About Matthias_BY

Matthias_BY · ‎11-13-2013

Hi, | delta then you can make a eval with if statement. eval result= if(delta=0, 0, 1) if the delta value is 0 assign 0 every other value assign 1 br matthias

Matthias_BY · ‎11-11-2013

Thanks a lot. the trick was to edit the props.conf and reference the sourcetype with the file path in the stanca. http://docs.splunk.com/Documentation/Hunk/latest/Hunk/Setupavirtualindex#Edit_props.conf_.28optional.29_to_define_data_processing

Matthias_BY · ‎11-08-2013

Hello, as i did understand within Hunk data is returned in Jason format. I have log data in my Hadoop Environment. Connection + Search is working fine. But the line break does not work properly. In one "Hunk" Event are always 4 of my Events. Even the events have quite similar structure... how can i configure the event break settings within Hunk? couldn't find anything in the documentation. Thanks a lot Matthias

Matthias_BY · ‎10-29-2013

The parallelcoords.js is referencing to the following path: var d3 = require("../d3/d3"); this means the d3 directory from the example dashboard app is also requiered. copy + paste it into my app and it did work. this is not stated in the documentation. br

Matthias_BY · ‎10-29-2013

Hello, i used the Splunk Enterprise 6 Dashboard Examples app to create in a own app (independent of the simple_xml_examples app) a visualization with the D3 Parallel Coordinates visualization. followed the documentation and did copy the parallelcoords directory from /appserver/static/components to my own dashboard. additionally i added the html tags with the visualization + did edit the path of the files in the require section + added the autodiscover.js to the dashboard tag as well copied into the appserver/static/ directory. after this the visualizations are not displayed. what is going wrong? br

Matthias_BY · ‎10-24-2013

Hi Mike, If you review the python lookup script you can see that there is some code commented out. If you remove the # the lookup script will create this file and log what it recieves from your splunk search and what values are given back. This is how i track during development how the script is working, how many lookups are performed etc. As it can produce a lot of data dependinc how many realtime lookups of ip's you are doing i did not emable it by default to aboid eating up any splunk license. I might have should removed the input before doing the release. Thanks for the hit. I'll consider this for a next update. Also make sure you add IP Reputation as tag to your answer. This is how you question gets notized from me immiditly. Happy splunking, Matthias

Matthias_BY · ‎10-10-2013

thanks a lot for your support so far - but it's still the same result - only one hour with all the count instead many with the evolving of the time: Time Concurrent 22:00 4

Matthias_BY · ‎10-10-2013

still same result... date_hour is always the field when the session did start/end. but i need to stretch this accross the duration timeline. from start of the session until the end.

Matthias_BY · ‎10-10-2013

Hi, this displays only the hours where i have an event starting: 22:00 4 nothing else... it does not display 22:00 4 23:00 1 24:00 1 01:00 1 02:00 1 ...

Matthias_BY · ‎10-10-2013

Hello, i have data with VPN connectivity. Format is quite simple: 1378764018782;1378764018781;OK First is Start Time of the Session - second timestamp is Ending/Stop of a Session. Both in Epoch time. I figured already out how to convert etc. all the info. so my current search gives me the results: Start End Concurrent duration 09/10/2013 00:00:19 09/10/2013 00:00:57 1 38 09/10/2013 00:00:19 09/10/2013 00:00:20 2 1 09/10/2013 00:00:19 09/10/2013 00:00:19 3 0 09/10/2013 00:00:23 09/10/2013 00:06:59 2 396 Search: sourcetype=vpn "OK" | eval Start = StartTimestamp | eval Stop = StopTimestamp | eval Start = round(Start/1000,0) | eval Stop = round(Stop/1000,0) | eval Start_epoch = Start | eval duration = (Stop-Start) | convert ctime(Start) AS Start | convert ctime(Stop) AS Stop | concurrency duration=duration start=Start_epoch output=concurrent | table Start Stop concurrent duration Now i want to have a Report to fill this up to answer the question: how many people have been conccurrent at 12 etc. with the option to AVG per hour. i guess somehow with gentimes but i don't figured out how it is working... Result: 00:00 2 Concurrent Sessions 01:00 1 Concurrent Session 02:00 1 03:00 1 ... 06:00 1 07:00 0 thanks a lot matthias

Matthias_BY · ‎09-23-2013

Hi, i found a nearly best solution including being independent from the schedule with kmeans. So first listing all successfull runs, then calculating the delta of each run and then with kmeans adding some statistical calculation to find the outlier. as if the system was off or one scheduled task was missing this can be shown: `set_internal_index` host="mmaier-mbp15.local" source=*scheduler.log savedsearch_name="BlueCoat - Stats - Collect" status!=continued | stats max(run_time) as Max, count by _time savedsearch_name | sort -_time | delta _time as delta | where Max>0 | eval delta = round (delta/60*-1,2) | kmeans delta | sort -_time | replace 1 with OK, 2 with "ERROR" in CLUSTERNUM Even in the line visualization i can visualize it very good:

Matthias_BY · ‎09-23-2013

thanks for your hint - but this shows only successfull run vs. errors. if i have a scheduled activity every 5 minutes and i shutdown my instance of splunk for 1 hour and start it again - i won't get it displyed that it misses several scheduled activities...

Matthias_BY · ‎09-18-2013

Hi, sorry that is not the answer. You're referring to splunk web. i'm asking for forwarder traffic. br

Matthias_BY · ‎09-18-2013

Hello, i have some scheduled searches. Some run every 5 minutes, some 15 minutes some hourly etc. Some of those searches are there to generate a summary index, a few other to exportcsv to feed it into another tool regularly. if there is an outage of the search head (even with two search heads or SH pooling) some jobs might be skipped or missed as they won't rerun. This will result in a not complete dataset. In the first step, i'll would need a Report which shows me, based on the actual schedule which search was skipped. index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") | search savedsearch_name="Project Honey Pot - Threatscore AVG Last 4 Hours" NOT continued | table sched status savedsearch_name Report Like: User Activity Search - Last RUN | scheduled every 5 Minutes | STATUS=Completed - Last RUN - 5 minutes | STATUS=Completed - Last RUN -10 Minutes | STATUS=Completed - Last RUN -15 Minutes | Status=Not Executed - Last RUN -20 Minutes | Status-Completed and this for each scheduled search dynamically with the scheduled every 5 minutes. The above example would show a potential Restart of the SH 15 minutes ago. And then i can manually investigate and re-run the export for this specific timeframe to add the data again... or it can review the last 10 successfull runs - subtract the times and then automatically detect that it is running all 5 minutes. Thanks a lot Matthias

Matthias_BY · ‎09-10-2013

Hello Marius, i just updated my app with a new version. i have configured a new start dashboard which includes already some simple xml reports. there you can easily review how the reports are working and customize them with your own needs. hope this helps you. br matthias

Matthias_BY · ‎08-26-2013

Thanks - that looks good. but even the // is bad within the mail client... i think the best workaround is to forward via workflow action a a small wepage with PHP content and add the content as values and then with a few lines of php code display everything and launch the mail client from there.

Matthias_BY · ‎08-26-2013

Hi RT, i'm looking to launch a email client with predefinied subject and body. so they have the chance to edit it and then send it out.

Matthias_BY · ‎08-26-2013

Hello, i want to allow my people to mail an event in a custom format to other people out of splunk manually. so i'm looking for a way to involve the workflow action for event types. i tried to use like: mailto:test@test.com?subject="ALARM-Stufe_Rot_$host$?body=Hello_that_is_body_test_with_clientip_$clientip$ this does not work. the workflow does only appear if a URL is included... does someone know how i can work around this? copy into clipboard would also work, but i think with the MailTo it might be easier. br matthias

Matthias_BY · ‎08-16-2013

Hi, i want to send out data with an forwarder to a splunk indexer hosted in the web like splunk storm. Is it possible to route the traffic of a forwarder over a proxy server? br matthias

Matthias_BY · ‎08-16-2013

great this is working - so easy 😉 thanks a lot

Matthias_BY · ‎08-15-2013

Hello, i have a scripted lookup which is working fine. i configured in the lookups that the field name is called clientip for lookups. now i want to make it more dynamic so that the lookup can also be used for other fields containing an ip address. those fields might be clientip, src_ip, source_ip, dst_ip, dest_ip and so on. currently i found only that i need to configure one lookup command for each field name or rename the field in a pre command. i want to make my app ip reputation more generic. so that someone can type ... | lookup threatscore src_ip as well as ... | lookup threatscore clientip or other field names depending what's required. Thanks a lot Matthias

Matthias_BY · ‎08-15-2013

Hi, you need to set the lookup-objec to appear in All apps. br matthias

Matthias_BY · ‎07-22-2013

Hello Marius, what kind of log data are you using? The predefinied dashboards are filtered down to eventtype="honeypot_app_events" - this means you need to Tag your log source of which you want to see your data and enrich those. to verify if you ip reputation lookup is working, you need to do the following: Create some Field Extractions with IP's and name the fields "clientip" Search for some periode of time like clientip=* | lookup threatscore clientip Verify if there is a new field called "threatscore" within the "interesting fields" The filtering was added to avoid that if you click on your dashboard the lookup is starting across all your it-data. the lookup is going via DNS Requests - and if Splunk runs for thousands of IP's a dns query you can imagine what happens to your DNS Server 😉 so use it only on data which you're really interested. br Matthias

Matthias_BY · ‎07-18-2013

Hi, make sure you have imported the csv library: import csv #for splunk batch input/output additional to this you need to add a loop to read each line and enrich each line and give it back into std output. here is a sample which reads the client ip, executes the method scorelookup and brings the values back. br matthias def main(): #print 'starte main' if len(sys.argv) != 3: print "Usage: python [ip field] [threatscore]" sys.exit(0) r = csv.reader(sys.stdin) w = csv.writer(sys.stdout) clientip = sys.argv[1] threatscore = sys.argv[2] header = [] first = True for line in r: if first: header = line if clientip not in header: print "IP field must exist in CSV data" sys.exit(0) csv.writer(sys.stdout).writerow(header) w = csv.DictWriter(sys.stdout, header) first = False continue # Read the result result = {} i = 0 while i < len(header): if i < len(line): result[header[i]] = line[i] else: result[header[i]] = '' i += 1 # Perform the lookup if len(result[clientip]): ts = scorelookup(result[clientip]) out = "%s,%s" % (result[clientip],ts) print out main() #f.close()

Matthias_BY · ‎07-18-2013

hi, i tried it but it does not work. the eval statements are wrong and do not work... br

Posts	69
Solutions	9
Karma Given	20
Karma Received	33
Member Since	‎03-15-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to display the date and time of the first and ...

iplocation: How to replace null or empty string Ci...

Filter values after timechart

Sendemail to recipient from a field

Hunk Line Break Configuration

D3 Parallel Coordinates - Graphic stays empty

Displaying concurrent users over time

Report to show missed schedule searches duo downti...

Workflow Action - Can I use Mailto?

Forwarder behind a proxy

Re: How do i write a query on SPL to have a flag w...

Re: Hunk Line Break Configuration

Hunk Line Break Configuration

Re: D3 Parallel Coordinates - Graphic stays empty

D3 Parallel Coordinates - Graphic stays empty

Re: IP Reputation - default inputs.conf

Re: Displaying concurrent users over time

Re: Displaying concurrent users over time

Re: Displaying concurrent users over time

Displaying concurrent users over time

Re: Report to show missed schedule searches duo do...

Re: Report to show missed schedule searches duo do...

Re: Forwarder behind a proxy

Report to show missed schedule searches duo downti...

Re: IP Reputation App. No data

Re: Workflow Action - Mailto

Re: Workflow Action - Mailto

Workflow Action - Can I use Mailto?

Forwarder behind a proxy

Re: Dynamic field-names for lookups

Dynamic field-names for lookups

Re: Sharing a dynamic lookup from an app

Re: IP Reputation App. No data

Re: External Lookup script Never works

Re: Top X and rare events X in one Report without ...

Are you a member of the Splunk Community?