Knowledge base

Getting Started (2)

Design, Install and Configuration

Setup (3)

• What usage information is sent back to Gravwell?
• Is Gravwell for structured as well as unstructured data?
• What is an enumerated value?

Administration (1)

• In what order should I upgrade Gravwell?

Ingesters (1)

Configuration (2)

• Is there a way to specify how or what log files are ingested by syslog and the windows agent? Could it only ingest critical and or warnings?
• I have multiple sub folders within a base directory that I want to pull logs from. Do I need to setup multiple followers or can I do that under a single follower?

Searching (3)

Extraction (3)

• I need help configuring a variable in a dashboard. What I have passes the JSON check, but is seen as 2 unnamed variables.
• I am using limit 2 in my search but getting back more than 2 results?
• Help filtering based on SRC values to enumerate all possible SRC values over a time period and searching a subset of events based on SRC as filter.

Processing (4)

• I'm having trouble using the lookup module in my search query
• Can I do a lookup with CIDR notation for IP address ranges?
• How do I match multiple IP addresses?

View all 4

Rendering (1)

• Why do my chart values seem way too high?

Assets (2)

Resources, Files, Kits and Playbooks

Resources (2)

• Will there be an issue if I have multiple scheduled searches updating the same CSV resource?
• How would you go about enriching user names with Microsoft AD attributes like department, name, country, etc?

Playbooks (1)

• Do you have any template dashboards available with the Community Edition?

How To (1)

Tips and Tricks (1)

• Find Gravwell Services

Troubleshooting (2)

Webserver (1)

• What is the error "WebSocket server is unavailable. Check with your administrator"?

Ingesters (1)

• SingleFile ingest error "Failed to wait for hot connection: Connection timeout"