Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About starcher
starcher
Influencer
Member since:
09-21-2012
4 weeks ago
Community Statistics
| Posts | 556 |
| Solutions | 106 |
| Karma Given | 106 |
| Karma Received | 285 |
| Member Since | 09-21-2012 |
Activity Feed
- Got Karma for Re: How to search for logon/logoff activity of domain admins. 12-18-2024 11:48 AM
- Got Karma for Re: Removing 1 IP from a threat Intel list without removing the entire list?. 11-13-2024 12:39 AM
- Got Karma for Re: Splunk Enterprise Security: https://s3.amazonaws.com/alexa-static/top-1m.csv.zip is no longer working. Is there a new source for this file?. 10-08-2024 10:20 PM
- Got Karma for Re: How to get Splunk Python on CentOS to use SSL/Crypto?. 08-01-2024 03:02 PM
- Got Karma for Re: Combining results from 2 indexes?. 07-04-2024 07:49 AM
- Got Karma for Re: What privileges does the splunk user need on Linux?. 10-02-2023 06:26 AM
- Got Karma for Re: KVStore Backup for Search Head. 03-15-2023 01:27 AM
- Got Karma for Re: Can you help with an Issue merging identities from two lookup tables in Enterprise Security?. 02-21-2023 02:42 AM
- Posted Re: How to stop searching when first result was found in each index in multisearch on Splunk Search. 02-08-2023 06:00 AM
- Got Karma for Re: How to Normalize the IPs in lookup table which is in CIDR notation ?. 01-17-2023 12:40 PM
- Got Karma for Re: How to Normalize the IPs in lookup table which is in CIDR notation ?. 01-17-2023 04:08 AM
- Got Karma for Re: lookup in suppression search. 12-27-2022 05:18 AM
- Got Karma for Golang execute Splunk search. 12-25-2022 04:56 PM
- Posted Golang execute Splunk search on Splunk Enterprise. 12-25-2022 03:43 PM
- Tagged Golang execute Splunk search on Splunk Enterprise. 12-25-2022 03:43 PM
- Tagged Golang execute Splunk search on Splunk Enterprise. 12-25-2022 03:43 PM
- Posted Re: lookup in suppression search on Splunk Enterprise Security. 12-23-2022 09:40 AM
- Posted Re: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup on Dashboards & Visualizations. 12-19-2022 07:36 AM
- Posted Re: How to Normalize the IPs in lookup table which is in CIDR notation ? on Splunk Search. 12-19-2022 05:34 AM
- Posted Re: I would like to use lookup table to make a filter on Splunk Search. 12-16-2022 08:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 3 | |||
| 2 | |||
| 2 | |||
| 1 | |||
| 3 | |||
| 2 | |||
| 3 | |||
| 3 |
07-28-2016
01:38 PM
It is also a good idea if you have large lookups you treat as scratch to blacklist from replication a naming scheme like temp_. Then name any lookups that are large and have no real need to go to the indexers start with that prefix. I run into this a lot when manipulating large asset tables.
... View more
04-12-2016
07:08 AM
1 Karma
Do you have transparent huge pages disabled on the systems?
... View more
04-11-2016
05:06 PM
1 Karma
If using ES I would target more to 70-80GB/day per indexer. On 6.3+ I would definitely add more HFs with an input pipeline of 2 in front of your indexers. Then do the same pipeline improvement on the indexers once you get more HFs added. You might also consider forcing time based load balancing from the HFs to the Indexers.
... View more
03-14-2016
06:05 PM
1 Karma
Use this diff to patch for the above changes if you do not want to do it by hand.
*** old/bin/levenshtein.py 2014-11-11 14:49:21.000000000 -0600
--- new/bin/levenshtein.py 2016-03-14 20:01:06.000000000 -0500
***************
*** 27,33 ****
results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
for r in results:
! if "_raw" in r:
if command=="ratio":
ratio=Levenshtein.ratio(r[string1], r[string2])
r["ratio"]=ratio
--- 27,33 ----
results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
for r in results:
! if string1 in r and string2 in r:
if command=="ratio":
ratio=Levenshtein.ratio(r[string1], r[string2])
r["ratio"]=ratio
diff -rc old/default/commands.conf new/default/commands.conf
*** old/default/commands.conf 2014-11-05 12:44:12.000000000 -0600
--- new/default/commands.conf 2016-03-14 20:01:44.000000000 -0500
***************
*** 1,2 ****
--- 1,4 ----
[levenshtein]
filename=levenshtein.py
+ retainsevents=true
+ streaming=true
... View more
03-14-2016
05:24 PM
2 Karma
The following changes will make the command work reliably in a larger environment.
Fix to allow tstats to work with the command:
Edit line 30 in the levenshtein.py in bin: replace the if '_raw' in r with the following.
if string1 in r and string2 in r:
Add to commands.conf:
retainsevents=true
streaming=true
If you make the above changes you will be able to use the command with tstats across data models like the Network Resolution for DNS queries. This will perform much faster due to accelerated data models over normal SPL index=... sourcetype=... type searches.
... View more
03-10-2016
11:51 AM
1 Karma
For current versions of Splunk I would recommend using KV store based lookups which can easily be maintained via the REST API.
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG
And it has the benefit that if you are using Search Head Clustering the KV Store itself handles the replication of the changes for all nodes.
... View more
02-23-2016
06:27 AM
That is correct, you have to allow traffic to services you wish to reach. I'll put a note in the readme next time I touch that project. And I'll try to do that update in a week or so. Thanks!
... View more
12-03-2015
08:30 AM
You might go through this as reference.
http://www.georgestarcher.com/wp-content/uploads/2015/09/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf
... View more
11-03-2015
11:45 AM
Yup that is me. That code is represented in the repo. Though I do need to redo all this in the new alert framework as mentioned by frobinson above in the comments. [email protected] will reach me.
... View more
11-03-2015
11:41 AM
You can use my code as a model/base. It is MIT license so you are free to use it how you wish. With the only restriction of don't blame me if you don't like it 😃
... View more
11-03-2015
11:31 AM
You can always make your own python code and send in the results in a table csv for it to act on. Similar to what I do here: https://github.com/georgestarcher/Splunk-Alert/tree/master/XARF Not GUI simple but works.
... View more
11-02-2015
12:31 PM
They mentioned at conf that the Web UI was not updated yet for it. It will require a support ticket. One of the Splunk folks will have to reply on how to open a ticket for a trial account.
... View more
11-02-2015
11:27 AM
2 Karma
If you send to ouputlookup fronting a csv the cluster will replicate it. But the idea for state is to use KVstore. That is why it was added. KVStore is mongoDB and handles replication on it's own across the cluster members. It also lets you update just the records that need updating more efficiently than doing it with a csv based lookup. http://www.georgestarcher.com/wp-content/uploads/2015/09/conf2015-LookupTalk.pdf
... View more
11-02-2015
11:20 AM
2 Karma
You could make a custom search command to get your external data then pipe to outputlookup. Schedule that search. The cluster will then replicate that updated lookup across members when it is refreshed.
... View more
No problem.
... View more
07-23-2015
02:34 PM
4 Karma
Technically the SHC cluster replication function is not handling the KV store. The KV store captain is coordinating that. Which could be any node in the SHC. Technically KV store is mongoDB.
... View more
07-23-2015
01:18 PM
1 Karma
Is there any method for determining the KV captain? I have yet to find it. Maybe an undocumented rest api call or cli command? Best I understand it, the members delegate their writes to the captain so I expect they cache them while a new one is elected.
... View more
05-06-2015
07:20 PM
Splunk search time order of operations handles eval prior to lookup. You cannot really change that unfortunately. You might could make an external lookup command script that does the calculation and the lookup and returns the result you want for the new field.
... View more
05-06-2015
07:09 PM
1 Karma
You need to make your own certificates with another CA if you want to use custom CN etc information. That is the default Splunk SSL certificate. These slides might help. http://www.georgestarcher.com/wp-content/uploads/2014/11/Nashville-UG-Splunk-SSL-Presentation.pdf
... View more
03-27-2015
09:51 AM
1 Karma
What you need is in the Splunk documentation at http://docs.splunk.com/Documentation/Splunk/latest/Security/Aboutsecuringdatafromforwarders
... View more
You can get the old login.css modification to work . But you have to start Splunk in legacy mode as you would if you want the Duo Two Factor authentication login plugin to work. http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/StartSplunk#Start_Splunk_Enterprise_on_Unix_in_legacy_mode
... View more
02-04-2015
06:50 PM
3 Karma
I posted my thoughts on this whole topic of syslog and Splunk here: http://www.georgestarcher.com/splunk-success-with-syslog/
... View more
Actual built in mail notifications to a splunk admin would be useful instead of having to log in to find out there are issues. Searches against index=_internal still work and just the right search might be able to send such an alert even if searching is down due to number of violations. I would have to play with it to come up with a specific search.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
4 weeks ago
|
Karma given to
| User | Karma Count |
|---|---|
| 7 | |
| 1 | |
| 2 | |
| 10 | |
| 1 |
