About xpac

xpac · ‎05-16-2018

Hey, there is a good explanation in the "Set a retirement and archiving policy" part of the docs. Those settings can be configured per index, and you're most likely looking for frozenTimePeriodInSecs , which defaults to ~6 years, after which (by default) the data is deleted. You also have to make sure that your index maximum size is big enough, because Splunk will delete data earlier when an index reaches it's maximum size. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-16-2018

Could you elaborate on the exact message you get? If possible, try Chrome, because it usually shows a more detailed error message.

xpac · ‎05-16-2018

Could you give an example what you're already doing, your data, your lookup, your expected output, etc?

xpac · ‎05-16-2018

You wanna read this chapter of the docs. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-16-2018

Hey, When you setup a file monitor, data is ingested ASAP, which means real time, maybe a few seconds delay. If you search for it or not doesn't matter at all.

xpac · ‎05-16-2018

Summary of our discussion: What you intend to do is not possible with Splunk. Splunk does not allow to store data without indexing, e.g. without counting it against your license. A possible solution would be to have syslog-ng (or another daemon) write those logs to disk, where you can search and process them using common Linux tools like grep. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-16-2018

Then this is going to be your solution (like, having syslog-ng or another daemon write to disk). When Splunk stores data to disk, it always indexes them. There is no other way.

xpac · ‎05-16-2018

So - you want to collect (ingest) data, then parse (preprocess) it, and then? Drop some of them? We seem to have a misunderstanding in what your actual requirement is - maybe you can rephrase what you want to do?

xpac · ‎05-16-2018

If you don't index data, it's not stored. It is completely lost. Parsing is only the step that comes before indexing - preprocessing the data, that means. Are you aware of that?

xpac · ‎05-16-2018

Disabling SSL Certificate validation (in almost any product) usually means, do not: Check if hostname and certificate SAN match Check if the CA that issued the certificate is trusted Check if the certificate has expired or has been revoked Actually, it means "Do encryption, but don't care at all about who is on the other side - if the other side supports encryption, encrypt it."

xpac · ‎05-16-2018

Also, you might want to start using a service like regex101.com. It would've shown you that your regex has invalid syntax. 🙂

xpac · ‎05-16-2018

Best practice hint: Always set up timestamp recognition for your data, don't let Splunk guess. It will not only save you trouble like this, but maybe even more in the future - because Splunk might recognize that timestamp as "day 1 of month 3", as well as "day 3 of month 1".

xpac · ‎05-16-2018

Hint: Responses might be much more helpful if you'd give more details, e.g. what "having bad time" exactly means. Like, error messages, expected vs. observed behavior, etc.

xpac · ‎05-16-2018

Maybe... you only want to collect and parse them, and then forward them somewhere else? I'm as confused as @niketnilay.

xpac · ‎05-15-2018

I'm sorry, I literally assumed that this was possible as with almost all other inputs, but you're right. Do you, by any chance, have an HF/SH available that's not yet running HEC that you could use for such a test?

xpac · ‎05-15-2018

I'm not sure if I remember correctly, but did you try putting an AND between Cisco_IOS_Event.product="IOS" and index=* ?

xpac · ‎05-15-2018

Did you try to setup a second HEC input with SSL disabled, just for testing? This way you could keep SSL for those that already work.

xpac · ‎05-15-2018

Can you please show the exact browser error? Which browser is this? Also, which ports are you using for http/https?

xpac · ‎05-15-2018

Hey, most likely, you are experiencing this issue because your browser is configured to not accept untrusted connections. By default, Splunk ships with a self-signed default certificate, that is not trusted by any system and should be replaced (at least on production instances). Therefore, if you replace that certificate with a valid one, or are able to tell your browser to ignore it, you should be able to proceed. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-15-2018

As you're on Windows - use netstat -a to actually show listening ports - it doesn't show them by default. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-15-2018

Your problem is that America/Chicago is not really a valid timezone information that Splunk can handle - it uses things like +06:00 or GMT . You can see what is usually accepted on pages like strftime.org or the proper Splunk docs. In this case, it seems to be Java that parses the timestamps, however their documentation shows the same. Therefore - you might be able to have the database or the SQL query string set up in a way that returns the proper format. Else, I don't know a way to fix this on the DB Connect/Splunk side... Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-15-2018

Hey, I haven't used DUO with Splunk yet, but have used DUO as additional protection for SSH logins. There, you could exclude certain user accounts, or source IPs from having to use the DUO two-factor. It was simply available in the DUO admin interface on their website - look for something like bypass. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-15-2018

So... you're talking about a TA/app you downloaded? Or something you built yourself? There's a bunch of information missing...

xpac · ‎05-15-2018

Yeah, the different " , “ are the devil's work and should be avoided (looking at you, MS Word!). We should however do those UTF-8 things more often, test where Splunk breaks and then get it fixed, because, standards! ;D

xpac · ‎05-15-2018

As @FrankVI also said, your problem is most likely based on broken timestamp recognition. Do you read that file locally, or is it send to you via syslog?

Posts	467
Solutions	70
Karma Given	143
Karma Received	147
Member Since	‎04-29-2018

Online Status	Offline
Date Last Visited	‎01-18-2024 07:01 AM

Re: Can i define the time to search logs in colddb...

Re: Installed 3rd party cert yet I'm still getting...

Re: data model and lookup table

Re: How to use a lookup table in a Splunk query?

Re: Can you monitor a keyword on logs in real time...

Re: How can I collect (and/or parse) data without ...

Re: How can I collect (and/or parse) data without ...

Re: How can I collect (and/or parse) data without ...

Re: How can I collect (and/or parse) data without ...

Re: Disable SSL validation Tenable add-on

Re: how to capture 2 slightly different pattern of...

Re: Splunk does not pickup custom timestamp prior ...

Re: McAFee DLP logs into splunk.

Re: How can I collect (and/or parse) data without ...

Re: Troubleshooting failure to process HTTP Event ...

Re: Tenant / index on Overview page tanking search...

Re: Troubleshooting failure to process HTTP Event ...

Re: Why does the Azure Instance of Splunk won't ac...

Re: Why does the Azure Instance of Splunk won't ac...

Re: How to configure a receiver to listen on port ...

Re: How to configure time in Splunk DB Connect and...

Re: How does DUO authentication for SPLUNK work?

Re: How to add the destination port value for a fi...

Re: Unicode characters in dashboards/searches

Re: Problem with monitor file

Join the Conversation