About coreyf311

coreyf311 · ‎06-18-2018

collecting windows logs using evtsys and forwarding to a syslog server. I have a UF installed on the universal forwarder reading the windows logs created by evtsys. I have tried using sourcetype=WinEventLog:Security but the logs do not match what I see in the samples directory from the Splunk_TA_windows apps so these events are not extracted per the app. Is there a TA or sourcetype i can use to get evtsys logs parsed correclty? trying to avoid a custom props/transforms from scratch to parse all this data.

coreyf311 · ‎06-18-2018

a simple read of the inputs.conf spec gave me the answer 🙂 Thanks!

coreyf311 · ‎06-18-2018

the current sources are /var/log/LOGCENTRAL/Windows/hostname/hostname.log. This obviously varies as there are many hosts writing logs. My props is now [source::/var/log/LOGCENTRAL/Windows/...] and thats not working either.

coreyf311 · ‎06-18-2018

I would prefer to set source as part of the inputs.conf Can I override the source in inputs.conf?

coreyf311 · ‎06-18-2018

I have the below configured but source is not being over written. I am trying to wild card anything after Windows in the path. props.conf [source::/var/log/Windows/*] TRANSFORMS-changesource=changesource transforms.conf [changesource] FORMAT= source::WinEventLog:Security DEST_KEY=MetaData:Source I have it deployed to my heavy forwarder. It's not working there. I am also curious if I can deploy something like this to a Universal Forwarder after I am sure the syntax is correct?

coreyf311 · ‎05-01-2018

At index time is what i am looking for in this case. The source is gmetad but we dont have access to the source at the host level. Only to the aggregate points of the data. There are multiple aggregation points each handling a couple thousand hosts. Managing at the source would be a nightmare, there are thousands of hosts per aggregation. We maintain this hostlist.csv (in splunk) which contains all the hosts. It would be easier from a management perspective to do it at index time as this would be an aggregation point of all the hosts. I realize this might be a slow down of indexing this data, we are testing right now. Maybe its worth it, maybe its not.

coreyf311 · ‎05-01-2018

thanks, that's what I am doing now to get by. Is there anything that could be done with external_cmd in transforms to accomplish this?

coreyf311 · ‎05-01-2018

I cant provide screen shots or example data. The basics are, I am trying to create a dimension called "servergroup" in my metric store using a lookup to compare the host field to. Each host in this "hostlist.csv" has a field called "servergroup". So a host is member of a "servergroup". Lets say there are 4 groups, servergroupA, servergroupB, etc. Using the provided example, lookup the host in the hostlist.csv and output the hosts "servergroup" into the "servergroup" dimension in our metrics store. This is easy in a regular index. How do I do this for a Metrics Store?

coreyf311 · ‎04-30-2018

In our non metrics indexes we use props to create a field at search time. This field is used to create role based security. If you have access to "servergroupA" then your role is restricted to servergroup=servergroupA. How can we apply the same logic to a metric store? Applying this in props.conf does not create the servergroup field. My understanding is that we need to create dimensions for everything NOT a metric in transforms.conf using REGEX. Which we are currently doing. LOOKUP-HOST-LIST = hostlist.csv host OUTPUTNEW servergroup as servergroup

coreyf311 · ‎04-16-2018

there are tsidx files but none are related to the DM's. Also, on a stand alone test server of the same version. I can see the DM stats but it does not have any tsidx files associated to the DM's either.

coreyf311 · ‎04-14-2018

I dont have infront of me but imagine they are there? We can search the data models fine from SH’s.

coreyf311 · ‎04-14-2018

I did use allow_old_summaries and it works for the user. Not sure what that does exactly thats different and why summariesonly doesnt work for that user.

coreyf311 · ‎04-13-2018

as admin i can see results running a tstats summariesonly=t search. Same search run as a user returns no results. As that same user, if I remove the summariesonly=t option, and just run a tstats...... search that user can return results. The Datamodel has everyone read and admin write permissions.

coreyf311 · ‎04-13-2018

We are at version 7.0.2. On our SH's, when we enable acceleration on a Datamodel we are not seeing the acceleration statistics. No build status, no access count, no size on disk, range, buckets, etc. This is on our Search head cluster as well on our stand alone SH we use for testing and admin purposes.

coreyf311 · ‎04-13-2018

we have majority. The SHC in total is 6 SH's. So we currently have 4 SH's up and available and 2 that are down and unavailable.

coreyf311 · ‎04-12-2018

does not work because the member i am trying to remove is not available. its down due to a power outage in the DC it is hosted.

coreyf311 · ‎04-12-2018

How can I remove a search head cluster member when that member is down? Power outage at a location took down two of our search head cluster members for a week. I cant push bundles from the Deployer while these two are down. How can I remove them from the cluster while they are down so that the rest of the cluster can operate as intended?

coreyf311 · ‎03-08-2018

I implemented the config using [source::splunktcp:port]. per the config in the link. No joy. With my HF set to forward and not index a copy, I get nothing on my indexing tier. With my HF set to store a copy and forward I get messages on my HF for unknown indexes.

coreyf311 · ‎03-08-2018

did this work using splunktcp:port? I am trying to use this same config to rename index using source::splunktcp:port and it is not working.

coreyf311 · ‎03-07-2018

We are receiving data from an external splunk instance. They have indexes A,B,C. When our indexers receive there data it cannot be indexed because we have indexes D,E,F. How can I rename the index for the incoming data? I am monitoring splunktcp:9998 as all our in house data is sent to the default splunktcp:9997. I have the below in props and transforms on our HF as this data is passing through that box before hitting our indexing tier. Props [source::splunktcp:9998] TRANSFORMS-index = override-index-theirindex transforms [override-index-theirindex] SOURCE_KEY = _MetaData:Index REGEX = theirindex FORMAT = myindex DEST_KEY = _MetaData:Index

coreyf311 · ‎08-08-2017

how to create a workflow action to populate a macro? Use a workflow action to grab hostname/IP from event and pass that to a macro for later use in follow on searches.

coreyf311 · ‎08-03-2017

we create a lookup from the server list....that list is used against the host names that are sending logs to splunk. That part we have down.....can we create a workflow in the dashboard that would remove a specific host from counting against the host checking count? We can't remove it from the lookup because that gets updated every night anyway via script.......unless some logic would tell it to NOT re-add that host back into the lookup? Maybe create a separate lookup with just the removed hostnames (bad_hostnames), run our nightly script and update good_hostnames and compare the two lookups and only add hostnames that are NOT in the bad_hostnames lookup?

coreyf311 · ‎08-03-2017

It lists ever IP'd device which is not always a device required to send splunk it logs. We just use it to create the lookup to work off of every night. We need to know what servers are reporting and which server are not so they can be looked at. Along with that reporting are false positives in that, an HP cluster with ilo connections that are IP'd and on the server list do not individually report to splunk. In that scenario the percentage is thrown off. The user/group responsible can look at there dashboard and check these non-reporting devices. And an even deeper quesiton, can we add something that allows a user to "temporarily" mark something as not reporting. Some groups could add 50 servers to the list, we do our nightly update to the lookup that then adds these 50 servers to the list and in one night the numbers are WAY down for that groups compliance. They can then mark those servers as "offline" or something for say 30 or 90 days or until the logs start hitting splunk then they are added back into the fold and countad against the reporting numbers.

coreyf311 · ‎08-03-2017

do they appear with the same hostname/IP but different client name? You might have more then one splunkd instance running on those UF's.

coreyf311 · ‎08-03-2017

We have a dashboard that shows the number of servers that are reporting to splunk. This is to maintain a count, weekly, of whats checked in and what has not. We compare whats in splunk to whats in our "approved server list" and DNS. sometimes they do not match or the list is ahead of the servers checking in to splunk. A group may add 50 servers to the approved list but dont actually stand them up for another 90 days. These kinds of things can make the number skew widley at times. We are looking for a way for users to look at the list of servers for their group that have checked in and be able to mark a device as "false" for ilo's and such or something like that so that it will not count against the overall number. Or even be able to add a time (ie 90 days) so that its notated but it also will not count against the check in numbers. We could put this into a summary index or something?

Posts	51
Solutions	2
Karma Given	3
Karma Received	3
Member Since	‎08-03-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Dark-Mode not working after upgrade

Single Value Radial Gauge

running smartctl as non root

splunk connect for Kubernetes

internal documentation links

Netflow timestamps are wrong after 7.2.3 upgrade

Where can I set the read-ahead per the following w...

kvstore value of 256 out of range

Can you help me set up conditional token using row...

Bundle replication response code 500

evtsys to syslog for windows events

Re: How to override the props source?

Re: How to override the props source?

Re: How to override the props source?

How to override the props source?

Re: Metrics props and transforms

Re: Metrics props and transforms

Re: Metrics props and transforms

Metrics props and transforms

Re: Why are datamodel acceleration statistics miss...

Re: Why are datamodel acceleration statistics miss...

Re: tstats summariesonly=t

tstats summariesonly=t

Why are datamodel acceleration statistics missing ...

Re: Search Head Cluster member removal

Re: Search Head Cluster member removal

Search Head Cluster member removal

Re: How to rename index in data sent from another ...

Re: Reparsing cooked data coming from a heavy forw...

How to rename index in data sent from another splu...

workflow action to polpulate macro

Re: remove result from dashboard

Re: remove result from dashboard

Re: After an upgrade to latest splunk version to t...

remove result from dashboard

Join the Conversation