About sh_tavousi

sh_tavousi

Hi, I got an error while i want to get logs from Kaspersky Console. I`ve done all the tasks to add it such as port,IP , .... index="kcs" Type=Error Message="Cannot start sending events to the SIEM system. Functionality in limited mode. Area: System Management."

sh_tavousi · ‎05-12-2021

Hi, I want to know how I can see what SQL queries are used on every table of my SQL databases. I mean, I want to monitor queries and users who write those queries. Thanks.

sh_tavousi · ‎05-10-2021

Hi, I want to know how I can detect if someone alter data in my databases in SQL Server. Also can I do it with DB Connect App. Thanks.

sh_tavousi · ‎05-08-2021

Hi, If we set our 2 indexers in outputs.conf of UFs ,according to the link you sent, UFs send logs to one of them until EOF. Therefore one of our indexers receives logs and by replication, logs will replicate between them. Is it true? As We have 2 indexers and they are clustered I want to know if replication between them is done properly. Thanks.

sh_tavousi · ‎05-08-2021

Hi, Thank you so much. Shohre

sh_tavousi · ‎05-08-2021

Hi, I have 2 indexers and I have set them in outputs.conf but my logs are indexed in one of them. I guess load balancing doesn`t work well. I want to know how I can know if load balancing works well as one of my indexers is going full but another is not. We have 2 clustered indexers. Thanks.

sh_tavousi · ‎05-03-2021

Hi, We have installed Eset security antivirus on our splunk server and we have many problems as when we disable antivirus everything is well. I want to know if antiviruses have any effect on performance of servers. Thanks,

sh_tavousi · ‎05-03-2021

Hi, Is there any way to backup/export regex saved in extracted fields as we want to use new instance as a search head and we don`t want to lose our regex saved in extracted fields. Thanks.

sh_tavousi · ‎04-12-2021

Hi, I want to know how we can change address of indexers for universal forwarders from deployment server as we have many UFs. Is there any way to change inputs.conf of UFs instead of changing one by one. Thanks, Shohre

sh_tavousi · ‎04-06-2021

Hi, I have 2 servers with the same names and I have installed universal forwarder on both servers. In forwarder management I have an issue that sometimes I can see one server another time I can see the other one. How Can I solve this problem to see both of them ? Can I change name of one of the hosts before sending logs to indexers? Thanks, Shohre

sh_tavousi · ‎03-08-2021

Hi, I have an issue in Forwarder Management, it says there errors in installing a specific app on some clients however for others the app has been installed without errors. I uninstalled the app but errors still exist. What should I do? Thanks

sh_tavousi · ‎03-07-2021

Hi, I have installed stream TA on windows. What should I do? Thanks.

sh_tavousi · ‎03-07-2021

Hi, I'm having issue to deploy stream forwarder to UFs by Deployment Server. I have installed stream TA in deployment app but it doesn't work and I can't see forwarders in stream forwarder. In inputs.conf I set splunk_stream_app_location with address of my stream app and also I have stream logs from my stream APP but it doesn't work on UFs. Can anybody help me with this problem? Thanks.

sh_tavousi · ‎02-20-2021

Hi Giuseppe, Yes, logs recognized and not recognized are in the same language. Sourcetype is note the same in both logs. In extracted logs sourcetype=wineventlog but in not recognized logs sourcetype=xmlwineventlog. Shohre.

sh_tavousi · ‎02-16-2021

Hi Yes, I installed Splunk_TA_windows on Forwarders and on Search Heads. In WinEventLog :security and WinEventLog:system, all fields are not extracted like Event Code, Event ID, Account Name and ... . However other hosts do not have any problems and I have all field extracted. I do not run searches in Verbose Mode. My search is " index=main source=WinEventLog :security" and then results in some hosts are not extracted. Shohre

sh_tavousi · ‎02-12-2021

Hi When I search source="wineventlog:security" or "wineventlog:system" in some hosts in search head, results are not extracted. They are raw but others are extracted properly. I have installed UF on hosts and also I have used Splunk_TA_Windows. I've looked at a lot of conf files and no luck as of yet. Shohre

sh_tavousi · ‎02-11-2021

In some instances, Windows event log fields are not extracted properly but in others they are extracted properly.

sh_tavousi · ‎02-08-2021

I want to know where should we install "SolarWinds Add-on Splunk", I mean on deployment server, search head or indexers? Also I want to know if this Add-on can get logs like when they are sent from syslog server.

Posts	19
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎02-07-2021

Online Status	Offline
Date Last Visited	2 weeks ago

Problem in getting logs from Kaspersky

See SQL queries on Splunk

Detecting alteration in SQL DB by splunk

Load Balancing in UF doesn`t work

Antivirus on Splunk Server

backup/export regex saved in extracted field

Changing address of indexers for universal forward...

2 host with the same names

Deployment Error for some clients

deploying stream forwarder to universal forwarders...

Problem in getting logs from Kaspersky

See SQL queries on Splunk

Detecting alteration in SQL DB by splunk

Re: Load Balancing in UF doesn`t work

Re: 2 host with the same names

Load Balancing in UF doesn`t work

Antivirus on Splunk Server

backup/export regex saved in extracted field

Changing address of indexers for universal forward...

2 host with the same names

Deployment Error for some clients

Re: deploying stream forwarder to universal forwar...

deploying stream forwarder to universal forwarders...

Re: Windows event log fields are not extracted pro...

Re: Windows event log fields are not extracted pro...

Re: Windows event log fields are not extracted pro...

Windows event log fields are not extracted properl...

SolarWinds Add-on for Splunk