Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About joeldavideng
joeldavideng
Path Finder
Member since:
08-22-2017
10-04-2021
Community Statistics
| Posts | 38 |
| Solutions | 4 |
| Karma Given | 8 |
| Karma Received | 6 |
| Member Since | 08-22-2017 |
Activity Feed
- Karma Re: Disable THP in AWS (Linux AMI) for jtrujillo. 09-27-2021 07:19 AM
- Posted Is anyone running Splunk in AWS ECS Fargate? on Deployment Architecture. 08-23-2021 06:28 PM
- Posted Smart Store Producing a High Volume of 204 and 404 Errors on Getting Data In. 10-23-2020 07:21 AM
- Karma Re: Splunk App for AWS: Will my index cluster die if I triple the cold retention period? for wyfwa4. 06-05-2020 12:50 AM
- Karma Re: Is there a way to propagate dbquery result to all search heads? for starcher. 06-05-2020 12:49 AM
- Karma Re: How to match values within a multi-value column for andre_tucker. 06-05-2020 12:49 AM
- Karma Re: what is different between add on for AWS and Amazon Kinesis Firehose for ssadanala1. 06-05-2020 12:49 AM
- Got Karma for How do I reduce the number of Windows 4688 events generated by Splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: How do I reduce the number of Windows 4688 events generated by Splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: Search to compare deposits versus withdrawals in a specific time period. 06-05-2020 12:49 AM
- Got Karma for Re: Calculated Data Model Field Value Inaccessible. 06-05-2020 12:49 AM
- Got Karma for Can you hide the Splunk Forwarder service to combat exploit kit modules?. 06-05-2020 12:49 AM
- Got Karma for Can you hide the Splunk Forwarder service to combat exploit kit modules?. 06-05-2020 12:49 AM
- Karma What is the data model acceleration default cron schedule? for the_wolverine. 06-05-2020 12:47 AM
- Karma Re: What is the data model acceleration default cron schedule? for MuS. 06-05-2020 12:47 AM
- Karma Import non native python libraries into Splunk for wweiland. 06-05-2020 12:47 AM
- Posted How to Capture Kubernetes Interactive Exec Logging on All Apps and Add-ons. 05-22-2020 08:13 AM
- Posted Has anyone run into certificate validation issues with the Workday Add-On? on All Apps and Add-ons. 04-17-2020 08:37 AM
- Posted Re: What will go wrong replicating smart store S3 buckets across AWS regions on Knowledge Management. 02-29-2020 06:58 AM
- Posted What will go wrong replicating smart store S3 buckets across AWS regions on Knowledge Management. 02-28-2020 01:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
10-10-2021
07:11 PM
to resolve similar kind of error, I had to append my public root and intermediate certificates to the end of cacert.pem in TA-workday/bin/ta_workday/aob_py3/certifi/cacert.pem and TA-workday/bin/ta_workday/aob_py2/certifi/cacert.pem
... View more
08-23-2021
06:28 PM
I was wondering if anyone has successfully deployed a clustered instance of Splunk enterprise on AWS ECS Fargate. I'm looking to get rid of server management altogether for my cluster without having to go to Splunk Cloud. I read through a Splunk blog post on deploying a single instance to Fargate, but it didn't really cover things like dealing with Smart Store or the high memory requirements for indexers and search heads. If anyone has experience with this, I'd much appreciate the lessons learned.
... View more
Labels
- Labels:
-
distributed search
04-27-2021
07:01 AM
Excellent insights. To add to original question, I am getting ready to turn on SmartStore on my IDX Cluster as part of a SplunkCloud Migration. What could go wrong and is there any backing out if problems develop? We are using Splunk PS and a migration app.
... View more
10-23-2020
07:21 AM
I recently started moving some of my indexes to Smart Store using AWS S3. I've noticed a lot of HTTP 204 and 404 errors in the Cache Manager when it tries to copy data from the local cache to the remote store. Strangely enough, the data seems to all be in the remote store and I'm not having any issues searching, but the number of errors is troubling. Does anyone know if the Cache Manager just normally misses write attempts and retries them until it succeeds?
... View more
Labels
- Labels:
-
indexer
05-22-2020
08:13 AM
I am using Splunk Connect for Kubernetes on EKS which seems to capture most logs right out of the box. What it doesn't capture are interactive commands run from within containers. For example, if I "exec" into a container and run commands, none of that seems to be logged. Has anyone configured that level of auditing before or am I missing something in the default set up that should be capturing that?
... View more
07-02-2019
01:05 PM
The search "Threat - Source and Destination Matches - Threat Gen" is working and producing results, only the results aren't ending up in the threat_activity index where I would expect them to be. Does anyone know the dependencies I should be checking to ensure those events eventually end up in the Threat Activity dashboard?
... View more
05-28-2019
03:36 PM
I think this does answer my question. The long term searches wouldn't be interactive and would be performed in the middle of the night once a month so I don't think the searches themselves would hose the index cluster.
My main concern was what would happen when Splunk rolls the data from hot/warm to cold since there would now be a much larger disk to search for open space. Based on your answer it doesn't sound like that would necessarily be the main factor to worry about.
I think I will try increasing the disk space and then increase the retention a month at a time to see if it becomes noticeable during the day.
Thanks.
... View more
01-25-2019
09:17 AM
Oh brother, I opened a support case days ago and headed here when they came up dry.
... View more
08-28-2018
02:16 PM
2 Karma
I recently ran across some exploit kit modules designed to stymie incident responders by attacking endpoint security agents (Splunk included) and wanted to know if I could hide the Splunk service on my endpoints. The modules do simple string searches for service names so renaming the Splunk Forwarder service to something innocuous would do the trick. Does anyone know how to do this on Windows and Linux hosts without breaking Splunk?
... View more
08-15-2018
04:49 PM
Straight from the horse's mouth. Thanks Starcher.
... View more
05-28-2018
05:51 AM
As it turns out, the answer is yes, Stream does in fact report DNS query events backwards. Each DNS record comes with two times; "timestamp", the start of the DNS session and "endtime", the end of the session. The default props.conf sets _time to "endtime", which produces the appearance of the backwards DNS events.
For example, if a workstation makes a DNS request through an internal DNS server who then passes the request to an external server you would expect to see
Workstation => Internal DNS
Internal DNS => External DNS
Internal DNS => External Authoritative DNS
However, since the workstation technically has the longest time to wait for its session to complete it will appear as
1. Internal DNS => External Authoritative DNS
2. Internal DNS => External DNS
3. Workstation => Internal DNS
... View more
02-20-2018
10:30 AM
This app is fire. Thanks a lot!
... View more
02-13-2018
01:42 PM
The Splunk Stream forwarders on my two primary DNS servers are failing every couple of hours for a TCP reassembly queue overflow. I tried doubling the queue size and filtering out all internal DNS traffic, but the agents still shutdown daily. Has anyone dealt with this before and know what settings to tweak?
... View more
02-13-2018
01:35 PM
In the absence of any guidance I just doubled the count to 1 million. I can't say this solved my problem, but it the agents didn't complain.
... View more
01-31-2019
03:30 PM
What most people do is create a summary index and then use a populating search to create aggregate events based on MID values and then use those events.
... View more
12-27-2017
05:58 AM
Sure thing, it was very close to the original.
| datamodel Process_Monitoring Process_Creation search | eval threshold = [ | search index=summary "search_name=pm_command_line_length_stats" earliest=-90d@d latest=-1d@d | stats avg(command_line_length) AS command_line_average stdev(command_line_length) AS command_line_stdev | eval threshold = round(command_line_average + ( command_line_stdev * 6 )) | return $threshold ] | where $Process_Creation.command_line_length$ > threshold
... View more
02-12-2018
06:01 AM
What do each of these stanzas mean?
... View more
10-15-2017
04:06 PM
Thanks for the quick turnaround on the help. I wasn't able to get the first method working, I'm not sure if that was meant to be a sub-search or something, but the second method of using an mvfilter worked like a charm.
... View more
09-26-2017
11:42 AM
@joeldavideng - Happy to oblige.
If your question is answered, then please accept the solution so others will know it has been solved.
... View more
08-22-2017
04:38 PM
I can't believe this is going to be on the internet forever.
The Debian install package adds the user splunk in Linux to the group splunk, but doesn't add it to the Splunk application admin group. Simply doing a "splunk add user splunk -password password splunk -role admin -auth admin:password" fixed the issue.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-04-2021
06:32 PM
|
Karma from
Karma given to
