Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About youngsuh
youngsuh
Contributor
Member since:
12-13-2019
Friday
Community Statistics
| Posts | 147 |
| Solutions | 10 |
| Karma Given | 185 |
| Karma Received | 22 |
| Member Since | 12-13-2019 |
Activity Feed
- Karma Re: Introducing the 2026 - 2027 SplunkTrust cohort! for azadsarker. 2 weeks ago
- Karma Introducing the 2026 - 2027 SplunkTrust cohort! for SplunkCommunity. 2 weeks ago
- Karma Re: From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest for hkchun18. 2 weeks ago
- Got Karma for Re: Building Reliable Asset and Identity Frameworks in Splunk ES. 11-10-2025 07:05 AM
- Got Karma for Re: Building Reliable Asset and Identity Frameworks in Splunk ES. 11-10-2025 07:05 AM
- Karma Re: Building Reliable Asset and Identity Frameworks in Splunk ES for iamryan. 11-09-2025 02:09 AM
- Posted Re: Jira Service Desk Simple Addon Unable to Configure an Account on All Apps and Add-ons. 11-04-2025 07:20 PM
- Posted Re: Splunk CAC Authentication not working on Security. 09-24-2025 08:42 AM
- Karma Re: Splunk Light running on Docker throwing unusable filesystem for naisanza. 06-24-2025 06:40 PM
- Got Karma for Re: Upgrade or install UF agents on endpoints via Deployment server. 09-25-2024 11:16 PM
- Karma Re: Difference between last(X) and latest(X) for dart. 09-12-2024 11:46 AM
- Karma Re: How to troubleshoot if splunk is down for woodcock. 09-04-2024 12:49 PM
- Karma Re: How to troubleshoot if splunk is down for Azeemering. 09-04-2024 12:49 PM
- Karma Re: Where can I download my Splunk certifications? for javiergn. 08-21-2024 10:27 AM
- Posted Re: virus total integration with Splunk SIEM on All Apps and Add-ons. 07-10-2024 08:04 AM
- Posted Re: How do I fix in curl requests: curl(77) error? on Splunk Enterprise. 07-03-2024 11:49 AM
- Karma Re: How do I fix in curl requests: curl(77) error? for comcordriro. 07-03-2024 11:48 AM
- Posted Re: Splunk CAC Authentication not working on Security. 06-14-2024 03:30 PM
- Posted Re: Which properties are available for a Universal Forwarder in Props/Transforms ? on Getting Data In. 06-11-2024 10:17 AM
- Karma Re: Which properties are available for a Universal Forwarder in Props/Transforms ? for martin_mueller. 06-11-2024 10:13 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
03-08-2021
09:00 AM
Q: Do you have an OKTA service trying to push data to a Splunk instance rather than a Splunk add-on pulling data fromOKTA? A: We're using the add-on to pull data. We have a CIPHER issue via CURL. I'd try the upper case with no luck in the inputs.conf. We're not pushing data into OKTA. I know that it's a CIPHER issue because CURL doesn't work without the CIPHER arg. We're getting ssl.c:742 via Okta add-on. Q: Should I input all the CIPHER you listed into inputs.conf?
... View more
03-05-2021
07:38 PM
Q1: is there a way to import a matrix into Splunk? Q2: What SPL command gives me all values set to true and tells me x, y coordinates? (object here is to create table) Here is an example of the matrix that I would like to import. (Q3: What would be SPL command provided the field name for the x, y that is true) a b c d e f 1 0 1 0 1 1 0 2 1 0 1 0 0 1 3 0 1 0 1 1 0 4 1 0 1 1 1 0 5 0 1 1 0 1 1 6 1 0 1 0 1 0
... View more
03-05-2021
05:26 PM
“BLUF: Looks like a TLS/cipher problem in addition to ca_bundel. I was able to connect without errors after specifying the ca_bundle file and explicitly specifying TLS version and ciphers.” I'd then modified inputs.conf [SSL]
cipherSuite = ecdhe-rsa-aes-128-gcm-sha-256 In addition, I'd added ca_bundel $splunk home dir%/etc/auth/ I am still getting SSL error. Any idea how to get around getting the input working?
... View more
Labels
02-25-2021
09:47 AM
Thank you for your response. Sry for the late response. I'll give a shot and get back to you.
... View more
02-19-2021
02:10 PM
index="wineventlog" sourcetype="script:installedapps"
| chart values(*) as * count by DisplayName
| fields DisplayName, DisplayVersion, host, count
| search DisplayName=*
| sort host, DisplayName How I can visual this in pie chart? I would like to show in pie chart with top 10 software and counts. Allow drill down to each of the software.
... View more
02-08-2021
03:42 PM
Could you update us on the dashboard?
... View more
02-08-2021
07:59 AM
Is there CIM for Software? I have different sources. ePO, ACAS, Windows add-on, and NIX add-on. Would like to using data model from CIM if possible? Here are the CIM I've already look at: https://docs.splunk.com/Documentation/CIM/4.18.0/User/Endpoint Endpoint Inventory Application State I've also searched Splunk Answers but, no quick results.
... View more
02-04-2021
04:20 AM
1 Karma
What's a good way to find user who logon to RDP with one user account then user another like privilege user account. I know the event code/id that need to be monitored.
Here are the event code/id:
EventCode=1146 OR EventCode=1147 OR EventCode=1148 OR EventCode=1149 OR EventCode=4624 OR EventCode=4625 OR EventCode=21 OR EventCode=22 OR EventCode=23 OR EventCode=24 OR EventCode=25 OR EventCode=39 OR EventCode=40 OR EventCode=4778 OR EventCode=4779 OR EventCode=4634 OR EventCode=4647 OR EventCode=9009
Here is the guy who documented the event id/code: https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
Which command would tell the story better? concurrency vs streamstats vs timechart or is it combination of concurrency and timechart or am I total off?
... View more
Labels
- Labels:
-
stats
-
timechart
-
transaction
-
tstats
02-02-2021
05:39 PM
Here is the regex to extract message_type based on CIM. Could anyone make this faster than 1387 steps? https://regex101.com/r/dHbs4i/1 (?P<message_type>[^.]query|response)\: Here is the sample syslog for DNS. Feb 3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 26818 from 10.130.27.34#13258: view none: query: a-grv-gocdzace.g.ae3.dns.mil IN A + (10.130.44.87%0)
Feb 3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 57035 to 10.130.27.34#13258: [NOERROR qr,aa,rd] response: a-grv-gocdzace.g.ae3.dns.mil
... View more
- Tags:
- regex
01-28-2021
07:37 AM
Could you provide little more details like which configuration file you change that on?
... View more
01-27-2021
10:13 AM
@to4kawa In reviewing your SPL. Look like I didn't provided enough information. I'd get the plugintext has field from a SPL search like so. index="tenable" sourcetype="tenable:sc:vuln" plugin_id=42760
| rex max_match=100 field=pluginText "\n+(?<software_name>[^[].*)\s\s\[version\s\d"
| rex max_match=100 field=pluginText "\s\s\[version\s(?<software_version>[^[]*.)\]"
| stats values(software_name) as software_name values(software_version) as software_version by dest I'd gave your SPL try to pipe the results with no luck. My SPL still is still elementary. Additional help would appreciated.
... View more
01-22-2021
10:00 AM
Here is what I've done. How to break out the results into individual software correctly in Splunk. Any tips could be helpful. Here is the regex being used for software_name and software_version. | rex max_match=100 field=pluginText "\n+(?<software_name>[^[].*)\s\s\[version\s\d"
| rex max_match=100 field=pluginText "\s\s\[version\s(?<software_version>[^[]*.)\]"
| stats values(software_name) as software_name values(software_version) as software_version by dest Here is the text being rex to field value. <plugin_output>
The following software are installed on the remote host :
McAfee Agent [version 5.6.6.232]
Mozilla Firefox 84.0.2 (x64 en-US) [version 84.0.2]
Mozilla Maintenance Service [version 84.0.2]
The following updates are installed :
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 :
KB2151757 [version 1] [installed on 3/23/2020]
KB2467173 [version 1] [installed on 3/23/2020]
KB2565063 [version 1] [installed on 9/10/2020]
KB982573 [version 1] [installed on 3/23/2020]
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 :
KB2151757 [version 1] [installed on 3/23/2020]
KB2467173 [version 1] [installed on 3/23/2020]
KB2565063 [version 1] [installed on 3/23/2020]
KB982573 [version 1] [installed on 3/23/2020]
</plugin_output> I want to break out the results to induvial line with the host repeated. But, I don't know where to start. I'd try mvexpan function but, it doesn't break out the correct pair of data.
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
01-21-2021
05:45 PM
1 Karma
Here is what I've done. How to break out the results into individual software correctly in Splunk. Any tips could be helpful. Here is the regex being used for software_name and software_version. | rex max_match=100 field=pluginText "\n+(?<software_name>[^[].*)\s\s\[version\s\d" | rex max_match=100 field=pluginText "\s\s\[version\s(?<software_version>[^[]*.)\]" | stats values(software_name) as software_name values(software_version) as software_version by dest I'd extracted the text has group of pairs.
... View more
12-07-2020
09:24 AM
I am noticing the something with those three source type. Did you resolve? sqlserver:locks - Performance Monitor sqlserver:latches - Performance Monitor sqlserver:sql_errors - Performance Monitor All the other Performance inputs are working correctly.
... View more
12-04-2020
07:52 AM
Have you made progress on this? Was it installing https://splunkbase.splunk.com/app/3719/ the solution? I'd also found this: https://www.splunk.com/en_us/blog/tips-and-tricks/serving-it-up-with-aws-and-splunk-aws-serverless-application-repository-now-available.html
... View more
10-25-2020
09:18 AM
"sourcetype=access_* status=200 action=purchase | chart dc(clientip) OVER date_hour BY categoryId usenull=f This search takes the purchase events and pipes it into the chart command. The dc() or distinct_count() function is used to count the number of unique visitors (characterized by the clientip field). This number is then charted over each hour of the day and broken out based on the category_id of the purchase. Also, because these are numeric values, the search uses the usenull=f argument to exclude fields that don't have a value."
... View more
10-20-2020
06:24 AM
Have made any progress? I am think of forwarding the syslog from the UAG doing this setup. https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/WS1-Secure-Email-Gateway/GUID-8EFA64BD-4727-4FCB-8756-45418BCBB508.html hoping: https://docs.splunk.com/Documentation/AddOns/released/VMW/Install parse data and line braking at lease. Use the following document to create sourcetypes. Syslog Formats and Events (vmware.com) Any feedback would be appreciated.
... View more
10-15-2020
09:10 AM
For those of you who run has splunk has service. You need to comment below. (for unix newbies) # assertInvokerIsSuperuser
... View more
08-19-2020
08:36 AM
1 Karma
Does anyone have a cheat sheet for btool to help newbies? Here is my version of btool cheat sheet: splunk btool <conf_file_prefix> <sub-cmd> <context> --debug "%search string%"
splunk show config <config file name> | grep -v "system\/default"
Step 1.
splunk btool inputs list --debug "%search string%" >> /tmp/splunk_inputs.txt
Step 2.
Import into excel using space as a separator.
Step 3. Use excel to filter feature to look for the settings Explanation: <conf_file_prefix>: props, inputs, outputs, transforms <sub-cmd>: list, display, user, dir <context>: --app=search "%serch string%": input the search you're looking for I'd prefer piping the command to "less" command. Splunk documents: https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport#btool https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/Usebtooltotroubleshootconfigurati... https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport External Site: https://splunkonbigdata.com/2018/10/03/splunk-btool/ Thanks, everyone who replied. I'd consolidated the information into the top page.
... View more
- Tags:
- btool
Labels
- Labels:
-
universal forwarder
06-19-2020
09:06 AM
I am using the rising column has event timestamp UTC and still getting the error. The previous version 3.2 worked by selecting a different date. This no longer works. Anything else that I can try other than call support.
... View more
05-13-2020
05:09 AM
Here is way to list all configuration via btool.
splunk btool indexes list --debug
... View more
05-05-2020
01:16 PM
LINE_BREAKER=([\r\n]+)time: worked for me.
... View more
04-24-2020
08:31 AM
@alacercogitatus Did you create app or modified the local\props.conf on the indexer for the solution?
... View more
04-23-2020
03:57 PM
Here is the search with rex. I am lost why it's not working to exact the user.
index=ldap sourcetype="ldap:audit"
| rex "\s\w{2}=\w\d(?<user>[^,]+)"
| stats count by user
Here is the event string:
time: 20200423225406
result: 0
changetype: modify
replace: lastLoginTime
lastLoginTime: 20200423225402Z
modifiersName: cn=g5-bdent,ou=srveauth,dc=june,dc=gov
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Friday
|
Karma from
