About ques_splunk

ques_splunk · ‎09-05-2024

are there any working screenshots or demo available for this app? there seems to be no video tutorial or any guidance docs beside the main doc. Any guidance would be helpful - I am looking for a way to get JIRA->Splunk data in whenever there is a change in the issue or just able to query all the issues in JIRA via splunk and pull back stats

ques_splunk · ‎07-08-2024

Hello All, I am installing Alert manager Enterprise on a standalone on-prem server. I can it indexed in a existing index or should I be using another new index for config. Also what would be the HEC host field, will it be my url for the splunk instance and what would be the HEC port as well. In my understanding is that, alert manager takes splunk alerts and displays it, Im not sure why HEC is even used when setting this up? Thank you for all the help! #

ques_splunk · ‎07-06-2024

Also to ask this, all the indexes referred here in this doc, https://docs.splunk.com/Documentation/ES/7.3.2/Install/Indexes Under specific app, are these apps installed when I install ES, and also after installing SPlunk_TA_FORIndexers, will I have access to all this indexes listed above . How are the apps associated there installed on my all-in-one instance, are the apps above isntalled when I installed ES and the indexes are installed when i install the TA? This just has my head confused a bit, thank you for answering all this!

ques_splunk · ‎07-06-2024

Hello @PickleRick , Sorry forgot to answer your question, Yes, its all -in-one config for my splunk deployment on one machine

ques_splunk · ‎07-06-2024

Hello @gcusello , Yes I have one machine running the splunk server, not a complex deployment one search head. So from my understanding, just deploying the TA-ForIndexers will let me have index=notable, notable_summary and risk? I dont want to change any settings for the this TA, just a vanilla download. is there any video guide that shows this if there is it would be really helpful! Thank you again!

ques_splunk · ‎07-06-2024

I have one server with installation for it of splunk on it, Just to confirm @PickleRick , installing the Splunk_TA_forIndexers will have the those indexes installed? also any correlation search that has notable event action will be get indexed under index=notable? Am i getting this right? Thank you so much for all the help!

ques_splunk · ‎07-05-2024

Hello, I did the splunk ES installation following all the steps noted here - https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity i did all the steps and now when trying to find those index, even on the /opt/splunk/etc/apps/SplunkEnterpriseSecuritSuite/local or default and there is no indexes.conf, with in them I am trying to find index=notable, notable_summary, risk to see notable events from correlation search How am i supposed to get these indexes in apps inside ES, like shown here as well. https://docs.splunk.com/Documentation/ES/7.3.2/Install/Indexes Any help would be appreciated

Posts	7
Solutions	0
Karma Given	6
Karma Received	0
Member Since	‎07-05-2024

Online Status	Offline
Date Last Visited	‎09-06-2024 03:39 PM

Jira Service Management

Setting up alert manager enterprise

Enterprise Security installation - index=notable n...

Jira Service Management

Setting up alert manager enterprise

Re: Enterprise Security installation - index=notab...

Re: Enterprise Security installation - index=notab...

Re: Enterprise Security installation - index=notab...

Re: Enterprise Security installation - index=notab...

Enterprise Security installation - index=notable n...