data on splunk as expected . But when i have checked splunkd.log in that i am seeing below error 08-14-2019 02:34:43.158 -0500 ERROR ArchiveContext - From archive='E:\Tanium\Tanium Module Server\services\connect-files\output\SavedQuestion\Splunk-Running-Processes-with-MD5-Hash\Splunk-Running-Processes-with-MD5-Hash_2019-08-13T15-42-22.gz': Decompression error Can anybody suggest how to get rid of it . Thanks in advance Kannu (manish kumar)

harsmarvania57 · ‎07-19-2019

If you want to run in powershell please try same command starting with & & "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd openssl x509 -in "C:\Program Files\SplunkUniversalForwarder\etc\auth\server.pem" -noout -enddate

kannu · ‎06-24-2019

@marycordova After enabling all logging , Still i am not able to fetch /search the data for any of the field Id • Name • Host_name • OS_version • State • Agent_version • Policy • Last_logged_in_user • Update_type • Update_available • Background_detection • Is_safe • Date_last_modified • Ip_address • Mac_address • Date_first_registered • Date_offline

koshyk · ‎05-10-2019

Well, most of the people put the syslog directly to Heavy Forwarder Server. So if you don't have separate syslog server, then you can re-use the "syslog" software on the HF server itself as long as it is not heavily loaded. esxi system (push via syslog) => Syslog server (collect using rsyslog or syslog-ng) => Splunk UF or HF can then send this to Indexer => Install addon on indexer/SH to extract fields (and on HF)

lakshman239 · ‎03-28-2019

Pls look at https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/FileTransfer and specifically configure section, where you can edit and enable ftp. https://docs.splunk.com/Documentation/StreamApp/7.1.2/User/ConfigureStreams

kannu · ‎04-15-2019

@knielsen . Your query is not returning the result in manner which i want . SsdfWsdfC4 VMware, Inc. SWsdfBeF5 VMware, Inc. ansdfging5 5.0.3 asd1dfsing6 5.0.3 ansdfsdfg2 6.2.1

sduchene_splunk · ‎10-28-2019

I'd use splunk app PDI : https://splunkbase.splunk.com/app/1901/ Or the latest Splunk data stream processing : https://www.splunk.com/en_us/software/stream-processing.html

adonio · ‎11-23-2018

please share to help others and accept your answer

MuS · ‎10-09-2018

Not exactly, the linked answer tells you to test the LDAP connection, and connection information with another tool and visually check the results for verification purpose. Anyway, have a look at @JDukeSplunk answer how to setup multiple OU's for userBaseDN cheers, MuS

niketn · ‎11-23-2018

See one of my recent answers in case your table as multi-values and you want to color them based on range: https://answers.splunk.com/answers/694420/is-it-possible-to-highlight-a-value-within-a-multi-1.html

renjith_nair · ‎09-20-2018

@kannu , Try index="your index" NOT [|inputlookup yourcsvfile]

FrankVl · ‎10-23-2018

as @teunlaan mentioned: the list forward-server command, only shows things as active, when there is actual data going across. If your only input is running just once every 5 minutes, then it will probably be silent for a good part of the time and therefor showing as inactive. If you put a watch on that command, and keep your eyes on it when the scripted input triggers, you'll likely see it come to life.

FrankVl · ‎07-12-2018

Can a deployment server influence etc/system/local?

niketn · ‎06-07-2018

@kannu, please refer to this documentation on Building your own custom visualization using Splunk's Custom Visualization API.

FrankVl · ‎06-01-2018

Yes, I would expect it would 🙂

Posts	103
Solutions	1
Karma Given	22
Karma Received	3
Member Since	‎04-20-2017

Online Status	Offline
Date Last Visited	2 weeks ago

Why i am not able to use ACS services on Splunk cl...

CIM compliance add-on normalizes data to which dat...

sample data for splunk PCI compliance app

extract multiple values from fields in same event

extract first value from json subarray

how to handle ERROR ArchiveContext , Decompression...

monitor universal forwarder agent license expiry d...

How to Force splunk to get timestamp of file creat...

multiple level of hierarchy in treemap splunk

CylancePROTECT App: Fetch device details

Re: Why i am not able to use ACS services on Splun...

Re: CIM compliance add-on normalizes data to which...

Re: Force splunk to get timestamp of file created

Re: Renewing server.pem certificate

sample data for splunk PCI compliance app

Re: How do I renew a Splunk forwarder's default ce...

Re: extract multiple values from fields in same ev...

Re: forwarding logs to third party system

Re: multiple level of hierarchy in treemap splunk

Re: extract first value from json subarray

how to handle ERROR ArchiveContext , Decompression...

Re: monitor universal forwarder agent license expi...

Re: CylancePROTECT App: Fetch device details

Re: monitor VMware systems in splunk

Re: With Splunk Stream, how do you set up an FTP s...

Re: combine two search results tables by matching ...

Re: pre process binary file before injecting to sp...

Re: full removing search head clustering

Re: How come the LDAP config is not picking up use...

Re: In a table format, how can I color a field if ...

Re: How do I make a Splunk query which would exclu...

Re: Seeing all the forwarded data on indexer but u...

Re: Index name entry in inputs.conf

Re: custom visualization

Re: Why doesn't the time format match my log?