Skip to main content

Questions tagged [splunk]

Splunk is a tool for collecting, monitoring, and analyzing log files from servers, applications, or other sources.

Filter by
Sorted by
Tagged with
0 votes
0 answers
34 views

K8s and Linux Audit Logs Missing From Splunk OTEL Collected Logs

I'm migrating from the Splunk Connect for Kubernetes Helm Chart to the SignalFX Splunk Otel Collector Helm Chart. I'm having trouble translating the custom filters that we have in the SCK chart to add ...
Dejon Gill's user avatar
0 votes
0 answers
47 views

Monitor Docker containers on EC2 instance from Splunk Enterprise

I need to monitor the Docker containers running on my EC2 aws machine on Splunk enterprise. I have installed Splunk and added Splunk forwarder to my EC2 machine and I am running a Docker httpd ...
proxyninoxy's user avatar
1 vote
2 answers
168 views

Splunk Enterprise - Configure to drop specific events

I have a simple Splunk set-up.  about 120 or so Linux servers (that are all basically appliances) w/ universal forwarder installed, and a single Linux server running Splunk Enterprise acting as the ...
Egyas's user avatar
  • 185
1 vote
2 answers
451 views

Syslog-ng multiple filters

I am fairly new to syslog-ng and I have the following issue. I have a Checkpoint firewall that sends the logs to a Splunk server. Due to the huge amount of data sent by the firewall, I tried to filter ...
Daniel D.'s user avatar
-1 votes
1 answer
1k views

splunk syslogs Forwarder set up not working and paused data flow

I have set up the Universal Forwarder locally in my machine using this guide https://splunk.paloaltonetworks.com/universal-forwarder.html /opt/splunkforwarder/etc/system/local/inputs.conf [monitor:///...
asasa178's user avatar
  • 109
-2 votes
1 answer
394 views

Splunk Universal Forwarder on Windows : how many logs to forward?

Splunk Universal Forwarded Windows Server 2019 When configuring the forwarder, a large variety of logs can be forwarded : Application Logs Security Log System Log Forwarded Events Log Setup Log In ...
BaltoStar's user avatar
  • 207
1 vote
1 answer
217 views

Splunk SNMP Modular Input

I just installed this app and found it simple to setup...but I most be doing something wrong. I've created Trap information on my two UPS devices and haven't had any luck bringing them into Splunk. I ...
YouSayHello's user avatar
0 votes
0 answers
323 views

How to feed IBM MQ logs into Splunk?

Our Java-program talks to IBM MQ using IBM-provided com.ibm.mq.allclient JAR. As documented by IBM, log-messages generated from within the JAR are written out into mqjms.log in the current directory. ...
Mikhail T.'s user avatar
  • 2,411
1 vote
1 answer
1k views

Splunk splitting multi-line log events by date

I have a mostly default Splunk config that is properly splitting most of my log messages from a standard Java application. We don't override any of the defaults concerning line breaks, line merging, ...
Chris Williams's user avatar
1 vote
0 answers
239 views

How do you monitor an external domain trust?

We have multiple external domain trusts with different companies, and while I know how to validate the trust in "Windows Domains and Trusts", I am wondering if anyone knows how to monitor it ...
Erick W's user avatar
  • 11
0 votes
1 answer
4k views

How to configure SSL certificates for Splunk on port 8089?

I want to configure a certificate for Splunk so that I could make API requests to it on port 8089. Currently the following command fails because Splunk's default certificate is used, and the default ...
user3207874's user avatar
0 votes
1 answer
303 views

How to non-interactively add a Splunk forwarder?

I wish to create a script for setting up forwarding to a splunk server. Here's what I have so far: ./splunk add forward-server SPLUNK-IP-ADDRESS:SPLUNK-PORT However, it asks for my credentials. How ...
user3207874's user avatar
0 votes
1 answer
3k views

HAProxy 503 Service Unavailable No servers avalible to handle this request

Hey I seem to have issues with HAProxy but can't seem to find the root of the problem. Setup: 1 Load Balancer 3 Servers (Splunk Search Heads) Both Load Balancer and the 3 servers are only accessible ...
HAProxy Help's user avatar
-1 votes
1 answer
2k views

Filtering out strings in Splunk

I have the below query. index=myindex sourcetype="application:access:log" host=myservers* FullURL="*/ABC" It works. However, I'd like the output to show all URLs with ABC within them, I just don't ...
Govno's user avatar
  • 11
1 vote
0 answers
158 views

Using Splunk DB Connect 3 in a large environment with connection pool

I am wondering if anyone can speak from experience with using DB Connect for a large number of sql server instances, each of which installed (so about 2,000 separate instances total). We currently use ...
datadawg2000's user avatar
1 vote
1 answer
1k views

Does Splunk have a "heartbeat" feature?

I run an application with fairly chatty logs, which we are forwarding to Splunk. Users are building custom alerts (as well as searches and even dashboards) for themselves. We are increasingly relying ...
Mikhail T.'s user avatar
  • 2,411
0 votes
1 answer
407 views

How to configure auditd to collect logs from /proc kernel file directory

I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk. To do this I need to be ...
Geordeaux's user avatar
0 votes
1 answer
2k views

Is there a listing of global splunk variables available for alerting?

This is simple, however I have been able to find anything at the basic level of "number of rows/records found in query" for use in a Slack notification. For example to reference the $name$ of the ...
Bryan Yeung's user avatar
0 votes
1 answer
336 views

Parsing or Reformatting Logs before feeding them to Splunk or Elastic Search

I have very complex log messages, that I want to reduce to the most important fields in order to save quota. The log messages are multiline and there is a lot of redundant information in them. A ...
gspoosi's user avatar
  • 131
0 votes
1 answer
149 views

Accessing Splunk instance via AWS

I signed up for a Udemy course on Splunk. I got through to the lecture on setting up an AWS instance of Splunk. Amazon says, "Get the IP of your instance, append :8000" and dump it in a web browser ...
Adrian's user avatar
  • 101
0 votes
1 answer
356 views

How to get Linux commands history in Splunk without Splunk Forwarder?

We have tons of Linux machines which are all connected to Active Directory (AD). AD logs are being pulled in Splunk. Is there a way to get the command history of all Linux machines in Splunk from AD ...
Vaibhav Nagariya's user avatar
0 votes
1 answer
347 views

Splunk web login through NAT

Good afternoon, I'm trying to get a Splunk instance setup to be accessed from outside the firewall it is NAT'd behind. Currently, I have the port forwarding rule in for 8000->8000. I can access the ...
Caleb Stewart's user avatar
1 vote
1 answer
1k views

How to process core-dumps with Splunk?

We are managing an application, which some times crashes and dumps core. We have a script, which outputs the application's stack from the core -- and some other details useful for debugging. Can ...
Mikhail T.'s user avatar
  • 2,411
2 votes
3 answers
4k views

Azure NSG not allowing traffic

I am having an odd issue. I have a Windows server in Azure which I have installed Splunk on and I can't get to the web UI. I created it from the default template and I have deleted it and tried to ...
frpm's user avatar
  • 23
2 votes
1 answer
742 views

Will Splunk update the index if an already indexed file is edited?

Our Splunk server indexes the audit logs from its clients. Once a week we audit these logs through a Splunk search. My question is, if someone edits the entries in a log file that is already indexed, ...
Sreeraj's user avatar
  • 464
1 vote
2 answers
2k views

Benefits of using WEF instead of SIEM collectors

Aside from the deployment overhead of a log collector agent on servers from which I want to collect events (using GPO, SCCM etc.), are there any added benefits for using Windows Event Forwarding to my ...
Franko's user avatar
  • 135
0 votes
1 answer
840 views

Sending sssd.log to syslog

How do I configure SSSD to send sssd.log logs to syslog? I would like to include the DEBUB SSSD logs as well. We would like to feed the sssd logs to Splunk. Our systems are already configured to send ...
Saqib Ali's user avatar
  • 438
1 vote
1 answer
2k views

Simpana CommVault logs and Splunk

What is the best way to get CommVault log data into Splunk? I don't see a Splunk app developed for CommVault, and CommVault generates a lot of log data. It would be extremely beneficial to collect and ...
Bede's user avatar
  • 411
0 votes
1 answer
329 views

Deploying apps using Chef and Splunk as a deployment server

I got Splunk up and running on some EC2 instances using Chef. All is fine and dandy and I was able to deploy some apps manually by using Splunk as a deployment server. I deploy the application -> I ...
Mugurel's user avatar
  • 923
0 votes
1 answer
96 views

Dumping Splunk Events

We have a nagios instance set up so that using MK-Livestatus and splunk, we are able to push all of nagios's alerts through livestatus's socket thanks to a call from splunk. However, splunk is now ...
Jouster500's user avatar
2 votes
1 answer
249 views

How do I exclude messages from indexing on Splunk Cloud?

I see from this question and answer on Splunk's own Q&A site that it's possible to exclude certain messages from indexing on a Splunk instance. I have a Splunk Cloud instance where the only way ...
Flup's user avatar
  • 8,168
1 vote
0 answers
696 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
Guldan's user avatar
  • 11
1 vote
3 answers
9k views

Splunk SAML SSO from an IdP with Apache mod_mellon fails

I am trying to configure SSO from an IdP to Apache with mod_mellon and mod proxy to splunk. Environment: Ubuntu 14.04; Apache 2.4.7; mod-auth-mellon 0.7.0. Apache configured with the mellon-...
Brett's user avatar
  • 221
1 vote
1 answer
92 views

Splunk 6: “Cannot preview on this Splunk instance”

I have a distributed Splunk 6 environment with which I am working through the installation of a new Technology Add-on. On my forwarder I am trying to add a new Data Input... Settings > Data inputs > ...
user1801810's user avatar
0 votes
1 answer
183 views

Splunk aws:config sourcetype not showing in Splunk

I created the data input for AWSConfig by modifying inputs.conf file but I dont see sourcetype aws:config created under Splunk. The AWSConfig messages are sitting in the SQS queue which means Splunk ...
minisch's user avatar
  • 83
0 votes
1 answer
963 views

Converting IP addresses from Hex to normal format in Splunk

How do you convert IP address data in a splunk field from HEX to the normal 4 octet format?
mightyKeyboard's user avatar
5 votes
2 answers
3k views

Splunk UniversalForwarder fails with " DetermineContextForAllProducts failed witht: 0x65b"

I am attempting to deploy the Splunk UniversalForwarder as an SCCM application using an MSI Deployment Type to a small group of testing servers and am encountering an uncharacteristically confusing ...
user avatar
0 votes
2 answers
4k views

JSON vs Key-Value for Splunk

Rolling out splunk I'm debating switching to JSON. Splunk supports spath now and even endorses JSON towards user friendliness (ref: http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 ) ...
CogitoErgoSum's user avatar
0 votes
1 answer
1k views

What webserver does Splunk use on Windows?

Is it a propietary web server? I thought it used Apache, but I've been looking through the installation files and can't find any references. I'm trying to secure the access to the free version of ...
jesusbolivar's user avatar
0 votes
1 answer
273 views

Monitoring solution that doesn't duplicate source data?

I need to analyze data stored in multiple databases. Each of them contains a few TB of logs and sensor data. If I use Splunk or ElasticSearch/Kibana, I see 2 solutions: Batch import everything Write ...
MasterScrat's user avatar
1 vote
1 answer
81 views

Segmenting syslog logs and access to those logs

I'm trying to figure out if what I'm trying to accomplish is possible or not. What I want is to have all my devices send logs to a syslog server, then have Splunk pull logs for everything EXCEPT my ...
LDJS's user avatar
  • 23
0 votes
1 answer
854 views

Splunk disk space requirements [duplicate]

I need to get a vague idea of disk space requirements before I start forwarding logs to a Splunk instance. Each indexed line will have on average 320 characters and I will be indexing around 500,000 ...
Michael's user avatar
  • 103
0 votes
2 answers
10k views

How Fortigate 100D send log to Splunk

I have a Fortigate 100D with FortiOS 5.06 , this is my setting config log syslogd setting set status enable set server “192.168.7.4″ set reliable disable set port 515 set csv disable set facility ...
Jack Chuong's user avatar
0 votes
0 answers
1k views

Unable to access Splunk via port number on Ubuntu 12.04

Ubuntu 12.04 Server x64 & Splunk 6.0 I installed Splunk according to the documentation. Started Splunk as directed and I am able to see it running in the terminal. I believe I correctly added the ...
sparecycle's user avatar
1 vote
1 answer
735 views

Capturing Regex in Splunk

I'm trying to grab the directory paths of GET requests and count them in Splunk using this capturing regex. index=main sourcetype="access_combined_wcookie" | rex "(?i)\"GET /(?P<MYDIR>\w+)/" | ...
user181496's user avatar
0 votes
1 answer
1k views

HA proxy and keepalived with Splunk search heads

Is anyone using haproxy/keepaliveD as their software load balancer in a HA search head environment? I am configuring my haproxy.cfg and having some trouble getting sticky sessions and proper load ...
user162159's user avatar
2 votes
4 answers
2k views

Using Puppet to incrementally add lines to a file, from multiple classes

I am trying to use Puppet to automatically configure Splunk monitoring. This involves adding a list of file paths to a Splunk configuration file (inputs.conf). Each role (webserver, db, etc.) in our ...
Mike Ryan's user avatar
  • 288
1 vote
1 answer
236 views

Weird DF ourput in Red Hat 5.4 - Used < Size, but 0 available?

I have a server with two LUN's mounted from a local SAN. I have a configuration file in place for the vendor software we're using (splunk) that defined the size of the second LUN, but I had ...
Matthew's user avatar
  • 2,747
2 votes
2 answers
402 views

Alternative solution to replace aging swatch

We are using swatch installation to sort through 3-5 gig worth of networking syslog and alert us on patterns , we are using splunk to index and search the data but splunk alerting capabilities are ...
Irfan's user avatar
  • 21
3 votes
1 answer
1k views

Using the Augeas INI lens without a header

I am using the IniFile module with augeas to create a Splunk management lens. This works well for all files containing section headers like a normal INI file but there are a couple files that don't ...
Tim Brigham's user avatar
  • 15.6k