Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About daniel333
daniel333
Builder
Member since:
09-08-2011
2 weeks ago
Community Statistics
| Posts | 484 |
| Solutions | 8 |
| Karma Given | 5 |
| Karma Received | 58 |
| Member Since | 09-08-2011 |
Activity Feed
- Got Karma for SC4S Dropping Events Going to Edge on Same Server. 2 weeks ago
- Posted SC4S Dropping Events Going to Edge on Same Server on Getting Data In. 2 weeks ago
- Got Karma for Alert Manager Enterprise - Malware Detection vsw.exe. 04-03-2025 08:16 AM
- Posted Alert Manager Enterprise - Malware Detection vsw.exe on All Apps and Add-ons. 04-01-2025 03:44 PM
- Posted Missing Data in Office 365 App Input on All Apps and Add-ons. 05-02-2024 03:50 PM
- Got Karma for Event_breaker vs Line_breaker ?. 10-13-2022 01:49 AM
- Posted How do I map my group/roles with human readable claims with Azure? on Security. 07-12-2022 05:23 PM
- Got Karma for Re: How to post to Http Event Collector with PHP?. 02-01-2022 08:10 AM
- Got Karma for How to display a list of fields for an index?. 12-16-2021 07:26 AM
- Got Karma for Splunk SSL Error with Python. 03-08-2021 12:42 PM
- Posted Splunk needs a shell? on Security. 02-02-2021 02:39 PM
- Got Karma for Is there a recommended auditd configuration we can start with?. 11-20-2020 05:50 AM
- Got Karma for Re: Is there a recommended auditd configuration we can start with?. 11-20-2020 05:49 AM
- Posted Troubleshooting Stanza entry not found for data-type 'time-specifier error on Monitoring Splunk. 11-17-2020 05:44 PM
- Posted Re: Splunk_TA_Windows - script:installedapps timestamp issues? on Getting Data In. 11-16-2020 04:03 PM
- Posted Splunk_TA_Windows - script:installedapps timestamp issues? on Getting Data In. 11-16-2020 03:29 PM
- Posted Conditional Input.conf setting? on Getting Data In. 11-11-2020 12:36 PM
- Posted Any experience/practices with old buckets getting created with sourcetype config_file? on Knowledge Management. 10-28-2020 02:13 PM
- Got Karma for Estimating Cost By Sourcetype. 09-30-2020 05:07 PM
- Posted Estimating Cost By Sourcetype on Monitoring Splunk. 09-30-2020 05:01 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
02-20-2020
04:47 PM
All,
Anyone ever post to HEC using PHP? Got a working example? Or see where I am going wrong?
<?php
$ch = curl_init("https://10.x.x.x:8088/services/collector/event");
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERPWD, "x:MYTOKEN");
curl_setopt($ch, CURLOPT_POSTFIELDS, "number=10");
$output = curl_exec($ch);
curl_close($ch);
echo $output;
?>
... View more
02-20-2020
03:30 PM
All,
I enabled the packages input on Splunk_TA_nix on my CentOS 7 box. I get 790 packages back. How ever when I get the same data from the command line I get 796 packages.
#rpm --query --all | wc
796 796 26418**
Something seems off. Any ideas?
Output from btool
sourcetype =
[package]
ADD_EXTRA_TIME_FIELDS = True
ANNOTATE_PUNCT = True
AUTO_KV_JSON = true
BREAK_ONLY_BEFORE =
BREAK_ONLY_BEFORE_DATE = True
CHARSET = UTF-8
DATETIME_CONFIG = CURRENT
DEPTH_LIMIT = 1000
HEADER_MODE =
KV_MODE = multi
LEARN_MODEL = true
LEARN_SOURCETYPE = true
LINE_BREAKER = ^((?!))$
LINE_BREAKER_LOOKBEHIND = 100
MATCH_LIMIT = 100000
MAX_DAYS_AGO = 2000
MAX_DAYS_HENCE = 2
MAX_DIFF_SECS_AGO = 3600
MAX_DIFF_SECS_HENCE = 604800
MAX_EVENTS = 256
MAX_TIMESTAMP_LOOKAHEAD = 128
MUST_BREAK_AFTER =
MUST_NOT_BREAK_AFTER =
MUST_NOT_BREAK_BEFORE =
SEGMENTATION = indexing
SEGMENTATION-all = full
SEGMENTATION-inner = inner
SEGMENTATION-outer = outer
SEGMENTATION-raw = none
SEGMENTATION-standard = standard
SHOULD_LINEMERGE = false
TRANSFORMS =
TRUNCATE = 1000000
detect_trailing_nulls = false
maxDist = 100
priority =
sourcetype =
... View more
02-20-2020
02:41 PM
All,
I am creating an app and was hoping to set the default to dark mode, is there a simple XML or conf file I should edit? Looks like each dashboards needs "" hoping for a global setting.
thanks
-Daniel
... View more
02-14-2020
02:31 PM
Just wanted to give this a quick bump, I am able to find what I am looking for using tcpdump so I know the event is there. Just not sure how to configure a stream for it.
How I am getting the data from the command line -
tshark -i ens160 -Y ssl.alert_message.level
tcpdump -ni ens192 -C 100 -W 5 "port 443 and (tcp[((tcp[12] & 0xf0) >> 2)] = 0x15)"
... View more
02-12-2020
02:02 PM
All,
I have a Squid web proxy with an in house cert on it. We've gone through and applied the root certs to all our hosts and set it as trusted and it's working great. What I am looking to do is create an alert in Splunk that is a host tries to hit our proxy and fails the, I get an alert.
I am assuming there is a SSL cert disconnect message of some sorts in Stream I can capture. But I am not sure what streams to configure. Point me in the right direction?
... View more
02-03-2020
03:52 PM
All,
Looking to bring in general security data from about 200 MacOS laptops. Ideally CIM friendly and filtered down all the junk as much as possible.
1) Any good docs/read throughs you'd recommend I start with?
2) I checked out cmdReporter, seems pretty good. Anything else similar I should look at?
3) Is Splunk_TA_nix worth doing on MacOS?
thanks
-Daniel
... View more
01-31-2020
01:32 PM
1 Karma
All,
Has anyone ever setup Google Authenticator with Splunk for 2fa? Any walk throughs available for Splunk Enterprise 8?
... View more
01-28-2020
04:40 PM
Just did this, and it worked. Seems like I am solving this wrong.
props.conf:
[(?::){0}*-too_small]
TRANSFORMS-remove_too_small = remove_too_small
transforms.conf:
[remove_too_small]
SOURCE_KEY = MetaData:Sourcetype
DEST_KEY = MetaData:Sourcetype
REGEX = sourcetype::(.*)-too_small
FORMAT = sourcetype::config_file
... View more
01-28-2020
04:00 PM
All,
I need to monitor the /etc/resolv as sourcetype config_file in my env. This is well below the 256 byte min for CRC I am sure.
Larger files are working fine, but this is pretty small, 3 lines. It's coming in as hosts_too_small. I clearly have sourcetype set correct in inputs.conf and even tried setting it again with a tranform. But still comes in as "too small".
Any idea how I can get this file correctly indexed as sourcetype config_file?
... View more
12-18-2019
08:55 PM
All,
I have a relatively default setup for Splunk_TA_nix on centOS 7 and /var/log/messages is coming in as sourcetype=syslog. How ever when I review the pretrained sourcetypes docs here I see that is not the correct sourcetype https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Listofpretrainedsourcetypes
Any idea what's up? Any reason I shouldn't configure this to be sourcetype=linux_messages_syslog?
thanks,
-Daniel Wilson
... View more
12-18-2019
03:48 PM
All,
I am seeing parsing queue slow downs when large sets of linux_secure data comes in. After talking with support we decided that the default timestamp of "auto" was a bad idea for us. So I am rewriting the props.conf file for linux_secure
[linux_secure2]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 27
NO_BINARY_CHECK = true
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%dT%H:%m:%S.%q
TIME_PREFIX = ^
TZ = GMT
category = Operating System
description = Format for the /var/log/secure file containing all security related messages on a Linux machine
disabled = false
pulldown_type = true
How ever when I run this, all my events come stamped at 4:00. Any idea where I went wrong?
Here is an example log
2019-12-17T23:01:36.259901+00:00 ssomehost.somedomain.local sudo: ambari : TTY=unknown ; PWD=/var/lib/ambari-agent ; USER=root ; ENV=PATH=/usr/sbin:/sbin:/usr/lib/ambari-server/*:/usr/hdp/current/hadoop-client/bin:/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/chef/bin:/var/lib/ambari-agent ; COMMAND=/usr/bin/test -f /disk11
... View more
11-23-2019
10:08 AM
All,
What's your favorite Vulnerability scanner to use with Splunk? That is what have you seen generate the best logs and metrics for Splunk data models and CIM?
... View more
11-18-2019
09:44 AM
All,
Just working with Splunk_TA_Windows today and noticed that there is no specified sourcetype in inputs.conf and I don't see how the sourcetype is found in props.conf. Any idea how this is getting it's sourcetype? Would I be hurting anything to add it on?
[WinRegMon://default]
disabled = 1
hive = .*
proc = .*
type = rename|set|delete|create
[WinRegMon://hkcu_run]
disabled = 1
hive = \\REGISTRY\\USER\\.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\.*
proc = .*
type = set|create|delete|rename
[WinRegMon://hklm_run]
disabled = 1
hive = \\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\.*
proc = .*
type = set|create|delete|rename
... View more
10-27-2019
10:17 PM
All,
I have dashboard with an HTML page embedded. Works great and I need to add an image called called food.jpg to it.
Paths look like this:
/Applications/Splunk/etc/apps/MyApp/static/welcome.html
/Applications/Splunk/etc/apps/MyApp/static/food.jpg
How can I add the image to the html page? I have tried this -
<img src="tart.jpg" alt="Smiley face">
And this
<img src="/static/tart.jpg" alt="Smiley face">
Any ideas?
... View more
10-15-2019
02:03 PM
All,
Is there any reason I should keep the KVstore on if I am not using it?
Can anyone link me ot how the kvstore works in a distributed env?
thanks
-Daniel
... View more
10-10-2019
06:03 PM
All,
Is there an app or utility so I can from the forwarder manager UI upload apps into the Deployment-apps directory?
... View more
10-09-2019
03:14 PM
All,
So I in my personl lab I setup Splunk and exposed 8089 and the mobile app worked perfectly. I went to go try the same using my POC cloud instance and I get "Sign in Failed - Cannot Acces the Splunk Web Port".
Hitting
http://mycloud.splunkcloud.com:8089
Tried 443 too just in case, no luck. Is there something special I need to do for this?
... View more
10-08-2019
03:12 PM
Looking to direct the data to certain indexers. Certain set of values should end up on my splunk cooud install, while everything else ends up onprem. Basically adjust the TCP out for a collect?
... View more
10-07-2019
10:30 AM
1 Karma
All,
Silly question - Is there a way to automate the sending of diags to Splunk support? I'd like to know they have current diags on file at anytime. If I can submit one nightly to them and they keep in a repo or something?
... View more
10-04-2019
11:12 AM
thanks for replying, really just hoping to get some better executive reporting on our Splunk status and don't want to turn this into a manual process.
... View more
10-04-2019
07:22 AM
All,
I want to Splunk my Splunk educational credit status to build a custom report for my management chain. Has anyone hit the Splunk API or scraped the Splunk site for this use before?
thanks
-Daniel
... View more
10-02-2019
02:34 PM
All,
Is there a way to selectively send data to differnt indexer groups? In my case I have a search head reading from local indexers and I need to send certain metrics and summary logs to a Cloud instance?
thanks
-Daniel
... View more
09-19-2019
07:30 PM
How is is this used? Like it is in a dashboard? Is it just admin metadata?
... View more
09-19-2019
08:38 AM
All,
I have been asked to make Splunk more self service. The first ask from management is that our developers be able to code and release their own TA's for their own apps in our development data center without the Splunk admin (we'll still promote said apps to prod).
Just so we're clear I am hopelessly out numbers with 400+ splunk users, dev, prod and ES instances and I am the only Splunk guy.
I stood up a developer instance of Splunk they can copy their logs to, and install some App building TAs.
I played with Jenkins/GIT and that worked, its just a little slow and a lot to teach and manage. I wrote a job that allows users to upload SPL zipped apps to the deployment server via the the app manager then the job moves it to deployment-apps, and that is somewhat functional.
Have other run into this? Can I hear you best practices? Lessons learned?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
