Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About arber
arber
Communicator
Member since:
07-29-2014
08-01-2025
Community Statistics
| Posts | 74 |
| Solutions | 1 |
| Karma Given | 19 |
| Karma Received | 24 |
| Member Since | 07-29-2014 |
Activity Feed
- Got Karma for Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?. 07-08-2025 05:54 AM
- Got Karma for Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?. 07-08-2025 05:54 AM
- Karma Re: Getting error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0" when running a search for the_wolverine. 06-05-2020 12:48 AM
- Karma Re: Checkpoint opsec lea 4.0 error with Checkpoint R80 for ektasiwani. 06-05-2020 12:48 AM
- Karma Re: How to resolve messages about 'File Integrity checks' for Splunk files for sanderdenheijer. 06-05-2020 12:48 AM
- Got Karma for With data integrity control enabled on indexes, is there a way to alert if the integrity is compromised?. 06-05-2020 12:48 AM
- Got Karma for With data integrity control enabled on indexes, is there a way to alert if the integrity is compromised?. 06-05-2020 12:48 AM
- Got Karma for With data integrity control enabled on indexes, is there a way to alert if the integrity is compromised?. 06-05-2020 12:48 AM
- Karma Re: Why am I getting a handshake error trying to set cipherSuite on web.conf to allow only tls=1.2 connection in Splunk 6.2? for dflodstrom. 06-05-2020 12:47 AM
- Karma Re: enable integrity control on splunk 6.3 for dbhagi_splunk. 06-05-2020 12:47 AM
- Karma Re: Retention Issue: Why is data getting rolled to frozen before hitting the frozenTimePeriodInSecs setting? for acharlieh. 06-05-2020 12:47 AM
- Karma Re: How to enable kvstore in Splunk 6.2.2 to finish setting up the Splunk App for Windows Infrastructure? for malmoore. 06-05-2020 12:47 AM
- Karma Re: Is there a command to downgrade from Splunk version 6.2 to 6.0 on Unix? for MuS. 06-05-2020 12:47 AM
- Karma Re: I have Windows Universal Forwarder that is sending thousands of blank Windows events and duplicating events for milesbrennan. 06-05-2020 12:47 AM
- Karma Re: How to create a tag for multiple fields? for esix_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunk Add-on for Cisco ASA: Why am I getting "The lookup table networkservice does not exist" in the alert messages? for sjh65. 06-05-2020 12:47 AM
- Got Karma for Splunk App for Windows Infrastructure: Why does the Group Policy changes view displays no results, but I'm able to view the data in a search?. 06-05-2020 12:47 AM
- Got Karma for enable integrity control on splunk 6.3. 06-05-2020 12:47 AM
- Got Karma for enable integrity control on splunk 6.3. 06-05-2020 12:47 AM
- Got Karma for Splunk Add-on for Cisco IPS: Why am I unable to connect to Cisco IPS after upgrading to Splunk 6.3?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 3 | |||
| 2 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-19-2017
05:52 AM
worked perfectly.. thanks
... View more
08-01-2017
04:34 AM
I have the same issue. and i have a debian 9.1 as an OS. Did anyone find a proper solution regarding this ?
... View more
04-18-2017
02:25 AM
We created another folder on splunk that these devices send the logs to. After that applied the monitor on the new folder. That seemed to work
... View more
01-06-2017
03:49 AM
Hi,
we are trying to monitor some events on a Custom View created on the Windows Event Viewer like in the pic below
We tried to get those events adding the stanza [WinEventLog://MonitoredEvents] but nothing is shown in Splunk. Has anyone encountered this before ?
Thanks
... View more
11-01-2016
12:22 AM
Hi,
We have enabled the data Integrity check for the indexes that we have on our splunk environment. As per the documentation we can execute the integrity check command from cli and see if there is any violation of the integrity for that index. Is there any alert that we can set up that automatically checks the integrity and notifies the users if something is changed ?
Thanks
... View more
04-21-2016
07:03 AM
Save yourself time and use this script
https://github.com/tuwid/splunk_frozen_db_restore
like below :
root@XXXXXX:~# python splunk_frozen_db_restore.py
We're using the default index path, for custom indexes please adjust the path variable here
Enter index:winevents_security
Enter start date: (eg 30.12.2015): 31.12.2015
Enter end date: (eg 30.12.2015): 01.01.2016
[+] Searching dates on index winevents_security
in /opt/splunk/var/lib/splunk/winevents_security/frozendb/
1451516400
1451602800
Got 313 elements from /opt/splunk/var/lib/splunk/winevents_security/frozendb/
Found : db_1452350660_1451453107_329
[+] Copying databases into thaweddb..
cp -R /opt/splunk/var/lib/splunk/winevents_security/frozendb/db_1452350660_1451453107_329 /opt/splunk/var/lib/splunk/winevents_security/thaweddb/
[+] Rebuilding DBs
splunkd fsck repair --one-bucket --include-hots --bucket-path=/opt/splunk/var/lib/splunk/winevents_security/thaweddb/db_1452350660_1451453107_329 --log-to--splunkd-log
root@XXXXXX:~#
... View more
04-21-2016
07:02 AM
Try this script and that should work fine https://github.com/tuwid/splunk_frozen_db_restore
as follows:
root@XXXXXX:~# python splunk_frozen_db_restore.py
We're using the default index path, for custom indexes please adjust the path variable here
Enter index:winevents_security
Enter start date: (eg 30.12.2015): 31.12.2015
Enter end date: (eg 30.12.2015): 01.01.2016
[+] Searching dates on index winevents_security
in /opt/splunk/var/lib/splunk/winevents_security/frozendb/
1451516400
1451602800
Got 313 elements from /opt/splunk/var/lib/splunk/winevents_security/frozendb/
Found : db_1452350660_1451453107_329
[+] Copying databases into thaweddb..
cp -R /opt/splunk/var/lib/splunk/winevents_security/frozendb/db_1452350660_1451453107_329 /opt/splunk/var/lib/splunk/winevents_security/thaweddb/
[+] Rebuilding DBs
splunkd fsck repair --one-bucket --include-hots --bucket-path=/opt/splunk/var/lib/splunk/winevents_security/thaweddb/db_1452350660_1451453107_329 --log-to--splunkd-log
root@XXXXXX:~#
... View more
04-21-2016
07:00 AM
Try this python script
https://github.com/tuwid/splunk_frozen_db_restore
root@XXXXXX:~# python splunk_frozen_db_restore.py
We're using the default index path, for custom indexes please adjust the path variable here
Enter index:winevents_security
Enter start date: (eg 30.12.2015): 31.12.2015
Enter end date: (eg 30.12.2015): 01.01.2016
[+] Searching dates on index winevents_security
in /opt/splunk/var/lib/splunk/winevents_security/frozendb/
1451516400
1451602800
Got 313 elements from /opt/splunk/var/lib/splunk/winevents_security/frozendb/
Found : db_1452350660_1451453107_329
[+] Copying databases into thaweddb..
cp -R /opt/splunk/var/lib/splunk/winevents_security/frozendb/db_1452350660_1451453107_329 /opt/splunk/var/lib/splunk/winevents_security/thaweddb/
[+] Rebuilding DBs
splunkd fsck repair --one-bucket --include-hots --bucket-path=/opt/splunk/var/lib/splunk/winevents_security/thaweddb/db_1452350660_1451453107_329 --log-to--splunkd-log
... View more
Hi,
We have enabled data integrity control on the indexes. Is there a way that we can set up alerts if the integrity is compromised?
or a better/faster way to check the integrity rather than just running the command:
./splunk check-integrity -index [ index name ]
thanks
... View more
03-24-2016
05:53 AM
You need to use the 32bit version of libpam and other libraries like :
sudo apt-get install libstdc++6:i386 libgcc1:i386 libc6-i386 libpam-modules:i386
On Debian 7, if you're unable to install 32-bit packages, the reason is because newer Debian distributions need to enable the installation of i386 packages on amd64 systems. Use the following command to enable installation of i386 packages:
sudo dpkg --add-architecture i386
sudo apt-get update
After enabling i386 package installation on amd64 systems, execute the following command to install all required packages:
sudo apt-get install libstdc++6:i386 libgcc1:i386 libc6-i386 libpam-modules:i386
... View more
12-18-2015
07:38 AM
Hi
thanks for the update. I tried to upgrade. but for me it is still not working this is what i have in the logs
Fri Dec 18 16:32:39 2015 - INFO - Checking for existing SubscriptionID on host: X.x.x.x
Fri Dec 18 16:32:39 2015 - INFO - No existing SubscriptionID for host: x.x.x.x
Fri Dec 18 16:32:39 2015 - INFO - Attempting to connect to sensor: x.x.x.x
Fri Dec 18 16:32:39 2015 - INFO - Successfully connected to: x.x.x.x
Fri Dec 18 16:33:38 2015 - ERROR - Connecting to sensor - x.x.x.x: Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/get_ips_feed.py", line 99, in run sdee.open() File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 187, in open self._request(params) File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 163, in _request data = urllib2.urlopen(req) File "/opt/splunk/lib/python2.7/urllib2.py", line 127, in urlopen return _opener.open(url, data, timeout) File "/opt/splunk/lib/python2.7/urllib2.py", line 404, in open response = self._open(req, data) File "/opt/splunk/lib/python2.7/urllib2.py", line 422, in _open '_open', req) File "/opt/splunk/lib/python2.7/urllib2.py", line 382, in _call_chain result = func(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 1222, in https_open return self.do_open(httplib.HTTPSConnection, req) File "/opt/splunk/lib/python2.7/urllib2.py", line 1184, in do_open raise URLError(err) URLError:
Any idea what can be the issue ?
Thanks for the support
... View more
11-12-2015
11:47 AM
2 Karma
Hi,
I'm trying to gather logs from an IPS into Splunk. the Splunk Add-on for Cisco IPS is configured, however, it looks like no subscription is created.
On sdee_get.log we have this:
(Thu Nov 12 21:36:45 2015 - INFO - Checking for existing SubscriptionID on host: x.x.x.x
Thu Nov 12 21:36:45 2015 - INFO - No existing SubscriptionID for host: x.x.x.x
Thu Nov 12 21:36:45 2015 - INFO - Attempting to connect to sensor: x.x.x.x
Thu Nov 12 21:36:45 2015 - INFO - Successfully connected to: x.x.x.x
Thu Nov 12 21:36:45 2015 - ERROR - Connecting to sensor - x.x.x.x: Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/get_ips_feed.py", line 99, in run sdee.open() File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 187, in open self._request(params) File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 163, in _request data = urllib2.urlopen(req) File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "/opt/splunk/lib/python2.7/urllib2.py", line 431, in open response = self._open(req, data) File "/opt/splunk/lib/python2.7/urllib2.py", line 449, in _open '_open', req) File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain result = func(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 1240, in https_open context=self._context) File "/opt/splunk/lib/python2.7/urllib2.py", line 1166, in do_open h = http_class(host, timeout=req.timeout, **http_conn_args) TypeError: __init__() got an unexpected keyword argument 'context')
The version of splunk we are using is 6.3
What can be the issue for this ?
Thanks
... View more
10-30-2015
05:52 AM
Thats an XML issue, you should substitute Event with EventType and not do
Event< 14
but
> (EventType==1 OR EventType==2 OR
> EventType==3 OR EventType==4 OR
> EventType==5 OREventType==6 OR
> EventType==7 OR EventType==8 OR
> EventType==9 OR EventType==10 OR
> EventType==11 OR EventType==11 OR
> EventType==12 OR EventType==13 )
That should fix the issue. The alternative is to use CDATA to bypass xml errors.
This is the way i went around it and it works fine.
... View more
10-08-2015
12:44 PM
Thanks for the reply, in fact now i can see 3 buckets with hashes for that index. Thanks again
... View more
10-08-2015
06:38 AM
2 Karma
Hi,
we recently migrated to 6.3. However in this version we cannot use anymore the eventhashing stanza in audit.conf. As per documentation
http://docs.splunk.com/Documentation/Splunk/6.3.0/Security/Dataintegritycontrol
we should use the enableDataIntegrityControl feature. We enabled this feature on one of our indexes.
After that we run
./splunk check-integrity -index [index_name]
but we have these kind of errors:
Integrity check error for bucket with path=/opt/splunk/var/lib/splunk/index_name/db/db_1429532061_1429531988_278, Reason=Journal has no hashes.
tried to regenerate hashes
./splunk generate-hash-files -index [ index_name]
but the same error
anybody having trouble with this ?
Thanks
... View more
Labels
- Labels:
-
configuration
10-07-2015
06:31 AM
The problem was related to some local configuration files on inputs.conf. The local settings are removed and teh system is logging fine now
... View more
09-22-2015
03:45 AM
Hi ,
we are having some issues with duplicated logs from one server, the logs have the same record number field
is there a way to filter them from not indexing ??
... View more
08-21-2015
04:32 AM
Hi, did you get any response from them ?
... View more
08-20-2015
05:11 AM
Hi,
We are implementing the Splunk App for Windows Infrastructure, and we wanted to have the powershell scripts running. We have set up the servers to allow the running of the powershell scripts, but unfortunately, we still do not see the data coming. We have deployed the TA-DomainController-2012R2 app as they are Windows 2012 R2 servers, but still no logs are coming. In our environment, we also have some 2008 servers that we can collect the logs coming from the powershell. Any idea what's to be done on 2012 R2 servers ?
Thanks
... View more
08-05-2015
01:37 AM
I have also the same issue. we also see that sometimes the dest_nt_domain will show as double
e.g dest_nt_domain="mydomain mydomain"
sometimes is extracted correctly
is it something that has to do with the addon that is deployed on the clients ?
... View more
07-28-2015
01:42 AM
on /opt/splunk/var/log/splunk we can find crash-2015-07-28-06:25:03.log
[build 271043] 2015-07-28 06:25:03
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 2365 running under UID 0.
Crashing thread: MainTailingThread
... View more
07-28-2015
01:03 AM
Hello,
Two days ago, we upgraded the Splunk version on our indexers from 6.2.2. to 6.2.4. However, we are facing an issue where the splunkd service is stopped. It happened two times on all our indexers. After restarting the service again, everything comes back to normal.
Has anyone experienced this issue with the new Splunk version?
Thanks
... View more
07-08-2015
05:29 AM
Hi,
we are using the SoS app, basically most of the searches are working. However we have noticed that the index sos does not have any log.
the scripts are enabled but still no log is show. We have also installed the TA sos addon.
any idea on this ?
Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-01-2025
03:28 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
