About mreynov_splunk

mreynov_splunk · ‎02-26-2016

you need your forwarder to send the data to the indexer (=search peer), not search head are you looking at the forwarder logs?

mreynov_splunk · ‎02-24-2016

You should be able to play around with sourcetype settings after clicking "Add Data" and using a file. To get the file, you should be able to export some of your search results in raw format. Then save the sourcetype and you will be able to use that when defining your actual input.

mreynov_splunk · ‎02-24-2016

The problem is that Splunk does not understand how to break up the lines in your data. To fix that, you need to set the correct LINE_BREAKER: http://docs.splunk.com/Documentation/Splunk/6.2.8/Data/Indexmulti-lineevents Do you have a sourcetype for your data or did you use an existing one?

mreynov_splunk · ‎02-24-2016

the exact answer will differ depending on what you are using simple XML or HTML for your dashboard. What you will need is a custom piece of javascript. In the meantime, here is some info on drilldowns in Splunk: http://dev.splunk.com/view/webframework-developapps/SP-CAAAESJ

mreynov_splunk · ‎02-24-2016

if I am not mistaken, you may need to add astrerisk before, as the regex matches the entire path. So something like this: (*\.bin*|*\.conf*)

mreynov_splunk · ‎02-16-2016

Do you want to move data previously indexed on old indexers to new indexers? Do you want to use both old indexers and new? I am not familiar with redirecting from indexers to indexers, if anything - use existing forwarders and edit outputs.conf to forward to new indexers, which is what the link covers.

mreynov_splunk · ‎02-16-2016

This may help: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

mreynov_splunk · ‎02-01-2016

If logs were not rotated, it should just work. If they were, you may need to import some of the data manually.

mreynov_splunk · ‎01-14-2016

This Bit9 Splunk support TA is CIM-compliant: https://splunkbase.splunk.com/app/2790/ (It does not have any dashboards though)

mreynov_splunk · ‎01-14-2016

there is no timeline currently. Supported OS version means that it's been tested on that OS, but does not mean it would not work with other OS. Have you tried it?

mreynov_splunk · ‎01-14-2016

can you post your inputs config and a couple of sample records? No extractions like this indicate a conf file error.

mreynov_splunk · ‎01-05-2016

Not sure why the message, but perhaps you can use this TA instead: https://splunkbase.splunk.com/app/2758/

mreynov_splunk · ‎12-03-2015

can you show a couple of records to compare?

mreynov_splunk · ‎12-03-2015

enabled entries in inputs.conf are a definite way to tell if there are inputs 😄 While in general @richgalloway is correct, I would also add the following: since you do not have forwarders and some add-ons may have modular inputs, I would suggest splitting the processing between SH and indexer. I would not remove savedsearches (to avoid human error) from indexers though, since they are not going to run there.

mreynov_splunk · ‎12-01-2015

This might have been due to lack of 64-bit support of the LEA cert.

mreynov_splunk · ‎12-01-2015

authorize.conf it is. what is the question again?

mreynov_splunk · ‎11-20-2015

In this answer you can get the daily volume: https://answers.splunk.com/answers/29415/daily-index-volume-by-sourcetype.html You can run the same search for the day before and use eval to compare

mreynov_splunk · ‎11-19-2015

The searches are actually performed on the indexers, so I would look at that first. Here is a bit of reading to get you started: http://docs.splunk.com/Documentation/Splunk/6.2.0/Deploy/Datapipeline

mreynov_splunk · ‎11-19-2015

There you go: https://answers.splunk.com/answers/71477/sourcetype-too-small.html

mreynov_splunk · ‎11-19-2015

This may be helpful: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Deploysecurepasswordsacrossmultipleservers

mreynov_splunk · ‎11-19-2015

or you can figure out how to use the fancy new HTTP Event Collector: http://blogs.splunk.com/2015/10/06/http-event-collector-your-direct-event-pipe-to-splunk-6-3/

mreynov_splunk · ‎11-19-2015

You may have to adjust sourcetype naming, but otherwise should not be a problem. Look in the dashboards of the app for the sourcetype it is expecting and do a [sourcetype] rename in the local/props.conf for the app.

mreynov_splunk · ‎11-16-2015

<> | outputlookup blacklist_lookup_name save this as a saved search and have it run on a schedule http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Outputlookup

mreynov_splunk · ‎11-16-2015

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/ModInputsSpec

mreynov_splunk · ‎11-16-2015

If this is something you need to do for an array of events, then yea, you should probably try streamstats. If just one, then you can try something like this: since you know the timestamp of the latest event, search for _timestamp < latest_event_timestamp and get the latest() out of the result set. https://answers.splunk.com/answers/149904/find-earliest-and-latest-event-per-day-for-a-time-range.html http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonstatsfunctions

Posts	141
Solutions	12
Karma Given	63
Karma Received	69
Member Since	‎01-07-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: Bit9 Security Platform: How to troubleshoot wh...

Re: Why is Splunk combining several log lines into...

Re: Why is Splunk combining several log lines into...

Re: How to drill down to another dashboard by clic...

Re: Splunk Add-on for Amazon Web Services 3.0: Why...

Re: How to edit outputs.conf for the Splunk Add-on...

Re: How to edit outputs.conf for the Splunk Add-on...

Re: Connectivity to Check Point OPSEC LEA reset, n...

Re: Are there plans to make the Bit9 Security Plat...

Re: When will the Splunk Add-on for Check Point OP...

Re: Why are fields not parsed in the Bit9 Security...

Re: Why is Splunk marking a custom TA as deprecate...

Re: Splunk Add-on for Check Point OPSEC LEA: Why a...

Re: Where to install apps in a distributed environ...

Re: Splunk Add-on for Check Point OPSEC LEA 3.1.0:...

Re: Restrict search for specific index in Windows ...

Re: alert when an increase of indexed data more th...

Re: What do I do if I have too many saved searches...

Re: How to consolidate two sourcetypes for one ind...

Re: How do I get properly encrypted credentials in...

Re: How to collect Apache logs in Splunk without a...

Re: Blue Coat ProxySG App for Splunk: Can I get da...

Re: Splunk for DNS: How can I update the blacklist...

Re: How does Splunk know which script to run for a...

Re: How to search the time difference between a ce...

Join the Conversation