Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rajindurbal
rajindurbal
Path Finder
Member since:
02-12-2018
06-05-2020
Community Statistics
| Posts | 28 |
| Solutions | 4 |
| Karma Given | 16 |
| Karma Received | 18 |
| Member Since | 02-12-2018 |
Activity Feed
- Got Karma for Re: KV Store Process Terminated. 10-25-2021 12:38 PM
- Got Karma for Re: KV Store Process Terminated. 09-08-2021 04:15 AM
- Got Karma for Re: KV Store Process Terminated. 07-09-2021 05:01 AM
- Got Karma for Re: KV Store Process Terminated. 04-15-2021 02:01 PM
- Got Karma for Re: KV Store Process Terminated. 08-27-2020 01:56 PM
- Got Karma for Re: KV Store Process Terminated. 06-22-2020 06:37 AM
- Karma Re: Splunk version and Splunk Searching and Reporting App are are on different versions. for woodcock. 06-05-2020 12:50 AM
- Karma Re: Splunk version and Splunk Searching and Reporting App are are on different versions. for woodcock. 06-05-2020 12:50 AM
- Karma Re: SA-LDAP field extraction for richgalloway. 06-05-2020 12:50 AM
- Karma Missing or malformed messages.conf stanza for INSTALLED_FILES_INTEGRITY:FOUND_INTEGRITY_PROBLEMS__1_splunk.domain.com for dees74. 06-05-2020 12:50 AM
- Karma SEP 14.2 RU1 log format change for jtwind_2. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk version and Splunk Searching and Reporting App are are on different versions.. 06-05-2020 12:50 AM
- Karma Encountered the following error while trying to update: Splunkd daemon is not responding: (u"Error connecting to /servicesNS/nobody/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup: ('The read operation timed out',)",) for saicharankurri. 06-05-2020 12:49 AM
- Karma Re: How Do You Forward Data to Syslog Server and Indexers? for deepashri_123. 06-05-2020 12:49 AM
- Got Karma for Re: KV Store Process Terminated. 06-05-2020 12:49 AM
- Got Karma for Re: KV Store Process Terminated. 06-05-2020 12:49 AM
- Got Karma for Re: KV Store Process Terminated. 06-05-2020 12:49 AM
- Got Karma for Cannot access appserver directly with appServerPorts configured.. 06-05-2020 12:49 AM
- Got Karma for Re: KV Store Process Terminated. 06-05-2020 12:49 AM
- Got Karma for Re: KV Store Process Terminated. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 2 |
08-22-2019
05:36 PM
1 Karma
So the issue was that the /etc folder had been overwritten with the older configuration file. When the file was overwritten it showed that it was on 6.5. This also caused other issues such as the install from file option to disappear and the searching and reporting app to not load. When I found the /etc folder that was for version 7 and overwrote it, everything started running fine.
... View more
08-06-2019
04:03 PM
How to make ldap search data searchable in Splunk Enterprise. I was able to run the following search within the add-on but when I collect the data the fields are no longer extracted.
| ldapsearch domain=default search="(objectClass=user)"
| collect index=summary
Could you tell me what I need to do to make this work or if it is even possible without creating a table of every field.
... View more
07-26-2019
03:48 PM
A Heavy forwarder was upgraded a while ago and it is on version 7. However, the Searching and Reporting App is still on 6.5. Why would that be the case?
... View more
05-31-2019
12:33 PM
Good afternoon Daniel,
Yes you can. You can convert you custom made dashboard panels into prebuilt panels by clicking on the gear on the top right corner of the panel and click "Convert to Prebuilt Panel". Then on a different dashboard where you want to add the Panel,
Click Edit -> +Add Panel -> "Add Prebuilt Panel"
Then you will be able to find your panel in there that you created.
Please let me know if this helps.
Rajin
... View more
05-29-2019
11:17 PM
Good Evening @usdmag ,
Based on the information you provided, it sounds like you could convert the prebuilt panel to an inline panel. This will allow you to make the changes you want to the panel. Please let me know if this helps
Thanks,
Rajin
... View more
05-29-2019
11:05 PM
Good Evening @dzayas ,
I am not able to reproduce that error as well. Something you can do to fix that is:
index=fw
| stats count by description
| table description, count
Please let me know if that helps
... View more
05-29-2019
12:30 AM
An app that may be helpful to you is https://splunkbase.splunk.com/app/3067/#/overview
... View more
05-29-2019
12:15 AM
Good afternoon @shandman ,
The easiest way to do this is with tokens on your dashboard. I suggest using the text input from the input dropdown at the top of the dashboard editor.
This link may assist you with creating tokens:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/tokens
Rajin
... View more
05-28-2019
11:25 PM
Good Evening @mwoods2 ,
Can you tell us which firepower version you are using? You may need a different version of the add-on depending on the version you are running.
https://splunkbase.splunk.com/app/3662/
... View more
05-28-2019
11:13 PM
Good Evening Giuseppe,
On your linux system, you can try using grep in order to search for all instances of that folder path.
grep -r "/etc/apps/estreamer/logs" /.
After you find the file(s), you can edit them for a path you would prefer to use.
Rajin
... View more
05-28-2019
11:05 PM
Good Evening @sabaKhadivi
I think the easiest way to set up estreamer is to use the following add-on and app:
https://splunkbase.splunk.com/app/3662/ <-Cisco eStreamer eNcore Add-on for Splunk
https://splunkbase.splunk.com/app/3663/ <-Cisco Firepower eNcore App for Splunk
Also, following the guide in the following document:
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSplunkOperationsGuide_354.html
... View more
05-21-2019
07:42 PM
Something you can try that is similar is:
| stats list(city) as city, list(date) as date by name
... View more
01-25-2019
07:59 AM
12 Karma
So I worked with Splunk Support and what I had to do for this error was to:
Stop Splunk
rename the current mongo folder to old
Start Splunk
And you will see a new mongo folder created with all the components.
... View more
01-08-2019
07:05 PM
@kichojiran Thank you for the response. I tried removing it to see if that made a difference. All of the files in the folder are from the past 12 hours. It did not seem to fix the issue.
... View more
01-08-2019
06:26 PM
So I am monitoring a folder for all of the files in the folder on a splunk universal forwarder. In the SplunkUniversalforwarder/etc/system/local the config is:
[monitor://*.csv]
disabled = 0
index = abc
sourcetype = abc_sourcetype
ignoreOlderThan = 14d
So far I am only getting one file from the folder, when there are about 20. What do I need to do to fix this?
... View more
12-04-2018
09:40 AM
Hello @vr2312 ,
I am in an admin role. This data is coming in via syslog and coming in through an networking index which I am not sure where that is configured because I don't see it under the indexes.
... View more
12-03-2018
07:22 PM
I see the host IP 1.2.3.4 with 1000 events in the last 30 minutes. However, when I run the search, the search does not return any events. Why is this? Thank you for any assistance you may provide.
... View more
- Tags:
- splunk-enterprise
09-07-2018
05:39 PM
Can't tell you what the exact fix to this problem was, but after rebooting the whole server, this problem went away.
... View more
08-22-2018
06:35 PM
What I am trying to do is to get a particular source type forwarded from the heavy forwarder to a syslog server. In addition, I want the data to also go to my indexers. Is it possible to do this? What configuration would be needed?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
