All Posts

tkwaller1 · ‎12-20-2023

The records are linked via ID in the first search its MSGID in the second search its extracted from | rex field=_raw "<EventId>(?<MSGID1>.*)</EventId>"

nehabhuti · ‎12-20-2023

I'm migrating my Splunk Instance from an outdated OS. I want to increase the buffer size for my Splunk forwarder so that it can withstand all the logs when the receiver/ Indexer is down. We are using...

I'm migrating my Splunk Instance from an outdated OS. I want to increase the buffer size for my Splunk forwarder so that it can withstand all the logs when the receiver/ Indexer is down. We are using Splunk version 6.6.0, I'm unable to find relevant documentation for referring to the configuration file changes.

eholz1 · ‎12-20-2023

Hello Members and richgallowy, Thanks for the tip. It has been a while since I have needed to apply my limited "Splunk" skills, I appreciate this suggestion, and will try it out;. Regards, ...

Hello Members and richgallowy, Thanks for the tip. It has been a while since I have needed to apply my limited "Splunk" skills, I appreciate this suggestion, and will try it out;. Regards, EWHolz

VatsalJagani · ‎12-20-2023

@letsgopats39 , @PhoebeOh - Unfortunately, there is no option right now with Dashboard Studio. There is an option with a Simple XML dashboard called "hideSplunkBar" But for Dashboard Studio, the id...

@letsgopats39 , @PhoebeOh - Unfortunately, there is no option right now with Dashboard Studio. There is an option with a Simple XML dashboard called "hideSplunkBar" But for Dashboard Studio, the idea is submitted to add that in the future - https://ideas.splunk.com/ideas/EID-I-1063 (In good news is that the feature is "In Development".) I hope this helps!!! Kindly upvote and accept the answer if this is helpful!!!!

tkwaller1 · ‎12-20-2023

I was thinking something like this would work but its probably not the best way? index=messages* earliest=-2h MSG_src="AAAAA" MSG_DOMAIN="BBBBBB" MSG_TYPE="CC *" | rename MSGID AS MSGID1 | append...

I was thinking something like this would work but its probably not the best way? index=messages* earliest=-2h MSG_src="AAAAA" MSG_DOMAIN="BBBBBB" MSG_TYPE="CC *" | rename MSGID AS MSGID1 | append [search index=messages* MSG_src="CCCCCC", MSG_DOMAIN="DDDDDDD", MSG_TYPE="Workflow Start" | rex field=_raw "<pmt>(?<pmt>.*)</pmt>" | rex field=_raw <EventId>(?<MSGID1>.*)</EventId> | search pmt=EEEEEEE] | stats count by MSGID1 | search count<2 The problem I see in testing is that this triggers on new IDs that have come in but are still within the hour timeframe.

nehabhuti · ‎12-20-2023

Could you please share the docs that specify the maximum value that can be used for maxQueueSize in outputs. conf for Splunk version 6.6.0?

gcusello · ‎12-20-2023

Hi @Bo3432 , as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Inputsconf blacklist requires a regex: blacklist = <regular expression> but also: blacklist = <comma-separ...

Hi @Bo3432 , as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Inputsconf blacklist requires a regex: blacklist = <regular expression> but also: blacklist = <comma-separated list> | key=regex [key=regex] so I prefer to use a full regex containing both the keywors. In your case, you have a multiline log, so you have to add "(?ms)" to the beginning of the regex: (?ms)EventCode\=4769.*TaskCategory\=\w+\s\w+\s\w+\s\w+ that you can test at https://regex101.com/r/ToPGX2/1 Ciao. Giuseppe

Mr_Adate · ‎12-20-2023

Hello Yuanliu, Sorry to bother you again. with your code I am getting values for " ABC.csv + XYZ.csv " and XYZ.csv only file but not getting for ABC.csv only. can help me to get output for n...

Hello Yuanliu, Sorry to bother you again. with your code I am getting values for " ABC.csv + XYZ.csv " and XYZ.csv only file but not getting for ABC.csv only. can help me to get output for not matching count for ABC.csv only data as well ?

Bo3432 · ‎12-20-2023

This is the log. According to the splunk blacklisting documentation ., event codes do not have to be in regex format. LogName=Security EventCode=4769 EventType=0 SourceName=Microsoft-Window...

This is the log. According to the splunk blacklisting documentation ., event codes do not have to be in regex format. LogName=Security EventCode=4769 EventType=0 SourceName=Microsoft-Windows-Security-Auditing Type=Information RecordNumber=642560180 Keywords=Audit Success TaskCategory=Kerberos Service Ticket Operations OpCode=Info Message=A Kerberos service ticket was requested.

imarri · ‎12-20-2023

I'm aiming to develop a Playbook in SOAR Phantom to automate the deletion of containers(using label) older than one week. Can you guide me on which App to utilize for container management and how to ...

I'm aiming to develop a Playbook in SOAR Phantom to automate the deletion of containers(using label) older than one week. Can you guide me on which App to utilize for container management and how to implement appropriate filters in the Action Block?

ITWhisperer · ‎12-20-2023

Will MSGID1 always appear in the first search if it is found in the second search? If so, then the first search should be at least 1 hour longer than the second search, and if MSGID1 is not found in...

Will MSGID1 always appear in the first search if it is found in the second search? If so, then the first search should be at least 1 hour longer than the second search, and if MSGID1 is not found in the first search but is in the second search, then it has taken longer than an hour.

richgalloway · ‎12-20-2023

What links the results of the first search to the results of the second search? Without that, there is no solution to the problem.

richgalloway · ‎12-20-2023

It doesn't make sense to use an equality operator with a multi-select token. Try the IN operator. ... Privacy IN ($privacyFilter$) ...

tkwaller1 · ‎12-20-2023

Hello I have 2 searches that return message ids given certain field values. The first search index=messages* MSG_src="AAAAA" MSG_DOMAIN="BBBBBB" MSG_TYPE="CC *" | rename MSGID AS MSGID1 The s...

Hello I have 2 searches that return message ids given certain field values. The first search index=messages* MSG_src="AAAAA" MSG_DOMAIN="BBBBBB" MSG_TYPE="CC *" | rename MSGID AS MSGID1 The second search index=messages* MSG_src="CCCCCC", MSG_DOMAIN="DDDDDDD", MSG_TYPE="Workflow Start" | rex field=_raw "<pmt>(?<pmt>.*)</pmt>" | rex field=_raw <EventId>(?<MSGID1>.*)</EventId> | search pmt=EEEEEEE The results from the second search could come in up to an hour after the results from the first search. It is not an issue unless it takes over an hour. How can I account for this time delay so I can accurately alert if the span is longer than an hour? Thanks for the help!

richgalloway · ‎12-20-2023

Have you looked at the Datadog Add-on for Splunk (https://splunkbase.splunk.com/app/4163)?

yossisplunk · ‎12-20-2023

In a part of splunk soar (phantom) playbook I would like, in some cases, to send a syslog msg to a remote syslog server. I did not find any well-known app which can help me, so I figure out creating...

In a part of splunk soar (phantom) playbook I would like, in some cases, to send a syslog msg to a remote syslog server. I did not find any well-known app which can help me, so I figure out creating it as a (python) code via "Python Playbook Editor". BUT somehow using the default socket library and the connect + send functions did not work. Listening to all network interfaces did not show any attempt creating the tcp flow to the destination. Could someone help me or show me how can I can open a tcp connection in splunk SOAR

abi2023 · ‎12-20-2023

is It possible to do in Splunk. and What type of logs I need to have in Splunk?

richgalloway · ‎12-20-2023

There are two things you can do. 1) Change the retention period of the indexed data to one day. If necessary, create a new index dedicated to the CSV data. 2) When searching the CSV data, fetch on...

There are two things you can do. 1) Change the retention period of the indexed data to one day. If necessary, create a new index dedicated to the CSV data. 2) When searching the CSV data, fetch only the most recent day. index=foo earliest=-24h

richgalloway · ‎12-20-2023

Splunk HEC does not do callbacks. Clients send data over HTTP and Splunk responds with an HTTP status code. That's it (unless you use ACK, but don't do that).

sekhar463 · ‎12-20-2023

issue there is a json data want to ingest in splunk as i have attached sample data but its getting all in one single event. how we can get as separate events after which is enclosed with { }

All Posts

All Posts

Re: How can I account for delay in response

What is the maximum value for maxQueueSize that can be used in outputs.conf for Splunk version 6.6.0?

Re: Challenge with splunk forwarder and csv file

Re: How can I hide Splunk Bar to the dashbaords made from Dashboard Studio?

Re: How can I account for delay in response

Re: Splunk 6.2.3 Universal Forwarder maxQueueSize: What is the algorithm used to determine the amount of memory to use?

Re: blacklisting event code 4679. TaskCategory=Kerberos Service Ticket Operations

Re: How to compare matching values and their count from two fields from two lookup files

Re: blacklisting event code 4679. TaskCategory=Kerberos Service Ticket Operations

Splunk SOAR Deletion of Container using filter (such as Label of the container and age of the Container)

Re: How can I account for delay in response

Re: How can I account for delay in response

Re: I need to create panel with filter

How can I account for delay in response

Re: Splunk Integration with Datadog

sending a tcp packet as splunk soar action

I want to validate patch work done on windows side how do I verify if all our system are patch?

Re: Challenge with splunk forwarder and csv file

Re: How to integrate Salesforce Marketing Cloud with Splunk

Re: Need help on json data

All Posts

Are you a member of the Splunk Community?

All Posts