Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About e82than
e82than
Communicator
Member since:
07-23-2010
06-05-2020
Community Statistics
| Posts | 45 |
| Solutions | 1 |
| Karma Given | 8 |
| Karma Received | 8 |
| Member Since | 07-23-2010 |
Activity Feed
- Karma Re: Changing the options available on manager for Drainy. 06-05-2020 12:46 AM
- Karma Re: Do I Need an Event Type For This? for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Main differences between a saved report and a saved search for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Simple eval + stats count by 2 fields not working for the_wolverine. 06-05-2020 12:46 AM
- Got Karma for Main differences between a saved report and a saved search. 06-05-2020 12:46 AM
- Got Karma for default.xml customization. 06-05-2020 12:46 AM
- Got Karma for Re: default.xml customization. 06-05-2020 12:46 AM
- Got Karma for Re: default.xml customization. 06-05-2020 12:46 AM
- Got Karma for Re: default.xml customization. 06-05-2020 12:46 AM
- Karma Is there a Solaris SMF manifest for Splunk? for pde. 06-05-2020 12:45 AM
- Karma Re: Is there a Solaris SMF manifest for Splunk? for djalton. 06-05-2020 12:45 AM
- Karma Re: Is there a Solaris SMF manifest for Splunk? for mikelanghorst. 06-05-2020 12:45 AM
- Karma Re: Manager view for power user does not list any options even if i have given the power user the necessary capabilities. for Genti. 06-05-2020 12:45 AM
- Got Karma for Re: splunk forwarder showing different events indexed than splunk indexer. 06-05-2020 12:45 AM
- Got Karma for Re: Is there a Solaris SMF manifest for Splunk?. 06-05-2020 12:45 AM
- Got Karma for Splunk insists that i schedule a saved search. 06-05-2020 12:45 AM
- Posted Re: syslog data sent across forwarders and multiple indexers on Getting Data In. 02-26-2013 06:33 PM
- Posted Re: syslog data sent across forwarders and multiple indexers on Getting Data In. 02-23-2013 02:16 AM
- Posted syslog data sent across forwarders and multiple indexers on Getting Data In. 02-21-2013 08:39 AM
- Tagged syslog data sent across forwarders and multiple indexers on Getting Data In. 02-21-2013 08:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
02-26-2013
06:33 PM
the 2nd (similar) setup is working when sending to splunk. but the 1st example is not transmitting. Multiple syslog data as in e.g network appliances which transmits only on UDP://514 or UDP only traffic streams.
... View more
02-23-2013
02:16 AM
Help please, if anyone know?
... View more
02-21-2013
08:39 AM
I tried to do this
Send syslog data from a network device (on port: 514) to a Universal Forwarder listening on port: 514 irrespective of (ANY) host's IP -> indexer listening on port 20980 -> to another Universal Forwarder listening 20981 -> to a Syslog-NG server listening for all audit data from splunk and syslog data.
the mode of travel goes like this
__Multiple syslog data_ > UF > Indexer > UF > Syslog-NG_
the data traverses over this many system as they are in different network zones with the final Syslog-NG server there being a Vendors' component. I have ensure that the Last Syslog server is receiving all my splunkd and other splunk's logs from all the components, but i cannot get the Multiple syslog data (on port:514) to send over to the final Syslog-NG server.
What do i have to do to troubleshoot it?
I've created a similar setup which vary slightly from the top to narrow down the problem.
Multiple syslog data (on port:514) -> Syslog Indexer -> UF -> Syslog-NG_
Do note that the last Syslog-NG server is the same as the one as the top. This setup apparently is sending out all the splunkd and other splunk logs out properly, on top of that the syslog data is going over correctly.
Can anyone please show me the way forward? I thank you in advance for your kind assistance.
... View more
01-13-2013
11:54 PM
I concur Lisa's suggestion. Using the forwarder will be useful when deploying in large enterprises. If you do not use scripted inputs, it will also allow business continuity. You can further use a deployment server, to manage it when you have too many forwarders to look at.
... View more
12-15-2012
01:32 AM
1 Karma
I wonder if there is any site in splunk Docs that clearly define the distinct differences between the two of them. I am having trouble deciding which one to use.
... View more
- Tags:
- search-time
12-13-2012
06:57 PM
martin I can't get internet access on that Linux VM box i'm using... Frustrating... I needed to vary from the standard dashboards that i am creating because they are in time frames longer than prescribed.
... View more
12-13-2012
08:00 AM
I am trying to build dashboard offline to count license usage. I can't bring the work in. I can only build it via remotely. The client isn't aware of what he would like to do with splunk other than checking out on the $$ it costs. I just want to be able to input data into this file in Splunk's convention and sourcetypes so i can build dashboards off it and then the user just have to copy and paste my Customized app for him to use. No need to worry about it not being able to work in a new setup if the 1st server fails.
... View more
12-12-2012
11:59 PM
I would like to ask how can I 'fake' or create input of fields with values for splunk's license_audit.log to consume. which source type to put to? Is there a tool to create such sample logs?
Has anyone done this act before?
... View more
11-27-2012
10:35 PM
Hi Drainey, Sorry for being thick here but how is it that Splunk can make webpages show without having any index.html. I"m not the best person to ask when it comes to web page creation and HTML. Would you give me some advice on this? Link me and i will read just like the Jquery you taught me. http://docs.jquery.com/Tutorials:How_jQuery_Works
I followed the demo it was powerful.
... View more
11-27-2012
12:47 AM
Hi sdaniels, I'm not trying to configure forwarders from UI or using a deployment server. I'm trying to make a change to the manager page in splunk. Something like if you have a webpage, you edit the index.html. so i need to know how to do it on splunk's index.html. or if you can give me a hint on where that lies.
... View more
11-20-2012
12:13 AM
Is there anyone who can help? Desparate here.
... View more
11-14-2012
07:30 PM
Is there anyone out there? Splunk support guys please give me a hint!
... View more
11-14-2012
01:01 AM
I am not sure if anyone has attempted this, but i would like to ask how to change the options shown in manager.
E.G. I am trying to add a simple link which will link me to the "configure forwarding" page within "forwarding and receiving" section.
Is there any resources on how we can change the options on a search head and do the needful?
... View more
05-18-2012
12:24 AM
there's an ip assignment app which you can't see outright. you can look for it under Edit . the app name is Virtual network editor, if you're using VMware workstation or server.
... View more
05-18-2012
12:14 AM
I think there is no field called Type=Error I looked up www.ultimatewindowssecurity.com. It doesn't seems to have a field by that name. Unless it is just a metaphor.
... View more
05-18-2012
12:03 AM
Ok, a more human way would be to hold ALT then click on the eventcode you do not want. Then save your searches.
Alternatively, if you're trying to lower the data indexed. You can perform selective indexing. e.g send events to nullqueue.
I did this before.
... View more
05-17-2012
11:52 PM
I have done it before. No stability issues seen from my end, even if there is it isn't from splunk. Usually the instability comes from the DB (too many things to process), google for ulimit.
http://www-01.ibm.com/support/docview.wss?uid=swg21469413
How i do my splunk monitoring agentlessly. Thru syslog. point the agent to the indexer via changing syslog.conf . I've done splunk for both solaris 10,11. Oracle DB and AIX 6.
... View more
05-17-2012
11:48 PM
if you're not in a production environment, try using the logger command. Do make sure you send it from the system intended so the event can be read correctly. It can be used to simulate syslog events. You can try and ask for permission to inject events to proof your search is right.
I had to do it sometimes to test connectivity between systems. Also when in dispute of searches not working.
... View more
05-11-2012
04:04 AM
Yeah, romantercero is right. It does not care how many index you have. It is only concerned about the volume of data that is going into splunk indexer.
... View more
05-08-2012
01:00 AM
You need to also look out for VLAN network issues. Sometimes Tivoli netcool is created on another segment, and splunk on another thus they can't talk to each other on syslog. I have bumped into this problem 2x and most of the time is a network configuration issue. and it was an agentless splunk forwarder setup.
... View more
04-12-2012
06:24 PM
Joshd, can you please help me on doing up the script to connect to the DB and dump out the contents of the sys.aud$ or send me a sample of yours, please? my email is e82than@hotmail.com.
... View more
04-04-2012
08:22 PM
jbsplunk: I quote this.
Maybe something at the first event is different? You could try something like this to start at the beginning of the line:
BREAK_ONLY_BEFORE = ^StartEvent \d\d
Missing slashes added for TS. The regex will fail if the syntactics is not called well.
... View more
02-01-2012
07:28 PM
I swear to god i did put the sourcetype on both instance to [bcoat_proxysg]
the fields come out but it did not show dashboard, it says the last para to me.
... View more
02-01-2012
09:05 AM
2012-01-31 "[31/Jan/2012:17:32:45 +0800]" 960 xx.xx.xxx.xxx 200 TCP_MISS 14751 466 GET http a3.sphotos.ak.fbcdn.net 80 /hphotos-ak-snc7/s320x320/409184_350399211645343_100000258xxxxxx_1347828_1830594287_n.jpg - Userid OCOME\Domain%20admin DIRECT a3.sphotos.ak.fbcdn.net image/jpeg "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)" OBSERVED "Social Networking" - 10.21.21.118 SG-HTTP-Service
hi folks, I'm not sure if anyone else has this problem. I cannot make out what this line is trying to tell me. all i know is that this is a log from a bluecoat proxysg device. I cannot fathom how did guys here develop for Bluecoat. It's cryptic and there isn't alot of resource on how it works.
I would be glad if anyone can send me a copy of bluecoat's configuration and management guide for SGOS 5.5x.
Also, can anyone tell me if the Bluecoat app works at all? I can only see the app's panel shows "no results found ... Inspect." I put my logs in Index:main and also tried to put it elsewhere, by creating one just for bluecoat but still i cannot make it work.
... View more
02-01-2012
12:00 AM
try to do this. I just bump into this problem too when i was using the app in your timezone. Bluecoat ProxySG devices sends out data as UTC. but when viewing you would want it to show your own time zone. I screw up a little when i was fixing it by typing UTC+08. Which will bring your data forward by 8 hours. Try my way and see if it will work. It should.
[bcoat_proxysg]
TZ = UTC
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
