Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About alemarzu
alemarzu
Motivator
Member since:
03-10-2014
11-22-2024
Community Statistics
| Posts | 321 |
| Solutions | 35 |
| Karma Given | 35 |
| Karma Received | 49 |
| Member Since | 03-10-2014 |
Activity Feed
- Posted Re: How to Identify which HF is sending logs/metrics on Getting Data In. 11-22-2024 07:47 AM
- Got Karma for Re: How to split data into separate sourcetypes with transforms. 07-16-2024 01:04 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 05-25-2022 08:23 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 04-11-2022 10:45 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 01-06-2022 10:44 AM
- Posted Re: Windows Eventlog Blacklist Failing on Getting Data In. 06-09-2021 08:52 AM
- Posted Re: Using regex in field extraction on Splunk Search. 06-09-2021 08:40 AM
- Posted Re: CSVファイルのデータが一部文字化けして欠損する on Monitoring Splunk. 06-08-2021 02:43 PM
- Posted Re: Failed to load source for Event Timeline Viz visualization on Dashboards & Visualizations. 01-11-2021 12:38 PM
- Karma Re: ITSI Service Analyzer doesn't show anything for timothywatson. 01-11-2021 12:26 PM
- Got Karma for Re: Has anyone Splunked Trello data?. 01-04-2021 07:54 PM
- Got Karma for Re: How to configure UF to send data to splunk stand alone instance?. 10-28-2020 03:02 AM
- Got Karma for Re: How to configure UF to send data to splunk stand alone instance?. 10-28-2020 02:57 AM
- Got Karma for Re: Clarification on search query to detect outliers. 10-26-2020 11:11 PM
- Posted Re: How can one change the ITSI status of multiple episodes at once? on Splunk Cloud Platform. 10-24-2020 02:27 AM
- Posted Re: Clarification on search query to detect outliers on Splunk Enterprise Security. 10-24-2020 12:40 AM
- Posted Re: help on where condition on Dashboards & Visualizations. 10-23-2020 06:28 PM
- Posted Re: How to configure UF to send data to splunk stand alone instance? on Splunk Enterprise. 10-23-2020 06:04 PM
- Posted Re: TA-DMARC scheme error on All Apps and Add-ons. 10-23-2020 05:44 PM
- Posted Re: How can one change the ITSI status of multiple episodes at once? on Splunk Cloud Platform. 10-23-2020 05:31 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-06-2017
05:21 AM
Hi @Aina
For field extractions on json data use spath command: http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Spath
Export your fields of interest in CSV format (IPs in this case) with outputlookup command: http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Outputlookup
You can then load that CSV into your query and use it like a whitelist with this commands, lookup, inputlookup: http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Inputlookup
If this is not the help you were looking for please elaborate your question so that I can help you.
KR.
... View more
12-28-2016
11:32 AM
Oh my bad, \var\log\splunk it is. Thats not normal for sure.
... View more
12-28-2016
11:23 AM
Hi @dpanych,
Any crash log in $SPLUNK_HOME\var\log\splunk ?
EDIT: path
... View more
12-28-2016
04:47 AM
Run this on your forwarder
./splunk enable deploy-client -auth admin:changeme
./splunk restart
And check if you are receiving data on your indexer from that forwarder.
Let me know how it goes.
... View more
12-26-2016
07:57 AM
Hi there,
Do you mind sharing some sample data to work with ?
... View more
12-26-2016
07:12 AM
Can you share a deploymentclient.conf file of any forwarder ?
... View more
12-26-2016
05:17 AM
Hi there Ramu,
Please, run this command on your forwarders to see if they were configured properly first.
splunk show deploy-poll
... View more
12-26-2016
05:06 AM
Hi Gautami, does your UF have read access on that directory ?
... View more
12-14-2016
10:32 AM
Hi @jcrawfordd26
Try giving execution permissions to splunk user/group too, many of this inputs are scripts.
... View more
12-14-2016
10:08 AM
Hi @dnorman289
Check your internals for a timestamp format related events, you will probably have to specifiy the timestamp format on your props.conf.
... View more
12-14-2016
09:57 AM
Hi there @cpetterborg
Under which user is Splunk UF running ? Domain or local ? I believe it has to be domain user for remote performance monitoring.
Are you forwarding any other type of data besides perfmon from that host ?
... View more
12-13-2016
06:03 AM
2 Karma
Hi @schose, read Lisa's answers please.
https://answers.splunk.com/answers/202965/has-anyone-come-across-monitoring-an-xml-logfile-t.html
... View more
12-13-2016
04:22 AM
Nice, I'm glad it helped!
... View more
12-12-2016
12:32 PM
Hi there @dbcase
Try like this,
index=cox UCE-
| rex "UCE-(?<UCE_Code>(\d+))"
| lookup UCECodes.csv UCE-Code AS UCE_Code
| eval ud=UCE_Code+" - "+Desc
| eventstats count AS grandtotal
| eventstats count AS ptotal by UCE_Code
| eval aatype=if(match(source,"managedServer"), "managed", "access")
| chart values(Desc) AS Description, count(UCE_Code) AS "UCE Code Count", count(eval(aatype="managed")) AS "Managed Server Log", count(eval(aatype="access")) AS "Access Log", values(eval(round(ptotal/grandtotal*100,2))) AS Percentage by UCE_Code
| rename UCE_Code AS "UCE Code - Click for Detail"
| sort - "Percentage"
| rename ud AS "UCE Code - Description"
Let me know if it works.
... View more
11-22-2016
10:25 AM
Any answer/solution on this Javier ?
... View more
10-18-2016
06:58 PM
1 Karma
Okey then, give this a try, I don't have data to test it right now but let me know if it's not working aight ?
earliest=-1h@h latest=@h index=wineventlog sourcetype=WinEventLog:Security EventCode="4740"
| eval Account=mvindex(Account_Name, 1)
| stats count, latest(_time) AS lastBlock by Account
| eval modtime=lastBlock - 3600
| fields - count
| map maxsearches=100 search="search index=wineventlog sourcetype=WinEventLog:Security (EventCode="4625" OR EventCode="4768" OR EventCode="4771" OR EventCode="4776") earliest=$modtime$ latest=$lastBlock$ Account_Name=$Account$"
| eval Account=case(EventCode="4740" OR EventCode="4625", mvindex(Account_Name, 1), EventCode="4768" OR EventCode="4771", Account_Name, EventCode="4776", Logon_Account, 1=1, "Click-on-me")
| regex Account!="\\$"
| eval errorMessages=case(EventCode="4768", (EventCode."; ".Result_Code), EventCode="4771", (EventCode."; ".Failure_Code), EventCode="4776", (EventCode."; ".Error_Code), 1=1, "Click-on-me")
| stats count, latest(_time) AS lastFailure, values(Failure_Reason) AS failureReason, values(errorMessages) AS otherFailures by Account src_ip
| convert ctime(lastFailure)
| rename Account AS "Blocked Account", count AS LoginFailures
Should be same as before but this one has a new field called "otherFailures", that will hold the other types of failures that you have mentioned. It is a concatenated field holding the EventCode and Resulting Code.
edit: tested and working
... View more
10-18-2016
01:19 PM
Besides the changes you want to do now, the query worked out? If not, we have to start over.
Is not working with the eventcodes(4768,4771,4776) that you try to add for two main reasons:
- They have a completly different event structure.
- The query I've posted was made for those events only.
So please, let me know what you have in mind now so I can help you.
... View more
10-17-2016
05:17 PM
Nice, im glad it helped. Happy splunking!
... View more
10-17-2016
06:27 AM
Can you show me how did you adapt the query I've posted or some data samples ?
... View more
10-17-2016
05:50 AM
Hi @seetharamanPr
Try this.
index=acs action=failure signature=Failed_Attempts | stats values(IP) AS IP, count by user | sort - count | head 10
Hope it helps.
... View more
10-16-2016
06:48 PM
1 Karma
Hi @splunk_svc
Is it this what you are looking for ? This is a working example.
index=_internal | eventstats count by sourcetype | eval my_fieldname=sourcetype.", ".count | timechart count by my_fieldname
Hope it helps.
Edit: query outcome
... View more
10-12-2016
09:02 AM
Sorry about that. Tested on lab and fixed.
... View more
10-11-2016
02:06 PM
2 Karma
Hi @kranthi851
Try this out.
earliest=-1h@h latest=@h index=wineventlog sourcetype=WinEventLog:Security EventCode="4740"
| eval Account=mvindex(Account_Name, 1)
| stats count, latest(_time) AS lastBlock by Account
| eval modtime=lastBlock - 3600 | fields - count
| map maxsearches=100 search="search index=wineventlog sourcetype=WinEventLog:Security EventCode="4625" earliest=$modtime$ latest=$lastBlock$ Account_Name=$Account$"
| eval Account=mvindex(Account_Name, 1)
| regex Account!="\\$"
| stats count, latest(_time) AS lastFailure, values(Failure_Reason) AS failureReason by Account src_ip | convert ctime(lastFailure) | rename Account AS "Blocked Account", count AS LoginFailures
This will search for account blocks and then go back in time one hour to find login failures for the blocked user.
Hope it helps.
EDIT: Query updated.
... View more
10-11-2016
01:30 PM
Exactly, thats why at the end of the post I've wrote that you could add some case statements to alert when certain conditions are met.
... View more
10-11-2016
12:34 PM
Thats okey then, those fields could be empty. If the user has an account block (4740) the login failures (4625) might cause that.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-22-2024
07:49 AM
|
Karma given to
