Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jcorcoran508
jcorcoran508
Path Finder
Member since:
03-17-2020
Thursday
Community Statistics
| Posts | 28 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 03-17-2020 |
Activity Feed
- Posted Configured but inactive forwards: from Splunk list forward-server- How to activate them? on Splunk Enterprise. Thursday
- Posted Deployment server missing forwarder exception- Is there a way to ignore/not report on the node as being missing? on Deployment Architecture. Tuesday
- Posted Dev Tutorial question about "DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery" on Developing for Splunk Enterprise. 02-21-2022 06:28 AM
- Tagged Dev Tutorial question about "DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery" on Developing for Splunk Enterprise. 02-21-2022 06:28 AM
- Karma Re: How to extract ip address using regex? for FrankVl. 01-28-2022 05:11 PM
- Posted UF send log data to Splunk cloud options on Developing for Splunk Cloud Services. 01-20-2022 01:39 PM
- Tagged UF send log data to Splunk cloud options on Developing for Splunk Cloud Services. 01-20-2022 01:39 PM
- Posted Re: Error when pushing bundle to shcluster. Error = "No target specified" on Splunk Enterprise. 01-11-2022 03:57 AM
- Karma Re: Error when pushing bundle to shcluster. Error = "No target specified" for isoutamo. 01-11-2022 03:57 AM
- Posted Splunk Ta install on single site cluster on Splunk Enterprise. 12-03-2021 01:40 PM
- Posted Validating if 100 nodes are on boarded in splunk indexes or not. If not ? on Splunk Search. 10-08-2021 04:45 AM
- Tagged Validating if 100 nodes are on boarded in splunk indexes or not. If not ? on Splunk Search. 10-08-2021 04:45 AM
- Posted Re: sample cisco log data with sourcetype= cisco_wsa_squid on Installation. 09-05-2021 06:39 AM
- Posted Re: sample cisco log data with sourcetype= cisco_wsa_squid on Installation. 09-01-2021 03:51 AM
- Posted sample cisco log data with sourcetype= cisco_wsa_squid on Installation. 08-31-2021 02:05 PM
- Tagged sample cisco log data with sourcetype= cisco_wsa_squid on Installation. 08-31-2021 02:05 PM
- Posted Splunk and Ldap cloned group Not seeing on Splunk Enterprise. 08-11-2021 03:01 AM
- Tagged Splunk and Ldap cloned group Not seeing on Splunk Enterprise. 08-11-2021 03:01 AM
- Posted UF on cloud servers to send log data to ON premise Splunk indexers on Getting Data In. 08-02-2021 10:39 AM
- Posted Agent version grouping by OS on Knowledge Management. 06-30-2021 06:41 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Thursday
Please help - my centos 8 server is show some inactive forwards to my indexer. [splunk@centos8 ~]$ /opt/splunkforwarder/bin/splunk list forward-server Active forwards: 10.0.0.42:9997 Configured but inactive forwards: 10.0.0.36:9997 10.0.0.45:9997 [splunk@centos8 ~]$ outputs.conf [tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = mysplunkindexer1:9997,mysplunkindexer2:9997
... View more
Labels
- Labels:
-
using Splunk Enterprise
Tuesday
We have some staging servers in the cloud and are turned down after business hours.
Is there any method in With the Deployment server to ignore and not report on the node as being missing ?
... View more
Labels
- Labels:
-
deployment server
02-21-2022
06:28 AM
I have a question on the Dev tutorial as I am unable to figure the behavior or is the output expected under the
DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery
All the words in “DESCRIPTION” are not delimited a by a white space , is the normal behavior ?
Module 1 of the Splunk>Dev tutorial
https://dev.splunk.com/enterprise/tutorials/module_getstarted/
Set up the sample data bundle
To get the Eventgen sample bundle and send it to the devtutorial index, do the following steps:
Go to https://github.com/splunk/eventgen/blob/develop/tests/sample_bundle.zip and click Download to download the Eventgen sample data file, sample_bundle.zip, to your computer.
DESCRIPTION
AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery
... View more
- Tags:
- json
Labels
- Labels:
-
Other
01-20-2022
01:39 PM
I searched around and trying to pin down options on sending Universal Forwarder logs to Splunk Cloud. Diagrams, likes and experiences deeply app preciated.
... View more
- Tags:
- Splunk Cloud
Labels
- Labels:
-
Other
01-11-2022
03:57 AM
After more research I use this string, in this case, I would run this string on SHC1 or SHC3 search heads. Not on the SHC2 server or the local server name you on. /opt/splunk/bin/splunk apply --answer-yes shcluster-bundle -target https://SHC2:8089 -auth admin:HolySmoke
... View more
12-03-2021
01:40 PM
I am looking for unstandable Splunk_TA_linux deployment on a single site instance: 1 deployer 3 clustered search heads 1 Cluster Master 3 clustered indexes 1 deployment server I searched and could not find install guide for this add on - I have found some but not deep enough to prevent a messy end. Help would be greatly appreciated.
... View more
10-08-2021
04:45 AM
I have this task were I am successful in getting result sets from nodes that are present in my splunk instance. How ever I can't find a way to announce in the spl syntax if the Name of the Node that doesn't exist with a Yes or no value in another field i.e. Node present Appserver No
... View more
- Tags:
- search
Labels
- Labels:
-
eval
09-05-2021
06:39 AM
I didn't find what I was looking for. However I found this website that offer datasets / logs https://www.kaggle.com/
... View more
09-01-2021
03:51 AM
Thanks for the tip. No I was actually looking for sample cisco logs to upload in my test splunk box, so I can run some SPL against it. can you help ?
... View more
08-31-2021
02:05 PM
Greetings: In search of Cisco sampling logs with the sourctype=cisco_wsa_squid to sharpen my spl . Can any one point me to a location of such log for download ?
... View more
- Tags:
- squid
Labels
- Labels:
-
search head
08-11-2021
03:01 AM
Greetings- We clone a working group in LDAP and expecting the cloned group to show in Splunk Ldap page with the new Ldap group name. LDap windows team has indicated that the cloned group looks all good. Is there a configuration to set so I can see the newly cloned LDAP group ?
... View more
- Tags:
- configuration
Labels
- Labels:
-
troubleshooting
08-02-2021
10:39 AM
Looking for a process if possible to send cloud server log data to ON Premise Splunk indexers. Searched but nothing solid SplunkCloudLogs - > internet -> On premise Splunk indexers
... View more
Labels
- Labels:
-
universal forwarder
06-30-2021
06:41 AM
I have many agent versions and each row is displayed as the different version... Like the query is telling it to do. I need help in the sense of would like to truncate evey period and digit to the single version digit. 6.3.0.0 6.2.1 7.3.3 7.21 To look like this: 6 7
... View more
- Tags:
- agent version
Labels
- Labels:
-
field extraction
06-30-2021
06:35 AM
I have been trying for 2 days to get the proper syntax for get the UF agent version along with the RHEL os_release to be displayed as a report. I can get each separately but not together .... Can anyone help ?
... View more
Labels
- Labels:
-
Other
05-24-2021
06:46 PM
I inherited a one SH and 2 indexers , 1 LM, one Deployment server supporting forwarders. I have too on board data and not sure if I have to go to each indexer to update indexes.conf and props.conf ? On the Deployment server I created APP , serverclass.conf and configured the UF with serverclass.conf I configured an current existing index in the inputs.conf that I distributed to the UF. The UF was installed as root and owned by root. so I believe i can elimination log file permissions on the UF It would be greatly appreciated if you share your knowledge and approach on managing NON - Clustered indexers please. 3 non clustered indexers I have
... View more
05-14-2021
12:30 PM
Greetings: I inherited a splunk instance. We use CyberArk to manage our passwords Web GUI and CLI. Here is my problem both passwords in CyberArk allow me successful login to both interfaces. For the CLI , I log in as the splunk user and run some commands and I am prompted for the username: admin password: XXXXX The passwords fail to log in. i.e. is the admin account managed somewhere else ,other than CyberArk ?
... View more
Labels
- Labels:
-
access control
-
audit
-
authentication
-
SSO
05-03-2021
11:14 AM
Greetings - I do have the TA for nix. I spend a couple of hours scouring all my resources and looking at the TA_nix where to insert or turn an entry for the OS type. On the linux side need to know if what vendor : centos/RHEL , version 6,7,8 . Any input would be appreciated.
... View more
Labels
- Labels:
-
Other
04-26-2021
11:25 AM
Thank you for providing that information , worked wonderfully for what I was looking for and more!
... View more
04-22-2021
07:20 AM
I am doing an inventory of all apps on my search head - but one I have noticed is not listed - I have thrown the kitchen sink at it . I go to all configurations as the TA UFMA - Unified Forwarder Monitoring and Alerting for Splunk, I also see it in the Apps drop down menu, and I see it in the Managed Apps page. Here is the syntax I am using - is there a better search string I should be using to pick on all TA and Add-ons ? | rest /services/apps/local | search disabled=* | table label version
... View more
- Tags:
- Technology Add ons
Labels
- Labels:
-
Other
02-27-2021
09:51 AM
I am interested in your solution - can you share ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
