Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About khanlarloo
khanlarloo
Explorer
Member since:
06-02-2017
05-18-2022
Community Statistics
| Posts | 119 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 06-02-2017 |
Activity Feed
- Posted Re: Route and filter data on Getting Data In. 05-17-2022 10:00 PM
- Posted Re: Route and filter data on Getting Data In. 04-11-2022 12:58 AM
- Posted Re: Route and filter data on Getting Data In. 04-11-2022 12:37 AM
- Posted Re: Route and filter data on Getting Data In. 04-10-2022 10:30 PM
- Posted Re: Route and filter data on Getting Data In. 04-03-2022 03:28 AM
- Posted Is it possible to filter specific field values in indexers without HeavyForwarder in indexer cluster ? on Getting Data In. 04-03-2022 01:17 AM
- Posted Re: two search result at the same time on Splunk Search. 01-31-2022 03:15 AM
- Posted Re: two search result at the same time on Splunk Search. 01-31-2022 03:09 AM
- Posted two search result at the same time on Splunk Search. 01-31-2022 02:48 AM
- Posted hidden user in users on Security. 09-26-2021 02:18 AM
- Posted Re: data model field extraction on Splunk Enterprise. 07-31-2021 05:33 AM
- Posted data model field extraction on Splunk Enterprise. 07-20-2021 01:49 AM
- Karma Re: How can I index Netflow logs? for nickhills. 06-05-2020 12:49 AM
- Karma Re: add icon to app for niketn. 06-05-2020 12:49 AM
- Karma Re: Can we use regex for counting fields? for 493669. 06-05-2020 12:49 AM
- Posted Re: extract json files fields on Splunk Search. 05-26-2020 11:54 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 08:10 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 08:06 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 03:38 AM
- Posted Re: Different sourcetype with one hostname on Getting Data In. 05-19-2020 01:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-09-2018
11:35 PM
i want to install sql app splunk but i cant fine any documentation about it, can you help me how can i set up this app ?
... View more
09-02-2018
06:49 AM
we install this app for forigate firewall,but we need fortiweb (web application firewall)
... View more
09-02-2018
06:31 AM
i check.my problem solved. i didn't map LDAP groups to splunk roles.
... View more
09-02-2018
06:26 AM
We have fortiweb but Splunk doesn't have any app for fortiweb.
can some one help me make a report from logs of my fortiweb?
thank you
... View more
- Tags:
- splunk-enterprise
08-29-2018
07:08 AM
i installed my splunk in linux, i have 2 HF and one indexer all of them are linux based.
i want to login to my indexer with domain user. I configure LDAP in my indexer and it is ok. My user has administrator privileges. i have one problem i can not login with my domain user on indexer. Can you tell me what my problem is?
all the configuration for LDAP are correct.
... View more
08-26-2018
04:07 AM
here is my event
Aug 26 13:57:02 192.168.X.3 date=2018-08-26 time=13:51:33 devname="FGT-Lab" devid="FGT" logid="0001000014" type="traffic" subtype="local" level="notice" vd="root" eventtime=1535275293 srcip=192.168.X.100 srcport=18730 srcintf="wan1" srcintfrole="wan" dstip=192.168.X.3 dstport=8443 dstintf="root" dstintfrole="undefined" sessionid=5399 proto=6 action="close" policyid=1 policytype="local-in-policy" service="tcp/8443" dstcountry="Reserved" srccountry="Reserved" trandisp="noop" app="Web Management(HTTPS)" duration=3 sentbyte=5166 rcvdbyte=204729 sentpkt=81 rcvdpkt=150 appcat="unscanned"
... View more
08-26-2018
03:15 AM
i try this but it doesn't work,when i do this i don't receive any logs
... View more
08-25-2018
11:08 PM
i want my HF send specific field to my receiver and count the number of different strings,i configure props.conf and transforms.conf but it doesn't work,
i hav field named action=deny i want to send just this field to my receiver,and it count this field.
[setnull]
REGEX = .*
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = action=deny
DEST_KEY = queue
FORMAT = indexQueue
... View more
08-25-2018
02:38 AM
if i want to search base on host name how can i write the regex format?
host="12.13.2.1"
host="2.1.1.4"
... View more
08-25-2018
12:31 AM
Hi
I have one question, is it possible to count the number of event in regex format for writing in transforms.conf?
... View more
08-19-2018
08:49 PM
i have one HF and i want to send specific field from my HF to receiver.
the field in my HF is action and i want HF just send field action=block to my receiver.
... View more
08-18-2018
11:42 AM
i have problem when i do this i don't receive any logs from my device in forwarder
where is my mistake? is this configuration right?
... View more
08-18-2018
04:04 AM
i need only recieve events with action=blocked from farwrders,
my logs are :
Aug 18 12:56:13 192.168.X.X date=2018-08-18 time=12:50:36 devname="XXX" logid="0001000014" type="traffic" subtype="local" level="notice" vd="root" eventtime=1534580436 srcip=192.168.x.x srcname="SPLUNK" srcport=138 srcintf="internal" srcintfrole="lan" dstip=192.168.x.x dstport=138 dstintf=unknown-0 dstintfrole="undefined" sessionid=76899473 proto=17 action="deny" policyid=0 policytype="local-in-policy" service="udp/138" dstcountry="Reserved"
i config my props.conf:
[host::192.168.X.X]
TRANSFORMS-null= setnull,setparsing
and transforms.conf
[setnull]
REGEX = .*
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = (?m)^action=(blocked)
DEST_KEY = queue
FORMAT = indexQueue
but when i do this forwarder doesn't receive any logs from my device,can you tell me where is my mistake?
... View more
- Tags:
- splunk-enterprise
07-10-2018
04:50 AM
no both of them send their logs to the same sourcetype and index
... View more
07-10-2018
04:01 AM
non of them
... View more
07-10-2018
04:01 AM
The second dc sends logs to splunk, i see the logs in data summary. but in the app i can't search.
... View more
07-09-2018
12:36 AM
hi
i install this app,it shows my active directory logs.i have two ad :
1 : adp1.lab1.com
2 : adp2.lab1.com
i want this app shows my 2 ad logs but it shows just one ad logs, i configure the second dc as my first. but the app shows just one dc logs.i rebuild the app after configuring my second dc.
but it shows just the first dc logs.
what should i do to receive the second one logs in my app?
... View more
07-06-2018
10:21 PM
Configure stream on a forwarder:
I installed stream app on Splunk HF and indexer, I want to send my routers netflow logs to indexer, I run set_permissions.sh on both of them and configure my streamfwd.conf on HF like this:
[
streamfwd]
logConfig = streamfwdlog.conf
port = 8889
netflowReceiver.0.ip = HF_ip
netflowReceiver.0.port = 9995
netflowReceiver.0.decoder = netflow
And on Indexer
[streamfwd]
logConfig = streamfwdlog.conf
port = 8889
netflowReceiver.0.ip = Indexer_ip
netflowReceiver.0.port = 9995
netflowReceiver.0.decoder = netflow
I configure my routers to send netflow logs to my HF port 9995
but I don't receive any logs from my routers.
Can you tell me what is my problem?
... View more
06-13-2018
02:13 AM
can you tell why my charts have no result?
... View more
06-13-2018
01:12 AM
my disk and memory working good i don't have any issue aboute these,i see my metrics
it shows this :
6-13-2018 11:23:14.931 +0430 INFO Metrics - group=queue, name=indexqueue, blocked=true, max_size_kb=500, current_size_kb=499, current_size=971, largest_size=971, smallest_size=971
... View more
06-13-2018
12:38 AM
no only one indexer,i have indexing overwie
it shows indexing rate that is 0 and the status that is normal, i don't have these items "Total Indexing Rate" and "Average Indexing Rate".
... View more
06-13-2018
12:04 AM
unfortunately it doesn't show any chart and is empty and it shows "no result found".
in Splunk Enterprise Data Pipeline every ques is 100.
index rate=0 status=normal fillratio=100
... View more
