About dc17

dc17

Hi @VatsalJagani , I am not looking in any logs specifically because I need to create multiple Custom View and configure them with different Xpath queries. So I am looking on an approach to monitor with WinEventLog these CustomViews. In the photo an example of CustomView is "Test" folder. But in the path C:\Windows\System32\winevt\Logs I could not find any reference to this "Test" CustomView. To recap: "Test" CustomView works fine in the EventViewer and it is updated live with the execution of my query. It contains all the events I am interested (not important which one). However I could not find any path connected to it, where the logs are stored and ready to be collected by a Splunk WinEventLog monitor. Thanks,

dc17

Hi @VatsalJagani , Thanks for the reply, could you help me find the full path of the file/.evtx from the EventViewer? I could not find any reference from the EventViewer in my CustomViews of a full path where the Logs are stored. If I recollect this full path, I could perform some tests on the solution you kindly proposed to me, Thanks

dc17

Hello, I am trying to create a custom view (also via Xpath) from EventViewer and later insert it into Splunk via a "WinEventLog" and leveraging the Windows Addon. Can it be done using "WinEventLog" or some other way in inputs.conf as it is for Application/Security/System? [WinEventLog://MyCustomLog] As suggested here I tried this configuration but no logs were onboarded and it returned no error also in _internal logs. Has anyone found a custom solution for inserting these newly created custom views from the EventViewer to Splunk? Thanks

dc17 · ‎09-28-2023

Hi @isoutamo, thanks for your reply. I have seen the topics you've sent me. Unfortunately I noticed that these can not be applied to my case mainly because the errors are not on a custom Dashboard but on the Splunk Monitoring Console, so any modifications would be more complicated. It seems that my problem is strictly correlated to the folder "search_mrsparkle" that contains all the scripts giving me the error messages. This folder ended up to the path /opt/splunk/quarantined_files/share/splunk/ instead of its original path. Thanks,

dc17 · ‎09-22-2023

HI, I am trying to learn more about the certificates found within the document /etc/auth/appsCA.pem . I'm referring to Splunk's default certificates, Global Sign Root CA, Global Sign ECC, DigiCert Global Root, ISRG Root, IdenTrust Commercial Root. Are they safe? After changing the certificate configuration with my self-signed certificates and merging the CA Splunk certificates to make Splunkbase work properly ( This case here ), I wondered if they are all necessary for Splunk to work successfully or only some of them. Is there a documentation page or can someone explain the use of each of the certificates? Thanks in advance,

dc17 · ‎09-20-2023

Hi @willsy , I know this is an old topic but did you find any solution for this ? I have to send data in XML to a third party and maintain the data flow to Splunk indexers. It is possible to separate the "renderXML=true" command and "renderXML=false" in some way? Thank you,

dc17 · ‎09-01-2023

Hi, In some of the Dashboards of my Splunk Monitoring Console, it returns this error "A custom JavaScript error caused an issue loading your dashboard. See the developer console for more details" Error in Dashboard: The console in the developer details specifies a 404 Not Found Error on many scripts: The same error is issued for also other js like PopTart.js or Base.js. Searching for all these files in the Splunk folder I notice these scritpts are all stored in a folder called quarantined_files, an odd folder placed directly in the /opt/splunk/ path. Any ideas on how to debug this error?

Posts	7
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎09-01-2023

Online Status	Offline
Date Last Visited	2 weeks ago

Splunk onboarding Custom Views from EventViewer

Learning about certificates in appsCA.pem

Splunk Monitoring Console does not load all visual...

Re: Splunk onboarding Custom Views from EventViewe...

Re: Splunk onboarding Custom Views from EventViewe...

Splunk onboarding Custom Views from EventViewer

Re: Splunk Monitoring Console does not load all vi...

Learning about certificates in appsCA.pem

Re: winEventLogs and XmlWinEventLogs _TCP_ROUTING

Splunk Monitoring Console does not load all visual...