About DaveSavage

DaveSavage · ‎01-10-2013

Don't you need to escape the dots vistasyslog? Point / dot is a metacharacter in regular expressions. Usually fixed ones are in quotes? I'll try sort the regex out unless somebody does it first...

DaveSavage · ‎01-10-2013

I like the sound of that, and concept sideview 😉 @Mary as you are fairly new to this, blitz through the Exploring Splunk (Splunk Query Language) manual then go play with the data. Quite quickly and with only a v small amount of effort you will have top numbers calling, those called, duration etc. Interested in cost, by department?! Next stop, reference a tariff table, extend your searches and pipe the results to graphs and tables. I appreciate that the sound of all this may have you running for the hills...but I suspect not. Myabe Call Loggers are dead. Think of the savings.

DaveSavage · ‎01-10-2013

Nicee ;-)...thanks LG

DaveSavage · ‎01-09-2013

Damn ...did I down vote something Drainy?! Was it me? I shouldn't feel qualified to have an opinion on this. I've been using a Kindle Fire recently to access the SplunkBase if away from a desktop, and have to say it has yielded some 'unpredictable results'! I know...don't blame the technology 😉

DaveSavage · ‎01-09-2013

...and this is unmissable 😉 http://www.youtube.com/watch?v=Yf5gTNiotnM

DaveSavage · ‎01-09-2013

Splunk tutorial: http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/WelcometotheSplunktutorial Exploring Splunk: http://www.splunk.com/goto/book a really good read.

DaveSavage · ‎01-09-2013

Mary - the good news is that this is possible. You would probably split the fields out (even using the GUI) to create a Regex, defining the field. Searches are easily constructed for ANumber etc. If volume isn't going to cause you a problem with your license (CDRs are big, I know) then you could index the lot. Defining a new index would be advisable. For Regex I'll post the links, ditto the tutorial if they are useful? Br D

DaveSavage · ‎01-08-2013

Re: 1, no we don't as our apps are proprietary and chatty enough already ;-), but you could embed log writes. Re 2: Understand your point but I would err on the side of logging everything (it's not like an alarm system where you would be wiped out with volume), license permitting. Inside Splunk your searches pull critical, error OR info pending your interest on the day. It's powerful. Re 3: You can do that. Depends on the type of app. Web based and IIS logs are well served already. There is also a lot of app support here in the community. I'd still keep them separate per the above.

DaveSavage · ‎01-08-2013

You could ask either Splunk Sales or a reseller direct for full feature comparisons....but I think you will find you are comparing apples and pears. Site Scope from HP like many remote monitoring systems can be agentless and report incidents...or threshold breaches through snmp and the MIBs. Splunk uses the source system's logs to provide a richer picture. For Incident Management / app performance you will be able to see performance over time, norms and other data. We use a remote monitoring tool AND Splunk. The latter provides a wider view and satisfies out security needs whereas the former wouldn't. Br Dave

DaveSavage · ‎01-08-2013

Which operating system Perlish? For Linux I believe the files go in $SPLUNK_HOME$\var\log\splunk

DaveSavage · ‎01-02-2013

drussel - are you using a light or standard forwarder? The latter can be intensive. What size is the box and cpu? Take a look at this - or other threads...useful info. http://splunk-base.splunk.com/answers/5400/high-cpu-usage-on-splunk-forwarder Br Dave

DaveSavage · ‎01-02-2013

Rob - didn't you ask this, and receive an answer before? See http://splunk-base.splunk.com/answers/66972/5-and-above-login-failures If you just want to parameterise that to within "authentication" AND "access" AND "failure" | dedup _time, user | table Workstation_Name, Failure_Reason, Logon_Type, user ad optionally add a WHERE count etc... Br Dave

DaveSavage · ‎01-02-2013

Yes, see your challenge, that's a fairly rigorous series of checks you are performing! kmeeks has covered all of the bases. I'd only add from recent experience: Access and roles - defined and limited not only within Splunk but from the OS / access layer Policy - both written (as say RMADS) and the Windows type (if that is your OS) Security Admin to guard for you, daily checks (per policy), security incident process for queries even if false positives Look at some other apps / plug ins. (UK)GPG13 has similar requirements to PCI by Eqalis. Not a plug, still a fair bit of work to deploy. Br 😉

DaveSavage · ‎01-02-2013

Thanks kmeeks - very elegant!

DaveSavage · ‎01-02-2013

A familiar challenge, at least to us. We implemented named people and a naming policy as the individual is responsible for their code of conduct. I would negotiate with the auditor around the use of IP addresses - yes, nice to have but of no use if they use a hot desk facility, remote in from home etc etc etc? Having said all that, there is a useful field Source_Network_Address on WinEventLog:Security 😉

DaveSavage · ‎12-31-2012

Pramodkumar, then in the spirit of support to others who may follow you in the same issue, even if self-inflicted (we all learn), post it here. It's a good community, and this will not be the last time you need help...trust me 😉 We all do.

DaveSavage · ‎12-31-2012

I'd encourage you to get familiar with the indexes in the system, and know where your data is coming from / going to. The default is main but if you are using a plug-in such as '*.nix' for example, you will find yourself addressing and searching across other indexes, OS in that case. If you are using forwarders then clearly either you, or someone chose where the data was to go to. If IIS is your need today, consider how you'd deal with Win Performance Data next week. You may have already thought this through, so forgive if that is the case. Good luck though.

DaveSavage · ‎12-31-2012

Sumanth_isac, Drainy has covered it all, so don't vote this response up, am merely closing off your question above. Your 'business requirement' or driving needs are to see just today's files, not previous ones. Well, Splunk does that very elegantly in the Search parameters as it is, plus if you save previous IIS logs then you can start getting cute looking for trends over time? Re which index name should you be looking at, well - the blanket delete all covers everything, but you may find over time that you no longer have that luxury i.e. there is other data in your system.

DaveSavage · ‎12-31-2012

Sumanth_isac, do you mean log files because Splunk doesn't delete or clean up old files, you have to write your own scripts for that. Are the old log files still around somewhere - and therefore being re-indexed again? Are you qualifying your statement splunk clean eventdata indexname?

DaveSavage · ‎12-28-2012

A. Export per jonuwz's answer also has a good following in Sideview, which I think you are considering, or Ayn directed you towards recently? See here for more controls: http://splunk-base.splunk.com/answers/39470/resultsactionbuttons-export-button-is-not-working-in-spluk-43

DaveSavage · ‎12-28-2012

Abhayneilam - good, that's progress. The manual suggests that there are no required params, and just 2 options. It depends what you need? Per the notes above it is clear that it will also do save, print and share as well as export. Knowing your prev q's on drop-downs, the editView option yields a an edit link to start an 'editing' view in a popup window for a saved search or report. Another optional param eventsView offers the user a 'view events' link to see returned events and to run a part of the search before any transforms. The ref is p219 of the Developer manual for more.

DaveSavage · ‎12-24-2012

Nice one !

DaveSavage · ‎12-24-2012

Abhayneilam - have you tried using ResultsActionButtons in your dashboard? It doesn't require any special parameteres, and should bring in your buttons (save and print as well).

DaveSavage · ‎12-18-2012

In addition - are you aware / happy with the various versions of 'performace' vs performance?

DaveSavage · ‎12-16-2012

You haven't thought about teaching this stuff have you Ayn?! 😉 Seriously. It seems we cannot live without regex or Rex, but I have yet to see a solid tutorial, or masterclass on the advanced stuff. Maybe I missed something, it happens. gskinner.com is very useful....but..

Posts	163
Solutions	5
Karma Given	52
Karma Received	51
Member Since	‎01-28-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Consistent error 500's on File and Directory new d...

Splunk v5 Forwarder

Re: Change source type

Re: formatted CDR files

Re: formatted CDR files

Re: Splunk v5 Forwarder

Re: formatted CDR files

Re: formatted CDR files

Re: formatted CDR files

Re: Splunk / Sitescope/ Wily

Re: Splunk / Sitescope/ Wily

Re: when splunk crash,how can i got the informatio...

Re: high cpu usage on unix forwarder

Re: Break a search down per day

Re: Splunk on splunk SOS activity logging

Re: Splunk on splunk SOS activity logging

Re: Splunk on splunk SOS activity logging

Re: Don't want column names as values in the repo...

Re: Failed to remove indexed log files from search

Re: Failed to remove indexed log files from search

Re: Failed to remove indexed log files from search

Re: adding Export button on a form

Re: adding Export button on a form

Re: adding Export button on a form

Re: adding Export button on a form

Re: Indexing not working on the data imported by ....

Re: rex help??

Join the Conversation