About lakshman239

lakshman239 · ‎07-12-2017

Is Qualys TA for Splunk supported on SHC? looking at various threads, it appears to be not supported. Is that because of 'inputs.conf' running in SH and possible duplicate of the WAS and Host detection data or is there any limitation with the Add-on?

lakshman239 · ‎07-04-2017

does this mean without a proxy server, we cannot post a json data to the application, natively?

lakshman239 · ‎05-30-2017

On ES 4.0+ , the same is now available as part of 'Configure->Content Management-> New '

lakshman239 · ‎05-17-2017

In how many mins, do you want to see the failed login followed by successful logon? if you schedule the above search within that time frame, it should help in you in what you need. Alternatively, you could also use streamstats to get the running total for a given period.

lakshman239 · ‎04-25-2017

The default setting in 6.3 is not to replicate - http://dev.splunk.com/view/SP-CAAAEZJ with 'replicate=false'

lakshman239 · ‎04-05-2017

If you trying to install the 'havesine' app via splunk GUI and getting "There was an error processing the upload.Invalid app contents: archive contains more than one immediate subdirectory: and .haversine" error, this indicates that the folders have ".*" files which are being stopped by GUI. You can download the app to a PC or a linux server and run the command : 1. extract the app using tar -zxvf haversine.tar.gz 2. find haversine/ -type f -name ".*" -print0 to see all "." files. [ there is a .haveshine file as well, which needs to be removed] 3. delete all the "." files and recreate the tar.gz file and try to install via the GUI or move the app to etc/apps and restart the splunk. As far as I am aware, we only have havershine app which can give you the distance which you need for a given coordinates. Hope this helps.

lakshman239 · ‎04-05-2017

So, it appears that the disk space allocated for the SPLUNK_DB (usually /opt/splunk/var/lib/splunk) is not getting enough space as something else is consuming them faster. Possibly the splunk logs or other processes/services are taking up your disk space. On the other hand, if you have pointed your splunk_db to another mount point, you could check the usage there. On a linux system du -smh * and df -kh can help you to look at the disk/file space/usage.

lakshman239 · ‎04-05-2017

I believe you want to know about bucket rollover when it hits the configured maxSize. You can see the rollover logs in 'splunkd.log' and you can change the logging levels in log.cfg to INFO to see additional details. Hope this helps.

lakshman239 · ‎03-31-2017

In the case of delimited files (e.g IIS/w3c, tab delimited files), the field extraction happens at index time right? So, these fields are available as part of name value pairs in the search time. So [regex | regex in ] doesn't work. It seems accept only source. Is this a bug?

lakshman239 · ‎03-29-2017

You can still create the index on the distributed indexers ( You can then delete the indexes.conf on the search head or leave it as it doesn't do any harm). Ensure your indexers listen to the stream of logs from Zscaler on the required TCP port. Also, you can move or copy the props.conf and transforms.conf on to the indexers. If you want to keep the search time knowledge objects (e.g. EVAL/transforms/field alias), you could have them only on the search head.

lakshman239 · ‎03-17-2017

check your cron . for every 5 mins, it should be */5 * * * * and use same approach for other.

lakshman239 · ‎03-14-2017

As you know, the Verbose errors indicates that splunk is unable to parse the timestamp using the strptime (TIME_FORMAT) in the sourcetype. you can do a few things. 1. enable DEBUG by creating file 'log-local.cfg' (copy of log.cfg) in /opt/splunk/etc with following additions category.DateParserVerbose=DEBUG category.AggregatorMiningProcessor=DEBUG 2. restart splunk and check for DataVerbose errors. this will show the strptime format issue for you to see how splunk interprets the event timestamp. 3. update your props.conf to reflect something like the below (adjust as needed) TIME_PREFIX = ^ TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 30 SHOULD_LINEMERGE = false LINE_BREAKER = ([\n\r]+)\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+ TRUNCATE = 999999

lakshman239 · ‎03-13-2017

Nope. Just checking the basics. Did you setup the inputs.conf to enable respective inputs e.g. WinHostMon:Process

lakshman239 · ‎03-09-2017

Is your issue resolved now? on Cisco ASA add-on 3.2.6 we don't have parsing errors. on your sourcetype stanza above, MAX_TIME* should appear in the following line. I assume that's not a oversight

lakshman239 · ‎03-06-2017

Thx luke and looking for a solution in near future

lakshman239 · ‎03-06-2017

Thx Luke. How about for items 2 and 3 above. Just curious

lakshman239 · ‎03-06-2017

Item 1 above pls

lakshman239 · ‎03-06-2017

Thx Luke. Looking for the 1st one mainly

lakshman239 · ‎03-06-2017

You can run the splunk forwarder as a local user (with or without admin/additional access privileges) or as a domain user (with appropriate access/privileges). You may want to check this - http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller Some customers object to using 'local system' account as that has a lot of privileges and against their security polices. I would prefer using a 'domain user', so we can control the access/privileges to it. hope this helps

lakshman239 · ‎03-06-2017

I understand we can use the following to look at the investigations created which are 'Active'. |inputlookup append=t investigative_canvas_lookup |inputlookup append=t investigative_canvas_entries_lookup How to audit/track 'removed' investigations by an analyst? The info in _audit index logs seems to not capture 'delete/remove investigations'. Any pointers/help would be appreciated.

Posts	655
Solutions	70
Karma Given	14
Karma Received	60
Member Since	‎07-05-2016

Online Status	Offline
Date Last Visited	‎09-09-2022 12:22 PM

Can whitespaces be trimmed when using lookup edito...

Url parser - logs doesn't rotate

Update default/props.conf with TA-eStreamer

Splunk Add on for PA - incorrect tagging of Networ...

Metrics definition errors in the add-on - is fix a...

Can you help me with an issue using macros and inp...

eStreamer logs from Active - Passive Sourcefire se...

Why doesn't splencore.sh with clean up doesn't wor...

Why do I see a script error when then the data is ...

why do we not have setup.xml in add-on's created b...

Qualys TA : setting up in SHC

Re: How do I Configure a Workflow to POST JSON En...

Re: Enterprise Security: How to add swimlanes of c...

Re: How to search for 5 failed logins followed by ...

Re: For large lookups, should I use the kv store?

Re: How to search a area based on a given lat/lon

Re: Volume capacity

Re: Volume capacity

Re: Field Extraction from existing field

Re: install splunk app for zscaler in a distribute...

Re: Scheduled saved Search that is meant to fill a...

Re: Splunk Add-on for Cisco ASA 3.2.4: DateParserV...

Re: WinHostMon

Re: Splunk Add-on for Cisco ASA 3.2.4: DateParserV...

Re: Splunk ES 4.5 - How do we track removed 'inves...

Re: Splunk ES 4.5 - How do we track removed 'inves...

Re: Splunk ES 4.5 - How do we track removed 'inves...

Re: Splunk ES 4.5 - How do we track removed 'inves...

Re: What is the best way to monitor Active Directo...

Splunk ES 4.5 - How do we track removed 'investiga...