About dionrivera

dionrivera

I already have the Salesforce add-on for Splunk. Does Salesforce have an email source that I can tap on to get those emails? Has anyone done it successfully?

richgalloway · ‎09-29-2023

This thread is over three years old, is not related to Dashboard Studio, and involves a user who is no longer on the forum. Please post a new question.

dionrivera · ‎05-04-2023

As it turns out. I was able to use rsyslog. Created a configuration file in /etc/rsyslogd and enabled the "imfile" module in /etc/rsyslog.conf.

woodcock · ‎04-12-2023

Any user that starts with "mike" would match.

isoutamo · ‎03-17-2023

One more place to check how to update and what you need to consider is https://lantern.splunk.com/Splunk_Platform/Product_Tips/Enterprise/Upgrading_Splunk_Enterprise

scelikok · ‎03-16-2023

Hi @dionrivera, My confusion is why only Security events are affected. The first thing to check should have been the "thruput" setting but since your system events were working alright we didn't consider that option. Anyway, very nice to hear it is resolved.

dionrivera · ‎03-02-2023

13 years later and this solution worked like a charm for me. Although, I wasn't able to use the props.conf file. Not sure if that's changed since this topic came up.

Tom_Lundie · ‎03-02-2023

Glad to hear it, you're welcome! Is there a gap within a specific source on the same host e.g. XmlWinEventLog:Security has a gap on a specific host? On the face of it, I can't imagine why a particular eventlog would have a large gap unless the machine has been switched off or that particular eventlog has been disabled. I would compare what you're seeing in Splunk with what you can see in Windows Event Viewer (particularly for the gap). Could it also be that one the eventlogs has got a large retention set and Splunk is catching up?

dionrivera · ‎02-01-2023

Correction: After building a second HF. You do need to configure receiving. Receiving will allow the HF to receive data from forwarding clients.

dionrivera · ‎01-11-2023

Thank you so much. I'll give this a try

dionrivera · ‎12-01-2022

Hello. I'm trying to identify a pool of windows hosts by adding an additional field to the events they forward. I can do this by adding an inputs.conf in /Splunk_home/etc/system/local and this works. My metadata field is called uf_deployment::remote_laptop(see below). [monitor://C:\Windows\System32\winevt\Logs\Application.evtx] index = my_index disabled = 0 sourcetype = XmlWinEventLog _meta = uf_deployment::remote_laptop However, the only way I can see how to do this is by monitoring a log file and using the [monitor] tag. But this presents a problem; I don't want to forward events from a log that I'm not interested in, nor do I want to duplicate events. I'm looking for a solution that will allow me to send the _meta = uf_deployment::remote_laptop field without having to "monitor" a log file. So far I have tried [default] with no success(see below) Any help is appreciated. Thank you. [default] index = my_index disabled = 0 sourcetype = XmlWinEventLog _meta = uf_deployment::remote_laptop

yuanliu · ‎11-08-2022

I suppose that you have set up the lookup with match_type CIDR; the lookup theoretically would give you lat-long. Suppose the three columns in mylookup are: cidr, lat, and long. (You should have specified these parameters in the question and not waiting for others to speculate, which can easily be off base.) Not sure what the real question is. Do you get error? Unexpected output? This will be your basic listing. Or are you asking for a specific report format? | lookup mylookup cidr AS Client_IP | table Client_IP lat long

gcusello · ‎11-06-2022

Hi @dionrivera, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉

chaker · ‎08-25-2022

Ahh ok. For on premise, you will need to follow the docs for rewnewing the certificates. It could be as simple as "If you have previously configured certificates for your infrastructure, the process can be as simple as updating the expiring or expired certificate with the new certificate and restarting the Splunk platform instance to recognize the certificate." https://docs.splunk.com/Documentation/Splunk/9.0.1/Security/RenewExistingCerts Also worth noting that Splunk support will assist here if you have a valid support agreement.

dionrivera · ‎08-13-2022

Thanks for following up on your solution. I need something similar and will try this first.

dionrivera · ‎07-21-2022

@Roy_9 As it turns out, the upgrade to CMC changed the timeframe it looks back to 7 days instead of 1 day which explains why my numbers were multiplied. I reached out to Splunk and they are working on changing the default timeframe to 1 day. Which makes sense because this is what teams use to gauge their daily ingest rate which goes against their licensing costs. To answer your question, I'm on cloud. Thank you for your suggestion. You are appreciated.

dionrivera · ‎05-23-2022

@tonygpe Curious. Did this work for you. Looking for a similar solution

dionrivera · ‎04-20-2022

@isoutamo As it turns out the hostname on my HF had changed which caused it to lose connection to my Deployment Server. When it lost connection the deploymentclient app was not pushed out to the HF so it did not know how to talk to Splunk cloud. I have re-deployed the correct app and now I'm connecting. Thank you.

dionrivera · ‎01-26-2022

FYI, adding the search and rtsearch capabilities to my role fixed this issue for me.

Posts	37
Solutions	3
Karma Given	38
Karma Received	3
Member Since	‎05-01-2015

Online Status	Offline
Date Last Visited	a month ago

How can I pull email data from Salesforce?

Can I collect Linux application logs with no UF in...

How to correlate a field from a query to a field f...

Upgrade path to upgrade Splunk Enterprise?

How to re-ingest data under a different sourcetype...

Why are we missing Windows "WinEventLog:Security...

Converting UTC to PST time on events?

How to add metadata to UF config files?

How can I build a report using my query of IP addr...

Monitoring log sources that go silent?

How can I pull email data from Salesforce?

Re: How to remove search button below the panel an...

Re: Can I collect Linux application logs with no U...

Re: Lookup usage question

Re: Upgrade path to upgrade Splunk Enterprise?

Re: Why are we missing Windows "WinEventLog:Secu...

Re: Trying to split the message text in a Windows ...

Re: How to re-ingest data under a different source...

Re: How to set up a heavy forwarder to forward dat...

Re: Converting UTC to PST time on events

How to add metadata to UF config files?

Re: Matching IP address to location using lookup f...

Re: Monitoring log sources that go silent?

Re: How to push my new certs to all my UFs?

Re: Universal Forwarder - Tag or add identifier to...

Re: Bogus Ingest volume displaying in CMC

Re: Identify computers not being used

Re: HF unable to forward events

Re: Could not create search message on dashboard p...