About MuS

MuS · ‎06-12-2019

Hi daniel333, if you feel enabling the enable_insecure_login option is too insecure ... then there is an app for exactly this use case. It enables Splunk to display dashboards without the need to provide a username nor a password. Here is the link to this app https://splunkbase.splunk.com/app/4377/ Hope this helps ... cheers, MuS

MuS · ‎06-11-2019

Hi cthulhucalling, try this: earliest=-1d index=web [| inputlookup web_attack_sigs.csv | format] by using format you will get a list of ( ( uri_path="*/etc/passwd*" AND description ="Passwd file access attempt" ) OR ( uri_path="*phpadmin*" AND description ="PHPadmin access attempt" ) ) That will be added to your base search. More details here https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Format Hope this helps ... cheers, MuS

MuS · ‎06-10-2019

Update ping - I misunderstood the question, but this will give you a two in one answer/solution 🙂

MuS · ‎06-10-2019

Hi ddrillic, I started to use a props.conf, transforms.conf setting to work around exactly this issue. It will add a meta data field containing the host that parsed the event therefore you will always know which Splunk instance parsed the events or where it came from. Here is my config: props.conf [default] TRANSFORMS-000-add-relay-info-to-meta = add-relay-info-to-meta transforms.conf [add-relay-info-to-meta] FORMAT = splunk_hwf::<hostNameHere> REGEX = . WRITE_META = true You can then search for index=_internal splunk_hwf::* to see the Splunk instance that pared the events. The down side is that the hostname value needs to be hard coded, but I have an app that works around this as well 😉 Also be aware this will only work on non- INDEXED_EXTRACTIONS events, if you use a default parsing pipeline setup. Hope this helps ... cheers, MuS UPDATE The correct answer would be changing the connection_host in inputs.conf for the according [http...] stanza connection_host = [ip|dns|proxied_ip|none] * Specifies the host if an event doesn't have a host set. * "ip" sets the host to the IP address of the system sending the data. * "dns" sets the host to the reverse DNS entry for IP address of the system sending the data. * "proxied_ip" checks whether an X-Forwarded-For header was sent (presumably by a proxy server) and if so, sets the host to that value. Otherwise, the IP address of the system sending the data is used. * "none" leaves the host as specified in the HTTP header. * No default.

MuS · ‎06-10-2019

Update: The issue was not the regex, but the config files were at the wrong path. See this answer for the correct solution https://answers.splunk.com/answers/750050/how-to-eliminate-events-with-debug.html#answer-751623 cheers, MuS

MuS · ‎06-10-2019

Hi joesrepsolc, Good to hear this solved the issue. Can you please accept this as the answer? Thanks cheers, MuS

MuS · ‎06-09-2019

You must be using a different version of btool 😉 I get a nice output of the path when using the posted command $SPLUNK_HOME/bin/splunk btool indexes list --debug cheers, MuS

MuS · ‎06-07-2019

Move the app from $SPLUNK_HOME/etc/master-apps/_cluster/ to $SPLUNK_HOME/etc/master-apps/ and apply the bundle again. The directory $SPLUNK_HOME/etc/master-apps/_cluster/ is a special one and should only be used to deploy config files, not apps - see https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations#On_the_master cheers, MuS

MuS · ‎06-07-2019

You might be able to use the Add-On builder https://docs.splunk.com/Documentation/AddonBuilder/latest/UserGuide/Overview to create an add-on and use it on the universal forwarder. But again, it will be your task to bridge the gap and create a script that queries the device and outputs into Splunk. cheers, MuS

MuS · ‎06-07-2019

Did you also change the stanza from [fschange:// to be [monitor:// as mentioned in my answer? cheers, MuS

MuS · ‎06-06-2019

Sure this will work, I just did not understood it correct 😉 In this case try this regex: REGEX = \>([^\s]+)\s this will get string1 from your example as value of the MyNewFieldName . cheers, MuS

MuS · ‎06-04-2019

it actually works both ways, with or without escaping: | makeresults | eval foo=" need to do a line breaking after % and after \" on a total of \" " | rex mode=sed field=foo "s/%/&\n/g" | rex mode=sed field=foo "s/on a total of /&\\n/g" cheers, MuS

MuS · ‎06-04-2019

you might want to escape the \\ in the sed regex: | rex mode=sed field=Perc "s/%/%\\n/g" | rex mode=sed field=Perc "s/on a total of/on a total of\\n/g" cheers, MuS

MuS · ‎06-04-2019

Hi u568675, Well, that is what fschange (which btw is deprecated since Splunk 5.x) does: [fschange:<path>] * Monitors changes (such as additions, updates, and deletions) to this directory and any of its sub-directories. Source https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf . If you want to index config files and index when they change, you need to add a monitor stanza and add the option crcSalt = <SOURCE> to the monitor. This will re-index the file once it changes. Hope this helps ... cheers, MuS

MuS · ‎06-04-2019

Hi Rocky31, 1 & 2 can be resolved by using this command on an indexer instances: $SPLUNK_HOME/bin/splunk btool indexes list --debug This will show you the output of all indexes.conf merged and their location. For just one index run it like this: $SPLUNK_HOME/bin/splunk btool indexes list indexNameHere --debug Regarding 3. if you have the monitoring console configured https://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview you will get a lot of pre-built dashboards around index sizing, age and more. Hope this helps ... cheers, MuS

MuS · ‎06-04-2019

Hi joesrepsolc, two things that are important in this case: The sourcetype in props.conf is case sensitive, so make sure it really matches. The regex uses > which is a special character in regex and needs escaping like this ^\>Debug Further more use $SPLUNK_HOME/bin/splunk btool props list diplomat:server --debug on one of the indexers to validate your props.conf is being applied and not overwritten by some other app taking precedence over your app. Hope this helps ... cheers, MuS

MuS · ‎06-04-2019

Hi radialdrillingvibe, You wanted to know the right thing, but you asked the wrong question 🙂 Your question should be like How do I get Microsoft UL output into Splunk? Short version: Any output to stdout by a script started by Splunk will be indexed, see details here https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro . Your task will be, to write a script that queries the USB device and outputs the data to stdout . And to answer your posted question: Yes, it can - see here https://docs.splunk.com/Documentation/SplunkLight/latest/GettingStarted/AboutSplunkLight#Events_indexing for more details. As you can see it lists scripts as option for event indexing 😉 Hope this helps ... cheers, MuS

MuS · ‎06-03-2019

Hi Meterman, yes, those files are Splunk internal logs and by default do not contain any other events or log sources. I agree with you that you can consider them false positives. cheers, MuS

MuS · ‎06-03-2019

Hi EricLloyd79, these two numbers can be the same, but also can be very different. You can read about the thruput messages here: https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Aboutmetricslog#Thruput_messages and about the license usage here : https://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks#How_data_is_metered If it is TL;DR then see it as the thruput shows how much data (plus protocol over-head) was send by a Splunk instance and the license usage show how much data was actually indexed in the end. As I said, these numbers can be almost the same or differ a lot if you do event transformation or filtering for example. Hope this makes sense ... cheers, MuS

MuS · ‎06-01-2019

Hold tight, I have something in my pipeline that could solve this problem 😉 cheers, MuS

MuS · ‎05-30-2019

Hi vcorral, Please give this regex a try: Source (?:Number|id):[\s\w\<]+?(?<myNumber>\d+) cheers, MuS

MuS · ‎05-30-2019

Hi there, look the only one that can make that work is you. I would recommend to take baby steps and start with a simple base search like this: ( index=ssys_*_pj OR index=other) AND (RequestedHeadVoltagesSupport OR RequestedHeadVoltagesModel ) source=*** index!=ssys_internal* source=*_HM.cfg ) OR ( (index=ssys_*_pj OR index=other) NOT source=*Bio_Mimics* source=*** ("Serial Number") OR ("Maintenance counter \"H*") index!=ssys_internal* ) from there work your way forward by adding a fields to the search to only return what you really need. After that add all the eval , macros , and additional search filters until you get what you need. cheers, MuS

MuS · ‎05-27-2019

you could also just use timechart span=1h useother=f count(action) AS "count2" by character usenull=f but to limit or filter on the fields in the base search is much better 😉 cheers, MuS

MuS · ‎05-27-2019

Hi Afef, this looks all good and there is no way to throttling the replication except some network layer based QoS or other magic. You also forgot step 7: Have either a flight ticket or Whisky ready depending on the end result 🙂 cheers, MuS

MuS · ‎05-27-2019

Hi sarit_s, As a striating point combine your two base search into one search: ( index=ssys_*_pj OR index=other) AND (RequestedHeadVoltagesSupport OR RequestedHeadVoltagesModel ) source=*** index!=ssys_internal* source=*_HM.cfg ) OR ( (index=ssys_*_pj OR index=other) NOT source=*Bio_Mimics* source=*** ("Serial Number") OR ("Maintenance counter \"H*") index!=ssys_internal* ) | stats values(*) AS * by Region SerialNumber PrinterType then use all the eval , macros, table and so on on this result set. Much faster and you don't hit hidden limits of join . You can read more about this here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html Hope this helps ... cheers, MuS

Posts	4458
Solutions	814
Karma Given	2144
Karma Received	3944
Member Since	‎05-02-2011

Online Status	Offline
Date Last Visited	3 hours ago

Report Capture app for Splunk: Exception capturing...

How to use eval if there is no result from the bas...

How to compare fields over multiple sourcetypes wi...

Splunkbase Apps update bug?

docs.splunk.com wrong link to answers

splunkbase feature request

splunkbase colored background

Captain Picard's Star fleet messages

the pony command

max throughputs of forwarders

Re: Dashboards/View without logging in

Re: Using a lookup for search

Re: Where does HEC push come in from?

Re: Where does HEC push come in from?

Re: How to eliminate events with ">Debug"

Re: How to eliminate events with ">Debug"

Re: Please route me i am at INDEX deadend.

Re: How to eliminate events with ">Debug"

Re: Can Splunk Light capture IOT stream data in Mi...

Re: Monitoring the content of a configuration file

Re: Copy and then parse a field

Re: how to do a line breaking after a string

Re: how to do a line breaking after a string

Re: Monitoring the content of a configuration file

Re: Please route me i am at INDEX deadend.

Re: How to eliminate events with ">Debug"

Re: Can Splunk Light capture IOT stream data in Mi...

Re: CardRecon false positives?

Re: Why is the same search producing different res...

Re: How to generate a PDF of a full dashboard and ...

Re: How to drop brackets from field extraction res...

Re: Why is the join command running for a long tim...

Re: Null results on timechart using base search

Re: Best practices Migrating from standalone index...

Re: Why is the join command running for a long tim...

Join the Conversation