About BoldKnowsNothin

BoldKnowsNothin · ‎10-12-2023

Hello inventsekar, So let me try to explain this. We started to monitor our docker/containers on splunk. Unfortunately we cannot install splunk forwarders on container. So we using fluent bit to collect all logs from container and grabing logs via httpeventcollector. So we cannot use splunk on this scenario. When containers crushing they spamming exactly same logs(only timestamp different) like there is no tomorrow.

BoldKnowsNothin · ‎10-11-2023

Hello comrades! I just wonder, does splunk detects logs similarity by it's pattern? Many thanks.

BoldKnowsNothin · ‎10-02-2023

Sorry one last question. Do you suggest us to shift to HF or use indexer?

BoldKnowsNothin · ‎10-02-2023

did you create this on the HF, right? hehe no, that's why I started asking about HF. So UF cannot take this SEDCMD configs right?

BoldKnowsNothin · ‎10-02-2023

Sorry for trouble, As I named myself... 1. Document mentioned that I have to create props.conf in /opt/splunk/deployment.apps/Splunk-TA-windows/local/ ---> created 2. I just copied all lines with SEDCMD and cleared # and just hoping to config should work. All this changes made yesterday,

BoldKnowsNothin · ‎10-02-2023

All commands with SEDCMD

BoldKnowsNothin · ‎10-02-2023

Sir, If I can frankly say all I'm trying to do is here. Configure the Splunk Add-on for Windows - Splunk Documentation unfortunately there isn't any information about forwarders here.

BoldKnowsNothin · ‎10-02-2023

Hello comrade inventsekar, Thank you for your help, do I need other kind of licensing to use HV?

BoldKnowsNothin · ‎10-02-2023

Hello comrades, After my poor research, I found that only heavy forwarder supports props.conf, but it was like 5 or 6 years old posts. I wonder that UF could now support props.conf? Also how do I upgrade to HF? Many thanks,

BoldKnowsNothin · ‎10-01-2023

Hello inventsekar, Sir, all this only for reduce our license usage, currently we afraid to exclude logs, and looking something else to reduce. Many thanks,

BoldKnowsNothin · ‎10-01-2023

Hello gcusello, Sir, I just surfed that link you provided to me, many thanks. But does this field alias reduces space? Thanks again,

BoldKnowsNothin · ‎09-29-2023

Hello comrades, I'm just curios is there anyway to shorten frequent words? For example: <Data Name='IpAddress'>::ffff:10.95.81.99</Data> IpAddress to ipaddr or something like IPa. Many thanks,

BoldKnowsNothin · ‎09-24-2023

My dear comrades, I'm facing something unreal. We just deployed application on the host that looks like [monitor://C:\Data\log\*]. Unfortunately we cannot see any entries on splunk. But when I copied some files to another location on host and also we changed application to something like [monitor://C:\Program Files\Data\log\*]. It sends data. The folders permission etc are all same. Our application is hard coded so we cannot change the path just like this test. Any help will be much appreciated

BoldKnowsNothin · ‎09-22-2023

Hello comrades, We are using universal forwarder on hosts. And we have a noisy dude that products EventID:4674, and exceeds our license limit. Can we shut this dude's mouth on agent side but only on eventID:4674? Sorry newbie here. Many thanks,

Posts	14
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎09-22-2023

Online Status	Offline
Date Last Visited	‎10-17-2023 08:01 AM

How to drop simular logs

Does UF supports props.conf

Can I shorten frequent words?

Data not incoming

How to drop single host's single event

Re: How to drop simular logs

How to drop simular logs

Re: Does UF supports props.conf

Re: Does UF supports props.conf

Re: Does UF supports props.conf

Re: Does UF supports props.conf

Re: Does UF supports props.conf

Re: Does UF supports props.conf

Does UF supports props.conf

Re: Can I shorten frequent words?

Re: Can I shorten frequent words?

Can I shorten frequent words?

Data not incoming

How to drop single host's single event