About jmcclure

jmcclure · ‎01-25-2019

I can send a subset of windows data as syslog server by sourcetype and then use the TransFroms to REGEX out the host. None of this works though if Splunk puts a timestamp server header on each syslog message. I have tried the syslogSourceType = sourcetype::WinEventLog:Security, but this doesn't work. Am I missing anything?

jmcclure · ‎01-15-2019

The Peers keep showing up as BatchAdding....they stabilize and then go back....

jmcclure · ‎06-18-2018

Splunk bucket mover is taking over 4 minutes for a bucket to move from hot to cold. Now my hot storage volume is starting to fill

jmcclure · ‎05-01-2018

I have an issue where my hostnames coming in (mostly from Windows) are full domain name and some are the alias hostname vs hostname.domain.com I have lookups that I need to have just the alias. How can I get Splunk to give me just the alias. Am I going to have to go through the Windows TA and fix all the regexes?

jmcclure · ‎04-23-2018

I need to forward UF data from windows/Linux Universal Forwarders to a syslog server for a thrid party vendor. I was told that the Heavy Forwarder could split the Splunk stream and forward UF data to a Syslog Server.

jmcclure · ‎04-04-2018

Will that work with CSV lookups or jsut KSV? I'm diong a pull from Active Directory, dropping it into a CSV file and then creating lookups

jmcclure · ‎04-04-2018

What is a work around for case sensitive automatic lookups? I am trying to build out an automatic lookup for users and the users are all different types of capitilization. I am doing a pull from ldap dropping it into a CSV and then having a custom Splunk command execute a python script that that duplicates every row with different user capitilization. BUT I still am having issues with one offs... I know caculated fields could work BUT they are after lookups in searchtime calculations

jmcclure · ‎03-21-2018

Was able to find the issue...you have to update the commands.conf file for passAuth=true

jmcclure · ‎03-21-2018

I am running the sendresults app, which is a python script that uses the Splunk email abilities to email individual users from results. It was working fine and then today I noticed the emails were not going out. When I ran the report manually, I was getting this error command="sendresults", Error : Traceback: Traceback (most recent call last): File "/opt/splunk/etc/apps/operational/bin/sendresults.py", line 183, in getEmailAlertActions(argvals, settings) File "/opt/splunk/etc/apps/operational/bin/sendresults.py", line 49, in getEmailAlertActions sessionKey = settings['sessionKey'] KeyError: 'sessionKey' Anyone run into this before?

Posts	9
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎03-21-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Send Windows Logs to thrid party without Splunk ad...

Splunk Cluster keeps showing Peers as BatchAdding

Bucket mover taking a long time

Dealing with hostnames difference and Lookups in S...

SPlunk forwarding UF data at the Heavy Forward to ...

Splunk Automatic Lookups and Capitlization

Splunk Can't find SessionKey