Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About afx
afx
Contributor
Member since:
05-02-2019
03-01-2024
Community Statistics
| Posts | 140 |
| Solutions | 7 |
| Karma Given | 11 |
| Karma Received | 22 |
| Member Since | 05-02-2019 |
Activity Feed
- Karma Re: Create event if no results are returned for richgalloway. 03-01-2024 12:19 AM
- Karma Re: How do I monitor changes to config files? for jeremyfer. 02-09-2024 07:56 AM
- Got Karma for Re: Why is the Universal forwarder executing regmon, powershells and others with out them being explicitly configured?. 10-20-2023 09:23 AM
- Posted Various Errrors in "SANS ISC Adaptive Response Action" (app ID 3697) on All Apps and Add-ons. 09-18-2023 06:02 AM
- Got Karma for Re: How to Splunk the SAP Security Audit Log. 07-24-2023 02:42 AM
- Got Karma for Limit DB Connect Query Seever to localhost. 05-12-2023 04:38 AM
- Posted Re: How to Splunk the SAP Security Audit Log on Getting Data In. 11-12-2021 05:13 AM
- Got Karma for Re: Why does splunk need to be installed as root?. 08-02-2021 01:57 AM
- Got Karma for How to Splunk the SAP Security Audit Log. 04-21-2021 01:12 PM
- Posted Re: Documentation for Knowledge Object Overview App for Splunk on All Apps and Add-ons. 03-11-2021 04:30 AM
- Posted Re: Documentation for Knowledge Object Overview App for Splunk on All Apps and Add-ons. 03-10-2021 06:59 AM
- Posted Documentation for Knowledge Object Overview App for Splunk on All Apps and Add-ons. 03-10-2021 12:45 AM
- Posted Re: CMMaster - Unable to send scheduled jobs on Splunk Enterprise. 03-05-2021 12:31 AM
- Posted Re: JRE/JDK shipped with Splunk Enterprise? on Installation. 01-25-2021 08:53 AM
- Posted Re: JRE/JDK shipped with Splunk Enterprise? on Installation. 01-25-2021 04:45 AM
- Posted Re: JRE/JDK shipped with Splunk Enterprise? on Installation. 01-25-2021 12:39 AM
- Posted Re: JRE/JDK shipped with Splunk Enterprise? on Installation. 01-22-2021 06:37 AM
- Posted JRE/JDK shipped with Splunk Enterprise? on Installation. 01-22-2021 12:52 AM
- Tagged JRE/JDK shipped with Splunk Enterprise? on Installation. 01-22-2021 12:52 AM
- Got Karma for Alert Manager: How to suppress follow on alerts. 12-30-2020 11:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-08-2019
05:37 AM
OK, posted a refinement here: https://answers.splunk.com/answers/757714/how-to-splunk-the-sap-security-audit-log.html
... View more
07-08-2019
05:35 AM
2 Karma
The post question did include the answer, but then it could not be marked as an answer, therefore I pushed the content into a second post that could be marked as an answer.
... View more
06-18-2019
11:43 PM
After checking the docs, I unfortunately found that I cannot use EVAL on results from a LOOKUP.
... View more
06-18-2019
03:55 AM
That string is static yes, but it comes from a lookup.
... View more
06-18-2019
01:41 AM
Hi,
I am trying to make a parameterized log more readable.
Assuming a log that has the entries
20,hugo,10.1.1.1
which are the fields
msgid,user,src
I might have a log entry that has a msgid of 20 which then is resolved via a CSV lookup to a readable message which is available as a field:
message="User &A has logged in from &B"
I have that step working already, but I am a bit lost on how to proceed to the next one:
In a second step I want that message to be filled in by the two fields that have been extracted from the log (Say A=hugo and B=10.1.1.1) so that the result is available as a field
fullmessage="User hugo has logged in from 10.1.1.1"
All of this in props.conf/transforms.conf so that fullmessage is available for reports later on.
thx
afx
... View more
06-18-2019
12:05 AM
I did and it makes no change at all.
See last answer post, looks like I have a solution now.
Will post once testing is finished and the thing is a bit more polished.
... View more
06-17-2019
06:14 AM
Ok, meanwhile I have stumbled across this: Fixed Width data streamsfield extractions
This resulted in me trying to put delimiters in via a transform on_raw and then define the fields via the delimiter method. So far it seem successful, I'll do some more tests and will report back.
cheers
afx
... View more
06-17-2019
01:28 AM
Copied one sample file and the TA do a dedicated test box.
No change.
Used rex inline. Then it works. But why?
thx
afx
... View more
06-17-2019
12:47 AM
Tried that already ;-(
No change.
And from reading the first line of that blog post I would assume that this is outdated anyway.
... View more
06-14-2019
08:26 AM
Neither the bloomfilters nor the fields.conf file help.
Time to go up the corporate chain to get a ticket openend I guess ;-(
Thanks for all the suggestions!
... View more
06-14-2019
08:04 AM
I've put createBloomfilter = false into the indexes.conf file in the appropriate stanza.
Then pushed the masteter config.
So far no change.
... View more
06-14-2019
07:58 AM
I've seen that one, but it stats this issue is fixed since 4.3.
Would think it is still valid?
... View more
06-14-2019
07:40 AM
This works just fine.
If Splunk would not show me the fields in the selection list, then this would all be simply my regex incompetence.
But as it shows the fields jus as defined, I am stumped.
... View more
06-14-2019
07:30 AM
It is not the one long string, as I wrote in the first post, this also happens with individual definitions.
Ok, tried just the string and I do not get any results...
Which is weird.
I do get results for AUK* or "AUK*" which then highlights everything until the first space.
... View more
06-14-2019
07:09 AM
Why would I not use the right search terms?
Splunk is offering me the terms in the popup menus for the fields.
For example
AUK20190614155300000387400019D110.42.24S_ESA_ANG SAPMSSY1 1001ARFC&&ARFC_DEST_CONFIRM 10.42.242.200
Should be found when I select message_id=AUK from the interesting fields sidebar.
But I get no results
(The copy and paste did collapse spaces in this record. The extract definition above shows where things are. Just Imagine plenty of spaces to fill the fixed size records where you see a single space, this line is always exactly 200 characters wide).
... View more
06-14-2019
07:01 AM
Nope.
I select values from the dropdown menus that splunk offers me for the fields.
... View more
06-14-2019
06:46 AM
That would be easy 😉
The ones that work are user, app,src, sap_audit_class.
They don't seem to follow a pattern.
Even weirder, sap_audit_class is based on message_id and works, but message_id itself does not...
... View more
06-14-2019
06:33 AM
This is the props.conf file:
[sap:sal]
EXTRACT-sal = ^(?<message_id>.{3})(?<date>.{8})(?<time>.{6})(\w\w)(?<process_id>.{5})(?<task>.{5})(?<proctype>.{2})(?<term>.{8})(?<user>.{12})(?<transaction>.{20})(?<app>.{40})(?<client>.{3})(?<message>.{64})(?<src>.{20})
LOOKUP-auto_sap_sm20 = sap_sm20 message_id AS message_id OUTPUTNEW audit_class AS sap_audit_class event_class AS sap_event_class message AS sap_message new_in_release AS sap_new_in_release
transforms.conf:
[sap_sm20]
batch_index_query = 0
case_sensitive_match = 1
filename = SAP_SM20.csv
... View more
06-14-2019
06:14 AM
Yes, they show up there.
I also did this:
index=myindex sourcetype=mysource
| fieldsummary
| search field="myfield"
| table field count distinct_count values
And the result is just perfectly fine.
... View more
06-14-2019
05:53 AM
I have a totally weird case...
I have field extractions defined in props.conf either individually or all in one extraction, no difference.
The fields show up in the "Interesting Fields" list.
When I then select a field and pick a value, the result is empty.
For example
index=myindex sourcetype=mysrc myfield=A
Shows nothing even though the popup told me there are 100 entries of myfield with contents A.
But if I then flip the search to exclude A I get results...
index=myindex sourcetype=mysrc myfield!=A
This happens for several fields defined for that index/source type but not all and I see no pattern why some work and some do not (position seems irrelvant).
If I use the fieldsummary filter, I find things just fine.
Splunk 7.4.2, 2 indexers, one SH
So why can't I select field contents that Splunk clearly knows about?
I am totally lost.
thx
afx
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-01-2024
07:59 AM
|
Karma from
Karma given to
