About Roy_9

Roy_9

Hello, I am looking to download Forwarder package windows ARM for Surface 7 laptops and not finding the link, please help me with it. Thanks

Roy_9

Yup @richgalloway , it worked now. I have set it to 1 and tested. Thanks

Roy_9

Hello, I have the below SPL where I am looking to fetch the user accounts that have not logged in for 30 days or more but I am not seeing any results, Can someone please help me with this query if everything is good. index=windows sourcetype=* EventCode=4624 | stats latest(_time) as lastLogon by Account_Name | eval days_since_last_logon = round((now() - lastLogon) / 86400, 0) | where days_since_last_logon > 30 | table Account_Name, days_since_last_logon Thanks in advance

Roy_9 · ‎12-31-2024

Hello, I have a report scheduled every week and the results are exported to pdf's. Is there an option to NOT email if no results are found because sometimes these PDF's have nothing in them. Thanks

Roy_9 · ‎12-16-2024

Hello, I have an issue where I was part of multiple roles on Splunk Enterprise and Splunk Enterprise Security, the same role and saml group has access to all the indexes, On the Splunk Enterprise i am part of 3 roles(A, B, C) which has search filters but I am already part of role D which has access to all indexes but when I am trying to search any data, I am not getting any data, But On Enterprise Security SH, I am able to view all the data as expected. Is it something like precedence issue on Splunk Enterprise SH that is causing the issue?Please help me. Thanks

Roy_9 · ‎08-21-2024

Hello, we are trying to see if os version (eg. RHEL6, UBUNTU 6.x) from splunk add-on for linux, we have enabled version.sh script and trying to see how to get this info, currently i am only getting os_name as linux, Is this possible to get additional info like RHEL, UBUNTU, please help me out. Thanks

Roy_9 · ‎08-21-2024

Hello, Can someone help me with splunk search to see whether IPV6 is enabled on target machines? Thanks

Roy_9 · ‎07-06-2024

Hello, Anyone has experience configuring Splunk DBconnect with informix database? Do we need to install the drivers explicitly for this to be configured? if yes, anyone has the link to it where i can download these drivers?I am using linux environment. Thanks in advance.

Roy_9 · ‎07-03-2024

Hello, Anyone has experience configuring Splunk DBconnect with informix database? Do we need to install the drivers explicitly for this to be configured? if yes, anyone has the link to it where i can download these drivers?I am using linux environment. Thanks in advance.

Roy_9 · ‎07-03-2024

Hello, Anyone has experience configuring Splunk DBconnect with informix database? Do we need to install the drivers explicitly for this to be configured? if yes, anyone has the link to it where i can download these drivers?I am using linux environment. Thanks in advance.

Roy_9 · ‎06-03-2024

@ITWhisperer we have splunk add-on windows deployed on all machines.

Roy_9 · ‎06-03-2024

Hi, can someone help me with splunk search to identify browsers installed on a machine, im looking for a specific field where i can capture this data. thanks

Roy_9 · ‎05-30-2024

Hi @gcusello there are logs for the windows onesettings service "This service offers to report telemetry data back to MS about OS health, build info, etc. in order to keep the computer "healthy" . We came accross this setting recently. The logs are written to "Microsoft\Windows\Privacy-Auditing\" and they are in Windows Event Log I am not sure whether these events can be tracked using Splunk add-on for windows, any thoughts on this? Thanks

Roy_9 · ‎05-29-2024

Hello, Does the below log paths of windows logs can be ingested into Splunk and if this is available in any add-on's? Microsoft\Windows\Privacy-Auditing\Operational EventLog Thanks

Roy_9 · ‎05-17-2024

yes @shocko i have manually set the executable permissions for the ones that are missing and it worked.

Roy_9 · ‎05-17-2024

Hello @VatsalJagani I have the lookup table file and definition where the permissions are set to app level and when i am running the search inside app, it is fetching results but when i am running it in the main search and reporting app i am getting the error this lookup table requires a .csv or kvstore lookup defintion, how do we need to fix this error any idea? Thanks

Roy_9 · ‎04-30-2024

@gcusello We are using git repo for any code changes and i have validated that the permissions are set to executable on the deployers, do you want me to push these once again?

Roy_9 · ‎04-30-2024

@woodcock Hi, i am getting the permissions errors where it the execute bit is nor getting replicated to shc even though they are set to executable on deployers. do you have any idea?

Roy_9 · ‎04-30-2024

Hi @gcusello This is happening for splunk add-on for nix and OS is linux in a clustered SH. I checked the permissions are set to executible in the code repository but those are not getting replicated to search heads.

Roy_9 · ‎04-23-2024

Hi, I am facing a executable permission issue for the few scripts for a splunk app and seeing these errors on various search heads, what is the best way to fix it? can someone help me with the script or a fix if you ever come across? thanks in advance.

Roy_9 · ‎04-23-2024

Is there any script or playbook that can help in adding executible permissions for particular scripts for nix app?

Roy_9 · ‎03-07-2024

Hello, Can someone help me with a search to find out whether any changes has been made to the splunk reports(ex:paloalto report) in last 30 days. thanks

Roy_9 · ‎03-06-2024

@richgalloway or @General_Talos How do we need to hide the app that is downloaded from Splunk base to be viewed by other customers through source control like Git? I see a file with default.meta where it says [] owner =admin access = read : [*], write : [ admin ] export = system Thanks

Roy_9 · ‎02-15-2024

Hello, Is there any way where we can know what are all applications are accessed by the user instead of just logon/log off activities from the winevent logs? Can someone help me with the search? Thanks

Roy_9 · ‎02-03-2024

@gcusello It came with splunk forwarder package. "C:\ProgramFiles\SplunkUniversalForwarder\bin\splunk-powershell.ps1 Thanks

Posts	363
Solutions	22
Karma Given	73
Karma Received	35
Member Since	‎08-05-2020

Online Status	Offline
Date Last Visited	2 weeks ago

Where can I download Universal Forwarder Package f...

Need help with SPL for windows logins

Splunk Report Delivery

Unable to Access on Splunk Enterprise

Need help with splunk add-on for linux

How to check whether IPV6 is enabled on machines i...

Splunk DBConnect with Informix

Splunk DBConnect with Informix

Splunk DBConnect with Informix

Splunk query to find browsers installed on a machi...

Where can I download Universal Forwarder Package f...

Re: Need help with SPL for windows logins

Need help with SPL for windows logins

Splunk Report Delivery

Unable to Access on Splunk Enterprise

Need help with splunk add-on for linux

How to check whether IPV6 is enabled on machines i...

Splunk DBConnect with Informix

Splunk DBConnect with Informix

Splunk DBConnect with Informix

Re: Splunk query to find browsers installed on a m...

Splunk query to find browsers installed on a machi...

Re: Splunk Add-on for windows

Splunk Add-on for windows

Re: Permission Issues when dealing with Splunk_TA_...

Re: Help needed with lookup error

Re: Permissions issue Executable for Splunk App

Re: Permission Issues when dealing with Splunk_TA_...

Re: Permissions issue Executable for Splunk App

Permissions issue Executable for Splunk App

Re: Permission Issues when dealing with Splunk_TA_...

Splunk query to find if any changes made to the re...

Re: How do I search for Technology Add-ons or hidd...

Need help with Windows user activity

Re: Splunk forwarder Powershell script is causing ...