About DaveSavage

DaveSavage · ‎03-09-2013

Abhayneilam - sorry - have been out of the loop on 'real' work (lol). As Drainy says, post your xml here and peeps can do some deeper rooted analysis for you.. Br D

DaveSavage · ‎02-09-2013

The plug-in Splunk-on-Splunk SOS has this pre-built for you, which might save you some work. The option is available from the splash page, the last of the searches on the right hand side. It queries $SPLUNK_HOME/var/log/splunk/license_usage.log. The option to search 'all time' is supported. Good luck! 😉

DaveSavage · ‎02-08-2013

Take a look at 'Splunk on Splunk' as a plug-in. It's a great tool. This extends the standard (which I assume you've already seen) stats in the Search > Status > Search Activity info. SoS shows you the issues whether disk related, paging and memory. Good luck 😉

DaveSavage · ‎02-06-2013

Others have asked this question before. See Splunkbase: http://splunk-base.splunk.com/answers/10135/reduce-an-index-size

DaveSavage · ‎02-06-2013

Just thinking. You seem to have covered or checked the right areas. I don't know your experience level, but the inputs.conf data is correct? If you want to check that then post it here. Did you restart Splunk? 😉 If all of the above are ok, then take a look at the event data coming through from the native Search end.

DaveSavage · ‎02-06-2013

Is it throwing you an error (and what is that), or are you seeing 'no results found'?

DaveSavage · ‎02-06-2013

;-))...it happens to us all. Good luck with the MySQL DB Connect - its a neat start point and opens a LOT of doors as to where you can go with the data.

DaveSavage · ‎02-06-2013

By the way - did you restart the app or server on which the database is placed, or is used by? Assuming that is feasible and reasonable to do so, of course 😉

DaveSavage · ‎02-06-2013

That sounds to be correct. The Java DBC needs to be installed (placed) and you also need the JRE - in fact I found the fuller version to work better. You need to restart Splunk as well. Go into the dashboard and see if the 'green light' is on next to the bridge. Do you have the installation notes? They are very good. Jar files are compacted / a type of zip files. You will need to unpack it.

DaveSavage · ‎02-06-2013

Yes it is a full instance. In that context. Splunk release the full package. It will give you 30 days on the license then you need to either allow it to roll over to a free license (which doesn't have certain functionality such as user credentials and a few other bits - all of which is documented), or buy an enterprise license. You can add plug-ins such as Hadoop, as you indicate. There isn't a Hadoop Spunk version if that is what you mean. It's a Splunk instance to which the Hadoop plug-in has been installed.

DaveSavage · ‎02-01-2013

I didn't see M/soft access in the supported list BUT the plug-in is v flexible...providing the custom properties are considered, and ODBC / JDBC has been placed in the $SPLUNK_HOME/etc/apps/dbx/bin/lib. Sounds 'physical' with the path error...

DaveSavage · ‎02-01-2013

Have you talked to anybody at Splunk about this? There seems to be some traffic here in the Splunkbase concerning limitations. See these links: http://splunk-base.splunk.com/answers/67071/new-pdf-generation-limitations http://splunk-base.splunk.com/answers/68250/splunk-5-and-new-pdf-built-in-feature Drainy outlines a work-around for advanced xml dashboards in the 2nd link.

DaveSavage · ‎02-01-2013

When you say 'log in' you are trying to connect to it through the GUI? It doesn't support that. You can access it via the CLI and there is a rich thread on the commands at http://docs.splunk.com/Documentation/Splunk/latest/Admin/CLIadmincommands (thanks Drainy 😉

DaveSavage · ‎01-31-2013

I don't think you will find that Splunk can tell you that, at least not directly. It is interesting though! You can lock your systems down of course, and log / see if a person SU's up to root but ideally they shouldn't have root access as it totals your change control and protection of the systems. If you use a 3rd party product for asset discovery (software type) and that logs information then you can bring it back into Splunk as the point of control. Solaris has pkginfo for example.

DaveSavage · ‎01-30-2013

Saw this - hope its useful: http://splunk-base.splunk.com/answers/8688/monitoring-novell-edirectory-events-with-splunk br D

DaveSavage · ‎01-30-2013

If there is an active firewall in place of any type then it would need to be configured to allow your TCP or UDP traffic through it for the respective ports. If it isn't enabled, then there are no such constraints. Splunk doesn't care...as in your forwarders will attempt to send regardless. Splunk doesn't 'know' about your firewalls unless they are being log monitored as well by an app.

DaveSavage · ‎01-29-2013

Interesting. I am under the impression iro your Q that restart does pretty much as you expected in the 2nd para, stopping the services first...and that the restart element kicks everything off WITH due consideration now to apply any mods just made in the configs files. Any messing with them may alter your stability state, but amending user privileges shouldn't figure in that... Did you do anything else?! 😉

DaveSavage · ‎01-29-2013

Well points to you for diving in with Splunk AND Snort all in 1 go plus the comprehensive data provided! 😉 Just clarify please...2 searches, 2 fields (understood) of which you want only 1 of those - based on what criteria? End result is that you wish to see session times per connection between source and destination?

DaveSavage · ‎01-29-2013

I should add - xml with the tag data makes it eminently usable within Splunk, so less issues in respect of field identification even if you have to use regexes.

DaveSavage · ‎01-29-2013

Stefan, I haven't seen specific .net plug-ins (though clearly there is a potential following ;-), but Splunk will index your logs ok. Search xml in the splunk base for more. The following shows a few tweeks you may need to consider within the inputs. conf and props files using whitelists. I'd be interested to see how it went...let us know. Br D http://splunk-base.splunk.com/answers/7275/index-xml-log-files

DaveSavage · ‎01-29-2013

Thanks Ayn, I didn't know it could do that! Very useful for a certain application / usage that we have. Ta.

DaveSavage · ‎01-29-2013

You may consider looking at the other end, albeit this doesn't strictly address your request - but to check the visibility of the host at the indexer confirms the forwarder is working AND gives you opportunity to check the data stream plus the rate of indexing. All that completes the job, as opposed to checking at the send end ? If you have network access you would also see the traffic - worthwhile in case sure, it's sending but with no result i.e. you have firewall issues.

DaveSavage · ‎01-28-2013

Nicee..like that

DaveSavage · ‎01-28-2013

Understood. Yannk did the business below 😉

DaveSavage · ‎01-28-2013

If sshd appears in the event and the rmclomv text is distinct in your events then you can separate out the results in the search criteria. Even if you need to show the 2 in the same report, you can sum as separate totals. Other than that yes of course you can regex them out as say different source types, but it hardly seems to be worth it. Keep it simple? 😉

Posts	163
Solutions	5
Karma Given	52
Karma Received	51
Member Since	‎01-28-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Consistent error 500's on File and Directory new d...

Splunk v5 Forwarder

Re: Problem in generation the pdf file through spl...

Re: license information

Re: Detecting expensive searches in enterprise env...

Re: changing the size of an index

Re: splunk for juniper srx

Re: splunk for juniper srx

Re: Splunk DB Connect

Re: Splunk DB Connect

Re: Splunk DB Connect

Re: Splunk Instance

Re: DBX Connection to Microsoft Access

Re: Problem in generation the pdf file through spl...

Re: Cannot Login to Forwarder

Re: Splunk for unix

Re: eDirectory events

Re: If my windows firewall service is Stopped - wi...

Re: Restarting Splunk

Re: Snort log time calculation for RDP connect / d...

Re: Splunk support for XML log files written by Sy...

Re: Splunk support for XML log files written by Sy...

Re: Data Obfuscation at search time

Re: connectivity between forwarder and deployment ...

Re: Extracting usernames from Solaris 9 syslog

Re: Extracting usernames from Solaris 9 syslog

Re: Extracting usernames from Solaris 9 syslog