Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About jwalzerpitt
jwalzerpitt
Influencer
Member since:
10-29-2014
01-24-2023
Community Statistics
| Posts | 587 |
| Solutions | 5 |
| Karma Given | 338 |
| Karma Received | 46 |
| Member Since | 10-29-2014 |
Activity Feed
- Got Karma for Is there any chance that someone will update the BlueCat Add-On for Splunk for DHCP logs?. 06-21-2023 11:22 PM
- Posted Re: How to change sourcetype for HEC data input? on Getting Data In. 01-19-2023 05:53 AM
- Karma Re: How to change sourcetype for HEC data input? for scelikok. 01-19-2023 05:50 AM
- Posted How to change sourcetype for HEC data input? on Getting Data In. 01-19-2023 05:23 AM
- Got Karma for Re: Is there any chance that someone will update the BlueCat Add-On for Splunk for DHCP logs?. 01-18-2023 01:58 PM
- Posted Re: Is there any chance that someone will update the BlueCat Add-On for Splunk for DHCP logs? on All Apps and Add-ons. 01-18-2023 12:44 PM
- Karma Re: Is there any chance that someone will update the BlueCat Add-On for Splunk for DHCP logs? for richgalloway. 01-18-2023 12:44 PM
- Posted Is there any chance that someone will update the BlueCat Add-On for Splunk for DHCP logs? on All Apps and Add-ons. 01-18-2023 10:13 AM
- Karma Re: REST API - JSON Invalid format for paulsilver2000. 01-14-2023 07:12 AM
- Karma Re: REST API - JSON Invalid format for ineeman. 01-14-2023 07:07 AM
- Karma Re: REST API - JSON Invalid format for paulsilver2000. 01-14-2023 07:07 AM
- Karma Re: REST API - JSON Invalid format for stephenwmccoy. 01-14-2023 07:07 AM
- Posted Re: How to search JSON data for specific values? on Splunk Search. 01-11-2023 05:18 AM
- Karma Re: How to search JSON data for specific values? for yuanliu. 01-11-2023 05:17 AM
- Posted Re: How to search JSON data for specific values? on Splunk Search. 01-10-2023 05:58 AM
- Posted Re: How to search JSON data for specific values? on Splunk Search. 01-10-2023 05:57 AM
- Karma Re: How to search JSON data for specific values? for yuanliu. 01-10-2023 05:45 AM
- Karma Re: How to search JSON data for specific values? for PickleRick. 01-10-2023 05:45 AM
- Posted Re: How to search JSON data for specific values? on Splunk Search. 01-09-2023 02:00 PM
- Karma Re: How to search JSON data for specific values? for PickleRick. 01-09-2023 01:59 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-16-2018
09:43 AM
outputs.conf defined as follows:
[tcpout:azure]
server = x.x.x.x:9997
indexAndForward = 0
clientCert = opt/splunk/etc/auth/server.pem.
sslPassword = xxxxx
sslVerifyServerCert = false
... View more
02-16-2018
06:24 AM
Thx for the link.
I created a props.conf file as follows:
[azure]
TRANSFORMS-routing=azure
I created a transforms.conf file as follows:
[azure]
REGEX=WinEventLog:Security
DEST_KEY=_TCP_ROUTING
FORMAT=azure
Restarted the splunkd service, and checked the splunkd.log and see the same messages:
02-16-2018 09:01:17.183 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:65235. Read Timeout Timed out after 600 seconds.
02-16-2018 09:01:17.183 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:56929. Read Timeout Timed out after 600 seconds.
02-16-2018 09:01:17.183 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:59042. Read Timeout Timed out after 600 seconds.
02-16-2018 09:11:18.196 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:49407. Read Timeout Timed out after 600 seconds.
02-16-2018 09:11:18.196 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:57472. Read Timeout Timed out after 600 seconds.
02-16-2018 09:11:18.196 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:59586. Read Timeout Timed out after 600 seconds.
02-16-2018 09:21:19.214 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:49969. Read Timeout Timed out after 600 seconds.
02-16-2018 09:21:19.214 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:58009. Read Timeout Timed out after 600 seconds.
02-16-2018 09:21:19.214 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:60157. Read Timeout Timed out after 600 seconds.
... View more
02-15-2018
12:28 PM
I am seeing the following errors in the splunkd.log on server A:
02-15-2018 15:20:50.704 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:58553. Read Timeout Timed out after 600 seconds.
02-15-2018 15:20:50.704 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:63109. Read Timeout Timed out after 600 seconds.
02-15-2018 15:20:51.972 -0500 ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:61772. Read Timeout Timed out after 600 seconds.
I have the Microsoft Add-on installed on the Azure Splunk instance and the indexes.conf reads:
[windows]
homePath = $SPLUNK_DB/windows/db
coldPath = $SPLUNK_DB/windows/colddb
thawedPath = $SPLUNK_DB/windows/thaweddb
[wineventlog]
homePath = $SPLUNK_DB/wineventlog/db
coldPath = $SPLUNK_DB/wineventlog/colddb
thawedPath = $SPLUNK_DB/wineventlog/thaweddb
[perfmon]
homePath = $SPLUNK_DB/perfmon/db
coldPath = $SPLUNK_DB/perfmon/colddb
thawedPath = $SPLUNK_DB/perfmon/thaweddb
Thx
... View more
02-15-2018
11:58 AM
Modified the domain controller to send Windows security event logs to server A (HF). In Wireshark I see traffic coming into port 9997 from the domain controller and on the Azure Splunk server I see traffic from server A via tcpdump on port 9997, but the winevt index is not being populated. The inputs.conf file on Azure Splunk is as follows:
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
index = wineventlog
renderXml=false
With that, where can I troubleshoot to see if the logs are being sent on by server A, or if there is an error/failure on server A?
Thx
... View more
02-15-2018
06:10 AM
I am going to test later today - I will update this thread after I test
Thx
... View more
02-15-2018
05:55 AM
1 Karma
I have the following Splunk architecture
Server A has Splunk installed. It also has Sysmon installed, which I am forwarding to our on-prem Splunk instance. I'd like to configure Server A to function as a heavy forwarder so I can forward Windows Security Event logs from a Domain controller and then route them (not index on Server A) to our Splunk instance on Azure.
I've been reviewing docs and other questions/answers to try and configure my inputs and outputs.conf file correctly and here is what I have:
outputs.conf
[tcpout]
defaultGroup = default-autolb-group
indexAndForward = 0
[tcpout:default-autolb-group]
server = splunk-onprem:9997
[tcpout-server://splunk-onprem:9997]
[tcpout:azure]
server = x.x.x.x:9997
indexAndForward = 0
clientCert = opt/splunk/etc/auth/server.pem.
sslPassword = xxxxxxxxxx
sslVerifyServerCert = false
inputs.conf
[default]
host = servername
[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = false
renderXml = 1
index=sysmon
[WinEventLog://Security]
_TCP_ROUTING = azure
I believe the outputs.conf file is good, but not sure about the inputs.conf file.
Any help would be greatly appreciated
Thx
... View more
02-14-2018
01:27 PM
Thx for the reply and information
... View more
02-14-2018
08:52 AM
Does the Splunk Add-on for Microsoft Cloud Services support ingesting Azure AD Identity Protection Risk events?
Thx
... View more
02-12-2018
11:42 AM
I found one problem in that the index I was using was having an issue in general with listing the lat/lon fields, so I used a different index.
1) For the new index, when I remove the sort and table commands, iplocation fields (including lat/lon) are poresent
2) I do see IPs in the stream / when I run the following search index=foo sourcetype=foo tag=success src_ip!=10* src_ip!=127.0.0.1
| sort - _time
| iplocation src_ip
| eval short_lon=round(lon, 2)
| eval short_lat=round(lat, 2)
| strcat short_lat "," short_lon as latlon
| where isnotnull(lat)
| rename _time as time
| streamstats current=f global=f window=1 first(lat) as next_lat first(long) as next_long first(time) as next_time first( ip) as next_ip first(country) as next_country first(state) as next_state by user , I see IPs
3) The IPs are publicly routable (I am excluding RFC1918 IP space)
4) the mddb does have the appropriate permissions for the search instance to access it / set to -rw-rw-r--
Thx
... View more
02-12-2018
09:11 AM
I have a single instance of Splunk running, but I did update the MDDB file (from 12/2017 to 02/2018) and re-ran the search | iplocation allfields=true ip
| sort _time
| table lat lon , but still not getting the lat or lon fields
... View more
02-12-2018
08:21 AM
Thx - adding | search last_latlon!="," got rid of the error, but as I was digging into this a little more, I noticed that the iplocation command is not returning lat or lon for me, When I run:
index=foo
| iplocation allfields=true ip
| sort _time
| table lat lon
I'm not seeing either field
Thx
... View more
02-12-2018
07:51 AM
I found the following search utilizing the haversine app that looks for anomalous logins re: speed/distance:
| iplocation ip
| sort _time
| strcat lat "," lon latlon
| streamstats current=f global=f window=1 last(latlon) as last_latlon
| eval last_latlon=if(isnull(last_latlon), latlon, last_latlon)
| streamstats current=f global=f window=1 last(_time) as last_ts
| eval time_since_last = _time - last_ts
| eval time_since_last=if(isnull(time_since_last), 0, time_since_last)
| haversine originField=last_latlon outputField=distance units=mi latlon
| eval speed=if(time_since_last==0, 0, (distance/(time_since_last/60/60)))
| where speed > 500
| strcat speed " MPH" speed
| table username, distance, _time, time_since_last, speed, _raw
However, when I run it, I get the following error:
command="haversine", Origin value malformed. Received ',' - expected origin='x,y' as a value represented using decimal degree notation, (e.g. '-41.22,80.22').
How do I modify the line to allow the search to run
Thx
... View more
02-07-2018
06:19 AM
Thx Yunagi - that was it!
... View more
02-07-2018
06:16 AM
I ran | inputlookup ip_cidr.csv on both instances and I'm seeing the same results - 2,439 results - on both instances.
Thx
... View more
02-07-2018
05:51 AM
I'm seeing a weird issue - I have two Splunk instances, one for prod and one for dev. I have a lookup created that looks for an IP and then compares it to the lookup list to see what CIDR it falls into and then extracts the firewall zone it's in. Here's a search I run in prod that works (returns the firewall zone):
index=foo sourcetype="foo"
| lookup ip_cidr.csv cidr_range as IP_Address
| eval firewall=coalesce(firewall,"null")
| eval context=coalesce(context,"null")
| eval zone=coalesce(zone,"null")
| stats count by IP_Address,zone
| fieldformat count=tostring(count,"commas")
| sort -count
I get a list of IPs with the zone and the count
On dev, I'm running a similar search against our DNS logs:
index=bind `dns_whitelist`
| lookup ip_cidr.csv cidr_range as src
| eval firewall=coalesce(firewall,"null")
| eval context=coalesce(context,"null")
| eval zone=coalesce(zone,"null")
| stats count by src,zone,query
| fieldformat count=tostring(count,"commas")
| sort -count
However, for this search the zone is returned as "null" for every IP. I verified the permissions for both the lookup file and the lookup definition and they're both set to Global and All apps.
I'm just at a loss as to what the difference is between the two. Any help would be appreciated.
Thx
... View more
02-01-2018
11:00 AM
Thx - that worked perfectly!
... View more
02-01-2018
10:05 AM
1 Karma
I have the following search:
index="foo" EventCode=*
| lookup windows_signatures.csv signature_id AS EventCode OUTPUT signature
| stats count by EventCode, signature
How do I see the events related to the field EventCode that doesn't have a corresponding signature in the lookup file?
I currently see the following:
EventCode signature count
4624 An account was successfully logged on 259296
4634 An account was logged off 255921
4672 Special privileges assigned to new logon 251320
but I want to see all EventCode events whether they have a signature field or not:
EventCode signature count
4624 An account was successfully logged on 259296
4634 An account was logged off 255921
6 254891
4672 Special privileges assigned to new logon 251320
Thx
... View more
01-31-2018
09:14 AM
Thx again!
... View more
01-31-2018
09:09 AM
One last question - is it possible to just forward the logs on without storing them on the heavy forwarder?
Thx
... View more
01-31-2018
08:11 AM
Thx for the info - much appreciated
... View more
01-31-2018
07:59 AM
We currently use nxlog on our Windows domain controllers to forward logs one destination.
With nxlog I can forward the logs to another destination and I'd like to forward the Windows event logs to our Splunk instance in Azure. With that, can I forward the domain controller logs to an on-prem heavy forwarder and then have the heavy forwarder forward the domain controller logs to Splunk in Azure?
Basically, can the heavy forwarder function as both a receiver and forwarder?
Thx
... View more
01-18-2018
08:48 AM
Apologizes as diving into this more I finally realized your point on making sure the time picker is set correctly. Once I got that right, everything worked expected.
Thx again for the help!
... View more
01-10-2018
11:23 AM
I have 1,087,163 million events for yesterday:
_time
count
2018-01-09 00:00 65
2018-01-09 01:00 57
2018-01-09 02:00 38
2018-01-09 03:00 12
2018-01-09 04:00 3
2018-01-09 05:00 71
2018-01-09 06:00 11
2018-01-09 07:00 6
2018-01-09 08:00 1701
2018-01-09 09:00 48821
2018-01-09 10:00 46659
2018-01-09 11:00 68360
2018-01-09 12:00 76469
2018-01-09 13:00 83794
2018-01-09 14:00 81029
2018-01-09 15:00 85605
2018-01-09 16:00 84611
2018-01-09 17:00 90232
2018-01-09 18:00 93578
2018-01-09 19:00 88134
2018-01-09 20:00 86039
2018-01-09 21:00 73613
2018-01-09 22:00 48728
2018-01-09 23:00 29527
... View more
01-10-2018
11:08 AM
I do have the app installed already
Thx
... View more
01-10-2018
10:32 AM
Not dumb at all as I'm sure that has killed many search!
I do have the time picker set to "Last 24 hours". Changing it to "Last 7 days," I'm still not seeing what I would expect. It's not breaking down yesterday's event count per hour, just providing an overall count for the day.
Thx
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-24-2023
11:36 AM
|
Karma given to
