- 33
- 100 333
Travis Hall
เข้าร่วมเมื่อ 4 ม.ค. 2012
Using PowerShell Scripted Inputs to Collect Windows Data in Splunk
Recently, I was asked how to capture data using PowerShell scripts on a Windows device.
In this video, I'll demonstrate how I created a PowerShell script to locate all instances of calc.exe and how to use the Splunk Add-on for Windows to execute the script on a Windows 11 desktop.
Splunk documentation links:
Monitor Windows data with Powershell scripts:
docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdatawithPowerShellscripts
Splunk Add-on for Microsoft Windows:
splunkbase.splunk.com/app/742
Documentation for Splunk Add-on for Windows:
docs.splunk.com/Documentation/AddOns/released/Windows/AbouttheSplunkAdd-onforWindows
In this video, I'll demonstrate how I created a PowerShell script to locate all instances of calc.exe and how to use the Splunk Add-on for Windows to execute the script on a Windows 11 desktop.
Splunk documentation links:
Monitor Windows data with Powershell scripts:
docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdatawithPowerShellscripts
Splunk Add-on for Microsoft Windows:
splunkbase.splunk.com/app/742
Documentation for Splunk Add-on for Windows:
docs.splunk.com/Documentation/AddOns/released/Windows/AbouttheSplunkAdd-onforWindows
มุมมอง: 175
วีดีโอ
Configure Splunk OpenTelemetry collecter (OTEL) to send kubernetes (k8s) data into Splunk Core.
มุมมอง 2.2K7 หลายเดือนก่อน
To gain a deeper understanding of Kubernetes (K8s), I opted to establish a MicroK8s environment for hosting a DOS game. Once the environment was up and running, I proceeded to configure the Splunk OpenTelemetry collector to transmit metrics and log data to Splunk Core. In this video, I specifically chose Splunk Core over the Splunk Observability Cloud suite of tools to assist individuals constr...
Batman Helmet printed on Creality K1 max using ELEGOO Rapid PETG Filament sliced with OrcaSlicer
มุมมอง 1K8 หลายเดือนก่อน
Have always wanted to print a helmet in 1 piece and finally tried printing out the "New 52 Batman Inspired Helmet by Budwin" on Thingiverse: www.thingiverse.com/thing:4773564 With the help of "Sizing Heads Updated by Budwin" on Thingiverse: www.thingiverse.com/thing:4885210 I was able to scale the helmet to fit my head, ended up scaling the original model to 104%. This scale gave me about a fin...
Creality K1 max printing Chair stacking game with no supports sliced in OrcaSlicer
มุมมอง 27510 หลายเดือนก่อน
Used OrcaSlicer to slice the Chair stacking game. I did try and print a single chair in Creality Print and it failed. Chair stacking game - No supports www.printables.com/model/74303-chair-stacking-game-no-supports
Creality K1 max timelapse Silk PLA of Floppy Dragon
มุมมอง 45910 หลายเดือนก่อน
Timelapse taken from Creality Print of the Floppy Dragon with tri-color silk pla. Used the default settings in Creality Print for Generic-PLA-Silk_1.75 and autobrim. 3d model: Floppy Dragon - Flexi Articulated Monster (print-in-place) by IXPatch www.printables.com/model/501117-floppy-dragon-flexi-articulated-monster-print-in-p Filament used: OVV3D Tri-Colors PLA 3D Printer Filament 1.75mm, Coex...
How I calculated interface bandwidth usage with SNMP iftable results and Splunk.
มุมมอง 38510 หลายเดือนก่อน
In my journey to understand Simple Network Management Protocol (SNMP) better, I started collecting interface data from my firewall box using snmptable request. First, I will cover the steps taken to create the snmptable request and send the data into Splunk. After that, I will then break down a Splunk query built to visualize bandwidth utilization on the different interfaces. I found the formul...
Splunk Getting Data In (GDI) via Scripted Inputs collecting SNMP requests
มุมมอง 53210 หลายเดือนก่อน
In an effort to gain a better understanding of the SNMP protocol, I decided to utilize snmpwalk, snmptable and snmpget requests to retrieve information from my OPNsense firewall. This will be 1 example on how to collect SNMP data into Splunk. There are many tools out on the market that can feed SNMP data into Splunk. You will see me go over how I enable Splunk to utilize the different SNMP requ...
How to install the Splunk App for Content Packs for IT Essentials Work & IT Service Intelligence.
มุมมอง 43711 หลายเดือนก่อน
With IT Essentials Work installed, I wanted to go over installing the Splunk App for Content Packs. The Splunk App for Content Packs includes prepackaged content that helps with quick setup for your IT Essentials Work (ITE Work) or IT Service Intelligence (ITSI) environments. This prepackaged content consists of KPI Base searches, ITSI Glass Tables, templates, and other objects. Splunk App for ...
Splunk add icon to app
มุมมอง 46311 หลายเดือนก่อน
In this video you will see how to add icons to a Splunk app that you have either created or downloaded from Splunkbase. Icons will add a customized look to an app that will appear in both the Splunk Web app list and on the app menu. Splunk documentation links: Splunk add Icons to your app: dev.splunk.com/enterprise/docs/developapps/createapps/#Add-icons-to-your-app
Classic (Simple XML) Dashboard Pie chart and Table visualization customization
มุมมอง 72411 หลายเดือนก่อน
This video will demonstrate how to customize Pie charts and Table visualizations from the classic dashboard user interface and edit the Simple XML source code. This is a follow on video where similar customizations were created using Dashboard Studio builder - th-cam.com/video/IgPCtTJ0mG8/w-d-xo.html You will also see how to include images into an HTML panel for both Classic (Simple XML) dashbo...
Splunk Dashboard Studio Pie chart and Table visualization color customization options
มุมมอง 1.8K11 หลายเดือนก่อน
This video will demonstrate additional options that can only be set in the source editor for both the Pie chart and Table visualizations while using Dashboard Studio. Additional options are not limited to visualizations that are used in the video and would recommend diving into the visualization that you want to use further. Splunk documentation links: Splunk Dashboard Studio Pie chart: docs.sp...
Using Splunk search commands: transaction, append and appendcols
มุมมอง 737ปีที่แล้ว
In the video you will see me use 3 Splunk search commands: transaction, append and appendcols. The first command I will cover is the “transaction” search command to create a field called duration that will help me understand how long an interface on my firewall box is down. Using the transaction search command helped me discover that my em2 interface was changing stats multiple times each day. ...
Using Splunk to search, alert and visualize metrics data being collected in a metrics based index
มุมมอง 3Kปีที่แล้ว
This video will build on the previous videos where I configured a deployment server to push out an app configured to collect metrics from Windows and Unix/Linux endpoints and installation of IT Essentials Learn/Work. I will cover using 3 Splunk search commands (mstats, mpreview and mcatalog) built to work with metrics data that has been collected in a metrics index. I will start with some basic...
Installation of IT Essentials Learn and Work app in Splunk then configure metrics collection
มุมมอง 1.4Kปีที่แล้ว
This video is a follow on to my configuring a deployment server and pushing out apps to my endpoints. You can check that video out here: th-cam.com/video/Wze0yXsMKVM/w-d-xo.html During this video I will cover installing the IT Essentials Learn and IT Essentials Work app in my Splunk environment. Both apps are free to download and supported by Splunk. After IT Essentials Learn and Work have been...
Basic setup of a Splunk Deployment Server to push out technology add-ons and custom apps
มุมมอง 6Kปีที่แล้ว
In this video I will walk through configuring a deployment server to push out Splunk Unix/Linux technology add-on (TA) and the Windows TA to my connected endpoints. I will demonstrate using the command line to point the endpoints to the deployment server. After that you will see me jump into Splunk Web and build out the server classes and attach them to apps that will be deployed. Along with th...
Splunk adding and configuring Shapes in Dashboard Studio builder
มุมมอง 860ปีที่แล้ว
Splunk adding and configuring Shapes in Dashboard Studio builder
Splunk create a dashboard from a search or report utilizing the Trellis Layout.
มุมมอง 1.4Kปีที่แล้ว
Splunk create a dashboard from a search or report utilizing the Trellis Layout.
Splunk Dashboard Studio search results or job metadata token usage example.
มุมมอง 1.9Kปีที่แล้ว
Splunk Dashboard Studio search results or job metadata token usage example.
Splunk 9.1 enable dark theme support in your custom app.
มุมมอง 1.2Kปีที่แล้ว
Splunk 9.1 enable dark theme support in your custom app.
Pass a drilldown token from one Splunk dashboard to another dashboard
มุมมอง 6Kปีที่แล้ว
Pass a drilldown token from one Splunk dashboard to another dashboard
Upgrading a Single Instance Splunk Indexer
มุมมอง 1.2Kปีที่แล้ว
Upgrading a Single Instance Splunk Indexer
Using the Splunk Dashboard Studio builder to create a dashboard for my 3d Printer metrics
มุมมอง 10Kปีที่แล้ว
Using the Splunk Dashboard Studio builder to create a dashboard for my 3d Printer metrics
Convert a Simple XML dashboard to a Dashboard Studio dashboard in Splunk
มุมมอง 2.9K2 ปีที่แล้ว
Convert a Simple XML dashboard to a Dashboard Studio dashboard in Splunk
Splunk Netflow dashboard using Network Topology visualization and Network Toolkit add-ons.
มุมมอง 7K2 ปีที่แล้ว
Splunk Netflow dashboard using Network Topology visualization and Network Toolkit add-ons.
Risk Management Framework (RMF) with Splunk IT Service Intelligence (ITSI).
มุมมอง 6813 ปีที่แล้ว
Risk Management Framework (RMF) with Splunk IT Service Intelligence (ITSI).
Splunk Windows Account Management overview and how to create this dashboard in your environment
มุมมอง 5753 ปีที่แล้ว
Splunk Windows Account Management overview and how to create this dashboard in your environment
Great explanation and easy to understand. Requesting to do more videos on single side and multisite clustering and Splunk troubleshooting
Thanks its very helpfull, btw do you have clue to running powershell with Administator permission, i have Command but required Admin
Learning all about splunk having a tough time finding videos online. Thank You for the explanation and tutorial. Not sure what your plans are however I would like to request you create a lab with hands on exercise for SOC purposes. Maybe use a pcap from malware analysis and break it down to us what you would normally look for step by step. Thanks.
curl -k 139.162.8.62:8088/services/collector -H "Authorization: Splunk 63340ac5-5f37-4883-89ad-1e670f99220d" -d '{"event":"Hello, World!"}' curl: (7) Failed to connect to 139.162.8.62 port 8088 after 190 ms: Couldn't connect to server i keep getting this error please help
OMG THANK YOU! IVE BEEN SEARCHING THE WEB FOR DAYS AND THE PART I WAS MISSING WAS A 1 MINUTE SEGMENT FROM 5:00
Glad this video helped you out.
i am not receiving the performance metrics from k8s_metrics index. not sure what went wrong
I would say double check the yaml file and ensure metricsEnabled:true is set, the "k8s_metrics" index has been created as a metrics type index, not an events type index and check for typo's.
@@travis-hall Great. It worked actually..I have enabled the wrong metrics :)
@@ArjunPavithram Glad you were able to find a solution.
Thanks Travis... in advance.
Thanks Travis
What slicer and what general settings are you using?
Orcaslicer has been my choice for slicers. I have Creality Print installed, but they have some work to do.
Hamari Kuti choron say mili hui hay.
Hello sir , do you take training for splunk
I am in the process of updating my Splunk certifications.
iam not getting how you replaces wineventlog to bitsv3 can you please let me know
How can i simulate the Nextflow network traffic using Splunk if I don't have real network logs? To use the netflow dashboard.
One way to get simulated data into Splunk is by using the Splunk Event Generator (Eventgen) utility. Here are 2 links for more info: splunkbase.splunk.com/app/1924 splunk.github.io/eventgen/ I have also played around with ChatGPT to help build a process that would generate synthetic data that can be ingested by Splunk. Another route would be to look into the Splunk makeresults command. Here are 2 links for more info: docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults lantern.splunk.com/Splunk_Platform/Product_Tips/Searching_and_Reporting/Using_the_makeresults_command
The "mpstat" call out solved an issue I was running into. Thanks!
Loved it
I learned SO MUCH from this video, thank you!!!
Out of all my amazon brands for PETG ive ordered this stuff prints the best and at 3X the speed and cheaper than rapid PLA. Sadly Canada is sold out :(
Amazing tutorial !!!
Did you use a custom profile for this filament?
Loved the tutorial. Thanks!
Hi Travis, im trying to do this on a windows box, I have my 4 initial icong properly labeled however, they still wont show up. Do I need to make changes in the file "application.css"?
It has been a while since doing this on a Splunk indexer hosted on Windows. However, you should not have to edit the ".css" file to get the icon to change. I would just make sure the files are name exactly as shown since they are case sensitive and it may be a windows thing with permissions. That is my first thoughts.
Also, don't forget to check or post your question on answers.splunk.com The community support is great and your not having to wait on me.
Love the Elegoo rapid PETG. Prints nice, prints fast, and is very affordable.
thank you
what do I do when Splunk tellls me that I have a status code of 500 with IT E.L.? ("Error fetching Use Case Families")
Good one
Just found your channel and your videos are a great help! Well done down to earth and detailed. I really appreciate it!
Glad you like them!
What settings are you running on silk PLA set up?
For my silk PLA prints, I have only used Creality Print with the Generic-PLA-Silk_1.75. The only change I have made to the generic material settings for the generic silk profile is under the Temperature tab: Printing, Initial Printing and Final Printing Temp = 230°C Build Plate and Initial Layer Temp = 60°C I do have "Sudden flow acceleration" checked and did not change any settings. I will point out that under the Properties tab, the "Max Volumetric Speed" is set to 10. This is the default setting and printing speed will be limited by this settings. You can always perform flow test to figure what the max setting could be. However, the default setting of 10 has worked with my silk PLA's and Flashforge Burnt Titanium PLA. For example, I have printed some parts in TPU and the "Max Volumetric Speed" is set to 3.5 with great results. This slowed down the K1 max and even fed my TPU through the tube with no issues. Hopefully this helps and happy printing.
What slicer . I can’t find any silk in my settings lol
Thank you! great video! easy to understand!
Good video.. Expecting more usefull videos on splunk
Ahh this is perfect, thank you. Helped me to create an add-on for Brocade switches.
Do you offer trainings?
Well, I currently work for Splunk and have led multiple workshops for customers under the territory I cover. If you are currently working with a Splunk account team, reach out and ask about Splunk workshops. Here you can virtual workshops available in your area: www.splunk.com/en_us/about-us/events.html Workshops are great, but does not replace the content our Splunk education team has put together. Make sure to check out the free training course: www.splunk.com/en_us/training/free-courses/overview.html If you can make it, Splunk .Conf is a great opportunity to interact with Splunk professionals. Splunk will also post the past 3 years of .Conf sessions here: conf.splunk.com/watch/conf-online.html#/
Thank you so much!
"promo sm"
Thanks Travis for posting very useful video.
Good one Travis
The way you explain is commendable brother, would you happen to have an email? or some way to send messages?
Good one Travis 👍
Good one
Hi Travis, thanks. It is a good one. I have one question how did the Godzilla icon populate when your app*.png files does not have the Godzilla logo?
For the video, I had already created the app*.png files from the Godzilla logo and to save time copied those over to my Linux box via WinSCP. If you stop video at 3:46, you will see a Godzilla folder that has those icons. The "suspicious" face icon I used was to demonstrate the steps I took in MSPaint to create the app*.png files. Looking back, I could have just recreated the icons with the Godzilla logo.
Great video. Thanks. It helped me a lot to understand the logic.
Great stuff, thanks!
Loved it❤❤ This was so helpful OMG
Great explanation the best I have seen on the setup of the deployment server
Thank you
@travishall2073 Hi Travis, could you show me a good example of integrating that I could use in my CyberArk labs to be able to do correlation with CyberArk PTA and Splunk to demo the functionality of a SIEM and PAM solution
@@dru0pa Never had the opportunity to work with CyberArk. However, I did find that Splunk has built an Add-on for CyberArk to pull system logs and traffic statistics from Privileged Threat Analytics (PTA) 12.0 and Enterprise Password Vault (EPV) 12. splunkbase.splunk.com/app/2891 There is also Splunk documentation that goes into the install/configuration of this Add-on. docs.splunk.com/Documentation/AddOns/released/CyberArk/About
Hello travis Can you please do a installation wnd configuration of qualys ta for splunk to push the qualys vm data into splunk
Hello travis thanks for sharing. Can you prepare video about getting windows log with server class using etc. Zero to hero series? I follow you, keep going.👍
Thanks for the words of encouragement and following me. In reply to your suggestion did you get a chance to check out my video around setting up a deployment server to push out technology add-ons and custom apps: th-cam.com/video/Wze0yXsMKVM/w-d-xo.html Let me know if this is what you were looking for or if it was something else.
@@travis-hall I will check asap. You guys deep dive splunk more than us and I love this. Thanks for reply👍
*Promosm*
Hey Travis, this might be an easy request, but how about a video on creating and assigning tags for identifying assets.
Let me write that down and see what I can get done. Currently working on a recording a series of videos that will go from setting up a deployment server, pushing out Splunk apps, ingest metrics data and then basic commands to search metrics data.
I love your videos they are helping me learn so much more about Splunk
Glad to hear you are finding the videos helpful.
nice video
"search on change" - I finally know why I need it. Thanks!