About DEAD_BEEF

DEAD_BEEF · ‎06-19-2019

The app requires that this be on port 20/21? I switched it to 2022 as you suggested but not seeing any messages in _internal anymore.

DEAD_BEEF · ‎06-18-2019

@LukeMurphey I updated the port to 2022 as you suggested and I'm not seeing the errors anymore. I ran the _internal search and there isn't anything new besides when it started the FTP server on the new port. I checked the index (main for now) and no data as of yet. What would you suggest I check next?

DEAD_BEEF · ‎06-18-2019

I'm trying to get logs from a remote system via SFTP. I read that the FTP Receiver app sets up a HF to act like a FTP server to retrieve files, monitor the log directory as an input, and send them to the indexers. I deployed the app to my HF and created a separate account to login to the HF (credentials matching the account to retrieve the FTP logs) and with all the various permissions from the README, but I'm just getting errors saying that the service could not start. The HF is running on RHEL 7.6 and the ftp service is enabled in firewalld. I tried telnet on 20 and 21 from another host in my environment to the HF and there was no route and then connection refused (respectively). In the Data Input > FTP > Port I tried both 20 and 21 with no success. Not sure what else I need to do to setup the app. @LukeMurphey =================UPDATE================= Changed port to 2022 and now no more errors. But not seeing any data either. What can I check next?

DEAD_BEEF · ‎06-17-2019

Documentation from Palo now breaks out each sourcetype into it's intended CIM datamodel.

DEAD_BEEF · ‎06-01-2019

for clarity, the path is: %splunk_home%/etc/apps/phantom/local/phantom.conf

DEAD_BEEF · ‎05-17-2019

@harsmarvania57 this was it! It was one of the users with the exact named search. Please change your response to an answer so I can accept. Thank you!

DEAD_BEEF · ‎05-16-2019

Just started getting this warning today. Configuration file settings may be duplicated in multiple apps: stanza="Notable - Events Over Time" conf_type="savedsearches" apps="SplunkEnterpriseSecuritySuite,SplunkEnterpriseSecuritySuite" Based on the message text, I thought that there is a search with the name Notable - Events Over Time that must be in savedsearches.conf twice. Unexpectedly, it is not in /local/savedsearches.conf at all. I checked the /default/savedsearches.conf and that stanza does not appear twice. I saw similar issues posted here and here but these don't seem to apply in this situation. [splunk@hostname apps]$ pwd /opt/splunk/etc/apps [splunk@hostname apps]$ find . -name savedsearches.conf | xargs grep -i "Notable - Events Over Time" ./SplunkEnterpriseSecuritySuite/default.old.20190319-222605/savedsearches.conf:[Notable - Events Over Time] ./SplunkEnterpriseSecuritySuite/default.old.20190319-222605/savedsearches.conf:[Notable - Events Over Time By Security Domain] ./SplunkEnterpriseSecuritySuite/default/savedsearches.conf:[Notable - Events Over Time] ./SplunkEnterpriseSecuritySuite/default/savedsearches.conf:[Notable - Events Over Time By Security Domain] [splunk@hostname apps]$ I don't see any duplicate or copy that's listed in the error message. Really puzzled... 2019-05-17 01:56:10,620+0000 WARNING pid=16225 tid=MainThread file=configuration_check.py:run:228 | status="completed" task="confcheck_es_correlationmigration" message="Configuration file settings may be duplicated in multiple apps: stanza="Notable - Events Over Time" conf_type="savedsearches" apps="SplunkEnterpriseSecuritySuite,SplunkEnterpriseSecuritySuite""

DEAD_BEEF · ‎05-09-2019

Hmm I'm not sure. I would 100% open up a case with support and see what they say. Your configs look right and that should def. be dropping those logs.

DEAD_BEEF · ‎05-09-2019

@richgalloway that worked perfectly! The docs on how to use the REGEX/DEST_KEY/FORMAT are not that great, your write-up makes much more sense. Thank you.

DEAD_BEEF · ‎05-08-2019

@richgalloway Please post your comment as an answer so I can accept it since it does explain why my FIELD_NAMES isn't working. I think I will have to use search time field extractions to get my data parsed (I don't see any other alternatives). Should be simple since it is comma separated.

DEAD_BEEF · ‎05-08-2019

Interesting solution, glad you figured it out!

DEAD_BEEF · ‎05-08-2019

@woodcock yes, the timestamp is in the date field (it follows my TIME_FORMAT entry). I already tried using TIMESTAMP_FIELDS = date but that messed everything up because I'm not using INDEXED_EXTRACTIONS . How can I set these up so everything is parsed?

DEAD_BEEF · ‎05-08-2019

Attempting to send a CSV file, but it's a bit messy. I need to remove some entries that aren't formatted correctly, delete the header row, and replace it with my own (hence FIELD_NAMES ). Data is on a UF and goes to my IDX. I'm not using INDEXED_EXTRACTIONS on the UF because the .csv file isn't clean/properly formatted, so I have my IDX doing the work. working - event breaking - removing improperly formatted entries - removed original header not working - my field names (nothing is parsed when searching, my FIELD_NAMES are missing). Based on this, I'm thinking that the old header isn't stripped until it reaches typingQueue ( TRANSFORMS ), but my FIELD_NAMES is trying to be applied at the aggQueue so it isn't working...but I'm not sure. How to fix this? UF inputs [monitor://C:\test\testfile_*.csv] index = main sourcetype = test crcSalt = <SOURCE> queue = parsingQueue disbled = 0 IDX props [test] SHOULD_LINEMERGE = false FIELD_NAMES = contentID,moduleName,levelName,date,loginID,last,first,var1,var2,var3,var4 FIELD_DELIMITER = , TIME_FORMAT = %F %T.%3Q TZ = UTC TRANSFORMS-null_hdr_and_nonevt = del_hdr,del_nonevt IDX transforms [del_hdr] REGEX = ^ContentID.* DEST_KEY = queue FORMAT = nullQueue [del_nonevt] REGEX = ^(?!\d+,).* DEST_KEY = queue FORMAT = nullQueue

DEAD_BEEF · ‎05-08-2019

@robjackon would you mind re-attaching the screenshots below. I would love to see the curl commands to pull this info. Thanks for the info!

DEAD_BEEF · ‎05-08-2019

@bimord did you find a solution?

DEAD_BEEF · ‎05-07-2019

Try modifying the regex again, use the following and don't forget to bounce the indexer for the new regex to take: REGEX=snmpd\[\d+\]:\sConnection\sfrom\sUDP:

DEAD_BEEF · ‎05-06-2019

Okay, just thinking. Check the UF and see if it was a full install or the UF install. This is really obvious via path name (/opt/splunk/... vs /opt/splunkforwarder/...) If it was a full install, you need to set it so it only functions as a forwarder.

DEAD_BEEF · ‎05-06-2019

Hi @tom_frotscher ! I think I understand it better now. If I use INDEXED_EXTRACTIONS on my UF, then that will override any props on my indexer. The problem is that my file is JSON format, but it has a non-standard header and footer that I will need to delete via SEDCMD before it's JSON "proper". The UF can't use transforms to clean that up. Based on what you said, if I were to use INDEXED_EXTRACTIONS on my UF, it may not work because my data isn't JSON-proper (yet). I believe the solution will be then to just do everything on the indexer (no INDEXED_EXTRACTIONS since I have my own line_breaker), then use KV_MODE=JSON on the SH. Does that solution make sense or am I off base on this?

DEAD_BEEF · ‎05-06-2019

Everything looks right imo. The only thing I can think of to try is make the regex even more specific (regex match visible here). Also, to be clear, this will only change future data, it will not eliminate/delete any existing logs that inadvertently were put into your index. This isn't a retroactive fix. REGEX = ^\w+ \d+ \d+:\d+:\d+ \w+ snmpd\[\d+\]: Connection from UDP:

DEAD_BEEF · ‎05-05-2019

@niketn may have some insight on this. Okay, I think I fully understand now. Depending on which line and datapoint they click on, you want to pull the URL from change_link. You need to set a variable (url) based on what they click on to extract the change_link. Then use this variable in the link_target. I'm not exactly sure how to set the variable, so you'll have to do some reading, but you can pull the url from a nested json via the spath command. You need to figure out how to set a token based on what they clicked on using spath to extract the change_link. Then you use that token as your link_target. Here are some resources: spath - see nested array, spath with eval, predefined chart tokens, conditional linking, conditional matching. <drilldown> <set token="url">| eval url=spath(_raw, "Analyze.$click.value${}.change_link")</set> <link target="_blank">$url$</link> </drilldown>

DEAD_BEEF · ‎05-05-2019

Why don't you put all these details in your initial question? You didn't specify that you needed conditional matches, you didn't state that you needed dynamic links. These are all important details that keep people from helping. Anyway, you can read up on how to use conditional matches here (look at chart tokens). This uses the name of the series to determine where the external URL <drilldown> <condition match="$click.name2$=="Investigate""> <link target="_blank">https://www.google.com</link> </condition> <condition match="$click.name2$=="Screen""> <link target="_blank">https://www.yahoo.com</link> </condition>

DEAD_BEEF · ‎05-05-2019

Okay, I understand. Once you have the visualization done, what are the names of your series? What does the legend say? Is it Investigate , Review , and Screen ? I only see 3 names in your search but 4 lines in your screenshot. You can upload an image directly to splunk answers (no need for external site).

DEAD_BEEF · ‎05-05-2019

@isplunk2999 If you made the changes I suggested, then when you click on any of the lines in your graph, it will automatically open a new browser window and navigate to the link you specified.

DEAD_BEEF · ‎05-05-2019

Easiest way is to simply edit the Drilldown and edit the "On Click" action. Alternatively, you can edit the xml. Please accept as answer if this is the solution for future readers. </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> ... ... <option name="trellis.size">medium</option> <drilldown> <link target="_blank">https://yourURL.com</link> </drilldown> </chart>

DEAD_BEEF · ‎05-05-2019

As you noted, a UF cannot utilize a transforms to dump to nullQueue. So you need to monitor the data with a UF and then send it to your indexer for parsing. One thing that looks odd is that in your props.conf you have [source.... which is odd because that would imply the logs are on your indexer themselves (based on the path) which makes me wonder why you have a UF. Instead, I presume you already have the sourcetype declared by your UF's inputs.conf , so on the IDX props you should just have [your_sourcetype] instead. If this works, please accept this as the answer. UF inputs.conf [monitor://...path_to_logs] index = my_index sourcetype = my_sourcetype IDX props.conf [my_sourcetype] TRANSFORMS-dump_snmpd = snmpdSetNull IDX transforms.conf [snmpdSetNull] REGEX = snmpd\[\d+\]: Connection from UDP: DEST_KEY = queue FORMAT = nullQueue And from the inputs, transforms, and props docs, you will need to restart splunk service # To use one or more of these configurations, copy the configuration block # into transforms.conf in $SPLUNK_HOME/etc/system/local/. You must restart # Splunk to enable configurations

Posts	251
Solutions	11
Karma Given	158
Karma Received	54
Member Since	‎08-14-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to create an area chart that displays an avera...

Stats count by when field exists, otherwise use an...

How to truncate the number of results in my table?

Splunk inputs and whitelists --- how to?

Multi-site Indexer rolling restart - indexer fails...

Volume configuration will not manage space used by...

How to estimate indexer data replication time from...

Field extractions for my app not showing up in sea...

How to field extract one or more times to the same...

Scripted input permission denied

Re: FTP Receiver app Troubleshooting

Re: FTP Receiver app Troubleshooting

FTP Receiver app Troubleshooting

Re: CIM datamodel mapping for PaloAlto threat (inc...

Re: Phantom App for Splunk: Why is there Error loa...

Re: Splunk ES - Configuration file settings may be...

Splunk ES - Configuration file settings may be dup...

Re: Splunk Light and Universal Forwarder: nullQueu...

Re: Why aren't FIELD_NAMES being applied?

Re: Why aren't FIELD_NAMES being applied?

Re: Why is my blacklist being so greedy when going...

Re: Why aren't FIELD_NAMES being applied?

Why aren't FIELD_NAMES being applied?

Re: Splunk ES 4.7.6 - How do we track active inves...

Re: Why is my blacklist being so greedy when going...

Re: Splunk Light and Universal Forwarder: nullQueu...

Re: Splunk Light and Universal Forwarder: nullQueu...

Re: Which props go where when indexing json?

Re: Splunk Light and Universal Forwarder: nullQueu...

Re: How to redirect to a URL when clicked on the c...

Re: How to redirect to a URL when clicked on the c...

Re: How to redirect to a URL when clicked on the c...

Re: How to redirect to a URL when clicked on the c...

Re: How to redirect to a URL when clicked on the c...

Re: Splunk Light and Universal Forwarder: nullQueu...

Join the Conversation