All Posts

iamryan · ‎11-07-2023

Hi @bora.min, This issue deals with sensitive information. I'm going to send you a Private Message right now with some next steps. Please check your Inbox.

richgalloway · ‎11-07-2023

This probably should be a new question. The solution is to add a monitor stanza to an inputs.conf file in the UF. [monitor://C:\Program Files\Thycotic Software\log\xyz.log] index = foo sourcetype =...

This probably should be a new question. The solution is to add a monitor stanza to an inputs.conf file in the UF. [monitor://C:\Program Files\Thycotic Software\log\xyz.log] index = foo sourcetype = bar

Helios · ‎11-07-2023

index=* OR index=_* earliest=" + last_scan + " lastest =" + now + " | append [ | mpreview index=*_metrics ] | fields - _bkt, _cd, _serial, _si

Helios · ‎11-07-2023

forgot to put the query currently running index=* OR index=_* | append [ | mpreview index=*_metrics ] | fields - _bkt, _cd, _serial, _si

AL3Z · ‎11-07-2023

Hi @richgalloway , How we can get logs stored on our Secret Server Distributed Engine servers. They already have the universal forwarder installed on them. We would like these logs to be available i...

Hi @richgalloway , How we can get logs stored on our Secret Server Distributed Engine servers. They already have the universal forwarder installed on them. We would like these logs to be available in Splunk as well. The logs are stored in the following location: C:\Program Files\Thycotic Software \log and the file is xyz.log. Thanks..

ITWhisperer · ‎11-07-2023

| rex "(?<username>[^:]+):(?<passwd>[^:]+):(?<path>[^:]+)"

Hema_Nithya · ‎11-07-2023

How to highlight empty fields in the dashboard in colours . Simple step pls

Hema_Nithya · ‎11-07-2023

John:x:/home/John:/bin/bash is there a way to extract the field from above with colon separated. We have many users in the above format from /etc/passwd John - username x - passwd /ho...

John:x:/home/John:/bin/bash is there a way to extract the field from above with colon separated. We have many users in the above format from /etc/passwd John - username x - passwd /home/John - path

gcusello · ‎11-07-2023

Hi @Splunkerninja , the only way to have different retention policies is to store logs in different indexes. Usually you choose to have different indexes based on two parameters: retention policy a...

Hi @Splunkerninja , the only way to have different retention policies is to store logs in different indexes. Usually you choose to have different indexes based on two parameters: retention policy and Access Grants. You cannot have different retention policies on data in the same index. This means that you have to create a rule on your Indexers or (if present) on Heavy Forwarders to override the default index value. Ciao. Giuseppe

Splunkerninja · ‎11-07-2023

@gcusello @richgalloway @ITWhisperer ++ ++ Any suggestions please?

richgalloway · ‎11-07-2023

Use the strptime function to convert text timestamps into epoch format. Then use strftime to convert epoch timestamps into human-readable form. | eval epochTime=strptime(plugin_date, "%Y%m%d%H%M") ...

Use the strptime function to convert text timestamps into epoch format. Then use strftime to convert epoch timestamps into human-readable form. | eval epochTime=strptime(plugin_date, "%Y%m%d%H%M") | eval humanTime=strftime(epochTime, "%Y-%m-%d %H:%M")

Splunkerninja · ‎11-07-2023

We are indexing email metadata logs from various regions (china,US,Mexico,Italy) in Splunk Cloud. The retention policy of these metadata logs is 270 days. We want to change the retention policy of f...

We are indexing email metadata logs from various regions (china,US,Mexico,Italy) in Splunk Cloud. The retention policy of these metadata logs is 270 days. We want to change the retention policy of few of the regions. For example, we want to store China metadata logs only for 30 days and all other logs for 270 days. How to achieve this? Appreciate any kind of input here.

splunkthat · ‎11-07-2023

In my splunk search for getting the date of Nessus plugins feed version used in a scan I get the number returned in the orginal format used of year-month-date-time (for example November 7th 2023 at 1...

In my splunk search for getting the date of Nessus plugins feed version used in a scan I get the number returned in the orginal format used of year-month-date-time (for example November 7th 2023 at 1200 would display as 202311071200) that I would like to convert into a readable format that I can then manipluate in splunk such as if i want to get the epoch time. How would I go about doing this?

ITWhisperer · ‎11-07-2023

No, the number after the slash / denotes how many significant bit are to be compared when the addresses are converted to binary. There are 32 bits in the binary representation of an IPv4 address, so,...

No, the number after the slash / denotes how many significant bit are to be compared when the addresses are converted to binary. There are 32 bits in the binary representation of an IPv4 address, so, for example, /24 means just compare the first 24 bits of the addresses. This is equivalent to ignoring the last byte or masking with 0xFFFFFF00, or shifting right by 8 bits (32 - 24)

yoshileigh66 · ‎11-07-2023

Apparently my Google-Fu isn't the best and I can't find an explanation. Can someone please enlighten me? I have a lookup table that looks like this: CIDR, ip_address 24, 1.2.3.4/24 23, 5.6.7.8/...

Apparently my Google-Fu isn't the best and I can't find an explanation. Can someone please enlighten me? I have a lookup table that looks like this: CIDR, ip_address 24, 1.2.3.4/24 23, 5.6.7.8/23 I wanted events with source ips that match the ip addresses in the lookup table with destination ips that do not match the ip addresses in the lookup table. I ran the following query, and this appears to work (unless its actually not??) index="index1" | lookup lookup1 ip_address as src_ip OUTPUTNEW ip_address as address | where dest_ip!=address My confusion stems from the fact that ip_address is in CIDR notation. The way my mind is processing this query is that a new field called address is created, and the value of dest_ip is compared against the value of address. However, the value of address is in CIDR notation, and dest_ip is not. Is address treated as a list and the value of dest_ip is checked against each item in the list?

FelixLeh · ‎11-07-2023

As far as I can tell your configuration checks out. The problem could be that the input for salesforce is over an API/Script. Different types of inputs behave differently with the configurations and ...

As far as I can tell your configuration checks out. The problem could be that the input for salesforce is over an API/Script. Different types of inputs behave differently with the configurations and some even skip certain parts of the pipeline. If it was a normal Monitoring Input and your mentioned configuration is on the indexer everything should work. I have to gather more info myself regarding the transformation of the API inputs to help you further on this.

gjhaaland · ‎11-07-2023

Hi, I have created a Cluster Map that show number of counts based on number of ASA blocked actions. The circle size is based on number of hits. A bigger circle represent more counts than a small ...

Hi, I have created a Cluster Map that show number of counts based on number of ASA blocked actions. The circle size is based on number of hits. A bigger circle represent more counts than a small circle. So far so good. It looks ok, but would be even better if I could change color based on number of counts/hits. Is it also possible change color based on destination portnumber (80,23,22++) Thanks Geir

martaBenedetti · ‎11-07-2023

I've tried props.conf and transforms.conf both on Heavy Forwarder where the add-on is installed and on indexers with no succeed, it seems that are ignored anche all the event_type are being collected...

I've tried props.conf and transforms.conf both on Heavy Forwarder where the add-on is installed and on indexers with no succeed, it seems that are ignored anche all the event_type are being collected. This is the splunk doc I've followed: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest transforms.conf [setnull_EVENT_TYPE] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing_EVENT_TYPE] REGEX = EVENT_TYPE\=\"LightningPageView\" DEST_KEY = queue FORMAT = indexQueue props.conf [sfdc:logfile] TRANSFORMS-setEventType = setnull_EVENT_TYPE, setparsing_EVENT_TYPE This is a sample log: 2023-11-06T22:58:22.108+0000 SFDCLogType="LightningPageView" SFDCLogId="aaaa" SFDCLogDate="2023-11-06T00:00:00.000+0000" EVENT_TYPE="LightningPageView" TIMESTAMP="20231106225822.108" REQUEST_ID="TID:aaaa" ORGANIZATION_ID="aaaa" USER_ID="aaaa" CLIENT_ID="" SESSION_KEY="aaaa" LOGIN_KEY="aaaa/aaaa" USER_TYPE="Standard" APP_NAME="aaaa:aaaa" DEVICE_PLATFORM="SFX:BROWSER:DESKTOP" SDK_APP_VERSION="" OS_NAME="WINDOWS" OS_VERSION="10" USER_AGENT=""Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0"" BROWSER_NAME="EDGE" BROWSER_VERSION="119" SDK_VERSION="" DEVICE_MODEL="" DEVICE_ID="" SDK_APP_TYPE="" CLIENT_GEO="Italy/Rome" CONNECTION_TYPE="" UI_EVENT_ID="ltng:pageView" UI_EVENT_SOURCE="" UI_EVENT_TIMESTAMP="1699311501485" PAGE_START_TIME="1699310036553" DURATION="588.0" EFFECTIVE_PAGE_TIME_DEVIATION="false" EFFECTIVE_PAGE_TIME_DEVIATION_REASON="" EFFECTIVE_PAGE_TIME_DEVIATION_ERROR_TYPE="" EFFECTIVE_PAGE_TIME="588.0" DEVICE_SESSION_ID="aaaa" UI_EVENT_SEQUENCE_NUM="22" PAGE_ENTITY_ID="" PAGE_ENTITY_TYPE="Case" PAGE_CONTEXT="force:objectHomeDesktop" PAGE_URL="/lightning/o/Case/list?filterName=Recent" PAGE_APP_NAME="LightningService" PREVPAGE_ENTITY_ID="aaaa" PREVPAGE_ENTITY_TYPE="Case" PREVPAGE_CONTEXT="one:recordHomeFlexipage2Wrapper" PREVPAGE_URL="/lightning/r/Case/aaaa/view" PREVPAGE_APP_NAME="LightningService" TARGET_UI_ELEMENT="" PARENT_UI_ELEMENT="" GRANDPARENT_UI_ELEMENT="" TIMESTAMP_DERIVED="2023-11-06T22:58:22.108Z" USER_ID_DERIVED="aaaa" CLIENT_IP="xxx.xxx.xxx.xxx" UserAccountId="aaaa" SplunkRetrievedServer="https://aaaa.my.salesforce.com"

gcusello · ‎11-07-2023

Hi @TISKAR , I never saw this issue. Open a case to Splunk Support. Ciao. Giuseppe

gcusello · ‎11-07-2023

Hi @beneteos , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated

All Posts

All Posts

Re: How can I reset the Saas service root admin password?

Re: How do we Parse logs of Secret Server in Splunk Cloud

Re: missing ~49 minutes of events out of 1 hour scheduled cron job with savedsearches

Re: missing ~49 minutes of events out of 1 hour scheduled cron job with savedsearches

Re: How do we Parse logs of Secret Server in Splunk Cloud

Re: Is there a way to extract fields which is : separated

Highlight empty fields in color

Is there a way to extract fields which is : separated

Re: How to change the retention of policy of metadata logs based on region

Re: How to change the retention of policy of metadata logs based on region

Re: Convert date and time bunched together to a readable date

How to change the retention of policy of metadata logs based on region

Convert date and time bunched together to a readable date

Re: Why does this work: lookup, outputnew

Why does this work: lookup, outputnew

Re: How to filter out the EVENT_TYPE in sfdc:logfile using Splunk Add on for Salesforce?

Cluster map

Re: How to filter out the EVENT_TYPE in sfdc:logfile using Splunk Add on for Salesforce?

Re: Why I can't access to savedsearch page or authentication user page?

Re: Install Monitoring Console on the Search Head node in distributed mode

All Posts

Are you a member of the Splunk Community?

All Posts