Hello
I'm getting started with Splunk but my environment was set by another person.
I keep reading strange events from cisco IPS, when I select "show source" something like this appears:
1358522528604486000 eventid="1337599901669938718" trigger_packet="AABeAAEB+GbyxMzPCABFAABPfDlAAIAG
rNXABgFaCrUFhQG9CIKTXK915Wedu1AY/RjWLgAAAAAAI/9TTUJzbQAAwJgH
yAAAQlNSU1BZTCAAAAAA//4A6IAAAAAA" trigger_packet_details="=00=00^=00=01=01=F8f=F2=C4=CC=CF=08=00E=00=00O|9@=00=80=06=AC=D5=C0=06=01Z
=B5=05=85=01=BD=08=82=93\=AFu=E5g=9D=BBP=18=FD=18=D6.=00=00=00=00=00#=FFSMB=
sm=00=00=C0=98=07=C8=00=00BSRSPYL =00=00=00=00=FF=FE=00=E8=80=00=00=00=00"
Those lines account for 5 events in the search app. I can't make any sense of that. Is it an expected log? In that case what does it means?
Thanks
Hi again!
The best solution I found was updating the application to the latest version. From the changelog:
Now it works like a charm (even tough I had to uninstall the app completely and install the new version) and I get more features like a decent timestamp.
Thanks to everyone.
Hi again!
The best solution I found was updating the application to the latest version. From the changelog:
Now it works like a charm (even tough I had to uninstall the app completely and install the new version) and I get more features like a decent timestamp.
Thanks to everyone.
hHey glmartin,
Most likely what you are seeing is packet captures which are present in the events being pulled via SDEE. There isn't an option in the Splunk app to ignore packet data, but if you look for a line like this:
syslog_msg = syslog_msg + packet_info
change it to:
# syslog_msg = syslog_msg + packet_info
To comment it out. Realize, however, that if you comment it out, if you upgrade the version of the App, you will need to comment it out again.
Hope that helps,
Dave
Hello Dave
Thanks a lot for our answer I'll try that as soon as possible.
However I'd like to keep the packet info, but tightly coupled to an event, maybe having one or more fields containing the same information. It would greatly improve the analysis of the data.
Thanks again!