About thambisetty

thambisetty · ‎09-05-2018

Can you give me an example?

thambisetty · ‎09-05-2018

| eventstats count by oper_field ,department| where count > 1 | stats list(oper_field) as gn by department

thambisetty · ‎08-30-2018

One more: TA is not supporting multi inputs Since your checkpoint can't differentiate input name. Hope you consider all these changes and update the TA or I will try to complete TA which I am already working on.

thambisetty · ‎08-30-2018

@493669 TA is not looking for event timestamp(TimeGenerated), TA will index events with time when you fetch.

thambisetty · ‎08-30-2018

one more : The TA is indexing the data with current time not with the event time Timestamp Mapping - add below code to local/props.conf if you have installed TA on HF OR add to Indexer. [loganalytics] TIME_FORMAT = %Y-%m-%dT%H:%M:%S%Z TIME_PREFIX = "TimeGenerated":"

thambisetty · ‎08-30-2018

Modified Line number 91 from value = str(data["tables"][0]["rows"][i][n]).replace('"',"'").replace("\", "\\").replace("None", "") to value = str(data["tables"][0]["rows"][i][n]).replace('"',"'").replace("\", "\\").replace("None", "").replace("\r\n","") This will remove newlines and carriage returns if the field value is dictionary. Due to field values have dictionary and it contains new lines I could see line breaking. This change will avoid line breaking

thambisetty · ‎08-29-2018

Single event is broken into multiple events - logs parsing issue

thambisetty · ‎08-21-2018

The reason why 5671/5672 need to be opened is because The TA uses different protocol aqmp/aqmps to fetch data from azure. The defining features of AMQP are message orientation, queuing, routing (including point-to-point and publish-and-subscribe), reliability and security. So, you need to allow these two ports on your firewall to make successful connection to azure.

thambisetty · ‎08-13-2018

Please go through the conversation here. Its saying that the REST API which is used in this TA has been depricated by Microsoft and they have been using different queries all together. Contact me on [email protected] for further details on this.

thambisetty · ‎08-13-2018

Yes. But you have to follow the document on creating azure app which will have access to your subscription and get the key of that app and secret these will be used in the script. I have tested the connection using app key and secret its working fine. I am thinking on what to collect. Full logs or the alerts for the configured saved searches in log analytics.

thambisetty · ‎08-08-2018

Have you replaced PutPhoneHomePeriodInSecsHere with your phone home interval?

thambisetty · ‎08-08-2018

Yes, there is a problem with oauth2 in rest TA.

thambisetty · ‎07-31-2018

index=audit_logs [search index=access_logs | dedup src | table src | format src] Make sure that you have ip field renamed to src in both the sources. Sub search will produce unique src ips and will be given input to audit logs to find the matches.

thambisetty · ‎07-31-2018

That means field value is not extracted as you expected if you can post samle raw event i can help you with regex to extract richiest field value.

thambisetty · ‎07-31-2018

May be I need to test your scenario to give you whats exactly gone wrong in this scenario.

thambisetty · ‎07-31-2018

You will have to write props.conf and transforms.conf to remove unwatered rows from your logs. If you have HF, Add the below props.conf in your search app local folder. [yoursourcetype] TRANSFORMS-set = setnull And create transforms.conf in the same folder And add below lines to it [setnull] REGEX = USERNAME DEST_KEY = queue FORMAT = nullQueue If you dont have heavy forwarder add this in indexer and restart splunkd.

thambisetty · ‎07-31-2018

AFAIK, there is no such option in Splunk. May be you will have to write batch or bash script to do this. Would be better way to do this. Any how its not big deal. Its just matter of singlei line cronjob in linux.

thambisetty · ‎07-31-2018

Hi, Go to your dashboard and create new panel and add your existing report search to this new panel. It will not depend on the report which is already created by you and is referred in the dashboard.

thambisetty · ‎07-31-2018

Hi, Are you able to see full value of richiesta field in raw log? Are you getting truncated value only while displaying it in table?

thambisetty · ‎07-31-2018

Hi, Below rex will create new field Merged_text and it captures until . (Full stop) After Application name. Your base search | rex "Merged\stext\=(?<Merged_text>[^\.]+)"

thambisetty · ‎07-30-2018

Whats the logic to identify server is offline or online?

thambisetty · ‎07-30-2018

If you are getting _internal logs from heavy forwarders where you are receiving syslog, then you can check based on source type to find out HF which is forwarding events to indexer by running below search index=_internal metrics sourcetypename

thambisetty · ‎07-27-2018

How did you get this app worked? I have proxy in between client and server, not able to set proxy in adal-node. Any ideas?

thambisetty · ‎07-27-2018

Are you still getting an error or able to collect logs? Have you tried collecting Azure activity logs?

thambisetty · ‎07-27-2018

Any ideas?

Posts	1137
Solutions	129
Karma Given	55
Karma Received	364
Member Since	‎03-27-2014

Online Status	Offline
Date Last Visited	a month ago

Microsoft Office 365 Reporting Mail Add-on for Spl...

tenable add-on dest missing values

SPLUNK ES Notable Event Closure

Issue while downloading logs

Search is not running from JS

how to apply these trained data models to actual D...

getting econnreset error while trying to fetch azu...

Where does collect command indexes its result?

Query on Splunk certification

Is anyone using SPLUNK MLTK for windows events?

Re: How can I get common values from data?

Re: How can I get common values from data?

Re: Why am I getting a "Winsock Error 10053" while...

Re: Why am I getting a "Winsock Error 10053" while...

Re: Why am I getting a "Winsock Error 10053" while...

Re: Why am I getting a "Winsock Error 10053" while...

Re: Why am I getting a "Winsock Error 10053" while...

Re: Unable to get Azure Activity Log, Azure Diagno...

Re: Why am I unable to configure Microsoft OMS Mod...

Re: Why am I unable to configure Microsoft OMS Mod...

Re: How to check how long splunk uf agents are dow...

Re: REST API OAuth2 only first request works.

Re: How do I create a list of unique IPs from an a...

Re: field extraction very long field

Re: Why are the panels not showing data in the das...

Re: How to remove the header details with null va...

Re: Is there a way to periodically restart Splunk?

Re: Why are the panels not showing data in the das...

Re: field extraction very long field

Re: how to extract multiple values into one field

Re: I need to find how many machines in a store ha...

Re: Is it possible to know from which heavy forwar...

Re: Unable to get Azure Activity Log, Azure Diagno...

Re: Unable to get Azure Activity Log, Azure Diagno...

Re: getting econnreset error while trying to fetch...

Join the Conversation