×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- About afx
afx
Contributor
Member since:
05-02-2019
a week ago
Community Statistics
| Posts | 142 |
| Solutions | 7 |
| Karma Given | 11 |
| Karma Received | 24 |
| Member Since | 05-02-2019 |
Activity Feed
- Posted Re: How to Splunk the SAP Security Audit Log on Getting Data In. a week ago
- Posted Re: How to Splunk the SAP Security Audit Log on Getting Data In. a week ago
- Got Karma for How to Splunk the SAP Security Audit Log. 01-14-2025 02:06 AM
- Got Karma for Re: How to Splunk the SAP Security Audit Log. 01-14-2025 01:58 AM
- Karma Re: Create event if no results are returned for richgalloway. 03-01-2024 12:19 AM
- Karma Re: How do I monitor changes to config files? for jeremyfer. 02-09-2024 07:56 AM
- Got Karma for Re: Why is the Universal forwarder executing regmon, powershells and others with out them being explicitly configured?. 10-20-2023 09:23 AM
- Posted Various Errrors in "SANS ISC Adaptive Response Action" (app ID 3697) on All Apps and Add-ons. 09-18-2023 06:02 AM
- Got Karma for Re: How to Splunk the SAP Security Audit Log. 07-24-2023 02:42 AM
- Got Karma for Limit DB Connect Query Seever to localhost. 05-12-2023 04:38 AM
- Posted Re: How to Splunk the SAP Security Audit Log on Getting Data In. 11-12-2021 05:13 AM
- Got Karma for Re: Why does splunk need to be installed as root?. 08-02-2021 01:57 AM
- Got Karma for How to Splunk the SAP Security Audit Log. 04-21-2021 01:12 PM
- Posted Re: Documentation for Knowledge Object Overview App for Splunk on All Apps and Add-ons. 03-11-2021 04:30 AM
- Posted Re: Documentation for Knowledge Object Overview App for Splunk on All Apps and Add-ons. 03-10-2021 06:59 AM
- Posted Documentation for Knowledge Object Overview App for Splunk on All Apps and Add-ons. 03-10-2021 12:45 AM
- Posted Re: CMMaster - Unable to send scheduled jobs on Splunk Enterprise. 03-05-2021 12:31 AM
- Posted Re: JRE/JDK shipped with Splunk Enterprise? on Installation. 01-25-2021 08:53 AM
- Posted Re: JRE/JDK shipped with Splunk Enterprise? on Installation. 01-25-2021 04:45 AM
- Posted Re: JRE/JDK shipped with Splunk Enterprise? on Installation. 01-25-2021 12:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-20-2020
01:55 PM
Currently our Infrastructure is small, so I try to not involve yet another box.
The funny thing is, the machine is pretty much idle when this happens.
cheers
afx
... View more
02-20-2020
01:47 PM
Still on 7.2.4, but good to know,
thx
afx
... View more
02-20-2020
04:26 AM
1 Karma
Thanks,
looks like that worked (I also added a disabled=1 as I did not put it into a local file but pushed it via the deployment server).
thx
afx
... View more
02-20-2020
04:03 AM
Not very efficeint in my eyes and the fill up the sysmon execution log.
The only benefit is the liceence increase for Splunk ;-(
Any ideas on how to disable this?
thx
afx
... View more
02-20-2020
02:58 AM
Hi,
why is my UF on Windows executing various splunk-* tools without them beeing configured in any input?
Every few minutes I see them in sysmon:
splunk-powershell.exe
splunk-regmon.exe
splunk-powershell.exe
splunk-netmon.exe
splunk-admon.exe
splunk-MonitorNoHandle.exe
splunk-winprintmon.exe
I do not see them in any inputs.conf.
thx
afx
... View more
02-13-2020
07:31 AM
Hidden files are explicitly forbidden, see
https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Splunkbase/Approvalcriteria
cheers
afx
... View more
02-12-2020
12:45 AM
Hi,
are you sure that this is the exact raw string of the file? It seems to be missing a digit before the AU1 message identifier (that digit gets eaten by splunk when using my definition of the line breaker).
I suggest opening an unmodified SAP audit log file in an editor where you can toggle the encoding (like Notepad++ or VIM) and checking it there to see if my defintion will work for it.
The beginning of your Unknown4 definitely looks like a SAP message, but it seems to have garbage at the end as only the "B&0&A" are used by AU1.
To me it looks like your SAP system is not nulling out buffers, but that should be extremely unlikely...
Unfortunately, there is no documentation apart from the referenced SAP Blog post about the format of the file.
cheers
afx
... View more
02-11-2020
04:10 AM
Great, silly me never noticed the subdued subscribe button.
thx
afx
... View more
02-10-2020
12:02 PM
Our Splunk cluster has no Internet connection by policy.
Any idea how to at least semi automate update checks for splunkbase apps?
thx
afx
... View more
02-10-2020
09:14 AM
Hi,
thanks to the wonderful website_monitoring app, I see some interesting but unexplained tidbits.
We have two indexers with HEC configurued. Because of project delays those HEC inputs are idle.
I use
https://splunk-index1:8088/services/collector/health
for the query in website_monitoring.
And at least onece a day I do get a 5 second response time on one of the indexers, not the other. Usually this is less than 20ms.
Checking _index/_audit for anything happening in parallel, I found nothing so far that would explain this monster increase.
It is not linked to specific times.
If I only use the port, the peak times are just up t0 60ms worst case. But that gives me an ugly 404 error, so I figured I might as well use a decent endpoint.
Any ideas?
thx
afx
... View more
02-10-2020
12:52 AM
The filename sounds ok.
So I wonder, did they convert this for you for convenince or why is it different.
After all, the SAL should be no different on AIX than the Linux ones I get.
cheers
afx
... View more
02-08-2020
06:02 AM
Strange, this seems to have a header. Not something I have seen in my logs.
As this is already a UTF8 file and the records are not of fixed length, I wonder how it was generated? I assume that this is not an original unmodified SAP audit file..
cheers
afx
... View more
02-07-2020
09:05 AM
From what you have shown me, the line breaker should be the same, but the events might be longer and then it gets confusing.
Would you have a test file for me to look at?
cheers
afx
... View more
02-07-2020
08:02 AM
Ok, this is different...
When our systems where migrated, the audit log format stayed the same.
Is this a fresh system with 750 or a migrated one?
As I only have a few boxes, I do not have much systems to compare with.
Do you still have 200 Character records? Check with NotePad++ or similar.
The spare characters for the line break seem to be still there from your example, so if there is just a new lenght, that could be adjusted easily for a longer record length.
cheers
afx
... View more
01-31-2020
06:48 AM
Hi becksboy,
glad this was helpful!
We do run 750 here and the blog post from the SAP guy references the added SAL events, so that should work fine.
I am curious, do you know why you have UTF-16BE in one log?
And what did you have to use for LINE_BREAKER and TIME_PREFIX?
have a nice weekend
afx
... View more
01-27-2020
12:25 AM
Yup, that was the reason.
I was wrongly thinking that the report is based on the definition not the log entries.
thx
afx
... View more
01-24-2020
04:35 AM
Thanks, that worked.
This leaves only the rising column tracker files. Copy and paste of the first line from a system where I used the GUI seems to be the way to go.
thx
afx
... View more
01-23-2020
05:40 AM
Hmm,
looks like the default set there will populate the GUI settings.
I was hopig for defaults that woul be automatically used without being explicity written ito the configuration file (I have more than 100 entries in there...)
cheers
afx
... View more
01-23-2020
05:36 AM
Started to set up a website via the GUI and advanced options instead of the inputs.conf file of the app.
Found a host setting there that said $decideOnStartup.
So one explicitly needs to set up the host, it is not taken from the monitored URL.
cheers
afx
... View more
01-23-2020
01:27 AM
Hi,
the new response logging makes it a bit hard to find out where it comes from:
thx
afx
... View more
01-23-2020
01:15 AM
Thanks,
it works, also setting the default index which is not in the spec.
thx
afx
... View more
01-23-2020
12:22 AM
Well,
splunk show default-hostname
splunk show servername
both report the correct hostname....
And actually, I would think it makes more sense to set the host of the target URL than the querying host here.
thx
afx
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
Karma given to
