About kmorris_splunk

kmorris_splunk · ‎08-14-2018

You would just do that in the base search: index=events state!="COMPLETED" | transaction reference endswith="WAITING"

kmorris_splunk · ‎08-13-2018

Can you explain what you mean by "add the data from the cloud interface"? If you are trying to configure your Universal Forwarder to send data via the Cloud search head, this won't work. You need to configure your forwarder in your inputs.conf. If this is Windows, you should have been given the option during install to define what data you wanted to forward (System, Security, Application logs, perfmon metrics, etc...). You won't be able to configure your forwarders from your Splunk Cloud instance. You would need an on-premise Deployment Server to do that.

kmorris_splunk · ‎08-10-2018

Using the search provided by @niketnilay, you could use a timeline visualization to represent this. https://splunkbase.splunk.com/app/3120/

kmorris_splunk · ‎08-09-2018

Give this a try. I am assuming you want a line for each combination of src_ip, dest_ip, and threat_name based on your search above. By the way, you are missing a function in your stats command. Something like count, avg, min, max, etc... Either way, I created a field that concatenates the src_ip, dest_ip, and threat_name so you can get a line for each in a line graph for example. I hope this helps. index=xxx_paloalto sourcetype="pan:threat" type=threat (threat_name="SCAN: TCP Port Scan(8001)” OR threat_name=“SCAN: Host Sweep(8002)”) (src_zone!="Inet-WAN1" AND src_zone!="Inet-WAN2") (dest_zone!="Inet-WAN1" AND dest_zone!="Inet-WAN2") src_ip != xxx | eval byfield=src_ip . "," . dest_ip . "," . threat_name | bin _time span=1d | chart count over _time by byfield

kmorris_splunk · ‎08-09-2018

You can use DB Connect: http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseinputs DB Connect allows you to input data from a database, output to a table, or use data that resides in a database as a lookup without ingesting it. Typically, time-series data is a good candidate for ingestion.

kmorris_splunk · ‎08-09-2018

Try using multisearch. This isn't super fast, but it did the trick. I added an extra value to each list to play around with when there were multiple differences. | multisearch [ search source="result1.csv" NOT [ search index="scratchpad" sourcetype="results" source="result2.csv" | fields AVC_ID] | eval OneNotTwo=AVC_ID | fields OneNotTwo] [ search source="result2.csv" NOT [ search index="scratchpad" sourcetype="results" source="result1.csv" | fields AVC_ID] | eval TwoNotOne=AVC_ID | fields TwoNotOne] | stats values(OneNotTwo) as OneNotTwo values(TwoNotOne) as TwoNotOne

kmorris_splunk · ‎08-08-2018

I think this is just a question of how Splunk shows _time. Try something like this to see if it helps. <YOUR BASE SEARCH> | convert timeformat="%Y-%m-%d %H:%M:%S:%6N" ctime(_time) AS c_time | table c_time

kmorris_splunk · ‎08-08-2018

I would recommend downloading the free version of Splunk on your desktop/laptop and ingesting a sample of the log. This will allow you to analyze the log and play with it before pushing it to your production Splunk instance. This is assuming you already have Splunk in production. Either way, you can download Splunk from splunk.com and use it for free for up to 500MB of ingestion per day.

kmorris_splunk · ‎08-08-2018

Is hostname and eventcount being null a definite indication that this is the problem? Are there other scenarios where this might happen? If not, could you add that to the SPL of your alert so that it only alerts when hostname and event count are not NULL?

kmorris_splunk · ‎08-07-2018

Check out this blog post: https://www.splunk.com/blog/2013/05/15/sql-injection.html

kmorris_splunk · ‎08-03-2018

The data summary is summarizing all of the distinct host, source, and sourcetype values in the currently searchable data in Splunk. It is dynamically picking up new values for those metadata fields as data comes in.

kmorris_splunk · ‎08-03-2018

Search restrictions are applied at the role level. I don't believe there is a way to do this. At the role level, you could add a restriction filter specifying the indexers using the splunk_server field, but this will only be for that role. You also have to consider inheritance from other roles a user might have.

kmorris_splunk · ‎08-02-2018

If you are monitoring a file, something like this might work: <YOUR BASE SEARCH> | eval bytes=length(_raw) | stats sum(bytes) by source Since an ASCII character is 1 byte, and _raw represents an event, you can calculate per event, then sum by source, which should be representative of the log file the data came from. This is dependent upon the assumption that the entire file has been ingested.

kmorris_splunk · ‎08-02-2018

If a user has multiple roles that have default app set, it is alphabetical. For example, if i have a_role and b_role, the user will inherit the default app from a_role. If a user sets a default app at the user level, this will override any role based default app for that particular user.

kmorris_splunk · ‎08-01-2018

This app may be helpful: https://splunkbase.splunk.com/app/3506/#/details

kmorris_splunk · ‎07-31-2018

Take a look at this app. It might help you find a different visualization. https://splunkbase.splunk.com/app/1603/ Keep in mind though, it is important to start with the data set you have and then determine what visualizations fit that data set (amount of data points, information you are trying to convey). Too often someone wants to use a cool visualization but it isn't right for the story they are trying to tell.

kmorris_splunk · ‎07-31-2018

Take a look at the Splunk Dashboard Examples app: https://splunkbase.splunk.com/app/1603/ Under Single Value Elements section there are examples.

kmorris_splunk · ‎07-31-2018

You can also check out the following book (free PDF download): https://www.splunk.com/goto/book And the documentation: http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/CreateDashboards

kmorris_splunk · ‎07-31-2018

Here is a tutorial: https://www.splunk.com/en_us/resources/video.gzdGVpbzqfsrZ6zSHd2qbGhuXBhMrEME.html Also, check out the Splunk Dashboard Examples App on Splunkbase: https://splunkbase.splunk.com/app/1603/

kmorris_splunk · ‎07-31-2018

Take a look at this post. https://answers.splunk.com/answers/41648/linebreakingprocessor-truncating-line-because-limit-of-10000-has-been-exceeded.html

kmorris_splunk · ‎07-26-2018

Take a look at this post: https://answers.splunk.com/answers/377035/filter-on-saved-report.html

kmorris_splunk · ‎07-26-2018

Assuming I am understanding your request correctly, it sounds like you want to create a new field made up of a concatenation of other fields in the same event. If this is correct, try something like this: <YOUR BASE SEARCH> | eval X-Trace-ID=field1 . "-" . field2 . "-" field3 . "-" . field4 Not sure if you wanted the values separated or not, so I added the "-" between fields.

kmorris_splunk · ‎07-25-2018

Could it be that your user doesn't have the rights to see the indexes. Check to see that your user has a role that has access to the indexes.

kmorris_splunk · ‎07-25-2018

Can you clarify which fields exists already, and which fields you are trying to construct?

kmorris_splunk · ‎07-24-2018

If you are trying to ingest Windows Event Logs locally, where you have installed Splunk, you can can set it up through the GUI. Take a look here under the section titled, "Use Splunk Web to configure event log monitoring". If you want to ingest Windows Event Logs from a remote Windows machine, you will need to install a Universal Forwarder to collect and forward the data to your Splunk indexers. On the Windows version of the forwarder, it will prompt you for what you would like to monitor during installation (System, Security, Application logs, performance metrics). In this case, you will need to make sure of a few things: There are no firewalls blocking communication between the forwarder and the indexers. You need to configure Splunk to listen on port 9997 (default). see here As for file monitoring, you can take a look here at the docs. This is a deprecated functionality, meaning, it still works, but could potentially go away in future versions of Splunk Enterprise.

Posts	324
Solutions	49
Karma Given	27
Karma Received	113
Member Since	‎07-29-2014

Online Status	Offline
Date Last Visited	‎02-24-2021 02:01 PM

Re: Can you filter transactions that do not contai...

Re: I can't see my data

Re: How can I create a visual depiction of when a ...

Re: How can I do a graph with multiple data?

Re: Can we forward a specific table of a DB to Spl...

Re: how to compare two search results and display ...

Re: Splunk not storing time in milliseconds

Re: How to Analyse the application Logs before imp...

Re: I want to stop receiving alerts when indexing ...

Re: Is their an app for SQL injection search for s...

Re: How do I add and delete host in Data Summary f...

Re: How do I limit an app to only search one clust...

Re: Command to get the log size in bytes if there ...

Re: Change the default app for users with a given ...

Re: External command to add whois data to search s...

Re: which chart can replace pie chart with good vi...

Re: how to create trend showing increase or decrea...

Re: How to create a Splunk dashboard?

Re: How to create a Splunk dashboard?

Re: field extraction very long field

Re: Can Searches be shared between users viewing t...

Re: How to merge several fields from a log to one ...

Re: Search from web UI not working

Re: How to construct columns with the same data, a...

Re: How to use Splunk to monitor failed logins and...

Join the Conversation