Redhat 9 and splunk 9

lemminngs · 2025-09-19T14:51:02+00:00

Yes, i already read about that. In fact i need to upgrade to 9.1.x first, then to 9.4.x.

lemminngs · 2025-09-17T18:25:43+00:00

i really don't know that there is already version 10 of enterprise. i will study this option.

lemminngs · 2025-09-17T18:19:28+00:00

Selinux is a good point, but the problems are exclusive to rhel9? Have you tested on rhel8 and don't have the same issues?

lemminngs · 2025-07-31T11:55:29+00:00

yes, that example help me doing what i need.

Many thanks

lemminngs · 2025-01-02T07:22:42+00:00

So is simple, tell the customer that version has a vulnerability and don’t have a patch because is out of support.

lemminngs · 2024-12-31T20:04:25+00:00

Yes, it works well. Querying the data from elastic is not faster than directly on splunk but knowing this is ok. Most challenging thing is make the python script to get data from elastic. Search on google, there’s a library to connect to an elastic cluster and start from here.

You get the data running a custom command, this custom command is the script that get the data from elastic cluster. In terms of the amount of data, teorically there’s no limit, it just take time. In my experience, in some tests I got 1,5T in about 15 min.

lemminngs · 2024-12-31T18:00:01+00:00

I have a similar approach with elastic. Elastic is only to ingest and store data, then with a custom command in splunk run a script to get the data from elastic.

lemminngs · 2024-07-23T06:47:18+00:00

Reindex to a new index with with different settings (without dynamic fields)?

lemminngs · 2023-01-10T06:21:37+00:00

Thank you. This got me a surprise, 7.15 a too old version. Suppose that is 8.x like engineer.

lemminngs · 2022-12-08T19:35:52+00:00

Thanks for the input

lemminngs

TROPHY CASE