About manderson7

manderson7 · ‎08-29-2018

We're attempting to ingest from ELK servers into Splunk using ELK -> HEC, but are having difficulties getting past ssl. Due to FW constraints, we're only able to send to one heavy forwarder on port 8088, which already has ssl enabled. We don't have certificate validation enabled. The data is going to be coming in from a company that we've purchased, so they're not on our domain, and I'm not certain if their root ca cert is in effect in our domain, nor certain if that matters here. They are sending using the following structure: http_method => "put" format => "json" url => https://nattdip:8088/services/collector headers => {"Authorization" =>"Bearer d****d-9f84-4a3a-a9fd-6*******e"} content_type => "application/json" We've tried both put and post as the method, and they get the same error: [HTTP Output Failure] Could not fetch URL {:url=>"https://nattdip:8088/services/collector", :method=>:post, I see the following in my _internal log: 08-28-2018 15:45:13.287 -0400 WARN HttpListener - Socket error from sourceip while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown We've added their rootca to our pem file that Splunk is using to protect web & hec, but get same error. Any suggestions would be great. Thanks very much.

manderson7 · ‎06-25-2018

Use system time when you're ingesting, so it's easier to search the time that you uploaded. Also, maybe upload to a test index so there's less data to check. It's not the most intuitive of setups.

manderson7 · ‎05-31-2018

This looks like the only user manual available. I don't see your specific request, but you might be able to find more information. http://docs.alertmanager.info/en/latest/user_manual/

manderson7 · ‎01-19-2018

No change with the field extractor. I added the following line to my props.conf but the field wasn't extracted: EXTRACT-LogName = ^\d+\s\w+\s+\d+\s\d+\:\d+\:\d+,\d+.\d+.\d+.\d+\|\|\w+(?<LogName>) Edit: I should say I also edited the delimiter line and changed it to ||, again no change.

manderson7 · ‎01-17-2018

I'm trying to ingest historical Windows security event logs from Nitro into Splunk. The event fields are delimited by a double-pipe. I'm green on creating a transforms that will deal with this data, and would love some input. An example event is shown below: 2017 Feb 28 23:57:31,172.30.66.143||Security||4094031727||Microsoft-Windows-Security-Auditing||4656||61||1488344058||4||DCNDCDNSFF01.domain.dev||||File System||16||S-1-5-18||DCNDCDNSFF01$||domain||0x3e7||Security||File||C:\Windows\Boot\PCAT||0x154||{00000000-0000-0000-0000-000000000000}||%25%251538%0D %09%09%09%09%25%251539%0D %09%09%09%09%25%251540%0D %09%09%09%09%25%251542%0D %09%09%09%09||%25%251538:%09%25%251804%0D %09%09%09%09%25%251539:%09%25%251804%0D %09%09%09%09%25%251540:%09%25%251801%09SeTakeOwnershipPrivilege%0D %09%09%09%09%25%251542:%09%25%251801%09SeSecurityPrivilege%0D %09%09%09%09||0x10e0000||SeSecurityPrivilege%0D %09%09%09SeTakeOwnershipPrivilege||0||0x208||C:\Windows\System32\services.exe||A handle to an object was requested.%0D %0D Subject:%0D %09Security ID:%09%09S-1-5-18%0D %09Account Name:%09%09DCNDCDNSFF01$%0D %09Account Domain:%09%09domain%0D %09Logon ID:%09%090x3e7%0D %0D Object:%0D %09Object Server:%09%09Security%0D %09Object Type:%09%09File%0D %09Object Name:%09%09C:\Windows\Boot\PCAT%0D %09Handle ID:%09%090x154%0D %0D Process Information:%0D %09Process ID:%09%090x208%0D %09Process Name:%09%09C:\Windows\System32\services.exe%0D %0D Access Request Information:%0D %09Transaction ID:%09%09{00000000-0000-0000-0000-000000000000}%0D %09Accesses:%09%09READ_CONTROL%0D %09%09%09%09WRITE_DAC%0D %09%09%09%09WRITE_OWNER%0D %09%09%09%09ACCESS_SYS_SEC%0D %09%09%09%09%0D %09Access Reasons:%09%09READ_CONTROL:%09Granted by Ownership%0D %09%09%09%09WRITE_DAC:%09Granted by Ownership%0D %09%09%09%09WRITE_OWNER:%09Granted by%09SeTakeOwnershipPrivilege%0D %09%09%09%09ACCESS_SYS_SEC:%09Granted by%09SeSecurityPrivilege%0D %09%09%09%09%0D %09Access Mask:%09%090x10e0000%0D %09Privileges Used for Access Check:%09SeSecurityPrivilege%0D %09%09%09SeTakeOwnershipPrivilege%0D %09Restricted SID Count:%090 I've created a sourcetype, winevent:sec:archive, and on ingesting the events into my local splunk instance, a single pipe, |, seems to break the fields up, while a double pipe just shows the time field, and no other fields, telling me that splunk doesn't like a double-pipe delimiter. FWIW, here's the props I've got, but I need help setting up the transforms with field names, of which I have most of them. [wineventlog:sec:archive] DATETIME_CONFIG = FIELD_DELIMITER = | HEADER_FIELD_DELIMITER = | INDEXED_EXTRACTIONS = psv KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Pipe-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true I hope this question makes sense. I'd appreciate any help you can provide. Thanks.

manderson7 · ‎11-15-2017

Never mind, needed splunk_server=local in the search. Sorry.

manderson7 · ‎11-15-2017

Cool app, we're testing it on a system now. Unfortunately, said system is also using single sign on, which is why I think, our requests_requester user is showing "(splunk-system-user - )". Do you know how we could get around this?

manderson7 · ‎09-22-2017

That did it, thank you.

manderson7 · ‎09-22-2017

I see this working on the test dashboard, so thanks for that. I'm having problems making it work on my prod dashboard however. <form script="tabs.js" stylesheet="tabs.css, custom.css"> <label>Security Posture-Executive View Clone</label> <fieldset submitButton="true"> <input type="time" token="latest_time_picker" searchWhenChanged="true"> <label>As of Time</label> <default> <earliest>$tokTime.earliest$</earliest> <latest>$tokTime.latest$</latest> <eval token="earliestTime">strftime(strptime($job.earliestTime$,"%Y/%m/%d %H:%M:%S %p"),"%Y/%m/%d %H:%M:%S %p")</eval> <eval token="latestTime">strftime(strptime($job.latestTime$,"%Y/%m/%d %H:%M:%S %p"),"%Y/%m/%d %H:%M:%S %p")</eval> </default> </input> <html> Date & Time Range Between: $earliestTime$ and $latestTime$ </html> </fieldset> That shows " Date & Time Range Between: $earliestTime$ and $latestTime$ ", not the date and time assigned, so the token isn't getting assigned.

manderson7 · ‎09-21-2017

We have a heavily used metrics dashboard that is showing a lot of data to execs. The data is filtered by a (mostly) universal time picker at the top of the dash. The time picker is showing a truncated date. In edit/token options/default, you can see From Aug 1, 2016 to Aug 31, 2017. However, the actual time picker is showing "From Aug 1, 2016 to Aug...". This wouldn't be a huge deal, if the dates displayed correctly when you click the drop down arrow on the time picker. However, the dates that are displayed (in the date range picker) are from yesterday to today, in this case "Sep 20-Sep 21". So, the user doesn't know the exact time period that's being searched on by default. I'm expecting the dates being displayed after you click the dropdown is a feature, but how do I show the entire date range in the time picker's default view?

manderson7 · ‎08-29-2017

May have figured this out. Had another app, Splunk_TA_paloalto, adjusting the max_timestamp_lookahead to 44 (without the time prefix), which seems to be in the middle of the day in the date string. Have changed that to 50 and pushed it out. Crossing fingers.

manderson7 · ‎08-28-2017

Fail to set active folder as partition "/Common". How to open port 443? I'm receiving this error message when I enable the F5 task in the add-on. As far as I can tell the server information is configured correctly, and I'm using the same account as what's set on the F5 itself for me. One of the answers Fail to set active folder as partition "/Common" for Template had an answer that said to open port 443, but it, and the documentation fail to mention where to open said port. I can telnet to the F5 from my heavy forwarder on port 443, but 443 isn't running in Splunk, nor is it allowed, as I'm running as the splunk user and not root, per best practices. Could someone please explain what to do here? Thank you.

manderson7 · ‎08-28-2017

Pretty weird situation here. Bringing in multiple palo alto syslog sources, all going to the same main syslog directory, then divvied up by host name, so /var/log/syslog/PaloAlto/host1/host1-PaloAlto.log, etc. Host 1 is showing the correct date in the event that matches the log 13:49:48,010108000857,TRAFFIC,end,1,2017/08/28 13:49:48,172.30.69.194,172.30.5.69,0.0.0.0,0.0.0.0,DC_Dea_Any,,,tanium,vsys3,DC_DEA_TRUSTED,DC_DEA_UNTRUSTED,ethernet6/4.1028,ethernet6/3.1028,Log_Fwd_PA-7050,2017/08/28 13:49:48,1343232963,1,54123,17472,0,0,0x5e,tcp,allow,3133,893,2240,14,2017/08/28 13:49:29,17,any,0,0,0x0,172.16.0.0-172.31.255.255,172.16.0.0-172.31.255.255,0,9,5,tcp-fin,43,0,0,0,DC-DEA,host1,from-policy 8/28/17 1:49:48.010 PM while host 2 is showing 13:49:49,007801000317,TRAFFIC,end,0,2017/08/28 13:49:28,204.76.30.253,172.217.2.46,0.0.0.0,0.0.0.0,PUBLIC_TO_INTERNET,,,google-analytics,vsys10,IPS_IN,IPS_IN,ethernet1/1,ethernet1/1,Log_Fwd,2017/08/28 13:49:28,120421,1,57690,443,0,0,0x53,tcp,allow,6609,1706,4903,17,2017/08/28 13:46:38,168,computer-and-internet-info,0,31998418668,0x8000000000000000,United States,United States,0,9,8,tcp-fin,892,0,0,0,IPS_TEST,host2,from-policy,,,0,,0,,N/A 8/2/17 1:49:49.007 PM We're uncertain how long this has been going on. I've added the following props for the sourcetype, but it's had no effect: [pan:traffic] DATETIME_CONFIG = NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIME_FORMAT = %Y/%m/%d %H:%M:%S TIME_PREFIX = \S+\,\S+\,\S+\,\S+\,\S+\, category = Custom pulldown_type = true MAX_TIMESTAMP_LOOKAHEAD = 19 I tried it without the timestamp_lookahead, but no change. Any help here would be appreciated.

manderson7 · ‎08-08-2017

I told inputs.conf to use the scripts in Splunk_TA_nix instead of Splunk_TA_nix_DHIS, and it stated working. Unsure why, but not arguing.

manderson7 · ‎08-08-2017

I've got the Splunk_TA_nix app installed on all of my *nix servers, and only want to get top, ps and vmstat from certain servers. I copied the Splunk_TA_nix app to a new app, copied over the inputs that I wanted and deployed to that server. I'm not getting those sourcetypes from a search on that server, and a skim of splunkd on that server shows: 08-08-2017 15:30:52.479 -0400 WARN IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/ps.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/ps.sh] in inputs.conf 08-08-2017 15:30:52.479 -0400 WARN IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/top.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/top.sh] in inputs.conf 08-08-2017 15:30:52.479 -0400 WARN IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/vmstat.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/vmstat.sh] in inputs.conf What am I doing wrong here? Thanks.

manderson7 · ‎08-04-2017

Never mind, looks like a restart of all the search heads did the trick.

manderson7 · ‎08-03-2017

Running a 2 site indexer cluster configuration, with 2 search head clusters. Site 1 shows a search head with the following error: Search peer site1sh08u has the following message: Bundle Replication: Problem replicating config (bundle) to search peer ' 172.30.63.42:8089 ', error while transmitting bundle data. Site 2 is showing the following error: Search peer site2sh01u has the following message: Bundle Replication: Problem replicating config (bundle) to search peer ' 172.31.133.16:8089 ', got http response code 401 HTTP/1.1 401 Unauthorized. Search peer site2sh01u has the following message: Bundle Replication: Problem replicating config (bundle) to search peer ' 172.31.133.17:8089 ', got http response code 401 HTTP/1.1 401 Unauthorized. Search peer site2sh01u has the following message: Bundle Replication: Problem replicating config (bundle) to search peer ' 172.31.133.18:8089 ', got http response code 401 HTTP/1.1 401 Unauthorized. What authentication is the message from site 2 referring to? Where can I find more information about these messages?

manderson7 · ‎07-25-2017

Yes thank you! That's it exactly. Forgot my slashes apparently.

manderson7 · ‎07-25-2017

I've been banging my head against the wall trying to get this to work, and not succeeding, obviously. I have a 217 line email from my power company I've ingested using the imap app, and I want to get a fields out of it. The built in field extractor will only show the first 15 lines of the email, so that's not helpful, and the regex's I've cobbled together aren't pulling out the data. The data that I want is: font face="Arial, Helvetica, sans-serif" size="2" color="" style="font-size: 13px">43 kWh </font and I want the "43 kWh" from that line, and to name the field "previousday_energy_use". and the next line I want is: font face="Arial, Helvetica, sans-serif" size="2" color="#3e3e3e" style="font-size: 13px">$5</font> and I want the "$5" data. I'd appreciate any help here. If I do a rex field=_raw "(?<kWh>13px\">.*?<)" the field created just shows 13px"><

manderson7 · ‎07-20-2017

Narrow down the src and destination IP addresses in the pcap and search on those. That's what I had to do to find my data. Luckily, they were different than the rest of my environment. Also, when you ingest, set the pcap to use system time for easier searching.

manderson7 · ‎07-19-2017

Smart idea, thanks man.

manderson7 · ‎07-19-2017

Since we've added our indexers into a cluster, we're getting the following exec error message: message from "/opt/splunk/etc/slave-apps/alert_manager/bin/alert_manager_scheduler.sh" python: can't open file '/opt/splunk/etc/apps/alert_manager/bin/alert_manager_scheduler.py': [Errno 2] No such file or directory Which makes sense, because the apps are being deployed deployed to etc/slave-apps now. So I can change the .sh script to point to etc/slave-apps/alert-manager/bin/alert_manager_scheduler.py. However, We're also deploying to our search heads, and the app will reside in etc/apps. So changing the path will break the script on the search heads. Can I just add the slave-apps path to the script and have both run, and one will work on the search heads and one will work on the indexers, and just live with the error messages that happen? Or will that cause the end of the world?

manderson7 · ‎07-19-2017

Turns out it's assigned in a csv in my dashboard, so this is a silly question. Sorry to add to the noise.

manderson7 · ‎07-19-2017

We're monitoring our splunk environment through the DMC as well as a hand built dashboard consisting of data from the _introspection index. Search looks like: index=_introspection sourcetype=splunk_resource_usage component=Hostwide search_group=Indexer | eval total_cpu_usage = 'data.cpu_system_pct' + 'data.cpu_user_pct' | timechart minspan=10s partial=f limit=25 Median(total_cpu_usage) AS cpu_usage by host | eval max=100 We've recently added new servers, including new indexers, and have added them to the DMC successfully, along with assigning their roles there. However, we're not seeing the new servers in the above search. They don't have a search_group assignment. How do I assign the new servers a search_group? Thank you

manderson7 · ‎07-17-2017

Turns out, that when you ingest a pcap via the Data Inputs/New PCAP section, it's supposed to add the pcap data into the inputs.conf. That's not really covered in the documentation. Also, and this will seem quite obvious, but make certain you're searching in the correct time period for the data you're looking for :). That's really all that was problematic with our approach. A feature request I'd look for in the future for this is to be able to search on the name we give the pcap when it's ingested, to make it easier to find when searching. We found yours, Hal, because it had an IP that we weren't using.

Posts	110
Solutions	5
Karma Given	33
Karma Received	12
Member Since	‎02-13-2014

Online Status	Offline
Date Last Visited	‎11-16-2023 06:44 PM

Need help with nested json and spath

How to join REST & search results?

How can I change input label color?

Where is the IT Essentials Work create entity butt...

How to flag when new value is created in field

Workload Management usage

Delta based on multiple inboxes

Determining if software is NOT installed

Settings for data source to only monitor weekdays

Configuring drilldown in Sunburst Viz & Number Dis...

Problem ingesting from HEC, sslv3 alert certificat...

Re: Problem ingesting pcap file with stream modula...

Re: Is there a latest manual of Alert Manager?

Re: New sourcetype, problems creating transforms w...

New sourcetype, problems creating transforms with ...

Re: Questions about single sign on and requester

Questions about single sign on and requester

Re: Setting $job.earliestTime$ and $job.latestTime...

Re: Setting $job.earliestTime$ and $job.latestTime...

Setting $job.earliestTime$ and $job.latestTime$ to...

Re: Palo Alto Networks syslog: 1 host is ingested ...

Splunk Add-on for F5 BIG-IP: error message -- "Fai...

Palo Alto Networks syslog: 1 host is ingested with...

Re: Splunk Add-on for *Nix "ignoring alternate exp...

Splunk Add-on for *Nix "ignoring alternate expansi...

Re: Various problems with bundle replication; unau...

Various problems with bundle replication; unauthor...

Re: Field extraction from html email

Field extraction from html email

Re: Problem ingesting pcap file with stream modula...

Re: Alert manager exec errors in cluster

Alert manager exec errors in cluster

Re: Introspection search_group assignment

Introspection search_group assignment

Re: Problem ingesting pcap file with stream modula...

Join the Conversation