About cervelli

cervelli · ‎01-10-2013

docs.splunk.com = www.splunk.com quickdraw.splunk.com does the translation to the right doc page. If you can reach both, something in between is blocking you. The docs are and remain generally available.

cervelli · ‎01-09-2013

The documentation issue is caused by being unable to reach, or DNS resolve, quickdraw.splunk.com and www.splunk.com.

cervelli · ‎11-01-2012

Per the support agreement, (http://www.splunk.com/web_assets/pdfs/support/SplunkSupportAgreement.pdf) until the second major release (e.g. 6.0) or 24 months, whichever is more. As 4.3 went GA Jan 2012, that would mean Jan 2014.

cervelli · ‎11-01-2012

Hi Kristian, The intended reading of that statement is that 4.x will be supported until 6.0 comes out, but for no less than 24 months. That means that 4.3, which went GA Jan 2012, will be supported at least until Jan 2014.

cervelli · ‎10-31-2012

There is no decision on when to remove fschange. The input will be supported for at least as long as 4.3.x is supported.

cervelli · ‎10-30-2012

The fschange input is deprecated in 5.0 for two reasons. First, it does not run predictably on all platforms. Since it has been that way for some time, many felt that was a form of 'implicit' deprecation. We prefer to be open whenever possible, so we decided the time had come to signal that this feature had too many caveats. Second, it does not do what is generally required for audit use cases, which is track the user/account making the change. Most OS/FS pairs provide high quality, out-of-the-box tools to do this already. In fact our guidance has been to use those tools in most cases, leaving little room for a Splunk-maintained feature. We are considering migrating the file metadata capabilities of fschange into monitor. That won't help the second point, but would be parity with fschange. If you would like to weigh in to support that, please file an enhancement request with our support team; both so we know your use case, and can get back to you personally.

cervelli · ‎11-15-2011

WRT to question 1 : the host issue has to do with how Splunk 'automagically' finds hostnames. In the event log, it's taken directly from the event, because the host is part of the data. (NOT the local host, as event log forwarding could create entries for many hosts on one machine) In the performance case, there is no host in the raw data. The normal host rules apply. You can force a specific treatment by configuring an explicit host= on the forwarder or a props rule on the indexer.

cervelli · ‎07-20-2011

The clean all command works for removing the fishbucket on a UF. Is there a reason you can't issue that command?

cervelli · ‎02-02-2011

Splunk can only connect to one domain in an AD forest at this time. That's a known limitation. However, is it possible to set whatever user name you want in the SSO header when you do the re-write. The proxy doing the re-write may be multi-domain or forest aware. How can I re-write the auth'd user from a non-Splunk-auth domain to target a user in Splunk? If I do, must I map them to users in the domain that Splunk can access to, in order to make the roles work out?

cervelli · ‎02-01-2011

You may be hitting a known issue. This answer discuss it, and potential work-arounds: http://answers.splunk.com/questions/2882/using-fschange-to-monitor-windows-filesystem

cervelli · ‎02-01-2011

See http://answers.splunk.com/questions/11233/when-will-splunk-support-solaris-11-and-rhel-6 It may work, but we haven't tested it sufficiently to declare it supported. Once we understand what may be involved - if anything - in certifying it we will update our roadmap accordingly.

cervelli · ‎02-01-2011

We're looking into Solaris 11 and RHEL 6 support. In preliminary testing they appear to be OK, but we won't know until we've had a chance to put them into our full testing suite. We'll update our roadmap after we see how much work is involved in certifying these platforms.

cervelli · ‎01-28-2011

Glad you all enjoy your Splunk Free! Generally no, we don't allow third parties to distribute our software. There are a variety of reasons for this, but most pressing are viral license agreements and an inability to keep the bits current. As mentioned to dome in their docs post, if you want more information you can contact me at my screen name at splunk dot com. WRT to the license agreement, the one you accept in the click-wrap of the download is authoritative. It does not allow you to distribute. I believe I found the legacy EULA vaijpc found in the docs; we'll fix that promptly. Thanks for the heads up.

cervelli · ‎10-13-2010

Why not just configure the event logs to roll? That's the default state and MSFT best practice. Splunk doesn't do destructive reads, and I'm not sure that even powershell will let you. A cursory examination suggests this is not something MSFT wants to allow, for obvious audit-ability reasons. Apologies if that's a non-answer.

cervelli · ‎10-13-2010

Not currently Hammer, but that's an interesting enhancement request. To clarify, is there any pattern to the names or their container? Do you want ansi-style wildcarding (e.g. '*') or regex pattern matching?

cervelli · ‎10-13-2010

The add data interface will list these out as well. Even if you intended to deploy to a forwarder, you can still create the stanza as a sample on one Splunk to make sure the syntax is correct.

cervelli · ‎10-13-2010

Overall, it's far, far more trouble than it's worth. As dwaddle points out, you need either a native WMI mapper, or a wbem client on the local windows box. (how that isn't as or more invasive than our or another agent is unclear). If for some reason you did go down the wbem mapper, there is also OpenPegasus. http://www.openpegasus.org/ At least then you could write a scripted input from the command line use wbemmapper. Note that you still need a PAM or other form of cross-compatible authentication as well for your Linux box to communicate with the box. Note that later versions of Windows (2008, W7) will have to have their security severely degraded significantly.

cervelli · ‎02-24-2010

The error is, alas, precise - we have attempted, and been explicitly denied, access to the logs. This can happen for the following reasons : you're not in a domain (see below) Splunkd service is running with Local System permissions Splunkd is running as a domain account, but cannot do at least one of these: log on as a service on the remote box bypass the firewall on the remote box, specifically IPSEC challenges use Remote Launch and Remote Activation DCOM rights Profile System Performance and Access this Computer from the Network GPO rights The RPC service is running, but DCOM and/or WMI services are not Whew. That's a lot of reasons, and there can be even more edge cases. For testing, try a domain admin account for the splunkd service login to verify connectivity is possible, then go from there to improve security. See: http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWMIdata or http://msdn.microsoft.com/en-us/library/aa394603%28VS.85%29.aspx RE: Domains. If you are NOT in a domain, it is possible to have identically named accounts with exactly the same login name and password who are both Local Administrators on both machines work with WMI. The polling Splunkd needs to have this account as it's service login. Note this will NOT work if either machine is actually in a domain; both must be stand alone.

cervelli · ‎01-28-2010

Splunk can monitor all objects in AD. It starts by enumerating the entire directory and turning the resultant data into standard key-value pairs that Splunk interprets as fields (don't worry, your AD is not that big by Splunk standards... we promise). From then on it monitors all changes made and records the new field values. It does this by tracking the 'universal serial number' (USN) that MSFT helpfully added to track replication changes. This too ends up in your Splunk. With that info, you can monitor the health of your AD. Additionally, you can take all the meta data about users and computers and use it to annotate (i.e. do cross-lookups) your events at search time. For example, you can add a full name and phone number to a basic user name in a log event such as a change request. You enable admon by turning on the input. A sample, disabled input is in the Windows Management sample app's inputs.conf that ships with Windows. You do not need the app to enable admon, but you must be running Splunk on a Windows box. Forwarders are fine if your primary indexer(s) are on *nix.

cervelli · ‎01-15-2010

Transaction marks a series of events as interrelated, based on a shared piece of common information. e.g. the flow of a packet based on clientIP address, a purchase based on user_ID. Stats produces statistical information by looking a group of events. Primarily used when the field(s) in question has a numeric value, and you want to do a statistical calculation. e.g. the average time to complete a transaction based on the averaged sum of all latencies, find re-try attempts that exceed session time out by more than 2 standard deviations. Both combine events. However transactions creates relationships based on metadata you provide, while stats calculates statistical relationships based on values or relationships already defined (by you, or by splunk).

cervelli · ‎01-14-2010

Splunk comes with a 60 day trial license by default, good for 500MB of indexing per day. If you need to extend your license, or need more volume per day, you can contact sales@splunk.com and ask for another (larger, or longer) trial license. You can also do the same thing by clicking on the 'extend your Trial' link in manager.

cervelli · ‎01-14-2010

When the trial expires, Splunk will automatically prompt you to get a trial extension, or convert to Free. However, if you’re ready to go to Splunk Free right away: Go to Manager (from any app) -> License Down in the text area of the license page, you’ll see text for “switch to a Free Splunk at any time” When you click that, you’ll go to the license switcher that will turn your Splunk into a Free Splunk. Note however, you must be running Splunk 4.0.5 or later for the free version. If you are currently using 4.0.4 or earlier, you must first upgrade in order to get the Free version. Enjoy!

cervelli · ‎01-14-2010

I've downloaded Splunk from the website. But it's the trial version. I want the free version. How do I install the free license? Do I need to wait until the trial expires?

Posts	24
Solutions	7
Karma Given	13
Karma Received	71
Member Since	‎01-17-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Using SSO proxy to connect to multiple AD domain

Convert Trial License to Free License?

Re: Splunk Documents 404 & CSV Issues

Re: Splunk Documents 404 & CSV Issues

Re: Why is FSChange (file system change monitor) a...

Re: Splunk Support and End-of-Life

Re: Why is FSChange (file system change monitor) a...

Re: Why is FSChange (file system change monitor) a...

Re: How do I collect data from Windows?

Re: Re-send data with universal forwarder?

Using SSO proxy to connect to multiple AD domain

Re: Windows File System Monitoring with FSChange

Re: RHEL 6 64bit on Splunk 4.1

Re: When will Splunk support Solaris 11 and RHEL 6

Re: Can I distibute splunk with my Linux Distro ?

Re: Can splunk delete remote event logs?

Re: All Windows Event Logs but not others?

Re: Windows 2008 Server Event Viewer Logs

Re: Splunk on Linux making WMI queries to Windows ...

Re: While setting up a Windows Eventlog collection...

Re: Can I monitor Active Directory with Splunk?

Re: transaction vs stats commands

Re: How do I get an Enterprise Trial License?

Re: Convert Trial License to Free License?

Convert Trial License to Free License?