Hi @Bo3432 , as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Inputsconf blacklist requires a regex: blacklist = <regular expression> but also: blacklist = <comma-separ...
See more...
Hi @Bo3432 , as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Inputsconf blacklist requires a regex: blacklist = <regular expression> but also: blacklist = <comma-separated list> | key=regex [key=regex] so I prefer to use a full regex containing both the keywors. In your case, you have a multiline log, so you have to add "(?ms)" to the beginning of the regex: (?ms)EventCode\=4769.*TaskCategory\=\w+\s\w+\s\w+\s\w+ that you can test at https://regex101.com/r/ToPGX2/1 Ciao. Giuseppe
Hello Yuanliu, Sorry to bother you again. with your code I am getting values for " ABC.csv + XYZ.csv " and XYZ.csv only file but not getting for ABC.csv only. can help me to get output for n...
See more...
Hello Yuanliu, Sorry to bother you again. with your code I am getting values for " ABC.csv + XYZ.csv " and XYZ.csv only file but not getting for ABC.csv only. can help me to get output for not matching count for ABC.csv only data as well ?
This is the log. According to the splunk blacklisting documentation ., event codes do not have to be in regex format.
LogName=Security
EventCode=4769
EventType=0
SourceName=Microsoft-Window...
See more...
This is the log. According to the splunk blacklisting documentation ., event codes do not have to be in regex format.
LogName=Security
EventCode=4769
EventType=0
SourceName=Microsoft-Windows-Security-Auditing
Type=Information
RecordNumber=642560180
Keywords=Audit Success
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
Message=A Kerberos service ticket was requested.
I'm aiming to develop a Playbook in SOAR Phantom to automate the deletion of containers(using label) older than one week. Can you guide me on which App to utilize for container management and how to ...
See more...
I'm aiming to develop a Playbook in SOAR Phantom to automate the deletion of containers(using label) older than one week. Can you guide me on which App to utilize for container management and how to implement appropriate filters in the Action Block?
Will MSGID1 always appear in the first search if it is found in the second search? If so, then the first search should be at least 1 hour longer than the second search, and if MSGID1 is not found in...
See more...
Will MSGID1 always appear in the first search if it is found in the second search? If so, then the first search should be at least 1 hour longer than the second search, and if MSGID1 is not found in the first search but is in the second search, then it has taken longer than an hour.
Hello I have 2 searches that return message ids given certain field values. The first search index=messages* MSG_src="AAAAA" MSG_DOMAIN="BBBBBB" MSG_TYPE="CC *"
| rename MSGID AS MSGID1 The s...
See more...
Hello I have 2 searches that return message ids given certain field values. The first search index=messages* MSG_src="AAAAA" MSG_DOMAIN="BBBBBB" MSG_TYPE="CC *"
| rename MSGID AS MSGID1 The second search index=messages* MSG_src="CCCCCC", MSG_DOMAIN="DDDDDDD", MSG_TYPE="Workflow Start"
| rex field=_raw "<pmt>(?<pmt>.*)</pmt>"
| rex field=_raw <EventId>(?<MSGID1>.*)</EventId>
| search pmt=EEEEEEE The results from the second search could come in up to an hour after the results from the first search. It is not an issue unless it takes over an hour. How can I account for this time delay so I can accurately alert if the span is longer than an hour? Thanks for the help!
In a part of splunk soar (phantom) playbook I would like, in some cases, to send a syslog msg to a remote syslog server. I did not find any well-known app which can help me, so I figure out creating...
See more...
In a part of splunk soar (phantom) playbook I would like, in some cases, to send a syslog msg to a remote syslog server. I did not find any well-known app which can help me, so I figure out creating it as a (python) code via "Python Playbook Editor". BUT somehow using the default socket library and the connect + send functions did not work. Listening to all network interfaces did not show any attempt creating the tcp flow to the destination. Could someone help me or show me how can I can open a tcp connection in splunk SOAR
There are two things you can do. 1) Change the retention period of the indexed data to one day. If necessary, create a new index dedicated to the CSV data. 2) When searching the CSV data, fetch on...
See more...
There are two things you can do. 1) Change the retention period of the indexed data to one day. If necessary, create a new index dedicated to the CSV data. 2) When searching the CSV data, fetch only the most recent day. index=foo earliest=-24h
Splunk HEC does not do callbacks. Clients send data over HTTP and Splunk responds with an HTTP status code. That's it (unless you use ACK, but don't do that).
issue there is a json data want to ingest in splunk as i have attached sample data but its getting all in one single event. how we can get as separate events after which is enclosed with { }
so initially my source is a SQL based query. i had modified my query by adding 2 new columns. so i ran my source. the dashboard has 2 reports which is linked to index and source (sql query).Their eve...
See more...
so initially my source is a SQL based query. i had modified my query by adding 2 new columns. so i ran my source. the dashboard has 2 reports which is linked to index and source (sql query).Their events are showing 0 from past 6 days. i ran this command |index=<index name> it shows 0 event.
Please explain your full process as you haven't really provided sufficient information to determine what you are doing, what you changed, what your results were before the change, etc.
ok but i have new columns to be added. if i do so the index stops working. so the data is not forwarding to the indexing. is there nay option to run my index again?