Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunkreal
splunkreal
Motivator
Member since:
05-26-2016
yesterday
Community Statistics
| Posts | 487 |
| Solutions | 20 |
| Karma Given | 684 |
| Karma Received | 38 |
| Member Since | 05-26-2016 |
Activity Feed
- Posted Re: Deployment Server and HeavyForwarder app local folder on Deployment Architecture. yesterday
- Karma Re: Deployment Server and HeavyForwarder app local folder for kiran_panchavat. yesterday
- Posted Deployment Server and HeavyForwarder app local folder on Deployment Architecture. yesterday
- Karma Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7. for the_wolverine. Wednesday
- Karma Re: How to change server roles in the Distributed Management Console using the CLI or conf files? for MuS. a week ago
- Posted Re: tstats via REST API on Splunk Search. a week ago
- Karma Re: tstats via REST API for isoutamo. a week ago
- Karma Re: How to delete a correlation search for DavidHourani. a week ago
- Karma Re: Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? for smoir_splunk. 2 weeks ago
- Got Karma for Re: New "role" cannot be added to any users due to "is not grantable"; how to make roles "grant. 2 weeks ago
- Posted Re: New "role" cannot be added to any users due to "is not grantable"; how to make roles "grant on Security. 2 weeks ago
- Karma Re: New "role" cannot be added to any users due to "is not grantable"; how to make roles "grant for gcusello. 2 weeks ago
- Karma Re: What populates the list of "Owners" in the ES App? for smoir_splunk. 2 weeks ago
- Karma Re: Enterprise Security Suite Incident Review - How Do You Edit the Owners List? for aakwah. 2 weeks ago
- Posted Re: Difference between ES Permissions page and Splunk native edit role page on Splunk Enterprise Security. 2 weeks ago
- Karma Re: license manager results differ from metrics.log indexed volume for yannK. 3 weeks ago
- Karma Re: Difference between ES Permissions page and Splunk native edit role page for meetmshah. 3 weeks ago
- Karma Re: Announcing Our Splunk MVPs for jkat54. 3 weeks ago
- Karma Re: Announcing Our Splunk MVPs for gcusello. 3 weeks ago
- Karma Re: Announcing Our Splunk MVPs for alan_a. 3 weeks ago
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-05-2019
06:39 AM
https://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Setup2
"From the Data list, select the data you want to collect with the input.
Non-Audit: Collects all event types except audit events.
Firewall Events: Collects firewall events only.
Firewall Audit: Collects audit events only.
SmartDefense: Collects Smart Defense events only.
VPN (Virtual Private Network): Collects VPN events only."
... View more
04-04-2019
07:32 AM
Hello guys,
we have Splunk Add-on for Checkpoint OPSEC LEA 4.1.0
We have only accept and drop actions when it's available in the fw.log on the Checkpoint log server where it's pulled from.
How to configure this in the OPSEC LEA addon? Or maybe it's on the Checkpoint LEA connection interface?
... View more
04-04-2019
02:23 AM
Using port 1025 solved, thanks guys 🙂
... View more
03-25-2019
07:40 AM
UP, is this still not possible in V7?
Thanks.
... View more
03-22-2019
08:32 AM
Hello, I tried adding this in CLI search job script using curl and getting no result, any idea? Thanks 🙂
... View more
03-20-2019
07:18 AM
Hello guys,
I use $trigger_timeHMS$ in logevent (triggering for each result) and I can see $trigger_timeHMS$ appears several times per tens results.
I use this token to save reporting date in raw data :
ex : schedule at 13:00 =
2019-03-20 13:00:32 19 events
2019-03-20 13:00:33 29 events
2019-03-20 13:00:34 29 events
2019-03-20 13:00:35 8 events
There is no duplicate result.
Thanks.
... View more
03-20-2019
02:20 AM
you need get_metadata capability
... View more
03-19-2019
03:22 PM
Hello,
does tstats require read access to indexes? same question for metadata?
The goal is to provide statistics from indexes without giving access to data (for monitoring by instance)
Thanks.
Splunk Enterprise V7.1.4
... View more
03-13-2019
09:45 AM
Hello,
is it possible to install Checkpoint OPSEC LEA app on several heavy forwarders without duplicates, which architecture do you advice?
Thanks.
... View more
03-07-2019
07:34 AM
solved, thanks, maybe bad copy/paste 🙂
... View more
03-07-2019
06:01 AM
Hello, this looks good however I'm getting error on UF 6.x when restarted :
Checking conf files for problems...
Bad regex value: '([\r\n]+)type=\S+\s+\msg=audit', of param: props.conf / [linux_audit] / LINE_BREAKER; why: unrecognized character follows \
One or more regexes in your configuration are not valid. For details, please see btool.log or directly above.
Done
.
... View more
01-22-2019
07:31 AM
Hi @yannK
what about this query?
index=INDEXNAME | eval bkt=_bkt
| table index,source,sourcetype,host,bkt
| join bkt
[| dbinspect index=INDEXNAME | convert ctime(startEpoch) | convert ctime(endEpoch)
| rename bucketId as bkt]
| table index,source,sourcetype,host,bkt,state,sizeOnDiskMB,startEpoch,endEpoch,splunk_server
Thanks.
... View more
01-11-2019
06:01 AM
Hello dear Duane,
thank you for your presentation at https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf
Do you confirm this is fully supported by Splunk and therefore should be documented in official documentation?
Thanks.
Best regards.
... View more
01-09-2019
09:09 AM
Hello guys,
this isn't a question just a trick 🙂
Add this to your query :
| appendcols
[| makeresults
| eval curWDay=strftime(_time,"%A")
| eval curHour=tonumber(strftime(_time,"%H"))]
| search ((curHour>08 AND curHour<13) OR (curHour>13 AND curHour<20))
| search (curWDay = Monday OR curWDay = Tuesday OR curWDay = Wednesday OR curWDay = Thursday OR curWDay = Friday)
... View more
01-04-2019
01:51 AM
this works too 🙂
... View more
11-21-2018
03:24 AM
Hello,
Due to General Data Protection Regulation (GDPR/RGPD), should Splunk administrator user / role be limited to access to all indexes?
How do I check if data is therefore correctly indexed using internal indexes (Splunk 7.1.4)?
Thanks in advance.
... View more
11-14-2018
04:20 PM
Hello guys,
I have data like this using Splunk 7.1 and I would like to calculate minutes between start and end of each event :
example (order can change) :
_time field1 status
2018-11-15 00:10 AAA1 start
2018-11-15 00:15 AAA2 start
2018-11-15 00:17 AAA1 end
2018-11-15 00:20 AAA2 end
2018-11-15 00:25 AAA3 start
2018-11-15 00:26 AAA3 end
I think I should group by field1 and time then calculate using streamstats.
Thanks for your help.
... View more
10-16-2018
02:10 AM
Hello, do you add MAX_DAYS_AGO on props.conf forwarder-side? Thanks.
... View more
09-24-2018
03:12 AM
Congratulations, it works, good method 🙂
... View more
09-21-2018
06:27 AM
Dirty solution :
CC :' \d+' de DN : 'CN=(?<CN>[^,]+)[^']+'\n- CODE \(serial : (?P<CODE>\d+)\) error.\n-+\n- CODE \(serial : (?P<CODE2>\d+)\) error.\n-+\n- CODE \(serial : (?P<CODE3>\d+)\) error.\n-+\n- CODE \(serial : (?P<CODE4>\d+)\) error.\n-+\n- CODE \(serial : (?P<CODE5>\d+)\) error.\n-+\n
... View more
09-21-2018
12:04 AM
It's a multiline single event, thanks 🙂
... View more
09-20-2018
07:28 AM
2 Karma
Hello guys, anyone knows when Splunk 8.0 will be released (and therefore EOL Splunk 6) ?
Thanks.
... View more
- Tags:
- splunk-enterprise
09-20-2018
02:43 AM
Hi Kamlesh, thanks however this way I can't associate CN with CODE accordingly.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
Karma given to
