About adobrzeniecki

pnodine1

You can get cleaner results by adding a table. |rest /services/search/jobs | search eventSorting=realtime | table label, author, dispatchState, eai:acl.owner, label, isRealTimeSearch, performance.dispatch.stream.local.duration_secs, runDuration, splunk_server, title

cboillot · ‎11-02-2022

Did you bounce Splunk or AD FS?

adobrzeniecki · ‎10-05-2022

Run /opt/splunk/bin/splunk btool outputs list --debug You should see that the whitelisted index list does not include _internal. It is a precedence issue. For us the issue was because the SplunkForwarder app did not include _internal in the whitelist for indexes. Just put this in /opt/splunk/etc/system/local/outputs.conf OR /opt/splunk/etc/SplunkForwarder/local/outputs.conf [tcpout] forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry)

aliuwkina · ‎07-29-2022

It's working! But you need to use addtime=false and Splunk taking first timestamp in your event.

adobrzeniecki · ‎12-02-2021

So i figured out a way to retain _time. Whatever you are bringing over into your summary index; source, sourcetype, fields of your choice....Create your own _raw field. In my instance I created _raw as below: | eval _raw= _time. ":" .source | table _raw ALL OTHER FIELDS YOU WANT | collect index=SI This will retain the _time value in your summary index. If this works for you please upvote this response!

CJHindmarsh · ‎11-23-2021

I was at the time utilizing the Splunk add on for Windows. It came with some predefined sourcetypes for Win Event logs.

adobrzeniecki · ‎06-29-2021

I am seeing in the eStreamer-Dashboard app that those eventtypes exist. Is this correct? Should they be in the TA or App?

adobrzeniecki · ‎05-17-2021

Is this still good in 2021?

adobrzeniecki · ‎03-02-2021

adobrzeniecki · ‎02-16-2021

Also the cert will be in the local directory of that app.

adobrzeniecki · ‎02-09-2021

Hello, I am experiencing this issue as well with SAML and using Splunk 8.1.2. We have over 50+ users in SAML. THey are being mapped in authentication.conf to roles that do exist. When i run the rest call above it only shows me 20 users. These 20 users are also only showing up in the GUI. BUT when i run that rest command and add the username of someone who is missing, it returns results for that user. I need some assistance here and i have a feeling that this may be a bug ticket. Does anyone have any information at all?

richgalloway · ‎12-07-2020

TCP inputs are not allowed in Splunk Cloud at all so you must have an on-prem instance to do it. Another respondent says UFs can listen for TCP input. Try it. If it doesn't work, use a HF. If your customer can run a UF they probably can run a HF.

adobrzeniecki · ‎09-01-2020

I am also having issues with the host field appearing when i run a search for this data. I commented out the field alias in props and for some reason the host field still does not exist in the search. When running a tstats on the index by host we see values for host. But not when we just simply search the data

adobrzeniecki · ‎04-02-2020

-How does this app bring in data? I know the script pulls in the data but is there anything I need to do to have the script run? I see there are two sourcetypes being used, one in the inputs.conf and one in the props.conf, so on Sunday will it download the files and use the sourcetype in the props.conf? I have downloaded the app, do I just wait until Sunday to have the data ingest? -After changing the directory in the script to where the files will be downloaded, as well as changing the interval (cron schedule) in the inputs.conf. I am not seeing that data downloaded to my directory. Am I missing something?

Posts	16
Solutions	0
Karma Given	16
Karma Received	2
Member Since	‎04-02-2020

Online Status	Offline
Date Last Visited	‎10-31-2022 10:42 AM

Questions regarding how the app works

Re: How can I identify real time searches?

Re: How to get AD FS 2.0 WinEventLogs into Splunk?

Re: Why are _internal logs from heavy forwarder(HF...

Re: Setting the timestamp when using the collect c...

Re: Why is _time order not maintained within my su...

Re: Unable to Collect SMBServer/Audit logs

Re: Latest eStreamer not CIM compliant?

Re: Entire file contents as a single event

Re: sort columns that with the highest Total to th...

Re: How to deploy self-signed certs to deployment ...

Re: Users missing from Access Control

Re: Can I configure universal forwarder to listen ...

Re: Windows IIS logs not formatting correctly / ho...

Questions regarding how the app works