Questions tagged [splunk]
Splunk is a tool for collecting, monitoring, and analyzing log files from servers, applications, or other sources.
63
questions
0
votes
0answers
15 views
Splunk web server external login
I'm using VirtualBox as a Virtual machine with CentOS 7 on it.
I have used a NAT-adapter with port forwarding and a Host-only adapter.
On the NAT-adapter I used port-forwarding for connecting to ssh ...
0
votes
1answer
48 views
Does Splunk have a “heartbeat” feature?
I run an application with fairly chatty logs, which we are forwarding to Splunk. Users are building custom alerts (as well as searches and even dashboards) for themselves.
We are increasingly relying ...
0
votes
1answer
39 views
How to configure auditd to collect logs from /proc kernel file directory
I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk.
To do this I need to be ...
0
votes
1answer
24 views
Is there a listing of global splunk variables available for alerting?
This is simple, however I have been able to find anything at the basic level of "number of rows/records found in query" for use in a Slack notification.
For example to reference the $name$ of the ...
0
votes
1answer
61 views
Parsing or Reformatting Logs before feeding them to Splunk or Elastic Search
I have very complex log messages, that I want to reduce to the most important fields in order to save quota.
The log messages are multiline and there is a lot of redundant information in them. A ...
0
votes
1answer
56 views
Accessing Splunk instance via AWS
I signed up for a Udemy course on Splunk. I got through to the lecture on setting up an AWS instance of Splunk.
Amazon says, "Get the IP of your instance, append :8000" and dump it in a web browser ...
0
votes
1answer
97 views
How to get Linux commands history in Splunk without Splunk Forwarder?
We have tons of Linux machines which are all connected to Active Directory (AD). AD logs are being pulled in Splunk.
Is there a way to get the command history of all Linux machines in Splunk from AD ...
0
votes
1answer
186 views
Splunk web login through NAT
Good afternoon,
I'm trying to get a Splunk instance setup to be accessed from outside the firewall it is NAT'd behind. Currently, I have the port forwarding rule in for 8000->8000. I can access the ...
1
vote
1answer
266 views
How to process core-dumps with Splunk?
We are managing an application, which some times crashes and dumps core. We have a script, which outputs the application's stack from the core -- and some other details useful for debugging.
Can ...
2
votes
3answers
909 views
Azure NSG not allowing traffic
I am having an odd issue.
I have a Windows server in Azure which I have installed Splunk on and I can't get to the web UI.
I created it from the default template and I have deleted it and tried to ...
2
votes
1answer
450 views
Will Splunk update the index if an already indexed file is edited?
Our Splunk server indexes the audit logs from its clients. Once a week we audit these logs through a Splunk search. My question is, if someone edits the entries in a log file that is already indexed, ...
1
vote
2answers
877 views
Benefits of using WEF instead of SIEM collectors
Aside from the deployment overhead of a log collector agent on servers from which I want to collect events (using GPO, SCCM etc.), are there any added benefits for using Windows Event Forwarding to my ...
0
votes
1answer
380 views
Sending sssd.log to syslog
How do I configure SSSD to send sssd.log logs to syslog? I would like to include the DEBUB SSSD logs as well. We would like to feed the sssd logs to Splunk. Our systems are already configured to send ...
0
votes
1answer
1k views
Simpana CommVault logs and Splunk
What is the best way to get CommVault log data into Splunk? I don't see a Splunk app developed for CommVault, and CommVault generates a lot of log data. It would be extremely beneficial to collect and ...
0
votes
1answer
247 views
Deploying apps using Chef and Splunk as a deployment server
I got Splunk up and running on some EC2 instances using Chef. All is fine and dandy and I was able to deploy some apps manually by using Splunk as a deployment server. I deploy the application -> I ...
0
votes
1answer
81 views
Dumping Splunk Events
We have a nagios instance set up so that using MK-Livestatus and splunk, we are able to push all of nagios's alerts through livestatus's socket thanks to a call from splunk.
However, splunk is now ...
2
votes
1answer
128 views
How do I exclude messages from indexing on Splunk Cloud?
I see from this question and answer on Splunk's own Q&A site that it's possible to exclude certain messages from indexing on a Splunk instance.
I have a Splunk Cloud instance where the only way ...
1
vote
0answers
577 views
How do audit file permissions changes over CIFS?
I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders.
...
1
vote
3answers
6k views
Splunk SAML SSO from an IdP with Apache mod_mellon fails
I am trying to configure SSO from an IdP to Apache with mod_mellon and mod proxy to splunk.
Environment: Ubuntu 14.04; Apache 2.4.7; mod-auth-mellon 0.7.0.
Apache configured with the mellon-...
1
vote
1answer
70 views
Splunk 6: “Cannot preview on this Splunk instance”
I have a distributed Splunk 6 environment with which I am working through the installation of a new Technology Add-on. On my forwarder I am trying to add a new Data Input... Settings > Data inputs > ...
0
votes
1answer
101 views
Splunk aws:config sourcetype not showing in Splunk
I created the data input for AWSConfig by modifying inputs.conf file but I dont see sourcetype aws:config created under Splunk.
The AWSConfig messages are sitting in the SQS queue which means Splunk ...
0
votes
1answer
700 views
Converting IP addresses from Hex to normal format in Splunk
How do you convert IP address data in a splunk field from HEX to the normal 4 octet format?
5
votes
2answers
2k views
Splunk UniversalForwarder fails with “ DetermineContextForAllProducts failed witht: 0x65b”
I am attempting to deploy the Splunk UniversalForwarder as an SCCM application using an MSI Deployment Type to a small group of testing servers and am encountering an uncharacteristically confusing ...
0
votes
1answer
2k views
JSON vs Key-Value for Splunk
Rolling out splunk I'm debating switching to JSON. Splunk supports spath now and even endorses JSON towards user friendliness (ref: http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 )
...
0
votes
1answer
899 views
What webserver does Splunk use on Windows?
Is it a propietary web server? I thought it used Apache, but I've been looking through the installation files and can't find any references.
I'm trying to secure the access to the free version of ...
0
votes
1answer
269 views
Monitoring solution that doesn't duplicate source data?
I need to analyze data stored in multiple databases. Each of them contains a few TB of logs and sensor data.
If I use Splunk or ElasticSearch/Kibana, I see 2 solutions:
Batch import everything
Write ...
1
vote
1answer
69 views
Segmenting syslog logs and access to those logs
I'm trying to figure out if what I'm trying to accomplish is possible or not.
What I want is to have all my devices send logs to a syslog server, then have Splunk pull logs for everything EXCEPT my ...
0
votes
1answer
750 views
Splunk disk space requirements [duplicate]
I need to get a vague idea of disk space requirements before I start forwarding logs to a Splunk instance. Each indexed line will have on average 320 characters and I will be indexing around 500,000 ...
0
votes
2answers
9k views
How Fortigate 100D send log to Splunk
I have a Fortigate 100D with FortiOS 5.06 , this is my setting
config log syslogd setting
set status enable
set server “192.168.7.4″
set reliable disable
set port 515
set csv disable
set facility ...
0
votes
0answers
967 views
Unable to access Splunk via port number on Ubuntu 12.04
Ubuntu 12.04 Server x64 &
Splunk 6.0
I installed Splunk according to the documentation. Started Splunk as directed and I am able to see it running in the terminal. I believe I correctly added the ...
1
vote
1answer
410 views
Capturing Regex in Splunk
I'm trying to grab the directory paths of GET requests and count them in Splunk using this capturing regex.
index=main sourcetype="access_combined_wcookie" | rex "(?i)\"GET /(?P<MYDIR>\w+)/" | ...
0
votes
1answer
868 views
HA proxy and keepalived with Splunk search heads
Is anyone using haproxy/keepaliveD as their software load balancer in a HA search head environment?
I am configuring my haproxy.cfg and having some trouble getting sticky sessions and proper load ...
1
vote
4answers
1k views
Using Puppet to incrementally add lines to a file, from multiple classes
I am trying to use Puppet to automatically configure Splunk monitoring. This involves adding a list of file paths to a Splunk configuration file (inputs.conf).
Each role (webserver, db, etc.) in our ...
0
votes
1answer
227 views
Weird DF ourput in Red Hat 5.4 - Used < Size, but 0 available?
I have a server with two LUN's mounted from a local SAN. I have a configuration file in place for the vendor software we're using (splunk) that defined the size of the second LUN, but I had ...
2
votes
2answers
359 views
Alternative solution to replace aging swatch
We are using swatch installation to sort through 3-5 gig worth of networking syslog and alert us on patterns , we are using splunk to index and search the data but splunk alerting capabilities are ...
3
votes
1answer
1k views
Using the Augeas INI lens without a header
I am using the IniFile module with augeas to create a Splunk management lens. This works well for all files containing section headers like a normal INI file but there are a couple files that don't ...
3
votes
5answers
2k views
thought on real time web analytics
we have a few web servers and am planning to create a dashboard to show the real time stats ip address,geo-location and other custom data based on database lookups. Splunk sort of fits perfectly but ...
0
votes
1answer
804 views
Getting Splunk logs from a remote location
I currently have a server in my home lab running Splunk, really love it. I'm soon going to have another server in the EC2 cloud, and I'd love to be able to monitor that using Splunk, hopefully though ...
2
votes
4answers
16k views
Splunk How do I get syslog to send data into splunk from remote machines
If I install the splunk forwarder, I can get the remote data into my splunk install, and index my logs, and searching is great. But I have a number of router devices and other devices that run syslog, ...
2
votes
2answers
2k views
How can I configure logs as data source from remote unix server in splunk?
How can I configure splunk with log files residing on remote unix servers?
Normally I log into putty to a linux server, from there I ssh into another company server and I navigate through directories ...
0
votes
1answer
440 views
Using ubuntu cloud-init to setup logging to splunk
I intend to start up ~100 EC2 spot instances using Canonical's Ubuntu images. I am using multipart cloud-init user-data to setup packages, scripts, etc.
I would like to know how I can tell rsyslog to ...
0
votes
1answer
908 views
Qmail - replacing multilog with splogger
I currently manage a qmail installation, set up on Centos using the qmailrocks guide (which seems to have vanished from the Internet now). So - daemontools, multilog, vpopmail, qmail.
I've been asked ...
0
votes
1answer
356 views
Installing Splunk on Godaddy server
Does anyone know if it is possible to install Splunk on a Godaddy server? I've downloaded the deb file on my server using wget (and obviously I have ssh access) but I'm struggling to install it as ...
49
votes
2answers
97k views
Splunk is fantastically expensive: What are the alternatives? [duplicate]
Possible Duplicate:
Alternatives to Splunk?
This has been discussed, but it has been several months, so it may be time to revisit it:
Earlier discussion RE Splunk alternatives
For the record, ...
0
votes
2answers
2k views
Detect port scanning using splunk
i have setup a log server with splunk running on it.
i pinged one of the clients using backtrack....Does this also genrate log which is sent the log server??????
I wanted to detect port scanning ......
0
votes
1answer
1k views
ASA5520 stops sending to splunk syslog
I have an ASA5520 that is set up to send logs to a splunk syslog server. the setup works for a while, usually around 24 hours or so, but then stops until either the logging is reconfigured (twiddling ...
1
vote
1answer
283 views
Is it possible to perform reverse lookups on syslogs without Splunk?
Splunk has this capability via its Google Maps addon that allows you to map IP addresses that show up in your syslog. That way you can pinpoint geo locations of attacks such as scans.
Do you guys ...
2
votes
3answers
307 views
Any QUICK hints for starting off with Splunk
Just downloaded a trial of Splunk, and am thinking of using it to monitor a Windows server base, with the associated apps, e.g.:
o Windows event logs / WMI queries (for Windows O/S, SQL Server, ...
3
votes
1answer
2k views
Splunk File & Directory Data Inputs
I've installed Splunk (4.1.5(85165) on windows) and have uploaded some logs without any issues.
I now want to monitor a linux server, but I'm having problems adding the datasource and always get the ...
1
vote
1answer
66 views
Can I forward events from Splunk 3 to Splunk 4?
I've only used Splunk 4 before and I was wondering if setup a Splunk 3 server to forward to another Splunk 4 server. The reason I'd need to do this is because I have an old Mac OS X 10.4.11 PowerPC ...
