About belasker

belasker · ‎08-22-2017

Hello Splunkers, I want to ask you about Splunk Universal Forwarder memory, CPU and DISK I/O consumption monitoring on client machines because I can do this only with a full Splunk Enterprise instance using a DMC server but can't do that with Splunk universal forwarder. Is there any solution? and I'm so thankful.

belasker · ‎08-22-2017

Hello Splunkers, I want to create my own saved search in Splunk Enterprise Security working on IP threat intelligence lookup called: ip_intel search command is : index="apacheSplunkES" | append [ inputlookup email_intel ]|where src_user=email And the command doesn't return any result even though I'm sure that I have a malicious IP stored in my index. Thank you

belasker · ‎05-08-2017

Thank you but In splunk official documentation (last example) they said " All other events get routed to the default group, everythingElseGroup" that means syslogGroup and errorGroup will be forwarded to the right place not the defaultgroup.

belasker · ‎05-07-2017

Hi Splunkers, here are my 3 configuration files transforms,props,outputs /// props.conf [host:firstClient] TRANSFORMS-routing=apacheWindows [host:secondClient] TRANSFORMS-routing=apacheLinux /// transforms.conf [apacheWindows] REGEX= . DEST_KEY=_TCP_ROUTING FORMAT=apacheWindows [apacheLinux] REGEX= . DEST_KEY=_TCP_ROUTING FORMAT=apacheLinux // outputs.conf [tcpout] defaultGroup = default-group [tcpout:apacheWindows] server=192.168.1.25:9997 [tcpout:apacheLinux] server=192.168.1.24:9997 [tcpout:default-group] server=192.168.1.25:9997 the issue here is when i use default-group all the data will be forwarded to the default-group address even tcpout:apacheLinux and when i remove default-group from outputs.conf ,data is forwaded correctly to the 2 different indexers here the example that i have followed in splunk official documentation ///// [tcpout] defaultGroup=everythingElseGroup [tcpout:syslogGroup] server=10.1.1.197:9996, 10.1.1.198:9997 [tcpout:errorGroup] server=10.1.1.200:9999 [tcpout:everythingElseGroup] server=10.1.1.250:6666 syslogGroup and errorGroup receive events according to the rules specified in transforms.conf. All other events get routed to the default group, everythingElseGroup. ////// Thank you.

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-07-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Can I use a Splunk universal forwarder to monitor ...

Help with Splunk Enterprise Security IP threat int...

Route event data to different target groups issue

Can I use a Splunk universal forwarder to monitor ...

Help with Splunk Enterprise Security IP threat int...

Re: Route event data to different target groups is...

Route event data to different target groups issue