×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
andresito123
Communicator
Member since: ‎04-03-2016
‎12-30-2025
Community Statistics
Posts 62
Solutions 3
Karma Given 2
Karma Received 4
Member Since ‎04-03-2016
Activity Feed
Topics I've Started
View All

Re: Mutliple field extractions in props.conf of on...

by in Splunk Dev
‎05-15-2018 02:15 AM
‎05-15-2018 02:15 AM
I used the pattern you mention in EXTRACT but it didn't work. I read that it might be better to use the fields in the "EXTRACT-". I didn't use the Splunk addons because the data I have are different from the data SPLUNK addons process... ... View more

Re: Mutliple field extractions in props.conf of on...

by in Splunk Dev
‎05-15-2018 12:29 AM
‎05-15-2018 12:29 AM
Does it matter in which props.conf those definitions are? ... View more

Re: Mutliple field extractions in props.conf of on...

by in Splunk Dev
‎05-14-2018 06:22 AM
‎05-14-2018 06:22 AM
Correct. I have tested the regex with "rex field=_raw" command and it extracts the data, however the configuration in props.conf does not work out. ... View more

Re: Mutliple field extractions in props.conf of on...

by in Splunk Dev
‎05-14-2018 04:54 AM
‎05-14-2018 04:54 AM
05/14/2018:14:26:07 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 17026121 0 : 192.99.7.203 37165443-PPE0 Mq0djxWpCR9ogxW7d5ZwQnjQ2Mg0000 www.example.com http://www.example.com/ Unknown content-type header value="text/html" <not blocked> 05/14/2018:03:40:20 netscaler 0-PPE-0 : default APPFW APPFW_XSS 16932959 0 : 5.101.140.66 36996274-PPE0 ph0QaNs5L/DXhZyM3aUBnI3WkZU0000 www.example.com http://example.com/xmlrpc.php Cross-site script check failed for field &lt 05/14/2018:03:40:20 netscaler 0-PPE-0 : default APPFW APPFW_XSS 16932955 0 : 5.101.140.66 36996273-PPE0 EoljFu6x/+qIovZRliKof87LjMA0000 www.example.com http://example.com/blog/xmlrpc.php Cross-site script check failed for field &lt 05/14/2018:03:40:20 netscaler 0-PPE-0 : default APPFW APPFW_XSS 16932951 0 : 5.101.140.66 36996272-PPE0 HB0tfWSePbvs10p6a1pNUL5RoII0000 www.example.com http://example.com/blog/xmlrpc.php Cross-site script check failed for field &lt 05/14/2018:03:40:20 netscaler 0-PPE-0 : default APPFW APPFW_XSS 16932947 0 : 5.101.140.66 36996271-PPE0 L9rwzkwsTiZFP3EyePpEtLsADIY0000 www.example.com http://example.com/xmlrpc.php Cross-site script check failed for field &lt 05/13/2018:13:21:39 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16806275 0 : 208.100.26.230 36705424-PPE0 30iII3l3UinctCDeqFxjcMDBJrk0000 www.example.com http://193.92.173.66/sdk Unknown content-type header value="" <not blocked> 05/13/2018:13:14:30 netscaler 0-PPE-0 : default APPFW APPFW_XSS 16805341 0 : 158.69.101.124 36700340-PPE0 0WUjjIz42lI/5Qg59uscoruCGW00000 www.example.com http://www.example.com/?q=user%2Fpassword&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+system%28%24_GET%5B%27cmd%27%5D%29%3B+%3F%3E%27%3E+sites%2Fdefault%2Ffiles%2Fvuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+system%28%24_GET%5B%27cmd%27%5D Cross-site script check failed for field name[#markup]="Bad tag: ?php" <not blocked> 05/13/2018:13:14:30 netscaler 0-PPE-0 : default APPFW APPFW_XSS 16805331 0 : 158.69.101.124 36700333-PPE0 FLG4AXecx5WjhLwVUeheHV3Dsg80000 www.example.com http://www.example.com/?q=user%2Fpassword&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+system%28%24_GET%5B%27cmd%27%5D%29%3B+%3F%3E%27%3E+sites%2Fdefault%2Ffiles%2Fvuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+system%28%24_GET%5B%27cmd%27%5 Cross-site script check failed for field name[#markup]="Bad tag: ?php" <not blocked> 05/13/2018:12:58:17 netscaler 0-PPE-0 : default APPFW APPFW_BUFFEROVERFLOW_URL 16803625 0 : 69.12.66.213 36687138-PPE0 NsGHMkHJdizkUdSykXw71ku9BUs0000 www.example.com URL length(1407) is greater than maximum allowed(1024): http://www.example.com/?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=echo+PD9waHAgaWYoaXNzZXQoJF9GSUxFU1sidXNlcmZpbGUiXVsibmFtZSJdKSl7ICR1cGxvYWRkaXIgPSBnZXRjd2QoKSAuICIvIjsgJHVwbG9hZGZpbGUgPSAkdXBsb2FkZGlyIC4gYmFzZW5hbWUoJF9GSUxFU1sidXNlcmZpbGUiXVsibmFtZSJdKTsgZWNobyAiPHA+IjsgaWYgKG1vdmVfdXBsb2FkZWRfZmlsZSgkX0ZJTEVTWyJ1c2VyZmlsZSJdWyJ0bX <blocked> 05/13/2018:08:56:00 netscaler 0-PPE-0 : default APPFW APPFW_BUFFEROVERFLOW_URL 16752492 0 : 69.12.66.213 36546864-PPE0 V6GTdjzy5ES5jxR2obCXoROwWRs0000 www.example.com URL length(1407) is greater than maximum allowed(1024): https://www.example.com/?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=echo+PD9waHAgaWYoaXNzZXQoJF9GSUxFU1sidXNlcmZpbGUiXVsibmFtZSJdKSl7ICR1cGxvYWRkaXIgPSBnZXRjd2QoKSAuICIvIjsgJHVwbG9hZGZpbGUgPSAkdXBsb2FkZGlyIC4gYmFzZW5hbWUoJF9GSUxFU1sidXNlcmZpbGUiXVsibmFtZSJdKTsgZWNobyAiPHA+IjsgaWYgKG1vdmVfdXBsb2FkZWRfZmlsZSgkX0ZJTEVTWyJ1c2VyZmlsZSJdWyJ0bX <blocked> 05/12/2018:23:01:17 netscaler 0-PPE-0 : default APPFW APPFW_BUFFEROVERFLOW_URL 16705334 0 : 77.111.175.75 36471517-PPE0 oIst98GdXzo+8lFQ0kCdRGUoEIc0000 www.example.com URL length(1124) is greater than maximum allowed(1024): http://example.com/user/password?name[%23post_render][0]=system&name%5B%23markup%5D=echo+PD9waHAgZWNobyA3NDU3NzM3KzczNjcyMzskcmFQb19yWmx1b0U9YmFzZTY0X2RlY29kZSgiWSIuY2hyKDEwOSkuIkYiLmNocigxMjIpLmNocig5MCkuIlQiLmNocig4OSkuY2hyKDQ4KS5jaHIoODgpLiIyIi4iUiIuImwiLiJZIi5jaHIoNTApLiI5Ii5jaHIoMTA3KS4iWiIuY2hyKDgxKS4iPSIuIj0iKTskeWRTSlB0bndyU3Y9YmFzZTY0X2RlY29kZShjaHIoODkpLiIyIi5jaHIoNTcp <blocked> 05/12/2018:20:27:48 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16685255 0 : 46.105.57.86 36439997-PPE0 BLpRSN+vcL9JddTXNccS3+HIY+40000 www.example.com http://www.example.com/user/ Unknown content-type header value="text/html" <not blocked> 05/12/2018:20:27:46 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16685246 0 : 46.105.57.86 36439991-PPE0 BLpRSN+vcL9JddTXNccS3+HIY+40000 www.example.com http://www.example.com/admin/ Unknown content-type header value="text/html" <not blocked> 05/12/2018:20:27:44 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16685241 0 : 46.105.57.86 36439986-PPE0 BLpRSN+vcL9JddTXNccS3+HIY+40000 www.example.com http://www.example.com/admin/login.php Unknown content-type header value="text/html" <not blocked> 05/12/2018:20:27:42 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16685234 0 : 46.105.57.86 36439983-PPE0 BLpRSN+vcL9JddTXNccS3+HIY+40000 www.example.com http://www.example.com/bitrix/admin/index.php?lang=en Unknown content-type header value="text/html" <not blocked> 05/12/2018:20:27:40 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16685229 0 : 46.105.57.86 36439979-PPE0 BLpRSN+vcL9JddTXNccS3+HIY+40000 www.example.com http://www.example.com/admin.php Unknown content-type header value="text/html" <not blocked> 05/12/2018:20:27:38 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16685224 0 : 46.105.57.86 36439975-PPE0 BLpRSN+vcL9JddTXNccS3+HIY+40000 www.example.com http://www.example.com/administrator/index.php Unknown content-type header value="text/html" <not blocked> 05/12/2018:20:27:38 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16685222 0 : 46.105.57.86 36439974-PPE0 BLpRSN+vcL9JddTXNccS3+HIY+40000 www.example.com http://www.example.com/wp-login.php Unknown content-type header value="text/html" <not blocked> 05/12/2018:17:01:30 netscaler 0-PPE-0 : default APPFW APPFW_BUFFEROVERFLOW_URL 16660727 0 : 69.12.66.213 36394656-PPE0 nHuDCzYtywEqXZZfl5udU1Zzbeg0000 www.example.com URL length(1407) is greater than maximum allowed(1024): https://www.example.com/?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=echo+PD9waHAgaWYoaXNzZXQoJF9GSUxFU1sidXNlcmZpbGUiXVsibmFtZSJdKSl7ICR1cGxvYWRkaXIgPSBnZXRjd2QoKSAuICIvIjsgJHVwbG9hZGZpbGUgPSAkdXBsb2FkZGlyIC4gYmFzZW5hbWUoJF9GSUxFU1sidXNlcmZpbGUiXVsibmFtZSJdKTsgZWNobyAiPHA+IjsgaWYgKG1vdmVfdXBsb2FkZWRfZmlsZSgkX0ZJTEVTWyJ1c2VyZmlsZSJdWyJ0bX <blocked> 05/12/2018:14:34:56 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16646737 0 : 191.96.249.235 36371007-PPE0 sQ8NN6HOKm+y4wMRTjqibKNWTs00000 www.example.com http://www.example.com/ Unknown content-type header value="text/html" <not blocked> 05/12/2018:14:34:56 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16646735 0 : 191.96.249.235 36371006-PPE0 mjXIaLYQRzKGui3ZJYJL6oFVt/M0000 www.example.com http://example.com/ Unknown content-type header value="text/html" <not blocked> 05/12/2018:14:34:56 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16646733 0 : 191.96.249.235 36371005-PPE0 flcJrCPYxSqXV0E3X3EMPIdhbZo0000 www.example.com http://www.example.com/ Unknown content-type header value="text/html" <not blocked> 05/12/2018:13:17:33 netscaler 0-PPE-0 : default APPFW APPFW_XSS 16639123 0 : 80.211.40.18 36358356-PPE0 HQlSdwdZiXdODfcRIDphbKGUB8g0000 www.example.com http://example.com/xmlrpc.php Cross-site script check failed for field &lt 05/12/2018:13:17:33 netscaler 0-PPE-0 : default APPFW APPFW_XSS 16639119 0 : 80.211.40.18 36358355-PPE0 iP1wV/rmOUYLSIdG7TGvAGQgdN40000 www.example.com http://example.com/blog/xmlrpc.php Cross-site script check failed for field &lt 05/12/2018:12:11:06 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16631721 0 : 89.248.168.171 36345725-PPE0 LLlnVL/4fgKkPOtkjFOeXXqGXKI0000 www.example.com http://193.92.173.66/GponForm/diag_Form?images/ Unknown content-type header value="gzip, deflate" <not blocked> 05/11/2018:23:19:16 netscaler 0-PPE-0 : default APPFW APPFW_SQL 16557325 0 : 195.181.172.173 36151762-PPE0 tyqgqCvM2o1CF5QNAsy2VuxH5i80000 www.example.com http://example.com/user/login/ SQL Keyword check failed for field name[0 05/11/2018:22:36:54 netscaler 0-PPE-0 : default APPFW APPFW_BUFFEROVERFLOW_URL 16552886 0 : 95.110.235.19 36144571-PPE0 GhgwMyNEPf8V17u8zb/zXEsCgMo0000 www.example.com URL length(1025) is greater than maximum allowed(1024): http://www.example.ro/sites/default/files/attachment/index.php/admin/Cms_Wysiwyg/directive/?forwarded=true&isIframe=true&___directive=e3tibG9jayB0eXBlPSJhZG1pbmh0bWwvcmVwb3J0X3NlYXJjaF9ncmlkIn19&filter=bnVtX3Jlc3VsdHNbZnJvbV09MCZudW1fcmVzdWx0c1tmaWVsZF9leHByXT0xPTIpO0RFTEVURSBGUk9NIGBhZG1pbl91c2VyYCBXSEVSRSB1c2VyX2lkID0gMTQ7ICBERUxFVEUgRlJPTSBgYWRtaW5fcm9sZWAgV0hFUkUgdXNlcl9pZC <blocked> 05/11/2018:22:34:34 netscaler 0-PPE-0 : default APPFW APPFW_BUFFEROVERFLOW_URL 16552574 0 : 95.110.235.19 36144164-PPE0 Nvn7vh4JJ0Yu1gjLP2C1LeCenjE0000 www.example.com URL length(1140) is greater than maximum allowed(1024): http://www.example.ro/sites/default/files/attachment/FData2015ENG.pdf&amp 05/11/2018:21:03:50 netscaler 0-PPE-0 : default APPFW APPFW_SQL 16540147 0 : 195.181.172.173 36125803-PPE0 zgF4WR6LAwVcRUYk+wdXOa4yL7A0000 www.example.com http://example.com/user/login/ SQL Keyword check failed for field name[0 05/11/2018:13:57:36 netscaler 0-PPE-0 : default APPFW APPFW_CONTENT_TYPE 16477695 0 : 163.172.249.131 36026582-PPE0 Qv0fl7m+pdCb1aIVfsWspJi8qjE0000 www.example.com https://www.example.com/company/our-people'A=0 Unknown content-type header value="text/html" <not blocked> ... View more

Mutliple field extractions in props.conf of one so...

by in Splunk Dev
‎05-14-2018 04:08 AM
‎05-14-2018 04:08 AM
Hello all, I am ingesting NetScaler Logs on Splunk with sourcetype "citrix:netscaler:syslog". For the set I receive, I am interested in WAF events that include either one of the following words: APPFW_CONTENT_TYPE APPFW_XSS APPFW_BUFFEROVERFLOW_URL APPFW_SQL The issue is that I need four different regexes for all of these four events. I have set in my props.conf the following declarations, but unfortunately not all fields are extracted: # APPFW_CONTENT_TYPE EXTRACT-function,src,dest_host,dest,signature_desc,action = .*(?<function>SSLVPN|SSLLOG|APPFW|EVENT)\sAPPFW_CONTENT_TYPE[0-9 \:]{15}(?<src>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)).*\s(?<dest_host>www.unisystems.gr)\s(?<dest>https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9]\.[^\s]{2,})(?<signature_desc>.*)\<(?<action>.*)\> # APPFW_XSS EXTRACT-src,dest_host,dest,signature_desc,action = .*(?<function>SSLVPN|SSLLOG|APPFW|EVENT)\sAPPFW_XSS.*\s[0-9 \:]{14}(?<src>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)).*\s(?<dest_host>www.unisystems.gr)\s(?<dest>https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9]\.[^\s]{2,})(?<signature_desc>.*)\<(?<action>.*)\> # APPFW_BUFFEROVERFLOW_URL EXTRACT-src,dest_host,signature_desc,action = .*(?<function>SSLVPN|SSLLOG|APPFW|EVENT)\sAPPFW_BUFFEROVERFLOW_URL.*\s[0-9 \:]{14}(?<src>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)).*\s(?<dest_host>www.unisystems.gr)\s(?<signature_desc>.*)\:\s(?<dest>https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9]\.[^\s]{2,})\s\<(?<action>.*)\> # APPFW_SQL EXTRACT-src,dest_host,dest,signature_desc,action = .*(?<function>SSLVPN|SSLLOG|APPFW|EVENT)\sAPPFW_SQL.*\s[0-9 \:]{14}(?<src>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)).*\s(?<dest_host>www.unisystems.gr)\s(?<dest>https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9]\.[^\s]{2,})\s(?<signature_desc>.*)\s\<(?<action>.*)\> Do you have any clue why this is not working? Thanks, Andreas Edit: The interesting part is when I go to "extract fields" option below a log line, I get all the fields extracted but I can't search them. ... View more

After Enterprise Security Update I get connection ...

by in Splunk Enterprise Security
‎02-23-2018 03:15 AM
‎02-23-2018 03:15 AM
I upgraded to the latest ES app and now I get "The connection was reset" error when I am trying to connect to the web interface. ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-20-2016 11:25 PM
‎11-20-2016 11:25 PM
No clues my friend... Personally, I believe there is room for improvement regarding btool!.. Thank you very much for your help! 🙂 ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-15-2016 12:15 PM
2 Karma
‎11-15-2016 12:15 PM
2 Karma
I changed outputs.conf from [tcpout: my_LB_indexers] server=10.37.129.12:9997,10.37.129.13:9997 forceTimebasedAutoLB=true autoLBFrequency=40 compressed=true to: [tcpout:my_LB_indexers] server=10.37.129.12:9997,10.37.129.13:9997 forceTimebasedAutoLB=true autoLBFrequency=40 compressed=true (deleted space after "tcpout:") and seems that this typo was the issue!... Still can't believe it; I am refreshing the page because I can't believe that the indexers are growing!... ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-15-2016 11:10 AM
‎11-15-2016 11:10 AM
You mean port 514 UDP? ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-14-2016 10:19 AM
‎11-14-2016 10:19 AM
I removed compressed from the forwarders and the problem persists... I entered compressed both on forwarders output.conf and indexers' input.conf and the problem persists... This is crazy. ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-13-2016 04:33 AM
‎11-13-2016 04:33 AM
Today, I took another troubleshooting step that may help you resolving this (hope so!): Opened UDP port at indexer1 and voila, the index started to grow!... ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-12-2016 02:58 AM
‎11-12-2016 02:58 AM
Haahhahha! I know, imagine myself! I tried to set up a lab for my exam and I got stuck troubleshooting indefinitely!.. So, inputstatus gives the following: /var/log/checkpoint.log file position = 8283370 file size = 8283370 percent = 100.00 type = open file "cat /opt/splunkforwarder/var/log/splunk/metrics.log | grep blocked" gives me nothing... I firmly believe it's something on the indexer... :S ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-10-2016 11:24 AM
‎11-10-2016 11:24 AM
Hi mmodestino, I got lost in this forum! The latest update is that I "disconnected" forwarder4 from the deployment server and created an ad-hoc connnection with the indexers, just to see if the deployed app from the forwarder had any issues. But no luck. Then, I opened rsyslog on the forwarder4 and recorded all logs from syslog to /var/log/checkpoint.log. Then I changed the forwarder instead from listening to 514 just to monitor /var/log/checkpoint.log. But still, still, no luck. So I believe it's a configuration issue on my indexers... ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-08-2016 04:06 AM
‎11-08-2016 04:06 AM
I changed the recipient of the logs to forwarder2 and explicitly used the "/opt/splunkforwarder/etc/system/local/inputs.conf" to include: [udp:514] sourcetype = syslog but still no luck on the indexers.... ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-07-2016 09:37 AM
‎11-07-2016 09:37 AM
Main index is 1MB for both indexers. 😞 Search output is for indexer1: 11/7/16 7:31:36.380 PM 11-07-2016 19:31:36.380 +0200 INFO Metrics - group=per_sourcetype_thruput, series="syslog", kbps=0.048009, eps=0.483869, kb=1.488281, ev=15, avg_age=0.000000, max_age=0 host = spl-forwarder1 source = /opt/splunkforwarder/var/log/splunk/metrics.log sourcetype = splunkd 11/7/16 7:31:05.380 PM 11-07-2016 19:31:05.380 +0200 INFO Metrics - group=per_sourcetype_thruput, series="syslog", kbps=0.078911, eps=0.838695, kb=2.446289, ev=26, avg_age=0.000000, max_age=0 host = spl-forwarder1 source = /opt/splunkforwarder/var/log/splunk/metrics.log sourcetype = splunkd 11/7/16 7:30:34.379 PM 11-07-2016 19:30:34.379 +0200 INFO Metrics - group=per_sourcetype_thruput, series="syslog", kbps=0.065022, eps=0.677440, kb=2.015625, ev=21, avg_age=0.000000, max_age=0 host = spl-forwarder1 source = /opt/splunkforwarder/var/log/splunk/metrics.log sourcetype = splunkd 11/7/16 7:29:32.380 PM 11-07-2016 19:29:32.380 +0200 INFO Metrics - group=per_sourcetype_thruput, series="syslog", kbps=0.060460, eps=0.624364, kb=1.839844, ev=19, avg_age=0.000000, max_age=0 For indexer2: 11/7/16 7:32:38.380 PM 11-07-2016 19:32:38.380 +0200 INFO Metrics - group=per_sourcetype_thruput, series="syslog", kbps=0.058120, eps=0.580630, kb=1.801758, ev=18, avg_age=0.000000, max_age=0 host = spl-forwarder1 source = /opt/splunkforwarder/var/log/splunk/metrics.log sourcetype = splunkd 11/7/16 7:32:07.380 PM 11-07-2016 19:32:07.380 +0200 INFO Metrics - group=per_sourcetype_thruput, series="syslog", kbps=0.048010, eps=0.483882, kb=1.488281, ev=15, avg_age=0.000000, max_age=0 host = spl-forwarder1 source = /opt/splunkforwarder/var/log/splunk/metrics.log sourcetype = splunkd 11/7/16 7:30:03.380 PM 11-07-2016 19:30:03.380 +0200 INFO Metrics - group=per_sourcetype_thruput, series="syslog", kbps=0.050372, eps=0.516128, kb=1.561523, ev=16, avg_age=0.000000, max_age=0 It's started to get a little bit crazy... :S ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-07-2016 07:13 AM
‎11-07-2016 07:13 AM
No, nothing. I try even "*" but nothing seems to have been indexed... ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-07-2016 05:44 AM
‎11-07-2016 05:44 AM
Those often TcpOutputProc logs (connected & closing stream) are ok? Regarding the logs sent, it seems they arrive quite often: root@spl-forwarder1:/opt/splunkforwarder/var/log/splunk# tcpdump -n 'udp port 514' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 15:43:11.767797 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG user.debug, length: 77 15:43:11.767821 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG user.debug, length: 82 15:43:16.207078 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG daemon.debug, length: 73 15:43:16.211091 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG daemon.debug, length: 49 15:43:16.211123 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG daemon.debug, length: 88 15:43:21.212108 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG daemon.debug, length: 49 15:43:21.212162 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG daemon.debug, length: 88 15:43:26.207075 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG daemon.debug, length: 73 15:43:26.213010 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG daemon.debug, length: 49 15:43:26.213039 IP 10.37.129.18.514 > 10.37.129.14.514: SYSLOG daemon.debug, length: 88 ^C 10 packets captured 10 packets received by filter 0 packets dropped by kernel ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-07-2016 12:57 AM
‎11-07-2016 12:57 AM
Regarding NTP servers, I believe this is not the issue because: 1. All splunk instances are VMs with Parallels Tools installed which sync with my OSX (hypervisor). 2. I manually type the command date on all instances and no discrepancies are noticed. Regarding the telnet, everything seems ok.... root@spl-forwarder1:~# nc -vvvn 10.37.129.13 9997 (UNKNOWN) [10.37.129.13] 9997 (?) open ^C sent 2, rcvd 0 root@spl-forwarder1:~# nc -vvvn 10.37.129.12 9997 (UNKNOWN) [10.37.129.12] 9997 (?) open ^C sent 0, rcvd 0 root@spl-forwarder2:~# nc -vvvn 10.37.129.13 9997 (UNKNOWN) [10.37.129.13] 9997 (?) open ^[[A^C sent 7, rcvd 0 root@spl-forwarder2:~# root@spl-forwarder2:~# nc -vvvn 10.37.129.12 9997 (UNKNOWN) [10.37.129.12] 9997 (?) open ^C sent 2, rcvd 0 root@spl-forwarder3:~# nc -vvvn 10.37.129.13 9997 (UNKNOWN) [10.37.129.13] 9997 (?) open ^C sent 0, rcvd 0 root@spl-forwarder3:~# nc -vvvn 10.37.129.12 9997 (UNKNOWN) [10.37.129.12] 9997 (?) open ^C sent 0, rcvd 0 root@spl-forwarder4:~# nc -vvvn 10.37.129.12 9997 (UNKNOWN) [10.37.129.12] 9997 (?) open ^C sent 2, rcvd 0 root@spl-forwarder4:~# nc -vvvn 10.37.129.13 9997 (UNKNOWN) [10.37.129.13] 9997 (?) open ^C sent 2, rcvd 0 "cat splunkd.log | grep TcpOutputProc" gives the following: 11-07-2016 10:37:42.711 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.12:9997 11-07-2016 10:37:42.711 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.13:9997 using ACK. 11-07-2016 10:38:22.559 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.13:9997 11-07-2016 10:38:22.560 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.12:9997 using ACK. 11-07-2016 10:41:02.161 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.12:9997 11-07-2016 10:41:02.161 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.13:9997 using ACK. 11-07-2016 10:42:21.909 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.13:9997 11-07-2016 10:42:21.909 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.12:9997 using ACK. 11-07-2016 10:43:01.757 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.12:9997 11-07-2016 10:43:01.758 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.13:9997 using ACK. 11-07-2016 10:43:41.622 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.13:9997 11-07-2016 10:43:41.623 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.12:9997 using ACK. 11-07-2016 10:45:41.292 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.12:9997 11-07-2016 10:45:41.293 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.13:9997 using ACK. 11-07-2016 10:46:21.148 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.13:9997 11-07-2016 10:46:21.149 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.12:9997 using ACK. 11-07-2016 10:47:00.995 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.12:9997 11-07-2016 10:47:00.996 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.13:9997 using ACK. 11-07-2016 10:49:00.602 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.13:9997 11-07-2016 10:49:00.603 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.12:9997 using ACK. 11-07-2016 10:50:20.385 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.12:9997 11-07-2016 10:50:20.386 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.13:9997 using ACK. 11-07-2016 10:51:00.312 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.13:9997 11-07-2016 10:51:00.312 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.12:9997 using ACK. 11-07-2016 10:52:59.923 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.12:9997 11-07-2016 10:52:59.923 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.13:9997 using ACK. 11-07-2016 10:53:39.772 +0200 INFO TcpOutputProc - Closing stream for idx=10.37.129.13:9997 11-07-2016 10:53:39.773 +0200 INFO TcpOutputProc - Connected to idx=10.37.129.12:9997 using ACK. ... View more

Re: Forwarded events not indexed

by in Getting Data In
‎11-06-2016 10:15 AM
‎11-06-2016 10:15 AM
Hello mmodestino! Thank you VERY much for your comment! Fist of all, I run the search at the indexers and today's error list is the following: "Detected system time adjusted backwards by 1227ms." "Detected system time adjusted backwards by 1228ms." "Detected system time adjusted backwards by 1489ms." "Detected system time adjusted backwards by 2127ms." "Either time adjusted forwards by, or event loop was descheduled for 5282268ms." "Either time adjusted forwards by, or event loop was descheduled for 5278269ms." "Either time adjusted forwards by, or event loop was descheduled for 5278267ms." "Either time adjusted forwards by, or event loop was descheduled for 5277353ms." "Either time adjusted forwards by, or event loop was descheduled for 5277692ms." "Either time adjusted forwards by, or event loop was descheduled for 7205106ms." "Either time adjusted forwards by, or event loop was descheduled for 7196218ms." "Either time adjusted forwards by, or event loop was descheduled for 7196216ms." "Either time adjusted forwards by, or event loop was descheduled for 7195297ms." "Either time adjusted forwards by, or event loop was descheduled for 7195488ms." "Either time adjusted forwards by, or event loop was descheduled for 7196020ms." "Either time adjusted forwards by, or event loop was descheduled for 7198834ms." "Either time adjusted forwards by, or event loop was descheduled for 7195032ms." "Either time adjusted forwards by, or event loop was descheduled for 7195981ms." "Invalid Phonehome response:" "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/metrics.log|host::spl-forwarder1|splunkd|71, streamId=0, offset=0 on host=10.37.129.12:9997" "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/splunkd.log|host::spl-forwarder1|splunkd|73, streamId=0, offset=0 on host=10.37.129.12:9997" "Connection to host=10.37.129.12:9997 failed" "Connect to 10.37.129.12:9997 failed. Connection refused" "Connection to host=10.37.129.13:9997 failed" "Connect to 10.37.129.13:9997 failed. Connection refused" "Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts" "X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: <http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates>" "Metric with name thruput:idxSummary already registered" "Metric with name thruput:thruput already registered" "Private key file does not exist but is defined in audit.conf - no local event signing will take place. You can create auditTrail keys if necessary by running splunk createssl audit-keys" "Core file generation disabled" "The hard limit of 'processes/threads' is lower than the recommended value. The hard limit is: 1899. The recommended value is: 16000." "Restarting Splunkd..." "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/splunkd.log|host::spl-forwarder1|splunkd|59, streamId=0, offset=0 on host=10.37.129.12:9997" "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/metrics.log|host::spl-forwarder1|splunkd|60, streamId=0, offset=0 on host=10.37.129.12:9997" "Applying quarantine to ip=10.37.129.12 port=9997 _numberOfFailures=2" "Applying quarantine to ip=10.37.129.13 port=9997 _numberOfFailures=2" "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/metrics.log|host::spl-forwarder1|splunkd|58, streamId=0, offset=0 on host=10.37.129.13:9997" "Either time adjusted forwards by, or event loop was descheduled for 635127ms." "The hard fd limit is lower than the recommended value. The hard limit is '4096' The recommended value is '64000'." "helper process seems to have died (child killed by signal 15: Terminated)!" message "Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts" "X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: <http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates>" "Metric with name thruput:idxSummary already registered" "Metric with name thruput:thruput already registered" "Private key file does not exist but is defined in audit.conf - no local event signing will take place. You can create auditTrail keys if necessary by running splunk createssl audit-keys" "Core file generation disabled" "The hard fd limit is lower than the recommended value. The hard limit is '4096' The recommended value is '64000'." "The hard limit of 'processes/threads' is lower than the recommended value. The hard limit is: 1899. The recommended value is: 16000." "Either time adjusted forwards by, or event loop was descheduled for 5877328ms." "Either time adjusted forwards by, or event loop was descheduled for 22788819ms." "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/splunkd.log|host::spl-forwarder1|splunkd|114, streamId=0, offset=0 on host=10.37.129.13:9997" "Either time adjusted forwards by, or event loop was descheduled for 7193272ms." "Either time adjusted forwards by, or event loop was descheduled for 7190869ms." "Either time adjusted forwards by, or event loop was descheduled for 7190871ms." "Either time adjusted forwards by, or event loop was descheduled for 7189950ms." "Either time adjusted forwards by, or event loop was descheduled for 7189872ms." "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/metrics.log|host::spl-forwarder1|splunkd|109, streamId=0, offset=0 on host=10.37.129.12:9997" "Either time adjusted forwards by, or event loop was descheduled for 613717ms." "Either time adjusted forwards by, or event loop was descheduled for 609716ms." "Either time adjusted forwards by, or event loop was descheduled for 608779ms." "Either time adjusted forwards by, or event loop was descheduled for 609146ms." "Connection to host=10.37.129.13:9997 failed" "Connect to 10.37.129.13:9997 failed. Connection refused" "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/splunkd.log|host::spl-forwarder1|splunkd|43, streamId=0, offset=0 on host=10.37.129.13:9997" "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/metrics.log|host::spl-forwarder1|splunkd|44, streamId=0, offset=0 on host=10.37.129.13:9997" "Applying quarantine to ip=10.37.129.13 port=9997 _numberOfFailures=2" "Applying quarantine to ip=10.37.129.12 port=9997 _numberOfFailures=2" "Connection to host=10.37.129.12:9997 failed" "Connect to 10.37.129.12:9997 failed. Connection refused" "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/splunkd.log|host::spl-forwarder1|splunkd|43, streamId=0, offset=0 on host=10.37.129.12:9997" "Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/metrics.log|host::spl-forwarder1|splunkd|44, streamId=0, offset=0 on host=10.37.129.12:9997" "Restarting Splunkd..." Regarding index, I have just let the default. My main concern was to just see the events and search them; in a latter phase I would reconfigure indexes. When I search with index=main, I get nothing both on my 2 indexers and on my search head who is configured to implement distributed search. When I run the command, I get the following: Fordwarder1: root@spl-forwarder1:~# splunk list forward-server Active forwards: 10.37.129.13:9997 Configured but inactive forwards: 10.37.129.12:9997 Forwarder2: root@spl-forwarder2:~# splunk list forward-server Active forwards: 10.37.129.12:9997 Configured but inactive forwards: 10.37.129.13:9997 Forwarder3: root@spl-forwarder3:~# /opt/splunkforwarder/bin/splunk list forward-server Active forwards: 10.37.129.13:9997 Configured but inactive forwards: 10.37.129.12:9997 Forwarder4: root@spl-forwarder4:~# /opt/splunkforwarder/bin/splunk list forward-server Active forwards: 10.37.129.12:9997 Configured but inactive forwards: 10.37.129.13:9997 In forwarder1, if I run ./splunk list inputstatus, I get the following: root@spl-forwarder1:~# splunk list inputstatus Cooked:tcp : tcp Raw:tcp : tcp TailingProcessor:FileStatus : $SPLUNK_HOME/etc/splunk.version file position = 70 file size = 70 percent = 100.00 type = finished reading $SPLUNK_HOME/var/log/splunk type = directory $SPLUNK_HOME/var/log/splunk/license_usage_summary.log type = directory $SPLUNK_HOME/var/log/splunk/metrics.log type = directory $SPLUNK_HOME/var/log/splunk/splunkd.log type = directory $SPLUNK_HOME/var/spool/splunk/...stash_new type = directory /opt/splunkforwarder/var/log/splunk/audit.log file position = 137579 file size = 137579 parent = $SPLUNK_HOME/var/log/splunk percent = 100.00 type = open file /opt/splunkforwarder/var/log/splunk/btool.log file position = 0 file size = 0 parent = $SPLUNK_HOME/var/log/splunk percent = 100 type = finished reading /opt/splunkforwarder/var/log/splunk/conf.log file position = 8075 file size = 8075 parent = $SPLUNK_HOME/var/log/splunk percent = 100.00 type = finished reading /opt/splunkforwarder/var/log/splunk/first_install.log file position = 70 file size = 70 parent = $SPLUNK_HOME/var/log/splunk percent = 100.00 type = finished reading /opt/splunkforwarder/var/log/splunk/license_usage.log file position = 0 file size = 0 parent = $SPLUNK_HOME/var/log/splunk percent = 100 type = finished reading /opt/splunkforwarder/var/log/splunk/license_usage_summary.log file position = 0 file size = 0 parent = $SPLUNK_HOME/var/log/splunk/license_usage_summary.log percent = 100 type = finished reading /opt/splunkforwarder/var/log/splunk/metrics.log file position = 18301609 file size = 18301609 parent = $SPLUNK_HOME/var/log/splunk/metrics.log percent = 100.00 type = open file /opt/splunkforwarder/var/log/splunk/mongod.log file position = 0 file size = 0 parent = $SPLUNK_HOME/var/log/splunk percent = 100 type = finished reading /opt/splunkforwarder/var/log/splunk/remote_searches.log file position = 0 file size = 0 parent = $SPLUNK_HOME/var/log/splunk percent = 100 type = finished reading /opt/splunkforwarder/var/log/splunk/scheduler.log file position = 0 file size = 0 parent = $SPLUNK_HOME/var/log/splunk percent = 100 type = finished reading /opt/splunkforwarder/var/log/splunk/searchhistory.log file position = 0 file size = 0 parent = $SPLUNK_HOME/var/log/splunk percent = 100 type = finished reading /opt/splunkforwarder/var/log/splunk/splunkd-utility.log file position = 21963 file size = 21963 parent = $SPLUNK_HOME/var/log/splunk percent = 100.00 type = finished reading /opt/splunkforwarder/var/log/splunk/splunkd.log file position = 1369294 file size = 1369294 parent = $SPLUNK_HOME/var/log/splunk/splunkd.log percent = 100.00 type = open file /opt/splunkforwarder/var/log/splunk/splunkd_access.log file position = 12246 file size = 12246 parent = $SPLUNK_HOME/var/log/splunk percent = 100.00 type = open file /opt/splunkforwarder/var/log/splunk/splunkd_stderr.log file position = 3325 file size = 3325 parent = $SPLUNK_HOME/var/log/splunk percent = 100.00 type = finished reading /opt/splunkforwarder/var/log/splunk/splunkd_stdout.log file position = 9371 file size = 9371 parent = $SPLUNK_HOME/var/log/splunk percent = 100.00 type = finished reading /opt/splunkforwarder/var/log/splunk/splunkd_ui_access.log file position = 0 file size = 0 parent = $SPLUNK_HOME/var/log/splunk percent = 100 type = finished reading UDP:hosts : 10.37.129.18 UDP:listenerports : 514 Yes, forwarder runs as root: root@spl-forwarder1:~# ps -ef | grep splunk root 1030 1 0 11:16 ? 00:00:59 splunkd -p 8089 start root 1033 1030 0 11:16 ? 00:00:00 [splunkd pid=1030] splunkd -p 8089 start [process-runner] root 1692 1080 0 20:12 pts/0 00:00:00 grep splunk Netstat gives the following: root@spl-forwarder1:~# netstat -tulpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 465/sshd tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN 1030/splunkd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1015/exim4 tcp 0 0 0.0.0.0:51706 0.0.0.0:* LISTEN 448/rpc.statd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 439/rpcbind tcp6 0 0 :::22 :::* LISTEN 465/sshd tcp6 0 0 ::1:25 :::* LISTEN 1015/exim4 tcp6 0 0 :::111 :::* LISTEN 439/rpcbind tcp6 0 0 :::46163 :::* LISTEN 448/rpc.statd udp 0 0 0.0.0.0:37255 0.0.0.0:* 411/dhclient udp 0 0 0.0.0.0:49322 0.0.0.0:* 448/rpc.statd udp 0 0 0.0.0.0:514 0.0.0.0:* 1030/splunkd udp 0 0 0.0.0.0:68 0.0.0.0:* 411/dhclient udp 0 0 0.0.0.0:614 0.0.0.0:* 439/rpcbind udp 0 0 0.0.0.0:111 0.0.0.0:* 439/rpcbind udp 0 0 127.0.0.1:624 0.0.0.0:* 448/rpc.statd udp6 0 0 :::60798 :::* 448/rpc.statd udp6 0 0 :::25151 :::* 411/dhclient udp6 0 0 :::614 :::* 439/rpcbind udp6 0 0 :::111 :::* 439/rpcbind Regarding the deployment server's configuration, yes I have instructed to restart the forwarder. On top of that, I remember also restarting it manually... Thank you very much again! ... View more

Forwarded events not indexed

by in Getting Data In
‎11-06-2016 03:40 AM
2 Karma
‎11-06-2016 03:40 AM
2 Karma
Hello! I am preparing for the architect exam and I have set the following lab: 10.37.129.10 spl-search-head 10.37.129.11 spl-deployment-server 10.37.129.12 spl-indexer1 10.37.129.13 spl-indexer2 10.37.129.14 spl-forwarder1 10.37.129.15 spl-forwarder2 10.37.129.16 spl-forwarder3 10.37.129.17 spl-forwarder4 10.37.129.18 Checkpoint GAIA R77.30 All forwarders talk to the deployment server and I have pushed an app named "sendtoindex" to the forwarders with the following /opt/splunk/etc/deployment-apps/sendtoindexer/default/outputs.conf: [tcpout: my_LB_indexers] server=10.37.129.12:9997,10.37.129.13:9997 compressed=true forceTimebasedAutoLB=true autoLBFrequency=40 useACK=true Then, I configured Checkpoint to send SYSLOG UDP 514 to forwarder1 and pushed the app named "syslogcheckpoint" through deployment server to forwarder1 with the following /opt/splunk/etc/deployment-apps/syslogcheckpoint/default/inputs.conf: [udp://10.37.129.18:514] host=10.37.129.18 connection_host = ip sourcetype=syslog queueSize=900MB persistentQueueSize=5GB In forwarder1 I have enabled tcpdump and I see the logs are delivered to forwarder. Moreover, both indexer1 and indexer2 listen to ports 9997. If I run a search to indexers (e.g. indexer1) it seems that logs are delivered to indexer1: Search: index="_internal" host="spl-forwarder1" syslog 11-06-2016 13:35:33.053 +0200 INFO Metrics - group=per_sourcetype_thruput, series="syslog", kbps=0.042025, eps=0.451624, kb=1.302734, ev=14, avg_age=0.000000, max_age=0 What is wrong in my configuration? Do I have to instruct indexers with a props.conf configuration? Why logs are not indexed although sent to indexers through port 9997? Thank you in advance for your help! ... View more

Re: ASA MAC address re-format

by in All Apps and Add-ons
‎09-26-2016 12:39 AM
‎09-26-2016 12:39 AM
With a lot of research I found out the formula: sourcetype="cisco:asa" message_id=604103 |rex mode=sed field=src_mac "s/01//g" | rex mode=sed field=src_mac "s/[:. -]//g" | rex mode=sed field=src_mac "s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/" However, can I would like to have it at index time and not search time... ... View more

Re: ASA MAC address re-format

by in All Apps and Add-ons
‎09-23-2016 07:36 AM
‎09-23-2016 07:36 AM
I have tried this configuration on transforms.conf but with no luck: [src_mac] REGEX = 01([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2}) FORMAT = src_mac::$1:$2:$3:$4:$5:$6 ... View more

ASA MAC address re-format

by in All Apps and Add-ons
‎09-23-2016 02:31 AM
‎09-23-2016 02:31 AM
Good morning community! I have a dead-end and hope somebody helped me. I have this Cisco ASA MAC address format: "0118.3a2d.584b.5e". When I read Network Traffic data model, I saw the recommendation: The destination TCP/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field. Note: Always use colons instead of dashes, spaces, or no separator. The question is how I can transform at index time MAC address from "0118.3a2d.584b.5e" to "01:18:3a:2d:58:4b:5e". Thanks in advance, Andreas ... View more

Splunk Enterprise Security: Why is the alert "Acti...

by in Splunk Enterprise Security
‎06-28-2016 02:34 AM
‎06-28-2016 02:34 AM
I have populated identities.csv on Splunk Enterprise Security and enabled the alert of "Activity from an expired identity". Although the identity is not expired, the alerts are being generated. Do you have any ideas on how to correct this issue? My identities.csv looks like the following: identity,prefix,nick,first,last,suffix,email,phone,phone2,managedBy,priority,bunit,category,watchlist,startDate,endDate,work_city,work_country,work_lat,work_long xxx,Mr.,,xxx,xxx,,xxx,,,xxx,,xxx,contractor,true,,01/31/17 23:59,xxx,xxx,, xxx,Ms.,,xxx,xxx,,xxx,,,xxx,,xxx,contractor,true,,01/31/17 23:59,xxx,xxx,, ... View more

Re: How to index email values without special char...

by in Getting Data In
‎06-14-2016 01:53 PM
‎06-14-2016 01:53 PM
This works, but I want it to have in indexing time. I don't want the special characters to show up and need to map it on CIM so as Enterprise Security will correlate this info as an email without < and > . ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎12-30-2025 03:23 AM
Karma from
View All
Karma given to
View All