About sowmy

sowmy · ‎05-07-2013

the re-edit hangs after "save edit", could u answer me about the same domain set up? should the splunk server machine and splunkforwarder all be under the same domain to send data ? should i configure splunk server machine ip and 9997 port on installation?

sowmy · ‎05-07-2013

Thanks, I just didnt figure out how to re-edit :), Thanks am trying now to reedit..

sowmy · ‎05-07-2013

@helge: I tried that too, can you please reply to my quesitons below?

sowmy · ‎05-07-2013

hi helge, Thanks for making things clear, I just want to revalidate my thoughts and have few questions: I understand Splunkforwarder collects the data and send to splunk server on another machine, that means both the machines have to necessarily be in the same domain? Am I correct? Tell if my understanding is right, I did following instructions- Machine in which splunk server is running : Goto Manager -> Forwarding and receiving -> Receive data -> Add new -> 9997 -> Save. Machine in which splunk forwarder/uberAgent is running: On installation of splunk forwarder - give the ip of the machine in which splunk server is running; should i give port as "9997" ? to send data at that port? Incase I have to reconfigure the ip/port on my splunk forawrder how do i do that? is the only option left out is uninstall and reinstall splunk forwarder? (i donot see any splunkforwarder web page like splunk server), if not what are the cmd line instructions to change the ip to which the splunk forwarder has to send data?

sowmy · ‎05-03-2013

i did all that, i dont see any data on search, also no errors in log, the TA is absolutely fine, just that the data does not flow to the UI app

sowmy · ‎05-03-2013

yes u are right i want to see it in the uberAgent splunk app..

sowmy · ‎05-03-2013

Hi, I just did the steps, but i still see no data when i goto SplunkWeb->Apps->uberAgent, i want my log data to be displayed here, right now the page says 0 sessions, 0 views and all the tables are empty, the steps listed by you, actually connects the data collected to splunk server as new source type, I want the uberAgent.log to be read by its UI counterpart (uberAgent under Splunkweb/apps)

sowmy · ‎05-03-2013

Hi, I have installed splunk server for windows in my machine successfully, i wanted to run uberAgent to capture desktop activities, I downloaded the uberAgent technology Add on and the UI app, successfully installed the uberAgent under Apps in my splunkweb, also installed the splunkforwarder and copied the uberAgentTA and see ranberAgent.exe in my taskmanager, the agent has started collecting the data into C:\Windows\Temp\uberAgent.log; Now, when i goto uberagent in the splunkweb, i donot see any log activities; how do i make the uberAgent.log data to be displayed in uberAgent app in the splunk web? Note: i have installed splunk/splunkforwarder/uberagent all in the same desktop machine, and in the splunkforwarder installation setup i gave the same machine ip to send the data.. am i missing something? please help me get this sorted out, since i need to do a little demo on how splunk collects/displays the desktop related data through uberAgent

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-03-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

uberAgent to collect desktop activity

Re: uberAgent to collect desktop activity

Re: uberAgent to collect desktop activity

Re: uberAgent to collect desktop activity

Re: uberAgent to collect desktop activity

Re: uberAgent to collect desktop activity

Re: uberAgent to collect desktop activity

Re: uberAgent to collect desktop activity

uberAgent to collect desktop activity

Join the Conversation