Splunk Search

Need an help to create a SPL's.



Could any one pls figure out from these below logs to achieve the use case like when we launch rdp,proxy from secretserver, we are seeing some drop in the connection eg. like look for error and handshake in logs

sample event for client

2024-01-12 05:03:37,391 [CID:] [C:] [TID:197] ERROR Thycotic.RDPProxy.CLI.Session.ProxyConnection - Error encountered in RDP handshake for client - (null)
System.Exception: Assertion violated: stream.ReadByteInto(bufferStream) == 0x03
at Thycotic.RDPProxy.ContractSlim.Assert(Boolean condition, String conditionStr, String actualStr)
at Thycotic.RDPProxy.Readers.ConnectionRequestProvider.ReadConnectionRequest(Stream stream, AuthenticationState clientState)
at Thycotic.RDPProxy.CLI.Session.ProxyConnection.<DoHandshakeAndForward>d__20.MoveNext()

sample event for user

2024-01-12 05:02:11,920 [CID:] [C:] [TID:266] ERROR Thycotic.DE.Feature.SS.RdpProxy.EngineRdpProxySessionService - An error was encountered while attempt to fetch proxy credentials for user 'chrisbronet' - (null)

another usecase is like the discovery process from ad to secretserver eg, scan ad and finds the local id creates the id and pwd in to the secret server.

sample events:


2024-01-11 23:39:36,183 [CID:] [C:] [TID:83] ERROR Thycotic.Discovery.Sources.Scanners.Dependency.ApplicationPoolScanner - WMI (IIS) Unable to connect to xyzwin.abc.com with Exception System.Threading.ThreadAbortException: Thread was being aborted.
at System.Management.IEnumWbemClassObject.Next_(Int32 lTimeout, UInt32 uCount, IWbemClassObject_DoNotMarshal[] apObjects, UInt32& puReturned)
at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
at Thycotic.Discovery.Sources.Scanners.Dependency.ApplicationPoolScanner.<>c__DisplayClass10_0.<IsIisRunningWmi>b__0(Object x) - (null)


2024-01-11 23:29:47,675 [CID:] [C:] [TID:PriorityScheduler Thread @ Normal] ERROR Thycotic.Discovery.Sources.Scanners.MachinePreDiscoveryTester - Could not connect to xyx.win.abc.com with port pre-check. Please open port(s) [135, 445] - (null)


2024-01-11 23:32:32,163 [CID:] [C:] [TID:PriorityScheduler Elastic Thread @ Normal] ERROR Thycotic.Discovery.Sources.Scanners.Dependency.ApplicationPoolScanner - Service Controller (IIS) Unable to connect to xyz.win.abc.com with Exception System.InvalidOperationException: Cannot open W3SVC service on computer 'xyz.win.abc.com'. ---> System.ComponentModel.Win32Exception: Access is denied --- End of inner exception stack trace --- at System.ServiceProcess.ServiceController.GetServiceHandle(Int32 desiredAccess) ... 1 line omitted ... at System.ServiceProcess.ServiceController.get_Status() at Thycotic.Discovery.Sources.Scanners.Dependency.ApplicationPoolScanner.IsIisRunningServiceController() - (null)



Labels (5)
0 Karma


These all seem to have the word ERROR in so just include that in your search

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...