About richgalloway

richgalloway · ‎11-06-2013

I don't see where you currently use your two lookup tables. The lookup statements should precede the table statement. lookup ... | table STAR PNUM PNOD Account SNOD SAccount SFIL DFIL

richgalloway · ‎11-06-2013

It seems that PNODs and SNODs are just nodes so why not have a single lookup file with "Node" and "Account" fields? Then do your lookups using '... | lookup nodes.csv Node AS PNOD OUTPUT Account | lookup nodes.csv Node AS SNOD OUTPUT Account AS SAccount | ...' .

richgalloway · ‎10-31-2013

What is your question? BTW, you can use underscores by escaping them with '\' or by entering the variables as code.

richgalloway · ‎10-31-2013

We've done that using a REGEX statement in our transforms.conf. [csv-transform] REGEX = (?<fieldA>.*?) | (?<fieldB>.*?) | (?<fieldC>.*?) | (?<fieldD>.*?) | \"(?<description>.*?)\" | (?<fieldF>.*?) You must also reference this transform in your props.conf. Ours looks like this. [csv-breaktest] BREAK_ONLY_BEFORE = (regex unique to our first field) CHECK_FOR_HEADER = false KV_MODE = multi MAX_TIMESTAMP_LOOKAHEAD = 50 NO_BINARY_CHECK = true SHOULD_LINEMERGE = true REPORT-csv = csv-transform

richgalloway · ‎10-31-2013

What delimits the strings you're searching for? If it's a fixed character like comma or space, put it in your like() clause - ' ... | where like(rawtext,"% "+hit+" %") | ... '. You may need to use multiple like() clauses if the delimiter varies ( ... | where like(rawtext,"% "+hit+" %") OR like(rawtext,"%,"+hit+",%") | ... ).

richgalloway · ‎10-31-2013

On our Splunk 5 system I can search for a sourcetype and it will be found in any non-internal index. For example, searching for ' sourcetype=foo ' will find matching events in the default index as well as in index 'bar'. On our Splunk 6 system, however, the same search returns no results if the event is not in the default index. I have to specify the index to find events not in the default index (' sourcetype=foo index=bar ', for example). Is this change in behavior intentional? I haven't seen mention of it in the release notes.

richgalloway · ‎10-30-2013

Your regex expects only two-digit hours so the examples occurring before noon are not recognized.

richgalloway · ‎10-25-2013

Then you need to adjust your search to select only the events you want to see (or remove those you don't want to see). For example, 'sourcetype="WinEventLog:Security" LogName="Security" | ...'

richgalloway · ‎10-25-2013

Include the sourcetype in your search statement. For example: sourcetype="WinEventLog:Security" "EventCode" | ...

richgalloway · ‎10-25-2013

You have to specify the key column of the table being updated. ... notFound=INSERT key=Name Name Age Sex Phone

richgalloway · ‎10-25-2013

Have you considered replacing the DELIMS and FIELDS statements with a REGEX? For example: [apache_fields] REGEX = (?<ip1>.*?)(,\s(?<ip2>.*?))?\s(?<remotelogname>.*?)\s(?<user_id>.*?)\s(?<timestamp>.*?)\s(?<resource_requested>.*?)\s(?<http_status_code>.*?)\s(?<content_length>.*?)\s(?<referrer>.*?)\s(?<user_agent>.*?)\s(?<response_time>.*)

richgalloway · ‎10-23-2013

Try '... | stats sum(hit_count) by src_ip,signature as hits | ...'

richgalloway · ‎10-23-2013

Perhaps something like this? sourcetype="IDS" | transaction src_ip signature | stats sum(hit_count) by src_ip as hits | table src_ip signature hits | sort -hits

richgalloway · ‎10-21-2013

Please accept this answer if it solves your problem.

richgalloway · ‎10-21-2013

Why be so specific? Just take everything between "NOERROR]" and the DNS name as the record type. | rex "NOERROR]\s(?<record_type>.*?)\s" | If you only want to see specific record types, use a where clause after the rex.

richgalloway · ‎10-21-2013

I got good results with this regex string (?i).+phonehome.+8089_(.+_)?(?P<fieldname>.+?)_ A helpful site for testing regex strings is RegexPlanet.

richgalloway · ‎10-18-2013

halr9000, see my existing question at http://answers.splunk.com/answers/105439/no-port_scan-data

richgalloway · ‎10-18-2013

Redirecting the nmap.sh output to a file showed nmap was failing because of a missing OpenSSL library. nmap: /opt/splunk/lib/libcrypto.so.1.0.0: version `OPENSSL_1.0.0' not found (required by nmap) nmap: /opt/splunk/lib/libssl.so.1.0.0: version `OPENSSL_1.0.0' not found (required by nmap) Adding unset LD_LIBRARY_PATH to nmap.sh fixed the problem. Thanks to Splunk tech support for their help with this.

richgalloway · ‎10-17-2013

Rex is pretty simple once you get the hang of it. Try something like this: ... | rex field=_raw "(?<arg1>.*?)\s(?<arg2>.*?)\s(?<arg3>.*?) Deny TCP reverse path check from (?<From>.*?) to (?<To>.*?) on interface (?<interface>.*?)" | dedup From, To | table From, To Someone else may have a more elegant solution.

richgalloway · ‎10-17-2013

I'm having a similar problem with the Asset Discovery app. It appears Splunk 6 does not come with the right OpenSSL library.

richgalloway · ‎10-17-2013

Perhaps it's copy-and-paste error, but it looks like you're missing a tag.

richgalloway · ‎10-16-2013

[script://./bin/nmap.sh] disabled = 0 [script://./bin/nmap.sh -A -O] disabled = 0 [script:///opt/splunk/etc/apps/asset_discovery/bin/nmap.sh -p14147 -t 172.16.42. 64 172.16.42.220 172.16.42.230] disabled = false index = asset_discovery interval = 60 source = nmap sourcetype = port_scan

richgalloway · ‎10-16-2013

I restarted Splunk and still am getting no port_scan data. In fact, my asset_discovery index contains nothing at all.

richgalloway · ‎10-15-2013

Try ' eventcount index=* summarize=false NOT (index=main OR index=summary OR index=history) '

richgalloway · ‎10-15-2013

I made the same changes and still no data. Did you have to restart Splunk?

Posts	16695
Solutions	2981
Karma Given	1964
Karma Received	6659
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	yesterday

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Lookup table with two primary keys

Re: Lookup table with two primary keys

Re: Can do search time lookup but automatic lookup...

Re: Importing a CSV and line breaking within a fie...

Re: How can I search for an exact match in the raw...

Splunk 6 change in index searching

Re: trouble using regex to find a timestamp

Re: Limit a workflow to a sourcetype

Re: Limit a workflow to a sourcetype

Re: To insert hard-code values into SQL Server via...

Re: Extract field values

Re: How to count total hits by certain fields?

Re: How to count total hits by certain fields?

Re: Matching A vs AAAA rex help

Re: Matching A vs AAAA rex help

Re: Regex Extracting Phonehome client name

Re: Commands broken after upgrade to splunk 6

Re: No port_scan data

Re: Finding unique entries

Re: Commands broken after upgrade to splunk 6

Re: Button on dashboard?

Re: No port_scan data

Re: No port_scan data

Re: how to exclude some index results

Re: No port_scan data

Join the Conversation