Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Lwoods
Lwoods
Path Finder
Member since:
02-16-2023
08-31-2023
Community Statistics
| Posts | 24 |
| Solutions | 0 |
| Karma Given | 20 |
| Karma Received | 0 |
| Member Since | 02-16-2023 |
Activity Feed
- Posted Why is San server not sending logs to syslog? on Getting Data In. 08-30-2023 06:20 AM
- Karma Re: Add-on for Cisco Webex video conference for meetmshah. 07-21-2023 07:27 AM
- Karma Re: Add-on for Cisco Webex video conference for meetmshah. 07-20-2023 11:42 AM
- Posted Re: Add-on for Cisco Webex video conference on Getting Data In. 07-20-2023 11:41 AM
- Tagged Re: Add-on for Cisco Webex video conference on Getting Data In. 07-20-2023 11:41 AM
- Posted Re: Add-on for Cisco Webex video conference on Getting Data In. 07-20-2023 11:15 AM
- Posted Add-on for Cisco Webex video conference on Getting Data In. 07-20-2023 10:30 AM
- Posted Re: Add-on or app for wireless lan controller on Getting Data In. 07-19-2023 11:17 AM
- Karma Re: Add-on or app for wireless lan controller for meetmshah. 07-19-2023 11:17 AM
- Posted Add-on or app for wireless lan controller on Getting Data In. 07-19-2023 11:00 AM
- Karma Re: Splunk Add-on for VMWare app- What is the Data Collection Node and Scheduler? for isoutamo. 07-06-2023 10:29 AM
- Posted Re: Syslog stopped sending logs to Indexer on Getting Data In. 06-22-2023 04:23 AM
- Karma Re: Syslog stopped sending logs to Indexer for gcusello. 06-22-2023 04:23 AM
- Karma Re: Get Data in from DMZ servers for richgalloway. 06-21-2023 12:00 PM
- Karma Re: Get Data in from DMZ servers for richgalloway. 06-21-2023 12:00 PM
- Karma Re: Indexer ingesting firewall logs every 4 hours instead of up to the minute for gcusello. 06-21-2023 11:59 AM
- Karma Re: Syslog stopped sending logs to Indexer for gcusello. 06-21-2023 11:59 AM
- Karma Re: Indexer ingesting firewall logs every 4 hours instead of up to the minute for gcusello. 06-21-2023 11:58 AM
- Posted Splunk Add-on for VMWare app- What is the Data Collection Node and Scheduler? on All Apps and Add-ons. 06-21-2023 06:59 AM
- Posted Re: Syslog stopped sending logs to Indexer on Getting Data In. 06-20-2023 06:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-30-2023
06:20 AM
I have a Dell Equallogic Group Manager (san server) that's hasn't been sending logs to syslog. I've added all the IPs for the server, pinged and did traceroute for them with no issues, yet logs are still not sending. Anyone have a solution?
Thanks
... View more
- Tags:
- splunk search
- syslog
Labels
- Labels:
-
syslog
07-20-2023
11:15 AM
That's where I got the input stanza info, but wasn't for sure if that would work. Do I have to create separate input stanza for all these sourcetypes?
... View more
07-20-2023
10:30 AM
Hello, I would like to find an add-on for my webex devices. I know there's the Cisco WebEx Meetings Add-on for Splunk, but wanted to see what every one else is using. The Cisco WebEx Meetings Add-on inputs.conf is [general_service] start_by_shell = false python.version = python3 sourcetype = cisco:webex:meetings:general:summarysession interval = 60 live = True disabled = 0 [history_service] start_by_shell = false python.version = python3 sourcetype = cisco:webex:meetings:history:meetingusagehistory interval = 86400 endpoints = [] disabled = 0 What does this configuration capture? Thanks
... View more
Labels
- Labels:
-
inputs.conf
07-19-2023
11:00 AM
Hello, I'm trying to find an app or add-on for my cisco wlc. Should I use the current cisco IOS add-on to index wlc data or try another add-on? I want to ensure wlc data is separate from ios data. Thank you
... View more
Labels
- Labels:
-
data
06-22-2023
04:23 AM
Hello, Thanks for the response. The esxi logs add-on installed on the deployment app, didn't match what was on the syslog. All the deployment apps are pushed down to the syslog. When configuring inputs.conf (monitor stanza) I didn't mirror those settings in the deployment server. Once I fixed it, it worked. Thanks for all you help and expertise.. Happy Splunking Lisa
... View more
06-21-2023
06:59 AM
Hello,
I have a distributed environment: 1 Search Head (SH), 1 Indexer, 1 Deployment Server, and 1 Syslog Server. I deployed my apps to the Syslog server for those devices that cannot have a forwarder installed. In Splunk Add-on for VMware, it shows a diagram of a distributed environment. I have my VMware device logs sent to the syslog server, then the syslog server sends them to the indexer. I've installed the add-ons for VMware Esxi Logs on SH and Syslog, and VMware add-on for Indexes on the Indexer.
I don't understand what a Data Collection Node, or a Data Collection Scheduler is? The documentation is confusing. What are these and do I need them in my environment for my VMware devices?
Thanks
... View more
Labels
- Labels:
-
configuration
06-20-2023
06:45 AM
Hello, Firewall logs are still sending logs to syslog, and syslog is forwarding them up to the indexer. Esxi and other devices have stopped reporting 12 days ago. 8 June. What could be wrong?
... View more
06-16-2023
08:48 AM
This also applies to my rsa logs, which stopped sending logs 7 days ago.
... View more
06-16-2023
08:41 AM
The logs stopped sending yesterday. Firewall logs are still sending Do you put a wildcard inside the monitor stanza like this: [monitor:///data/ES/*]
... View more
- Tags:
- Getting Data In
06-16-2023
08:33 AM
Hello,
I have a syslog server that collects logs from various hosts, (esxi). The syslog is currently receiving the logs each day from the hosts and puts them the "data/ES/" directory. I have splunkforwarder installed the syslog and inside the splunkforwarder, I have the esxi add-on app.
Inside the esxi add-on app
I have created an input stanza that monitors the data and sent to the indexer
[monitor:///data/ES/] disabled = false index = vmware-esxilog sourcetype = vmw-syslog
The logs stopped sending to the indexer several days ago. However, my firewall logs are still sending to the indexer. The firewall logs are sent the same directory "/data/fire/" and then sent to index. What am I missing?
Thanks
... View more
Labels
- Labels:
-
universal forwarder
06-15-2023
05:04 AM
I had ports 8089, and 9997 opened on the firewall. What is the Linux command to test the connection from the DMZ server to the Deployment server?
... View more
06-15-2023
04:40 AM
I had ports 8089, and 9997 opened on the firewall. What is the Linux command to test the connection from the DMZ server to the Deployment server?
... View more
06-14-2023
11:40 AM
Hello,
I have a few Linux devices that are located within the DMZ. My 3 Splunk servers (Search Head, Indexer, Deployment) are inside my network. I've installed the forwarders on my dmz servers, and set up the set-poll-deployment command (myserver.com:8089) to ensure it's pointing to the deployment server. There is no communication from the dmz servers to the deployment server
I did 2 tests:
1. I was able to connect from 1 dmz server to the deployment server. Result: Connection good.
2. I was not able to connect from the deployment server to the dmz server: Result: Connection refused
Are there other options to get the dmz servers to connect?
Thanks
... View more
Labels
- Labels:
-
universal forwarder
06-14-2023
06:23 AM
Hello,
I've completed the following:
1. Installed Linux forwarder.
2. Assigned ownership and permissions to splunk user and group
3. started splunk and accepted license
4. entered admin credentials
5. typed in "./splunk enable boot-start -systemd-managed 1 -user splunk -group splunk.
6. typed in "./splunk set deploy-poll mysplunkservertest.com:8089
7. Verified deployment.conf file and the uri
8. restarted splunk.
Now, how do I test the connection from the forwarder to the deployment server?
thanks
... View more
- Tags:
- Getting Data In
Labels
- Labels:
-
universal forwarder
06-09-2023
10:46 AM
So, to monitor my linux box that has a Splunk Instance on it, I cannot install a forwarder on it. Instead I do: 1. go to data inputs, 2. Files and directories Do I enable the /var/log directory to get the linux logs? If I enable it, will it conflict with anything? Also, can I do this with Indexer, and the Deployment Server? Thanks
... View more
05-23-2023
09:20 AM
My syslog is handling all devices that can't have forwarders on them, like switches routers, etc. It store all device logs for a limited time and the syslog sends them directly to their respective indexes. On the indexer, I view all latest events from each index that is being received from the syslog. The latest events for my switches, routers, etc are are all reporting the latest events in minutes. Whereas, the firewall is reporting the latest event 4 hours ago.
... View more
05-23-2023
06:41 AM
Hello,
I have a syslog server ingesting device logs which are sent from the deployment server, and then to the indexer. My esxi as well as other devices are sending logs every minute. However, my firewall logs are only ingested every 4 hours on the indexer. Could this be a latency issue, or is it the firewall causing the problem?
Thank you
... View more
Labels
- Labels:
-
universal forwarder
05-19-2023
11:46 AM
What's the purpose of enabling inputs in the search head and indexer?
... View more
05-19-2023
09:37 AM
Hello,
I have 3 servers, Search Head, Indexer, Deployment Server,
According to the manual:
Installed Splunk add-on for Unix and Linux on all 3 servers.
Manual says to enable data and scripted inputs.
In my Deployment Server:
I enabled all the File and Directory Inputs, Scripted Inputs, and the Scripted Event Inputs.
Questions:
Do I have to enable all the inputs on my Search Head and Indexer too?
If I enable the inputs in these 2 servers, will there be replicated data, or conflicts?
Thanks
... View more
Labels
- Labels:
-
configuration
05-17-2023
08:44 AM
For a regular linux host, do I have to create a user and group when installing UF, The manual says 1. Login as ROOT to the machine that you want to install the Splunk Universal Forwarder. Create the Splunk user and group. useradd -m splunk groupadd splunk 2. Install the Splunk software, as described in the installation instructions for your platform in Installation instructions. Create the $SPLUNK_HOME directory wherever desired. export SPLUNK_HOME="/opt/splunkforwarder" mkdir $SPLUNK_HOME
... View more
05-17-2023
08:14 AM
Hello, I'm reading the Forwarder Management manual and it states " Do not install the universal forwarder over an existing installation of full Splunk Enterprise." What does this mean? My goal is to install a universal forwarder on a Linux host, to monitor its /var/log directory. However, the host has the Splunk search head server installed on it. Can this be done, without crashing the search head server?
... View more
Labels
- Labels:
-
universal forwarder
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-31-2023
03:42 PM
|
Karma given to
