About adobrzeniecki

adobrzeniecki · ‎10-05-2022

Run /opt/splunk/bin/splunk btool outputs list --debug You should see that the whitelisted index list does not include _internal. It is a precedence issue. For us the issue was because the SplunkForwarder app did not include _internal in the whitelist for indexes. Just put this in /opt/splunk/etc/system/local/outputs.conf OR /opt/splunk/etc/SplunkForwarder/local/outputs.conf [tcpout] forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry)

adobrzeniecki · ‎12-02-2021

So i figured out a way to retain _time. Whatever you are bringing over into your summary index; source, sourcetype, fields of your choice....Create your own _raw field. In my instance I created _raw as below: | eval _raw= _time. ":" .source | table _raw ALL OTHER FIELDS YOU WANT | collect index=SI This will retain the _time value in your summary index. If this works for you please upvote this response!

adobrzeniecki · ‎12-02-2021

So i figured out a way to retain _time. Whatever you are bringing over into your summary index; source, sourcetype, fields of your choice....Create your own _raw field. In my instance I created _raw as below: | eval _raw= _time. ":" .source | table _raw ALL OTHER FIELDS YOU WANT | collect index=SI This will retain the _time value in your summary index. If this works for you please upvote this response!

adobrzeniecki · ‎11-23-2021

What sourcetype did your data come in with? Did you have to create the sourcetype?

adobrzeniecki · ‎11-16-2021

Is that the correct path of where those logs are actually located? Also, you are going to want to make sure that Splunk is able to capture from that location. Might want to check permissions on the windows event log configuration.

adobrzeniecki · ‎06-29-2021

I am seeing in the eStreamer-Dashboard app that those eventtypes exist. Is this correct? Should they be in the TA or App?

adobrzeniecki · ‎05-27-2021

Is this still good in 2021??

adobrzeniecki · ‎05-17-2021

Is this still good in 2021?

adobrzeniecki · ‎03-02-2021

adobrzeniecki · ‎02-16-2021

Also the cert will be in the local directory of that app.

adobrzeniecki · ‎02-16-2021

I have a customer that has four different outputs apps being sent from the DS to different types of UFs. We are thinking of putting each of the SSL certs in these different apps and pushing them to the designated forwarders. Question for you, as long as I put the correct path in clientCert, this will work properly correct? So for example: /opt/splunk/etc/apps/myexternalapp/local/outputs.conf clientCert = $SPLUNK_HOME/etc/apps/myexternalapp/local/splunk-forwarder.pem sslPassword = shabadooo sslVerifyServerCert = true sslVersions = tls

adobrzeniecki · ‎02-09-2021

Hello, I am experiencing this issue as well with SAML and using Splunk 8.1.2. We have over 50+ users in SAML. THey are being mapped in authentication.conf to roles that do exist. When i run the rest call above it only shows me 20 users. These 20 users are also only showing up in the GUI. BUT when i run that rest command and add the username of someone who is missing, it returns results for that user. I need some assistance here and i have a feeling that this may be a bug ticket. Does anyone have any information at all?

adobrzeniecki · ‎12-07-2020

@richgalloway I cannot find any documentation on caveats or issues with TCP inputs on UFs. I am in a bit of a quandry, my customer is in Cloud, does not have a HF on prem. They have an IDM in cloud, but the cloud team told us we cannot configure TCP inputs on an IDM. We do have a UF on prem. Could we setup the TCP inputs on the UF without any issues moving forward? This is for Zscaler.

adobrzeniecki · ‎09-01-2020

I am also having issues with the host field appearing when i run a search for this data. I commented out the field alias in props and for some reason the host field still does not exist in the search. When running a tstats on the index by host we see values for host. But not when we just simply search the data

adobrzeniecki · ‎06-02-2020

According to the documentation below, there is not an option for eventSorting=realtime. Indicates if the events of this search are sorted, and in which order. asc = ascending; desc = descending; none = not sorted Would the actual setting to be used be isRealTimeSearch?

adobrzeniecki · ‎04-02-2020

-How does this app bring in data? I know the script pulls in the data but is there anything I need to do to have the script run? I see there are two sourcetypes being used, one in the inputs.conf and one in the props.conf, so on Sunday will it download the files and use the sourcetype in the props.conf? I have downloaded the app, do I just wait until Sunday to have the data ingest? -After changing the directory in the script to where the files will be downloaded, as well as changing the interval (cron schedule) in the inputs.conf. I am not seeing that data downloaded to my directory. Am I missing something?

Posts	16
Solutions	0
Karma Given	16
Karma Received	2
Member Since	‎04-02-2020

Online Status	Offline
Date Last Visited	‎10-31-2022 10:42 AM

Questions regarding how the app works

Re: Why are _internal logs from heavy forwarder(HF...

Re: Why is _time order not maintained within my su...

Re: Setting the timestamp when using the collect c...

Re: Unable to Collect SMBServer/Audit logs

Re: Unable to Collect SMBServer/Audit logs

Re: Latest eStreamer not CIM compliant?

Re: How to get AD FS 2.0 WinEventLogs into Splunk?

Re: Entire file contents as a single event

Re: sort columns that with the highest Total to th...

Re: How to deploy self-signed certs to deployment ...

Re: How to deploy self-signed certs to deployment ...

Re: Users missing from Access Control

Re: Can I configure universal forwarder to listen ...

Re: Windows IIS logs not formatting correctly / ho...

Re: How can I identify real time searches?

Questions regarding how the app works