About I29851

I29851 · ‎04-19-2022

Hello all In our environment some universal forwarders are not reporting to Splunk cloud. When I tried to view forwarder log file i.e. splunkd.log I found that for past one week no log was present in the file. What maybe the reason? Is it related to forwarder not sending logs to Splunk index? Thank you

I29851 · ‎03-22-2022

Hello all I have installed universal forwarder on Databases and now want to create a weekly report which covers database operations, for example table deletion, database modifications etc. Do I need to install any app? Currently forwarders are configured only to collect windows events. Regards

I29851 · ‎02-15-2022

Hello all, In our company I need to create a daily email notification for Remote logn Disabled account Event Log Stopped or Cleared Search Account Lockout Please suggest which windows event correspond to above alerts. From my reading I think 4624, 4725, 1102, 4740 are the windows event IDs that I need to monitor but not sure. Thank you

I29851 · ‎02-04-2022

Hell all, In my organzation we are trying to collect logs from all Laptop/Desktop into Splunk. I read somewhere that we can use logs collected from AV agents instead of installing universal forwarders. I We have CrowdStrike agents on all our endpoint devices. s this right method? If so, what is the use cases where we may have to install UF on endpoint devices. Thank you

I29851 · ‎01-24-2022

Hello all, One of the certificates associated with our universal forwarders is due to expire this week. While we have renewed the certificate, we are yet to push it on all universal forwarders. My question is: if we are unable to push new certificate by weekend will the universal forwarders stop logging the data and sharing it with indexes? Thank you

I29851 · ‎11-30-2021

Hi Last week one of our vulnerability scan found out that our universal forwarders were suspectable to TLS CRIME vulnerability. To fix this vulnerability we updated our server configuration file (toggled allowSslCompression from True to False). Now we want to update server configuration file on all the servers but we found that server configuration is system specific and we can’t just replace it on every server. We are not using deployment server in our environment. Is there any other way wherein we can go and append server config file? Thank you

I29851 · ‎11-18-2021

Hi In our organisation we are in the process of implementing Splunk and there are some domains which do not have access to internet. For these domains can we use proxy server? It seems that preferred way is to use heavy forwarder but I am curious to know if proxy server can be used. What are the advantages/disadvantages of using proxy server? Thank you

I29851 · ‎10-26-2021

In my organization we are planning to install heavy forwarders for some domains. What are the hardware requirements for heavy forwarders? What is the ratio of servers to heavy forwarder?

I29851 · ‎10-20-2021

I trying to implement Splunk across multiple domains. Due to company policy some domains don't have access to internet and as a result servers in those domain cannot communicate with indexers located in Splunk cloud. What is the best way to send data to indexer in this case? One of the suggestions we received is to use heavy forwarder as intermediate. But it will introduce single point of failure so we might need to implement load balancer. Is their any other way possible?

I29851 · ‎12-30-2020

Hi Recently I installed Splunk App for AWS. How to export AWS device Inventory list from Splunk App

Posts	10
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎12-30-2020

Online Status	Offline
Date Last Visited	‎04-19-2022 11:44 AM

Why are Forwarder logs not generated?

How to create a weekly report which covers databas...

How to create an email notification for Event Iden...

Splunk deployment on Laptop/Desktop

Certificate upgrade on universal forwarders

Deployment of configuration files

Can we use proxy server for some domains?

Heavy forwarder Requirements

How to send logs from devices that don't have acce...

Export of device list from Splunk App for AWS