About SplunkExplorer

SplunkExplorer · ‎07-10-2023

Hi @GaetanVP, thanks a lot for your fast and kind answer. Now it totally clear how to add PowerShell logs to collected ones! Regarding your question on DNS, I don't know the answer; I mean, if your question is related to a config Microsoft side, I have no access to this data, cause customer hosts are on its Data Center and we do not manage the Domain Controller configuration. I have to check with our reference before give you an answer.

SplunkExplorer · ‎07-10-2023

Hi Splunkers, for a customer we are preforming a migration in Windows Logs collection: as suggested by some of you in another topic, we are passing from WMI method to UF one (and it is very, very, very - Have I already told "very"? - better). We encountered a difference with WMI we don't know how to solve, and here I am to ask your help. First, a little recap of architecture: UF are installed on DC and then data are sent to an HF, which following forward data to a Splunk Cloud instance. So the flow is: DCs with UF installed -> HF -> Splunk Cloud. When we configured WMI, we selected the "classic" logs (Security, Application, System) plus DNS and PowerShell. In particular, our SOC is interested in DNS query logs. When we installed the UF (with graphic wizard), we found only the "classic" options: Security, Application and System. If we want to collect also DNS query logs and PowerShell one, how can we achieve this using UF? I suspect we need to modify the inputs.conf file, but is my assumption correct? And if yes, how can I go on?

SplunkExplorer · ‎06-28-2023

I need to enable a custom user Role to see the CMC without give the same privileges of Admin one. Is this possible? And inf yes, when I configure the new role capabilities, which options should I use?

SplunkExplorer · ‎06-28-2023

Hi Splunkers, for our customer we collect log from Windows systems. The main configuration details are: Logs go from DCs to a dedicated HF and then to Splunk Cloud, so the flow is: DCs -> HF -> Splunk Cloud Due customer policy, we avoided UF and used the WMI Collection, so on HF we configured, as Data Input, the Remote event log Collection. Configuring Remote event log Collection, we put one DC hostname in box Collect logs from this host and then we added the remaining ones in the box to add additional hosts. I mean: with only one Remote event Collection data inputs, we are collection logs from alla DCs, and they are 12. We collect following data type: Application System Security DNS PoweShell Currently, we applied no blacklist and/or other filter mechanis, so we are collecting all logs from above category Our HF has the recommened system requirements. Yesterday we completed this configuration and started to collect logs. The issue we are facing is that logs arrive with a delay, which is always around 30-60 minutes. So, we have to understand why. Our suspect is that we have not a single root cause, but a set and it is: Use of WMI insted of forwarder, that could be problematic if we have multiple hosts, as stated in this Splunk Community Thread Collection of all logs without filtering anything; I mean that for above categories we collect all related EventCode occurrences. A "burst" in sending logs, cause we started collection from all DCs in the same time Configured only one Remote event log Collection, but we think this have a minimum weight on performance issues. Based on this, if all our assumptions are correct, considering that customer for sure will not enable UF installation, we thougth to: Excluding unwanted logs with inputs.conf in HF Evaluate if create separate Remote event log Collection input, in worst case one for every DC. Do you think guys this is fine? Our main doubt currently is: have we detected all issue causes? Are our fixes the right ones?

SplunkExplorer · ‎06-27-2023

Hi @isoutamo, thanks a lot. Yea, I know how to return value using a stats, with value(argument) command or other, my question was to confirm I have to use "more complex" search if I need more fields in notification. Another question arise now: if I have a simple search without transforming command, like: index=* sourcetype=cybereason:malware status=detected what will happend? The doubt is: due I use no transforming command, I will be able to access all fields in the logs OR the opposite, and so I will not able to add fields in notification, because I did not specified what field to return?

SplunkExplorer · ‎06-27-2023

Hi Splunkers, I have to configure, as alerts trigger actions, a mail sending that should have, in body test, some field contained in triggering events. I found here on community this post: How to implement tokens in Email alert? that explain vey clear to use $result.<field_name>$ notation but also that "the field you want to specify must be returned in the first result row of the search". So now a question arise. Suppose I have this sample search: index=* sourcetype=cybereason:malware status=detected | stats count by machineName It return rows with 2 fields: the machine where infection has been detected and the event count. So, I should be able to use, in my mail notification: $result.machineName$ $result.count$ but not $result.status$, cause it is used only as a filter and is not returned as search result. Am I wrong?

SplunkExplorer · ‎06-27-2023

Hi Splunkers, we have to connect our On Prem SOAR Solution (Palo Alto Cortex) to a Splunk Cloud instance. The dedicated SOAR integrations use API and ask: Username Password URL/Hostanem/IP Address Destination port We have some problems in destination port; we tried all the Splunk common one (9997, 8000, 8089, 8443) but we got always the Connection Timeour error. I'm wondering if, due we have a Splunk Cloud Environment, we need to ask to support some

SplunkExplorer · ‎06-26-2023

You were right giuseppe: the indexAndForwarding setting does not work on _internal. Simply, we found that previous config contained an error fixed when we add ALSO the indexAndForwarding parameter equals true, and this has lead us to believe that the problem was correlated. We set indexAndForwarding=false and data continue to go correctly to SC and UEBA. I also confirm that changing the inputs.conf with _TCP_ROUTING key was not required for our environment.

SplunkExplorer · ‎06-26-2023

Exabeam has a component called Site Collector that can be compared, more or lesse, to a Splunk HF; it can receive data in many way included syslog, both tcp and udp. We configured a tcp syslog enabling and until now, after many works, we are able to receive data on both Splunk Cloud (all data) and UEBA (a subset of data for some sourcetypes). Based on what Giuseppe and you explained me, because until now we didn't need to modify the inputs.conf, our first change will be to modify the indexAndForwarding parameter; I expect that, event putting it equal false, the double forwarding should be fine. Otherwise, we will modify also the inputs.conf file. I'll keep both you updated 😉

SplunkExplorer · ‎06-25-2023

We do not use the Splunk UBA, but a third party service, the Exabeam UEBA. I appreciate all your explanation, I'm going to share them today with my colleagues.

SplunkExplorer · ‎06-24-2023

Hi Giuseppe, currently I have no access to system where files are located, I have to wait Monday. I understand what you are speaking about, is what we discussed on my topic and via message; at the end we didn't put the _TCP_ROUTING because ODS told us that is not needed (I posted them the post where you encountered the issue and solved it); the reason is, about them, that cause we are using a TCP forwarding for both destination (Splunk Cloud and UEBA) and we are not using syslog, the explicit setting in inputs.conf is not required. But from your word I understand that, every time you split the forwarding, is required, so for sure I'm going to apply the change Monday. I'll keep you updated. Thanks a lot for you help, precious as always.

SplunkExplorer · ‎06-23-2023

Hi Splunkers, on one Splunk Environment I follow we implemented the filtering and route strategy. As described in another post here on community, we worked on our HFs and configured them to capture a subset of data for each sourcetype and send them to a UEBA solutions. Due some issues, we worked with ODS and now we achieved our purpose. All data continue to be sent to Splunk Cloud and a subset of them goes to UEBA. This has been achieved changing 3 files on HF: outputs.conf props.conf (on addon where specific sourcetype is configured) transforms.conf (on addon where specific sourcetype is configured) By the way, after a first config, we saw that on Splunk Cloud we were no longer able to see the _internal logs related to HF. I mean: if we launched this search on SH: index=_internal host=<HF hostname> no result was get. I underline that, before change the outputs.conf file, we were able to see them on SH. I searched on google and here on community I found some topics that state, in a nutshell, that this behavior could be normal if outputs.conf is changed to add other destinations for logs. So, ODS suggested us to add, in the HF's outputs.conf, the parameter indexAndForward=true. We followed the suggestion and after that we were able again to see _internal logs on SH but, as expected, on one HF we get the error message of lower disk space available; that has lead the HF to stop forwarding and getting _internal logs. So, we changed indexAndForward to false, stopped for now UEBA forwarding and HF starts again to produce _internal and send log to Splunk Cloud. So, going to a conclusion, my final question is: due the indexAndForward parameter cause, of course, a disk consumption (cause the HF start to index data like an indexer), how can we achieve our purpose? I mean, how can we mantain or change in outputs.conf to send data on our UEBA and, at the same time, continue to see HF _internal logs on SH?

SplunkExplorer · ‎06-22-2023

You are right, I confuse the logic. Thanks.

SplunkExplorer · ‎06-22-2023

Hi Splunkers, I have an issue with a search that use a lookup. I know here on community there are a lots of post on this argument, but event reading them I'm still in struck. My search must simple match this: verify if, from firewall logs, the destination ip match against the address contained on a lookup file and traffic is accepted/permitted. The search is: index=* sourcetype=cp_log direction=outbound action="Accept" | lookup tor_node tor_node_address as dst_ip output exclude | where isnull(exclude) | stats count by src_ip, dst_ip Where: the table name is tor_node this table has 2 columns: tor_node_address, which contains ip address, and exclude, inserted to esclude temporary some IPs from matching if needed. So, the query logic is: check if, in the events, the dst_ip field values match the lookup field named tor_node address ones and, with the use of isnull command, those IP are not marked with exclusion. How I want to check if the value in the lookup must be excluded from matching or not? If the cell of exclude column is empty, the row must be included in check; if it is populated, not. So, if the exclude column is full empty, all data of tor_node_address must be matched by dst_ip. That means that, if no dst_ip match tor_node_address, the search resut must be empty. Here a graphical view of my lookup: As you can see, the table has been created with https://splunkbase.splunk.com/app/1724 I ensured that, after saving file, the lookup is well populated with inputlookup command: I changed correctly lookup file permissions: I created the related lookup definition and set correctly its permission: And set no particular advanced settings, except avoid case sensitive match: So, what's the problem? The search dos not perform the check. Even if no dst_ip match the tor_node_address one, the search result is not empty. If I launch it, I can see the same results gained with: index=* sourcetype=cp_log direction=outbound action="Accept" | stats count by src_ip, dst_ip It seems like the lookup command is totally ignored.

SplunkExplorer · ‎06-22-2023

Hi Splunkers, we are setting a Splunk Cloud environment for a customer and we are working on Trigger Actions for alerts. We don't need, for now, some particular custom actions: afer alert triggering, sending an email to our SOC is enough. We know that fields in the events/alerts are easily usable thanks to $<field_name> notation, so how to customize the email action is not a problem. What we don't know is: if we have a custom template we want to use for our emails, with some logos and HTML code, is it possible simply put it in the message box? I mean, simply put our html code here: or we have to follow another way? And which one?

SplunkExplorer · ‎06-21-2023

Hi @gcusello, it is the second option you mentioned: no other events between the desired one must be present. For example: 15:00:00: Eventd ID 4776 for user gcusello 15:00:01: Eventd ID 4776 for user gcusello 15:00:02: Eventd ID 4776 for user gcusello is fine, while: 15:00:00: Eventd ID 4776 for user gcusello 15:00:01: Eventd ID 4776 for user gcusello 15:00:02: Eventd ID 4625 for user gcusello 15:00:03: Eventd ID 4776 for user gcusello it isn't.

SplunkExplorer · ‎06-21-2023

Hi Splunkers, I have to build a rule, based on Windows Logs (XML ones), that must check this: Notify me is there are at least 3 consecutive occurreces of EventID 4776 from a list of host. Tje desiderd output must show: Host Number of consecutive events User/account associated to events So for example, if we have that Host A has 4 consecutive events of EventID 4776 for user "Admin" Host B has 19 consecutive events of EventID 4776 for user "Test" Host C has 2 consecutive events of EventID 4776 for user "Joker" Host D has 3 Events of EvenID 4776, but only 2 consecutive; than has another different event and only after this another occurrence of 4776 for user "Hello" Host C don't match the consecutive count clause and must be escluded; same for Host D, because he has 3 events but not consecutive. The expected output is: Host User N. of consecutive events A Admin 4 B Test 19 What get me in stuck here is how to check that events are consecutive.Any suggestion?

SplunkExplorer · ‎06-13-2023

Hi Splunkers, we have an environment where for Windows Logs collection it is higly desiderated to avoid agent installation. After some searches, we found that the proper way is to use WMI. Now, what is not completely clear for us is the list of permission required for a Domain User; what we need is a short but esaustive list of permission for it. Untile now, we know that this user must: Be a domain user Belong to Event Reader group Have access to system where to collect logs Be able to read at minimum System, Application and Security logs in case of AD DCs Be the user that execute the splunkd daemon for forwarder (HF or U, in our case HF) that must collect data with WMI Is there any other requirements we are missing?

SplunkExplorer · ‎06-13-2023

Solved by myself: Splunk is able to use WMI to achieve this result.

SplunkExplorer · ‎05-17-2023

Hi Splunkers, I could have the following scenario to implement: a SplunkCloud platform that must receive data from some data sources, with at least an HF (but they could be 2 or more). Between data sources, there are Windows Acive Directory servers and, of course, I have to send data to Splunk. I don't know if this data will be routeed to HF or directly to Splunk Cloud, but this is not important now. The focal point is: it is very likely that we will not be able to install UF on those servers, for policy contraints. So, we will have to senda data from AD to Splunk in a agentless manner; what are the possible way to achieve this? And which ones could be the best ones?

SplunkExplorer · ‎05-17-2023

Hi Giuseppe, we are performing the configuration putting all togheter all the info. Work ongoing. Thanks a lot.

SplunkExplorer · ‎05-03-2023

Thanks giuseppe, I understand. So, in case I want to use Splunk Add-On builder on another PC (for example, my laptop) I can create it and then upload it directly on HF, for example from Web Gui. Clear.

SplunkExplorer · ‎05-03-2023

Hi Giuseppe, thanks for your answer, appreciated as always. At this point, 3 question arise: 1. For inputs.conf file, we mean the one under $SPLUNK_HOME/etc/system/local/ path? 2. If we don't want develop a new app, can we anyway develop those file under$SPLUNK_HOME/etc/system/local/ path or may us encounter some kind of problem? 3. I searched how to create an app (never perdormed before, only created add-on using add-on builder) and I found this: https://dev.splunk.com/enterprise/docs/developapps/createapps/. The links speaks about creating an app using the Splunk Web GUI; due we need this app on an HF, I have to assume we have to perform this action on HF Web Interface?

SplunkExplorer · ‎05-03-2023

Hi Splunkers, today I'm here not for an issue, or better, not yet, but to "pull all togheter" the components of my task, which is forwarding Splunk data from HF to another system, an Exabeam UEBA in my case. I'm trying to prevent possibile errors I could do in changing the required files, so I may want perform a check here with you to understand if I got all I need from docs. Let me give you more context and introduce the current state. The Splunk environment installation and setup has not been performed by my team, but by another one That team has not created an outputs.conf file in SPLUNK_HOME/etc/system/local; they created each outputs.conf they required in a separate folder under the SPLUNK_HOME/etc/app one. So at this time we have a lot of outputs.conf files, but no one under SPLUNK_HOME/etc/system/local. At the same time, no props.conf and transforms.conf are present under SPLUNK_HOME/etc/system/local We must forward only a subset of data via syslog and we have to filter them with sourcetypes We have 2 destination syslog servers balanced by a Load Balancer, so we have to send data to LB VIP We are using syslog but, for some reason, we will not use the default UDP; we are going to use syslog via TCP I have no direct access to Splunk HF; the task is going to be performed with colleagues that have this access. I'm in charge of editing the required files and pass them to my colleagues, that will upload them on HF. Which documentation we used? Those one: Forward data to third-party systems Route and filter data Plus I searched other symylar topics here on community and tried to got some results. So, putting all data togheter, we stated that, because there are not the outputs.conf, props.conf and transforms.conf files in $SPLUNK_HOME/etc/system/local, we must: create outputs.conf, props.conf and transforms.conf under $SPLUNK_HOME/etc/system/local folder populate them following docs If the above assumptions are right, I have some doubts about the files, because some docs points are not complete clear for me. So, suppose we want to to start forward only a subset of Windows EventID with syslog tcp; are the below conf files ok? outpust.conf: [syslog:syslogToExabeamGroup] type = tcp server = <ipaddress>:<port> Note that, cause I have to forward only a subset of data, I avoided the defaultGroup settings, like in the sample of Forward data to third-party systems docs. props.conf: [<windows_sourcetype_name>] TRANSFORMS-routing1 = syslog_from_win_to_exabeam Here I used directly the souretype name and not the syntax sourcetype::<sourcetype_name>; is it correct? Plus, even if in Forward data to third-party systems docs I have the syntax like TRANSFORMS-whatever_you_want, I followd what stated in Route and Filter Data and used a syntax like TRANSFORMS-routingX. transforms.conf: [syslog_from_win_to_exabeam] REGEX = EventID\>(4624|4625|4648|4672|4720|4722|4723|4724|4725|4726|4728|4729|4732|4733|4740|4756|4757|4767|4768|4769|4770|4771|4776|4780|1102|4611|4663|4673|4674|4688|4697|4698|4719|4778|4779|4780|4800|4801|5136|5137|5138|5139|5140|5141|5145|6272) DEST_KEY = _SYSLOG_ROUTING FORMAT = syslogToExabeamGroup The regex has been built based on our logs (we are receiving them in XML format). It seems all ok but I'm not sure I forgot/done bad some configuration.

SplunkExplorer · ‎04-17-2023

Hi Splunkers, my colleague and I are going to perform, this week, a change to forward data from Splunk HF to a third party system, in this case a UEBA product. In this scenario, we have to forward not all data, but only some subsets. How to perform this is well explained in the official doc, here , so the purpose of my post is not to understand how to do this. Reading the guide, I found some point that are not completely clear, so I kindly ask you to help me to understand. Paragraph "Forward a set of data"; inside the file transforms.conf we need to insert the following dest key: DEST_KEY=_TCP_ROUTING Do we need this because we are performing a tcp forwarding, as stated in the file outputs.conf with stanza [tcpout] ? I mean, all times I need to perform a tcp forwarding, I must use always a stanza "tcpoutput" and I need a dest_key like the above one in case of data subsets? What about if I need to perform a UDP forwarding? is it possible? If yes, How should I change stanzas in files? I mean, I can see that using syslog I could achieve this, but what about if I cannot/I don't want to use it?

Posts	122
Solutions	7
Karma Given	57
Karma Received	9
Member Since	‎09-22-2022

Online Status	Offline
Date Last Visited	‎06-11-2025 02:10 AM

Issues with csv Splunk File Monitoring

Avoid app update when deployer push bundle

Doubt about SSL encryption between multiple Splunk...

indexes.conf repFactor parameter

Search with Rest API to list all alerts, reports a...

Recover all fields in a Splunk environment

Alerts triggered actions: log events

Required permission for linux user owner of Splunk...

Double forwarding with double default group not wo...

Understand which HF send data to whic index

Re: Collect Windows DNS and PowerShell logs with S...

Collect Windows DNS and PowerShell logs with Splun...

Re: Ask questions and get help with Cloud Monitori...

Windows logs collection with WMI arrive with delay...

Re: Correct use of $ oken on alert email notificat...

What is the correct use of $ oken on alert email n...

Which port to connect SOAR solutions with Splunk C...

Re: HF no longer send internal to SC after change ...

Re: HF no longer send internal to SC after change ...

Re: HF no longer send internal to SC after change ...

Re: HF no longer send internal to SC after change ...

HF no longer send internal to SC after change outp...

Re: Lookup command not working

Why is Lookup command not working?

How to create custom alert email template on Splun...

Re: Check if certain events occurs N consecutive t...

How to check if certain events occurs N consecutiv...

Windows remote logs collection with WMI: user priv...

Re: Sending data from Microsoft Windows AD to Splu...

How to send data from Microsoft Windows AD to Splu...

Re: Forwarding raw data to third party systems wit...

Re: Forwarding raw data to third party systems wit...

Re: Forwarding raw data to third party systems wit...

Forwarding raw data to third party systems with Sy...

HF third party forwarding plus events whitelisting

Are you a member of the Splunk Community?