About chris_barrett

chris_barrett · ‎03-25-2020

Thank you. I ended up going in to Settings > Lookups > Lookup table files and found the two CSVs (bitcoin_transactions.csv and firewall_traffic.csv) within the Splunk_ML_Toolkit app. I then changed their Share status from "App" to "Global". The other issue was that I had installed version 5.1.0 of the MLTK on a system running Splunk Enterprise 7.3.4 and it turns out that they're not compatible (MLTK 5+ requires Splunk 😎 - so I had to downgrade MLTK to 4.5.0 and the Python for Scientific Computing app from 2.0.0 down to 1.4. But the visualization's description on SplunkBase says that it requires version 2.0 of the Python for Scientific Computing app so it looks like the visualization is only compatible with Splunk 8+ even though the page says that it's compatible with "8.0, 7.3, 7.2, 7.1, 7.0". I think that I'll just have to park the visualization until we upgrade to 8.

chris_barrett · ‎03-23-2020

The app's example visualizations aren't working and when I investigated the I found that the two CSVs that they reference as inputlookups (bitcoin_transactions.csv and firewall_traffic.csv) aren't present in the app's lookups directory. I have MLTK v5.1.0 and Python for Scientific Computing v2.0.0 installed in a deployment running Enterprise 7.3.4 Are these two lookups provided by another app that I need to install or have they been simply been accidentally left out during packaging? Or something else ...

chris_barrett · ‎03-23-2020

The app defines a macro called FMC-index which, by default, refers to the main and estreamer indexes. If your events are not in either of those indexes then you'll need to change the macro's definition to refer to the correct index.

chris_barrett · ‎03-19-2020

Lines 18-25 of the indexes.conf file above look like they're missing a stanza heading. Are they meant to be part of the [default] stanza? If so, try moving them up to under line 4.

chris_barrett · ‎03-01-2020

Hi @woodcock, Lookup Editor is developed by a third-party (@LukeMurphey) and I'm of the belief that https://ideas.splunk.com is only for software developed by Splunk.

chris_barrett · ‎03-01-2020

The Add-on's props.conf has a REPORT statement that calls, among others, sysmon-dns-record-data and sysmon-dns-ip-data. But there are no stanzas by these names in the Add-on's transforms.conf There are however [extract_dns_record_data] and [extract_dns_ip_data]. I'm not sure if it's just a case of the names needing to be aligned.

chris_barrett · ‎03-01-2020

Background: I attempted to import a CSV file into a KV Store using v3.3.3 of the Lookup Editor app. One of the fields in the CSV uses 0 to represent false and 1 to represent true. I set the corresponding field as Boolean when I created the KV Store but when I tried to import the data the Boolean field showed "#bad-value". I found that in order to get the CSV to be successfully imported into the KV Store, I had to pre-process the script (using sed) to replace the 1's with "true" (sans quotes) and the 0's with false (again, sans quotes). Various settings within the Splunk config files use 0 to represent false and 1 to represent true. Would it be possible to have Lookup Editor do the same when importing in to a field that has been typed as "Boolean"?

chris_barrett · ‎02-20-2020

The stanza [CLIENT_USER_xml] in transforms.conf has an error in it - the "REGEX = " needs to be removed from the start of the second line.

chris_barrett · ‎02-16-2020

We've recently realized that we were rolling our buckets out the coldPath too soon - thereby not making full use of the homePath volume which uses directly-attached SSDs. I've increased maxWarmDBCount for most of the indexes and I'd now like to bring the buckets that have already been rolled out to cold back to the faster homePath. I've reviewed https://answers.splunk.com/answers/208985/how-to-rollback-buckets-from-cold-to-warm.html but it reads like it's intended for a deployment that doesn't have clustered indexers. Does anyone have a procedure that can be used in a clustered deployment?

chris_barrett · ‎02-04-2020

Cisco eStreamer eNcore Add-on for Splunk v3.6.8 has two EXTRACTs with errors in them. EXTRACT-extract_src and EXTRACT-extract_dest both have an extraneous equal sign (=) before the start of the regex which means that src_ip and dest_ip don't get extracted. Both are under the [cisco:firepower:syslog] stanza.

chris_barrett · ‎02-03-2020

In hindsight, I should have said that the value of _raw was irrelevant as the decision to not index the event was being made on the basis of either the host, source or sourcetype. So the transforms stanza was really just about setting the queue to nullQueue. And thank you for the link to the Conf presentation. I had seen it before but it was good to go over it again.

chris_barrett · ‎02-02-2020

Which of the following (in terms of the REGEX) is the most efficient? I've seen examples of all of them. And is there an even more efficient REGEX? [send_to_nullQueue_dot] SOURCE_KEY = _raw REGEX = . DEST_KEY = queue FORMAT = nullQueue [send_to_nullQueue_dot_star] SOURCE_KEY = _raw REGEX = .* DEST_KEY = queue FORMAT = nullQueue [send_to_nullQueue_dot_plus] SOURCE_KEY = _raw REGEX = .+ DEST_KEY = queue FORMAT = nullQueue [send_to_nullQueue_dot_star_lazy] SOURCE_KEY = _raw REGEX = .*? DEST_KEY = queue FORMAT = nullQueue [send_to_nullQueue_captured_dot_star] SOURCE_KEY = _raw REGEX = (.*) DEST_KEY = queue FORMAT = nullQueue

chris_barrett · ‎01-27-2020

I'm not sure if this app is being maintained by the author anymore but I've noticed that there's a bug (syntax error) in the 'search' parameter for the 'OSSEC - Track Expected Hosts' saved search. The search parameter starts with '| metadata host | ...' but, as far as I can tell, this should be '| metadata type=host | ...'

chris_barrett · ‎01-21-2020

Having just downloaded version 0.6 of the TA, I suspect that the two of the FIELDALIASes need adjustment: The first (FIELDALIAS-icmptype = icmpcode AS icmp_type) looks like it should be: FIELDALIAS-icmptype = icmptype AS icmp_type The second (FIELDALIAS-bytes = size) looks like it should be: FIELDALIAS-bytes = size AS bytes I'm hoping that the author is monitoring Answers and is able to fix the two issues.

chris_barrett · ‎01-21-2020

Hi Douglas, The EVAL-first_pkt_sec statement is malformed and generates an error during searches so IMHO it needs a code change to fix it. The issue then is to what, and based on what you've described, I suspect that the answer is: EVAL-first_pkt_sec = coalesce(first_pkt_sec, event_sec) If that change makes sense then I'd prefer that the app itself was changed and updated on SplunkBase rather than me making a local modification.

chris_barrett · ‎01-19-2020

I'm running v3.6.8 of this Add-On and I'm seeing the following error message - "Invalid EVAL expression for 'EVAL-first_pkt_sec' in stanza [cisco:estreamer:data]: The expression is malformed. Expected AND." being report in the search.log during searches. The release notes for v3.6.8 of this Add-On include the note that the add-on was: "Modified definition of event_sec for connection events, in the FMC all connection events start at first packet time which is now the value used for indexing. The first_pkt_sec field is still preserved to support backward compatibility." Within the default/props.conf I can see the following entries under the [cisco:estreamer:data] stanza: FIELDALIAS-estreamer_first_pkt_sec_1 = connection_second AS first_pkt_sec FIELDALIAS-estreamer_first_pkt_sec_2 = connection_sec AS first_pkt_sec EVAL-first_pkt_sec = event_sec as first_pkt_sec The EVAL statement looks like it's trying to be a FIELDALIAS statement (albeit with a lowercase 'as') but I don't know enough about the source to understand what it's trying to achieve. Any help on a fix would be appreciated - preferably via a new version of the Add-on - but I'd accept a workaround that I can apply locally.

chris_barrett · ‎11-27-2019

FWIW we found that we still had to add AES256-GCM-SHA384 into the cipherSuite setting in server.conf in our 7.3.3 deployment.

chris_barrett · ‎09-17-2019

I have a squid access log that has entries contain with status codes of TCP_REFRESH_MODIFIED and TCP_MEM_HIT - all with a HTTP status code of 200. These events don't have an 'action' field as the status codes don't appear in the TA's squid_actions.csv lookup file. Is this by design, or an oversight/bug?

chris_barrett · ‎08-29-2019

Tested v1.0.6 and confirmed as working. Thank you for the quick response.

chris_barrett · ‎08-28-2019

We're experimenting with "v1.0.5 VersionControl For Splunk" https://splunkbase.splunk.com/app/4355 and experiencing an error when attempting to restore an object. ERROR name=<dashboard> with URL=https://<splunkserver>:8089/servicesNS/<user>/<app>/data/ui/views/<dashboard> statuscode=400 reason=Bad Request, response="<?xml version="1.0" encoding="UTF-8"?> <response> <message> <msg type="ERROR">Argument "version" is not supported by this handler.</msg> </message> </response>", in app=<app>, owner=<user> The backup component works correctly, however the restore feature fails. Please help!

chris_barrett · ‎05-22-2019

It's not clear if they are (and I suspect that that they aren't if they're coming out of log files), but if your old style events are in the same format as the aws:cloudtrail events then you should be able to use a rename=aws:cloudtrail in the props.conf on your Search Head(s). [old_sourcetype] rename = aws:cloudtrail Ref: https://docs.splunk.com/Documentation/Splunk/latest/Data/Renamesourcetypes

chris_barrett · ‎05-15-2019

I don't have a system here at home that I can test with but I believe that the following will do what you're after: SHOULD_LINEMERGE = true MAX_EVENTS = 50 TRUNCATE = 5000 You will however need to provide your own event breaking using BREAK_ONLY_BEFORE, MUST_BREAK_AFTER or similar.

chris_barrett · ‎05-15-2019

Ref: https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/HowSplunklicensingworks How data is metered For event data, data volume is based on the amount of raw external data that the indexer ingests into its indexing pipeline, after any filtering. It is not based on the amount of compressed data that gets written to disk. For metrics data, each metric event counts as a fixed 150 bytes. Metrics data does not use a separate license. Rather, it draws from the same license quota as event data. The key above is the "after any filtering". The TRUNCATE and TRANSFORMS operations occur within the Parsing pipeline which is before the Indexing pipeline (https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Howindexingworks)

chris_barrett · ‎05-01-2019

Try the example found here and see if it works - https://docs.splunk.com/Documentation/Splunk/7.2.6/RESTREF/RESTsearch#search.2Fjobs.2Fexport I do wonder if the asterisk not being escaped/encoded in your test is the issue?

chris_barrett · ‎05-01-2019

Hi @drawnsle, I have developed a Technical Add-On (tentatively called TA-GNSS) that handles the NMEA 0183 sentences from a range of systems (including GPS and GLONASS). I've submitted a proposal to talk about it's development and potential use-cases at .Conf19 and was planning to release the TA during Conf. Happy to look at a closed Beta in return for using some of your experiences with it as material for my talk. Chris

Posts	65
Solutions	4
Karma Given	1
Karma Received	35
Member Since	‎01-11-2015

Online Status	Offline
Date Last Visited	‎07-10-2026 06:49 PM

Why are events ingested using the journald modular...

How to determine which (if any) POSIX capabilities...

How do I fix this Error in Splunk Add-on for AWS N...

PAVO Getwatchlist Add-on - Enhancement request - a...

Potential bug in TIME_FORMAT for Splunk Add-on for...

Indexing the results from the running an inspect u...

Splunk App for Content Packs v1.2.0 - DA-ITSI-CP-m...

Splunk Add-On for MySQL (Splunk_TA_mysql) v2.0.2 -...

TA_netfilter - REGEX used by netfilter_flags trans...

Can I include the name of the PCAP as metadata whe...

Re: Is 3D Graph Network Topology Visualization v1....

Is 3D Graph Network Topology Visualization v1.1.0 ...

Re: Cisco Firepower App for Splunk : "no results ...

Re: Volume configuration will not manage space use...

Re: Feature Request - allow 1 to represent true an...

Bug Report - Add-on for Microsoft Sysmon v10.3.0

Feature Request - allow 1 to represent true and 0 ...

Bug Report - Error in transforms.conf for "Getting...

Can cold buckets be rolled back to the homePath in...

Cisco eStreamer eNcore Add-on for Splunk v3.6.8 - ...

Re: Efficiency of REGEX = . vs REGEX = .* vs REGEX...

Efficiency of REGEX = . vs REGEX = .* vs REGEX = (...

Bug Report - Reporting and Management for OSSEC v1...

Issues with FIELDALIASes in v0.6 of TA-winfw

Re: Cisco eStreamer eNcore Add-on for Splunk v3.6....

Cisco eStreamer eNcore Add-on for Splunk v3.6.8 "E...

Re: Why did the KVstore fail to start after using ...

Any reason why the TCP_REFRESH_MODIFIED and TCP_ME...

Re: Getting a status code 400 (Bad Request) when t...

Getting a status code 400 (Bad Request) when tryin...

Re: Sourcetype alias

Re: Truncate events in props.conf to reduce the li...

Re: Truncate events in props.conf to reduce the li...

Re: rex expression does not work in curl

Re: Has anyone integrated NMEA 0183 data from a so...

Join the Conversation