About richgalloway

richgalloway · ‎10-23-2013

Perhaps something like this? sourcetype="IDS" | transaction src_ip signature | stats sum(hit_count) by src_ip as hits | table src_ip signature hits | sort -hits

richgalloway · ‎10-21-2013

Please accept this answer if it solves your problem.

richgalloway · ‎10-21-2013

Why be so specific? Just take everything between "NOERROR]" and the DNS name as the record type. | rex "NOERROR]\s(?<record_type>.*?)\s" | If you only want to see specific record types, use a where clause after the rex.

richgalloway · ‎10-21-2013

I got good results with this regex string (?i).+phonehome.+8089_(.+_)?(?P<fieldname>.+?)_ A helpful site for testing regex strings is RegexPlanet.

richgalloway · ‎10-18-2013

halr9000, see my existing question at http://answers.splunk.com/answers/105439/no-port_scan-data

richgalloway · ‎10-18-2013

Redirecting the nmap.sh output to a file showed nmap was failing because of a missing OpenSSL library. nmap: /opt/splunk/lib/libcrypto.so.1.0.0: version `OPENSSL_1.0.0' not found (required by nmap) nmap: /opt/splunk/lib/libssl.so.1.0.0: version `OPENSSL_1.0.0' not found (required by nmap) Adding unset LD_LIBRARY_PATH to nmap.sh fixed the problem. Thanks to Splunk tech support for their help with this.

richgalloway · ‎10-17-2013

Rex is pretty simple once you get the hang of it. Try something like this: ... | rex field=_raw "(?<arg1>.*?)\s(?<arg2>.*?)\s(?<arg3>.*?) Deny TCP reverse path check from (?<From>.*?) to (?<To>.*?) on interface (?<interface>.*?)" | dedup From, To | table From, To Someone else may have a more elegant solution.

richgalloway · ‎10-17-2013

I'm having a similar problem with the Asset Discovery app. It appears Splunk 6 does not come with the right OpenSSL library.

richgalloway · ‎10-17-2013

Perhaps it's copy-and-paste error, but it looks like you're missing a tag.

richgalloway · ‎10-16-2013

[script://./bin/nmap.sh] disabled = 0 [script://./bin/nmap.sh -A -O] disabled = 0 [script:///opt/splunk/etc/apps/asset_discovery/bin/nmap.sh -p14147 -t 172.16.42. 64 172.16.42.220 172.16.42.230] disabled = false index = asset_discovery interval = 60 source = nmap sourcetype = port_scan

richgalloway · ‎10-16-2013

I restarted Splunk and still am getting no port_scan data. In fact, my asset_discovery index contains nothing at all.

richgalloway · ‎10-15-2013

Try ' eventcount index=* summarize=false NOT (index=main OR index=summary OR index=history) '

richgalloway · ‎10-15-2013

I made the same changes and still no data. Did you have to restart Splunk?

richgalloway · ‎10-11-2013

Splunk 6 was installed fresh. I then copied our app from our Splunk 5 system and installed the following apps: Splunk Add-on for *Nix, Asset Discovery, Splunk DB Connect, Splunk + OData, Sideview Utils, S.o.S, Splunk App for Unix, Deployment Monitor, Tenable Security Center. I swear I grepped for 'IPLookup' before I posted this question and didn't find it. This time I did find it. The lookup was an old experiment that didn't go anywhere. I've commented it out of props.conf. We do not see this error on our Splunk 5 system.

richgalloway · ‎10-11-2013

How about narrowing your search to the last 2 minutes and setting an alert if there are no results?

richgalloway · ‎10-11-2013

I'm not sure exactly what you want to convert the duration into. Something like this will put it in hh:mm:ss format. Or you could drop the tostring() call and just display the secs field. | rex field=Duration "((?<Hrs>.*?)hr)?\s?((?<Mins>.*?)mn)?\s?((?<Sec>.*?)s)?" | fillnull value=0 | eval secs=(Hrs*3600)+Mins*60+Sec | eval Time=tostring(secs, "duration") | table Duration, Time

richgalloway · ‎10-11-2013

Try adding ' | table DC, Version, Pageviews, "95th% RTT" ' to the end of your search.

richgalloway · ‎10-11-2013

The dboutput command changed in DBX 1.1 to not allow output stanzas. The complete syntax is now documented in http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands#dboutput.

richgalloway · ‎10-11-2013

Please mark my answer as accepted.

richgalloway · ‎10-10-2013

Have you tried | eval ts=strftime(_time, "%m/%d/%y %H:%M %p") ?

richgalloway · ‎10-10-2013

When I arrived in the office today I discovered our Splunk 6 logs were filling with errors like these: 10-10-2013 08:50:13.075 -0400 ERROR LookupOperator - Error 'Could not find all of the specified lookup fields in the lookup table.' for conf '(?::){0}PerfmonMk*:*' and lookup table 'IPLookup'. 10-10-2013 08:50:13.075 -0400 ERROR LookupOperator - Error 'Could not find all of the specified lookup fields in the lookup table.' for conf '(?::){0}WMI:*' and lookup table 'IPLookup'. 10-10-2013 08:50:13.076 -0400 ERROR LookupOperator - Error 'Could not find all of the specified lookup fields in the lookup table.' for conf '(?i)source::....zip(.\d+)?' and lookup table 'IPLookup'. 10-10-2013 08:50:13.076 -0400 ERROR LookupOperator - Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'ASR' and lookup table 'IPLookup'. 10-10-2013 08:50:13.076 -0400 ERROR LookupOperator - Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'ActiveDirectory' and lookup table 'IPLookup'. These appear to be for all apps and continued for hours until I restarted Splunk. They resumed an hour later. I have no idea why. The errors vary, but always complain about lookup table 'IPLookup'. Where is that lookup file? It seems like something was corrupted, but I have no idea where to look? Any help? None of my apps are working with Splunk in this state.

richgalloway · ‎10-10-2013

The Splunk 6 launcher (localhost:8000/en-US/app/launcher) displays apps in reverse alphabetical order - "Splunk App for..." comes before "Asset Discovery", for example. Likewise for the "Apps" drop-down at the top of the page (the 'appbar'?). How can I change them to display apps in alphabetical order?

richgalloway · ‎10-09-2013

-rwxr-xr-x 1 root root 1972032 Jan 4 2013 /usr/bin/nmap* Splunk is running as root so wouldn't nmap also run as root?

richgalloway · ‎10-09-2013

1800 seconds

richgalloway · ‎10-09-2013

I've searched 'sourcetype=port_scan' and 'source=nmap' without an index specified and get no results. Index manager says asset_discovery has zero events.

Posts	16708
Solutions	2982
Karma Given	1972
Karma Received	6666
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	2 hours ago

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: How to count total hits by certain fields?

Re: Matching A vs AAAA rex help

Re: Matching A vs AAAA rex help

Re: Regex Extracting Phonehome client name

Re: Commands broken after upgrade to splunk 6

Re: No port_scan data

Re: Finding unique entries

Re: Commands broken after upgrade to splunk 6

Re: Button on dashboard?

Re: No port_scan data

Re: No port_scan data

Re: how to exclude some index results

Re: No port_scan data

Re: PANIC - Splunk 6 can't find any lookup fields

Re: Splunk alert if no events in source returned i...

Re: Conver string to time duration.

Re: Saved Search in Splunk 5 produces a table, but...

Re: Syntax for dboutput

Re: Getting Date to Display Correctly - CSV Report

Re: Getting Date to Display Correctly - CSV Report

PANIC - Splunk 6 can't find any lookup fields

Splunk 6 launcher shows apps in reverse order

Re: No port_scan data

Re: No port_scan data

Re: No port_scan data

Join the Conversation