Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About Hemnaath
Hemnaath
Motivator
Member since:
03-15-2015
11-20-2025
Community Statistics
| Posts | 903 |
| Solutions | 12 |
| Karma Given | 1 |
| Karma Received | 55 |
| Member Since | 03-15-2015 |
Activity Feed
- Posted Re: How to create heatmap visualization in dashboard studio? on Dashboards & Visualizations. 11-20-2025 09:06 PM
- Posted How to create heatmap visualization in dashboard studio? on Dashboards & Visualizations. 11-20-2025 03:56 AM
- Got Karma for How to troubleshoot and fix the website input 504 Gateway Timeout Error while configuring an input ?. 01-12-2024 02:44 PM
- Posted Re: Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-29-2023 03:34 AM
- Posted Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-28-2023 04:58 AM
- Tagged Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-28-2023 04:58 AM
- Got Karma for Re: Splunk has found 1 orphaned searches owned by 1 unique disabled users.Click to view the orphaned scheduled searches. Reassign them to a valid user to re-enable or alternatively disable the searches.. 06-13-2023 04:41 AM
- Posted What splunk precedence rules should be followed to upgrade splunk clustered environment ? on Splunk Enterprise. 01-26-2023 01:29 AM
- Got Karma for Unable to break the multi-line events into single event from kinesis log?. 11-07-2022 02:14 AM
- Posted Re: How to write a Splunk query to find the Splunk UF version for specific set of hosts in Splunk Enterprise on Splunk Enterprise. 10-31-2022 11:13 PM
- Posted How to write a Splunk query to find the Splunk UF version for specific set of hosts in Splunk Enterprise on Splunk Enterprise. 10-31-2022 06:44 AM
- Got Karma for Re: ERROR: kvstore port [8191] - port is already bound. Splunk needs to use this port.. 10-13-2022 02:16 PM
- Posted Where can I get the release notes for Splunk enterprise v8.2.6.1 release notes ? on Splunk Enterprise. 07-26-2022 11:17 PM
- Posted How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”? on Getting Data In. 05-26-2022 09:01 AM
- Posted Re: How to write a monitoring stanza to monitor the windows Event Viewer logs on Getting Data In. 05-12-2022 08:59 AM
- Posted Re: How to write a monitoring stanza to monitor the windows Event Viewer logs on Getting Data In. 05-12-2022 06:14 AM
- Posted How to write a monitoring stanza to monitor the windows Event Viewer logs? on Getting Data In. 04-29-2022 03:13 AM
- Posted Re: How to write time format for 2022-04-07 20:40:03.360 -06:00 [XXX] XXXXX? on Splunk Enterprise. 04-16-2022 07:18 PM
- Posted How to write time format for 2022-04-07 20:40:03.360 -06:00 [XXX] XXXXX? on Splunk Enterprise. 04-14-2022 09:17 AM
- Posted Why is Splunk ingesting additional information from the source, when there is no actual data present in the source ? on Splunk Enterprise. 04-13-2022 05:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-12-2017
10:21 AM
hi adoino, thanks for your effort, it was type error which i had made while posting the question, now i have corrected the question.
Paloalto firewall are reaching the syslogs servers under the path/opt/syslogs/paloalto/device3pano.xxx..com/paloalto.log the same server is used as Heavy forwarder server to read the syslog data directly from the path /opt/syslogs/paloalto/.../paloalto.log* in to splunk.
inputs.conf details:
[monitor:///opt/syslogs/paloalto/.../paloalto.log*]
index=firewall
sourcetype=paloalto:network:log
host_segment = 4
Kindly guide me on how to troubleshoot this issue.
... View more
12-12-2017
09:53 AM
1 Karma
Hi All, Currently got a request to ingest the newly configured Paloalto device data into splunk. Configured syslog-ng.conf to reach the device data from source to syslog servers, and could see that data from the Paloalto firewall are reaching the syslogs servers under the path/opt/syslogs/paloalto/device3pano.xxx..com/paloalto.log the same server is used as Heavy forwarder server to read the syslog data directly from the path /opt/syslogs/paloalto/.../paloalto.log* in to splunk.
Architecture details :
Currently we have 5 individual indexer instances, 5 individual heavy forwarder instances, 3 clustered search head, one deployment instance and one Deployer instance, they all are running with splunk 6.6.1 version.
Syslog data flow:
All the five heavy forwarder instances acts as the syslogs server and data from network,firewall, ESX etc are read directly and forwarded to indexer instances from all five heavy forwarder instances.
Problem details: We could see the data being ingested from another paloalto firewall device2 in splunk from the same location from HF instances by executing the splunk query "index=firewall sourcetype="paloalto:network:traffic" source="/opt/syslogs/paloalto/device2pano.xxx..com/paloalto.log"
But when we try to execute the same query with different sourcetype="paloalto:network:log" we are unable to see any data in splunk from any paloalto device. sourcetype="paloalto:network:traffic" is defined in the props.conf and whereas sourcetype="paloalto:network:log" defined in the inputs.conf and both the configuration are placed in the Heavyforwarder instances and data reaches the HF instance first and then ingests the data in indexer instances.
Kindly let guide me how to start troubleshooting this issue.
... View more
12-11-2017
10:17 AM
Hi jkat54, can you please guide me on this to fix the issue, i am not sure where is the issue.
thanks in advance.
... View more
12-10-2017
09:37 PM
yes, the props.conf is in one of the heavy forwarder instances. Kindly guide me how to fix this issue.
... View more
12-10-2017
09:54 AM
Hi Jkat54,
Architecture details :
Currently we have 5 individual indexer instances, 5 individual heavy forwarder instances, 3 clustered search head, one deployment instance and one Deployer instance, they all are running with splunk 6.6.1 version.
Data flow:
All the remote machine data (UF) are forwarder to all the 5 individual Heavy forwarder instance and then its forwarded to the Indexer instances to index the data.
Syslog:
All the five heavy forwarder instances acts as the syslogs server and so that network,firewall, ESX etc data's are read and forwarded to indexer instances from all five heavy forwarder instances.
This particular Symantec logs are forwarded from third party device called atp server to the heavy forwarder. This is the inputs.conf details
[script://$SPLUNK_HOME/etc/apps/TA-symantec_atp/bin/atp_incidents_collect.py]
disabled = False
index = intrusion
Kindly guide me how to fix this issue.
thanks in advance
... View more
12-10-2017
09:18 AM
Hi All, I have successfully download and installed the snmptrap with the help of linux administrator.
From the below site you can download the snmptrapd.rpm for "Red Hat Enterprise Linux Server release 7.3 (Maipo)" 64 bit OS.
http://rpm.pbone.net/index.php3
Questions :
1) Should I need add any other configuration details in /etc/snmp/snmptrapd.conf
TRAPD BEHAVIOUR
snmpTrapdAddr udp:127.0.0.1:162,udp6:[::1]:162
doNotLogTraps no
ACCESS CONTROL
authCommunity log,execute,net solarwinds
disableAuthorization no
NOTIFICATION PROCESSING
OTHER CONFIGURATION
2) What configuration details should be added under this file /etc/sysconfig/snmptrapd.
snmptrapd command line options
OPTIONS="-Lsd"
Kindly guide me on this.
thanks in advance
... View more
12-10-2017
09:05 AM
Hi jkat54, good morning, hey still facing the same issue unable to make the _time value same as the time field in the events.
Props.conf details:
[symantec:tap:incidents]
SHOULD_LINEMERGE = false
FIELDALIAS-event_host = atp_host as event_host
KV_MODE = json
TRUNCATE = 0
TIME_PREFIX=device_time:\s
TIME_FORMAT=%FT%T.%3N
MAX_TIMESTAMP_LOOKAHEAD=32
TZ=EDT
12/10/17
9:24:06.000 AM
{"event_count": 1, "recommended_action": "Review the SEP settings, isolate the endpoint(s), remove the file(s), and/or clean the system(s).", "priority_level": 2, "tap_host": "10.X.X.X", "device_time": "2017-12-10T14:21:06.651Z", "summary": "Daily unresolved SEP detection(s)", "domainId": [""], "state": 1, "tap_incident_id": 104669, "log_name": "epmp_incident-2017-12-10/incident", "filehash": ["104eabf550b6fe22039a3170d5262a58342afd25395bcb181bf4b407dd4a0a7d"], "first_event_seen": "2017-12-10T14:16:07.000Z", "uuid": "5c5d0ab0-ddb5-11e7-eced-00000000006e", "time": "2017-12-10T14:21:06.651Z", "updated": "2017-12-10T14:21:06.651Z", "deviceUid": ["fe66a353-28d9-47e8-9dcf-83fbfe62dbd3"], "last_event_seen": "2017-12-10T14:16:07.000Z"}
The "time" field in the log is 12/10/2017 at 14:21:06, but the _time field in Splunk comes through as 12/10/17 at 9:24:06
Kindly guide me where I am making the mistake ?
thanks in advance
... View more
12-10-2017
04:26 AM
hi saurabh, In our production environment we have already indexing other network related device data in to the index=network.
But when I tested in my personal laptop after providing the required details I could see the inputs.conf file being placed under this folder /opt/splunk/etc/apps/launcher/local/inputs.conf. can I copy the same and place it in the /opt/splunk/etc/apps/snmp_ta/local/inputs.conf.
I am not sure about the custom MIB, So can I leave that option blank will there be any impact because of it.
Please guide me whether the above steps are correct to capture the remote CISCO prime snmp into the Heavy forwarder instance using the app.
thanks in advance.
... View more
12-10-2017
04:20 AM
Hi saurabh , thanks for your support, can you please provide me the link and exact file to download from the site.
thank in advance
... View more
12-09-2017
10:46 AM
Hi Woodcock, hey I had downloaded the snmptrapd from this link https://sourceforge.net/projects/net-snmp/files/net-snmp/5.7.3/ but I am not sure how to install this package in linux os .
"Download net-snmp-5.6.1.1-1.x86.exe (4.2 MB)"
Kindly let me know how to install this in linux
... View more
12-09-2017
09:21 AM
Hi Woodcock, I tried to install the app from splunk base on my test machine, after installing the app, I had followed the below steps to capture the CISCO PRIME SNMP traps.
Steps:
1) Manager-->settings-->datainputs--snmp--new
2) SNMP Mode was set as "Listen for traps"
3) SNMP Version kept as "2c"
4) Community String as "Public"
5) Custom MIBs - "Left Blank"
6) Custom Response Handling
Response Handler --> Left Blank
Response Handler Arguments --> Left Blank
7) SNMP Trap listener settings
TRAP listener host " 10.X.X.X" --> Heavy Forwarder IP Address
TRAP listener port "162"
😎 Reverse DNS lookup of trap sources. --> Left this option "unchecked"
9) Source type set to Manual
10) sourcetype : network:cisco:primesnmp
11) More settings -- > In this setting, I would like to set the index name as network.
Question :
1)How to set the index=network in the more settings ?
2) After saving the settings where I can see the inputs.conf stanza in this app. I mean from /opt/splunk/etc/apps/snmp_ta
3) Which option is better to capture the snmp traps, whether by using the snmptrapd or by using this app.
Kindly guide me on this.
thanks in advance.
... View more
12-08-2017
09:30 PM
Hi Woodcock, thanks for your support on this, yes i have gone through the link but my requirement is to configure one of the splunk Heavy forwarder instances to receive and index the CISCO prime traps and at the same time I need to have this index=network and sourcetype=network:cisco:primesnmp details configured in inputs.conf stanza.
Kindly guide me whether we can do this via SNMP Modular Input app.
... View more
12-08-2017
07:38 AM
Hi All, I have told to configure one of the Heavy forwarder instance to receive and index the CISCO prime traps. i had gone through the links https://docs.splunk.com/Documentation/Splunk/6.5.0/Data/SendSNMPeventstoSplunk provide in the splunk documentation.
but I am not sure how to install / configure the snmptrapd to capture the remote data.
Question:
1) From where I need to download the snmptrapd ? Please provide me the link.
2) My Heavy forwarder running on top of Linux version "Red Hat Enterprise Linux Server release 7.3 (Maipo)" 64 bit OS, so what version of snmptrapd will be compatible ?
3) How to configure the snmptrapd to capture from cisco prime traps? where to configure this two stanza in snamptrapd.
snmptrapd -Lf /var/log/snmp-traps
snmptrapd -Lf /var/log/snmp-traps --disableAuthorization=yes
4) Once snaptrapd is configured, I will be configuring the below inputs.conf stanza, so that splunk can read the trap from this location in heavyforwarder.
inputs.conf
[monitor:///var/log/snmp-traps*]
index=network
sourcetype=network:cisco:primesnmp
Kindly guide me on the above questions.
... View more
12-08-2017
06:09 AM
Hi All, still facing the issue, unable to make the _time field be the same as the time field in the event.
Kindly guide me on this.
... View more
12-08-2017
06:08 AM
Hi jkat54, I have tried that too but it did not work. I have doubt whether the changes will be applicable only to the latest events right not too the old events, is that right ?
Currently this is my props.conf details:
[symantec:tap:incidents]
SHOULD_LINEMERGE = false
FIELDALIAS-event_host = tap_host as event_host
KV_MODE = json
TRUNCATE = 0
TIME_PREFIX=device_time:\s
TIME_FORMAT=%FT%T.%3N
MAX_TIMESTAMP_LOOKAHEAD=32
TZ=EDT
Search details:
index=sem sourcetype="symantec:tap:incidents"
Event Details : Taken before setting the TIME_PREFIX=device_time:\s in props.conf
12/7/17
6:30:07.000 PM
{"time": "2017-12-07T23:27:17.962Z", "log_name": "epmp_incident-2017-12-07/incident", "scanners": ["stap01"], "first_event_seen": "2017-12-07T23:27:18.018Z", "filehash": ["95912bff1d9ba853b5adbafd8aa297ad0e87a0c3d1f5f378b1f37a438c7e91c5"], "priority_level": 1, "device_time": "2017-12-07T23:27:17.962Z", "deviceUid": ["0e76bdc7-f7b8-404a-9e93-9caa224c5b99"], "uuid": "2a5902a0-dba6-11e7-e6ac-000000000067", "summary": "Malicious domain www.driverwizard.org detected", "state": 1, "domainId": ["www.driverwizard.org"], "recommended_action": "Consider blacklisting the site. In addition, you may need to investigate the source of the exposure to see if further action is required.", "tap_incident_id": 104662, "tap_host": "10.X.X.X", "event_count": 1, "last_event_seen": "2017-12-07T23:27:18.018Z", "updated": "2017-12-07T23:27:17.962Z"}
The "time" field in the log is 12/7/2017 at 23:27:17, but the _time field in Splunk comes through as 12/07/17 at 6:30:07
... View more
12-07-2017
09:56 AM
Hi Jkat54, thanks for your much need support on this issue, hey we have removed this stanza from props.conf "DATETIME_CONFIG=CURRENT" and current we have the below stanza configured.
[symantec:tap:incidents]
SHOULD_LINEMERGE = false
FIELDALIAS-event_host = tap_host as event_host
KV_MODE = json
TRUNCATE = 0
TIME_PREFIX=^time:\s
TIME_FORMAT=%FT%T.%3N
MAX_TIMESTAMP_LOOKAHEAD=1024
TZ=EDT
Search details:
index=sem sourcetype="symantec:tap:incidents"
Event Details :
12/6/17
9:41:31.000 PM
{"summary": "Daily unresolved SEP detection(s)", "uuid": "f4f4e6b0-daf6-11e7-f496-000000000065", "recommended_action": "Review the SEP settings, isolate the endpoint(s), remove the file(s), and/or clean the system(s).", "filehash": ["d4d44b71598a87447b9517d0945909152d3f441132bb4867991cb6705b0d03d1", "0860cb4c27223edca4ebdc8c9d4f8043700b156b62366a56b77f3023ec3d18bf"], "time": "2017-12-07T02:33:06.459Z", "tap_incident_id": 104660, "updated": "2017-12-07T02:35:06.478Z", "domainId": ["", "www.ursoft.cn"], "tap_host": "10.X.X.X", "last_event_seen": "2017-12-07T02:28:59.000Z", "priority_level": 2, "event_count": 1, "log_name": "epmp_incident-2017-12-07/incident", "deviceUid": ["dec0cb0c-9ec9-44c6-a45c-0a00be34a303", "7bc90427-1f4e-4460-a698-a864a1cdd503"], "state": 1, "first_event_seen": "2017-12-07T02:27:42.000Z", "device_time": "2017-12-07T02:33:06.459Z"}
The "time" field in the log is 12/7/2017 at 02:33:06, but the _time field in Splunk comes through as 12/06/17 at 9:41:31
Issue still there, so kindly let me know how to calculate the MAX_TIMESTAMP_LOOKAHEAD Value.
... View more
12-07-2017
06:03 AM
Hi Jkat54, can you please help me on this issue, the issue still there.
... View more
12-06-2017
10:04 AM
Hi jkat54, can you please guide me on this issue.
... View more
12-06-2017
09:26 AM
Hi monteirolopes, hey we got a request from a client to configure an Cisco Prime SNMP Trap Monitoring in splunk. To start with I need to create an Inputstanza which has the index=network sourcetype=cisco:network:primesnmp.
Could please guide me how to setup a monitoring for capturing the SNMP trap in splunk.
thanks in advance.
... View more
12-06-2017
06:09 AM
Hi All, Can anyone guide me on this issue, I am unable to make the _time field be same as the time field in the event.
thanks in advance.
... View more
12-06-2017
04:32 AM
HI jkat54, can you please guide me on this, issue is being there for very long time, need to fix this.
thanks in advance.
... View more
12-06-2017
04:30 AM
Hi All, Can anyone guide me on this, how to make the _time field be the same as the time field in the event.
thanks in advance.
... View more
12-06-2017
03:53 AM
Hi jkat54, hey I had tried the above stanza what you had mentioned in your comment but it did not work. I am getting the same output, so could you please guide me to fix this issue.
index=sem sourcetype="symantec:tap:incidents"
Event details captured after changing the props.conf
12/5/17
11:05:28.000 PM
{ [-]
atp_host: 10.x.x.x
atp_incident_id: 104656
deviceUid: [ [+]
]
device_time: 2017-12-06T04:03:08.713Z
domainId: [ [+]
]
event_count: 1
first_event_seen: 2017-12-05T09:49:58.118Z
last_event_seen: 2017-12-05T09:49:58.118Z
log_name: epmp_incident-2017-12-06/incident
priority_level: 1
recommended_action: Consider blacklisting the site. In addition, you may need to investigate the source of the exposure to see if further action is required.
state: 1
summary: Malicious domain www.xxxx.com detected
time: 2017-12-06T04:03:08.713Z
updated: 2017-12-06T04:03:08.950Z
uuid: 5e89b190-da3a-11e7-d301-000000000061
thanks in advance
... View more
12-06-2017
03:52 AM
Hi Niketnilay, hey I tried the above stanza what you had mentioned in your comment but it did not work. I am getting the same output, so can you please guide me to fix this issue.
index=sem sourcetype="symantec:tap:incidents"
Event details captured after changing the props.conf
12/5/17
11:05:28.000 PM
{ [-]
atp_host: 10.x.x.x
atp_incident_id: 104656
deviceUid: [ [+]
]
device_time: 2017-12-06T04:03:08.713Z
domainId: [ [+]
]
event_count: 1
first_event_seen: 2017-12-05T09:49:58.118Z
last_event_seen: 2017-12-05T09:49:58.118Z
log_name: epmp_incident-2017-12-06/incident
priority_level: 1
recommended_action: Consider blacklisting the site. In addition, you may need to investigate the source of the exposure to see if further action is required.
state: 1
summary: Malicious domain www.xxxx.com detected
time: 2017-12-06T04:03:08.713Z
updated: 2017-12-06T04:03:08.950Z
uuid: 5e89b190-da3a-11e7-d301-000000000061
thanks in advance
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-20-2025
08:58 PM
|
