About kmorris_splunk

kmorris_splunk · ‎05-30-2019

Just a little clarification. Are you trying to find events in the two sourcetypes, with the same user and that happened at or close to the same time?

kmorris_splunk · ‎05-30-2019

Try something like this: sourcetype=access_combined | stats count(eval(action="remove")) as remove_count count as all_count | eval remove_ratio_%=round(((remove_count/all_count)*100),0)

kmorris_splunk · ‎05-29-2019

Would something like the following work for you? [YOUR BASE SEARCH] | eventstats max(_time) as mylatest | where _time > mylatest-86400 The eventstats is calculating the latest time for the base search, which would be available in each event. You then filter where the _time of each event is within 24 hours of the last event you received.

kmorris_splunk · ‎05-16-2019

You are using TaskCategory as the field to compare for your transaction. This means you will never get Logon and Logoff in the same transaction. You would need to use a field that will have the same value for both the Logon and the Logoff events. You can do your startswith and endswith like this: startswith=(TaskCategory=Logoff) endswith=(TaskCategory=Logon)

kmorris_splunk · ‎04-19-2019

Just a bit of clarification: The indexer (or indexers, if you have multiples) does receive and index the data send to it by the Splunk Universal Forwarders. However, it is storing the data in compressed files on disk. Splunk does not have a structured schema like in a database. The data is not "forwarded" to the Search Head, though the Indexers will respond to search requests from the Search Head. To install an indexer, it is the same installation as a Search Head. Most of Splunk's components are installed this way. The difference comes with how they are configured (Search Head, Indexer, Deployment Server, etc...). Take a look at this link: https://docs.splunk.com/Documentation/MSExchange/3.5.1/DeployMSX/InstallaSplunkIndexer Both the forwarders and the Search Head will need to know the IP/host of the indexer(s). Here are some notes I have for setting up a distributed environment (quick and easy). I just realized my notes don't mention setting up the Indexer to listen on a port (port 9997 by default), but you can find that in the link above, under "Configure recieving" section. Hopefully this is helpful as you start to learn Splunk: Configuring a distibuted Splunk environment: * Install Indexers * Change default password on each Indexer (required for Search Head to connect) * Install Search Head * Install Licenses on Search Head (License Master) * Configure each Indexer as a License Slave * Settings > Licensing * Click Change to slave * Click Designate a different Splunk instance as the master license server radio button * Specify the IP/Hostname and Splunk management port (8089 by default) * Save * Establish connections from Search Head to all Search Peers. This is the key step. * Distributed search > Search peers > Add New * Specify the search peer, along with any authentication settings * Save * Install Universal Forwarders and configure to send to all Search Peers * Example Universal Forwarder outputs.conf [tcpout] defaultGroup = my_search_peers [tcpout:my_search_peers] server=10.10.10.1:9997,10.10.10.2:9997 autoLB = true * Forward internal SH data to the indexer tier. * Create indexes from SH on the indexers (search peers). Internal indexes will already exist, but indexes created by apps can be easily created by installing the apps on the indexers as well. * Set SH up to Forward to all Search Peers. * Example outputs.conf * # Turn off indexing on the search head [indexAndForward] index = false [tcpout] defaultGroup = my_search_peers forwardedindex.filter.disable = true indexAndForward = false [tcpout:my_search_peers] server=10.10.10.1:9997,10.10.10.2:9997 * autoLB = true

kmorris_splunk · ‎04-15-2019

If there isn't a Splunk Add-on for this source, you will need to teach Splunk what the fields are. This can be done via the GUI, which will update props.conf for you for that sourcetype. https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/FXSelectSamplestep You could also do it by manually editing the props.conf if you are more adventurous. https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles

kmorris_splunk · ‎04-15-2019

Here is a good blog post that might also be helpful: https://www.splunk.com/blog/2014/04/23/its-that-time-again.html

kmorris_splunk · ‎04-15-2019

You will want to use a custom datetime.xml file. Make a copy of the default datetime.xml and rename it. In the renamed copy, look for one of the existing definitions like _masheddate and copy the whole section. It will look something like the following: <define name="_masheddate3" extract="year, month, day"> <text><![CDATA[source::.*?/sampledata/\w+(\d{4})_(\d{2})_(\d{2})\.txt]]></text> </define> Change the extract= portion to reflect the components of the date and/or time that you will be pulling from the filename, in the order they exist. So your example might look something like: You will want to use a custom datetime.xml file. Make a copy of the default datetime.xml and rename it. In the renamed copy, look for one of the existing definitions like _masheddate and copy the whole section. It will look something like the following: <define name="_masheddate3" extract="year, month, day, hour, minute, second"> <text><![CDATA[source::.*?/yourpathgoeshere/(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})\.*\.txt]]></text> </define> You may have to play around with this to get the regex correct. I am just working off of an example I did a while back, that only had the date, not the time. But this should point you in the correct direction. The last bit you need to do is point at the custom datetime.xml in your props.conf file. [your_sourcetype_goes_here] BREAK_ONLY_BEFORE = \(\d{2}:\d{2}:\d{2}\.\d{5} DATETIME_CONFIG = /etc/system/local/datetime_yourcopy.xml NO_BINARY_CHECK = true category = Custom I hope this is helpful. If you run into problems, take a look at the documentation around datetime.xml.

kmorris_splunk · ‎04-09-2019

Take a look at this on Splunk's data pipeline: https://docs.splunk.com/Documentation/Splunk/7.2.5/Deploy/Datapipeline

kmorris_splunk · ‎04-03-2019

Try something like this: BASE SEARCH GOES HERE... | eval modifier=case(date_wday == "sunday", 0, date_wday == "monday", 1, date_wday == "tuesday", 2, date_wday == "wednesday", 3, date_wday == "thursday", 4, date_wday == "friday", 5, date_wday == "saturday", 6, 1=1, 0) | eval first_wday_date=_time - (modifier * 86400) | eval first_wday_date=strftime(first_wday_date, "%m/%d/%y") | table date_wday _time modifier first_wday_date This is assuming Sunday is the first day of your week. I wasn't sure if you wanted it to be Monday. If so, just mess with the modifiers (the amount of days to subtract from the current weekday, to get you to the beginning day of the week. This also assumes, you could go back into the previous month if the beginning of the week was not in the current month. In the image below, the table has the current day of the week, the current date, the modifier value, and the date of the first day of the week.

kmorris_splunk · ‎02-21-2019

Have you installed the Splunk Supporting Add-on for Active Directory? https://splunkbase.splunk.com/app/1151/

kmorris_splunk · ‎01-23-2019

Just a note, be sure to replace any placeholder IP addresses in these notes with the appropriate IPs in your environment.

kmorris_splunk · ‎01-23-2019

Here are some notes I had which will summarize the steps. Even though you will have just one indexer, this will be the same process. Install Indexers Change default password on each Indexer (required for Search Head to connect) Install Search Head Install Licenses on Search Head (License Master) Configure each Indexer as a License Slave Settings > Licensing Click Change to slave Click Designate a different Splunk instance as the master license server radio button Specify the IP/Hostname and Splunk management port (8089 by default) Save Establish connections from Search Head to all Search Peers. This is the key step. Distributed search > Search peers > Add New Specify the search peer, along with any authentication settings Save Install Universal Forwarders and configure to send to all Search Peers Example Universal Forwarder outputs.conf [tcpout] defaultGroup = my_search_peers [tcpout:my_search_peers] server=10.10.10.1:9997,10.10.10.2:9997 autoLB = true Forward internal SH data to the indexer tier. Create indexes from SH on the indexers (search peers). Internal indexes will already exist, but indexes created by apps can be easily created by installing the apps on the indexers as well. Set SH up to Forward to all Search Peers. Example outputs.conf Turn off indexing on the search head [indexAndForward] index = false [tcpout] defaultGroup = my_search_peers forwardedindex.filter.disable = true indexAndForward = false [tcpout:my_search_peers] server=10.10.10.1:9997,10.10.10.2:9997 autoLB = true Configuration via files: Change password from changeme to something else on the indexers: ./splunk edit user admin -password foo -role admin-auth admin:changeme Configure indexers as license slaves: https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/LicenserCLIcommands ./splunk edit licenser-localslave -master_uri 'https://master:8089' Add search peer to Search Head: splunk add search-server https://192.168.1.1:8089 -auth admin:password -remoteUsername admin -remotePassword passremote

kmorris_splunk · ‎01-10-2019

Can you provide a sample of each event? Is there a common value that helps you tie the "writing to database" to the "successfully completed"? You could possibly use transaction command but will need more info from you regarding the events?

kmorris_splunk · ‎01-09-2019

Try a subsearch, something like this: sourcetype=access_combined NOT [ search sourcetype=linux_secure | eval clientip=dest | fields clientip] If the fieldnames are the same in each source, you won't need to do the eval that I did in my subsearch. This search above will show all of the clientip field values, within the time frame that I am searching, where those ip addresses aren't in the linux_secure sourcetype in the dest field. I know this isn't specific to your data sources, but hopefully, you can extrapolate the concept to use in your search.

kmorris_splunk · ‎12-20-2018

Set your search to All Time, just in case there are timestamping issues. You can also click on the Data Summary which has host, source and sourcetype tabs where you can look at all of the values for each to see if you can see the values you are expecting for any of those metadata fields. Also, make sure you have no firewalls blocking the traffic. I'm making the assumption that you are already listening on port 9997 on your indexers as well.

kmorris_splunk · ‎12-20-2018

This is just in the cases where you would want to also collect the logs locally as well (on the indexer or search head). I know the docs are very unclear on this and it causes some confusion. You can use the Windows add-on on a Linux based SH, Indexer as well, just not for collecting data locally, for obvious reasons (no windows logs =D).

kmorris_splunk · ‎12-20-2018

Does the wincsl index exist? Also, not sure if this is a typo in your question, or if this is the way your inputs.conf looks, but sourcetype is spelled incorrectly It has two u's.

kmorris_splunk · ‎12-17-2018

@prakash007 is correct in his comment. I would caution you when filtering out data however. Sometimes we don't know what we don't know, so be careful to be very specific on your regex when filtering. I have seen several customers who have inadvertently filtered out things that they didn't intend to.

kmorris_splunk · ‎12-14-2018

First I would ask if you are getting multiple results in your search. Next I would ask if you are triggering the alert Once, or for each result. If for each result, are you seeing duplicate values for the results. For example if you want an alert for each CLIENTIPADDR, and you possible have 2 rows in your table with the same value for CLIENTIPADDR. If so, you could use dedup in your search or something. Have you tried throttling in the alert config?

kmorris_splunk · ‎12-09-2018

One solution might be to add a calculated field that contains the date that you want it searchable til. Then, in your role definition, create a search restriction, where the current time is less than or equal to that field.

kmorris_splunk · ‎12-09-2018

You can install the app through the GUI: Apps...Manage Apps...Install App from file. Or you can unzip it in $SPLUNK_HOME/etc/apps/ directory.

kmorris_splunk · ‎12-06-2018

Is the CSV file larger than 500MB? That is the limit when uploading via the GUI.

kmorris_splunk · ‎12-05-2018

I know this isn't addressing your question, but I wanted to share this since it may be a better option for receiving SNMP traps than the modular input. https://www.splunk.com/blog/2018/08/30/managing-snmp-traps-with-itsi-event-analytics.html

kmorris_splunk · ‎12-05-2018

Can you provide a little more detail on what you would like as the end result?

Posts	324
Solutions	49
Karma Given	27
Karma Received	113
Member Since	‎07-29-2014

Online Status	Offline
Date Last Visited	‎02-24-2021 02:01 PM

Re: How to create a search that compares the user ...

Re: Evaluating a custom formula in Splunk

Re: Can we fetch the last available data in an ind...

Re: Duration between Logoff and Logon

Re: How to set up splunk Indexer

Re: best practice for custom syslog field extracti...

Re: How to use the timestamp from a file name at i...

Re: How to use the timestamp from a file name at i...

Re: Where can I find information on when SPL parse...

Re: How can I convert week number to starting date...

Re: No Users in app for Windows Infrastructure

Re: Could you give me step-by-step instructions on...

Re: Could you give me step-by-step instructions on...

Re: How do I Search logs with two different logger...

Re: How do you write a query that lists events fro...

Re: windows application log files.

Re: Questions about Splunk_TA_windows

Re: windows application log files.

Re: How do I limit what kind of events go into Spl...

Re: How can I delete the following duplicate alert...

Re: To restrict searching on indexed data till a p...

Re: How do I add TrendMicro to Splunk?

Re: Why is the process bar getting stuck while upl...

Re: SNMP Modular input - Unable to read from custo...

Re: How do I combine data from two different sourc...

Join the Conversation