Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About yossefn
yossefn
Path Finder
Member since:
01-10-2018
10-13-2021
Community Statistics
| Posts | 40 |
| Solutions | 1 |
| Karma Given | 6 |
| Karma Received | 2 |
| Member Since | 01-10-2018 |
Activity Feed
- Posted Re: Can I schedule DLP delivery for dashboard with input panels? on Dashboards & Visualizations. 01-13-2021 07:09 AM
- Posted Can I schedule DLP delivery for dashboard with input panels? on Dashboards & Visualizations. 01-13-2021 06:39 AM
- Posted Re: How reliable is the location value produced by the "iplocation" command? on Dashboards & Visualizations. 12-14-2020 12:05 AM
- Karma Re: How reliable is the location value produced by the "iplocation" command? for gcusello. 12-14-2020 12:05 AM
- Posted How reliable is the location value produced by the "iplocation" command? on Dashboards & Visualizations. 12-13-2020 05:46 AM
- Tagged How reliable is the location value produced by the "iplocation" command? on Dashboards & Visualizations. 12-13-2020 05:46 AM
- Got Karma for Re: What is the right order to change NTP setting in a clustered environment?. 12-09-2020 12:47 AM
- Posted Can I limit DB Connect query run time? on Splunk Enterprise. 11-30-2020 06:09 AM
- Posted Re: How to resolve "tcp-rst-from-server" & "tcp-rst-from-client" errors on Getting Data In. 11-11-2020 03:40 AM
- Posted How to resolve "tcp-rst-from-server" & "tcp-rst-from-client" errors? on Getting Data In. 11-11-2020 01:52 AM
- Posted Re: How can I compare values from a lookup and alert when there is no mach? on Splunk Search. 08-10-2020 04:40 AM
- Karma Re: How can I compare values from a lookup and alert when there is no mach? for to4kawa. 08-10-2020 04:40 AM
- Posted Re: How can I compare values from a lookup and alert when there is no mach? on Splunk Search. 08-10-2020 04:03 AM
- Tagged Re: How can I compare values from a lookup and alert when there is no mach? on Splunk Search. 08-10-2020 04:03 AM
- Tagged Re: How can I compare values from a lookup and alert when there is no mach? on Splunk Search. 08-10-2020 04:03 AM
- Posted Re: How can I compare values from a lookup and alert when there is no mach? on Splunk Search. 08-06-2020 06:03 AM
- Posted How can I compare values from a lookup and alert when there is no mach? on Splunk Search. 08-06-2020 01:55 AM
- Posted Re: How to transfer reports between clustered search heads on Reporting. 07-07-2020 11:32 PM
- Posted Re: How to transfer reports between clustered search heads on Reporting. 07-07-2020 11:25 PM
- Posted How to transfer reports between clustered search heads on Reporting. 07-07-2020 03:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
01-13-2021
07:09 AM
Ok, so I got it. I have changed the dashboard type from "form" to "dashboard" from the "edit source" option and it's working.
... View more
01-13-2021
06:39 AM
Hi, I have a dashboard with input panels in it, When I wanted to schedule a PDF delivery for this dashboard I saw that the option is grayed out. Is there any way to override it to enable the delivery? Thanks.
... View more
Labels
- Labels:
-
other
12-14-2020
12:05 AM
Thank you @gcusello
... View more
12-13-2020
05:46 AM
Hi, I need to create a report the will summary the countries that our users connected our network from. Using the "iplocation" command I got a results, but for sure I can say that I know about an employee connected from a country in Europe but in the logs it appears that he connected from a country in the middle east. Is there more accurate option to make sure I will present the correct information? Thanks.
... View more
- Tags:
- iplocation
Labels
- Labels:
-
other
11-30-2020
06:09 AM
Hi, I need to collect logs from a critical Database and I need to be sure that there will be no impact on the server. Is there any option to limit the DB Connect for 10 seconds for each query? Thanks.
... View more
Labels
- Labels:
-
configuration
11-11-2020
03:40 AM
Hi @sbaror11, The question is about Splunk - wondered if maybe Splunk denied somehow the connection, or I missed some configuration that preventing me from getting the logs. I had kind of issue with "aged-out" errors on the FW logs, then I figured out that the local FW on the Splunk servers denied the connection.
... View more
11-11-2020
01:52 AM
Hi,
I'm trying to collect logs from a web servers, but getting an error on the FIrewall says "tcp-rst-from-server" on port 9997. Also, I have another error "tcp-rst-from-client" on port 8089.
I have to say that there are other servers in the same VLAN that I'm getting logs from.
Where can I look to solve the problem?
... View more
Labels
- Labels:
-
monitor
08-10-2020
04:40 AM
Perfect. Thank you @to4kawa
... View more
08-10-2020
04:03 AM
Trying my luck another time.. I have created the below search: <my search here>
| fields users
| eval users=trim(split(users,","))
| mvexpand users
| lookup as400_ftp_users.csv user as users OUTPUT user
| rename users as FTP_USERS, user as ALLOWED_USERS
| table FTP_USERS ALLOWED_USERS Now I have two lists of users, ordered by user name: MO***FR MO***FR NA***ZA NA***ZA O***AS O***AS R***NI R***NI R***TL R***MKA R***MKA S**IM S**IM S***ARA S***ARA I want to print out the extra user on the left side (R***TL) because this user is not in the "allowed users" list. Is that possible? Thank you!
... View more
08-06-2020
06:03 AM
That's great @to4kawa , now I have two fields ("users" field from the system's output, and "user" from my ftp_allowed lookup). I ran the below stats and got two lists of users, now I just need to compare and alert when there is an extra user under one of the lists. | stats values(users) as ftp_users, values(user) as allowed_user
... View more
08-06-2020
01:55 AM
Hi, I have a lookup tables with user names (ftp_users.csv). Every day I'm getting one line from a particular system with users with FTP permissions, I want to compare between the lookup file (which contains the allowed FTP users) with the line I'm getting from the system and to alert when there is no match. The line form the system looks similar to the below row: users=user1, user2, user3, user4, user5 I'll appreciate any help with that, Thank you.
... View more
Labels
- Labels:
-
lookup
07-07-2020
11:32 PM
Thank you for the advice @burwell , I will have to check this with our Engineering team. Is that possible to create a cluster from an already running environment and to assign a captain to it?
... View more
07-07-2020
11:25 PM
Actually I'm not sure about the Cluster, because you question about a Deployer. My environment is 3 Indexers, 3 Search Heads (1 ES and 2 Ad-Hoc) and another few servers.. Monitoring Console installed on one of the Ad-Hoc servers. When looking at the MC I can see the main reason of skipped searches: "The maximum number of concurrent auto-summarization searches on this instance has been reached", most of them from the "Splunk_SA_CIM" app. I've temporary disabled this app yesterday and this morning I can see that the Skip Ratio is changed from 84% to 7%. I'll probably bring back this app to be enabled, but I have to understand how should I avoid such a behavior in the future. Do you have any suggestions where to start from? Many thanks.
... View more
07-07-2020
03:59 AM
Hi, I have 3 clustered Search Heads, one of them is an ES Search Head. The ES Search Heads holds a lot of scheduled reports that causing (in my opinion) a lot of problems with "skipped searches". I want to transfer most of the scheduled reports from the ES to another Search Head in the Cluster. Looking at the answers, I saw a couple of them talking about transferring from a stand-alone or non-clustered search head to a clustered etc. In my case, all of them are clustered and I'm just looking for the best way to move them. Thank you.
... View more
Labels
- Labels:
-
saved search
-
scheduled search
06-28-2020
02:49 AM
Looks like the SQL will have a little problem to write to a UNIX path, but we'll solve it with different tool to build a job that will copy the lookup file and write it the the Splunk server. Thank you @richgalloway for the idea.
... View more
06-23-2020
03:49 AM
Hi, I have a SQL job that exports a .csv table to our file server with one column of user names in the file. This job is running once a day at the morning and writing a new file every day with the same name. Since Iv'e uploaded the file once, I can't see the changes of the new files in the next days. Is there any option for me to monitor this file as a lookup and run a searches against the most recent data? Thank you, Yossi.
... View more
Labels
- Labels:
-
configuration
06-18-2020
05:35 AM
Wow, that was fast 🙂 Thanks @richgalloway for the solution!
... View more
06-18-2020
05:23 AM
Hi, I have a DNS logs with Parenthesis + numbers instead of Dots in the URL filed. How can I replace them with a Dots? Below are some examples from the logs. (5)_ldap(4)_tcp(5)cmp(6)_sites(3)rub(3)net(2)oz(0)
(4)wpad(3)rub(3)net(0)
(5)_ldap(4)_tcp(2)dc(6)_msdcs(9)dc(7)core(2)t4(3)rub(3)net(0) Thank you!
... View more
- Tags:
- rex
05-05-2020
11:27 AM
I don't understand why, but it still not working for me.
Where should I put all the headers I have in the URL? Are the should be included as part of the endpoint value?
'https://api.company.webresource.com/v2/logs/audit' -H 'Content-Type: application/json' -H 'Accept: application/json'
In your second example I can't see the Authorization part..
... View more
05-04-2020
11:26 AM
Hi @PavelP
I've created this stanza but still can't see any data coming in. How can I debug it to see the errors?
... View more
05-04-2020
05:23 AM
Sure, I'm working on my test machine. Thanks!
... View more
05-04-2020
05:18 AM
Hi @harsmarvania57 is this app will allow me to configure a continues REST collection? I want to index events from this web resource.
... View more
05-04-2020
04:53 AM
Hi,
I really need help with this issue. I need to collect logs using REST from a web resource. I'm trying for a lot of time to do it by myself, unfortunately I got stock in the final step. I have a 'curl' command I'm running against the web resource and I see the logs on my shell screen, all I'm trying to do is to convert this command to a valid REST call using the 'Add-on Builder' but I just can't finish it successfully.
Attached here is a masked version of my 'curl' command, please help me to get it done somehow so I'll be able to collect the logs.
curl -X POST 'https://api.company.webresource.com/v2/logs/audit' -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'Authorization:Bearer 196e6h17-798a-4e2c-64hr-xxxxxxxxxxxx' -i -d '{"query":{"from_date":1587848400000}}'
Thanks in advance!
... View more
Labels
- Labels:
-
other
03-17-2020
05:28 AM
@to4kawa , Thank you for you help! I got better results but still have a gap. any idea?
... View more
03-17-2020
04:43 AM
Here is the final search I'm running. Still there is a gap of around 50 sessions between my results and the actual data in the VPN management system.
index=vpn juniper_sslvpn_message="Connected to *" OR juniper_sslvpn_message="Closed connection to *" earliest=@d latest=now()
| stats count(eval(searchmatch("Connected"))) as start count(eval(searchmatch("connection"))) as stop by user
| eval live = start - stop
| where live > 0
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-13-2021
01:55 PM
|
