Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About systemsatpayzon
systemsatpayzon
Path Finder
Member since:
05-30-2013
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 05-30-2013 |
Activity Feed
- Karma Re: Forwarder props.conf [source::] stanza for echalex. 06-05-2020 12:46 AM
- Karma Re: Forwarder props.conf [source::] stanza for jkat54. 06-05-2020 12:46 AM
- Got Karma for Is 1w ago the same as this week in the timewrap app?. 06-05-2020 12:46 AM
- Posted Re: How can I generate a search to find hosts which are missing a certain sourcetype? on Splunk Search. 09-12-2016 09:45 AM
- Posted How can I generate a search to find hosts which are missing a certain sourcetype? on Splunk Search. 09-12-2016 09:30 AM
- Tagged How can I generate a search to find hosts which are missing a certain sourcetype? on Splunk Search. 09-12-2016 09:30 AM
- Tagged How can I generate a search to find hosts which are missing a certain sourcetype? on Splunk Search. 09-12-2016 09:30 AM
- Tagged How can I generate a search to find hosts which are missing a certain sourcetype? on Splunk Search. 09-12-2016 09:30 AM
- Tagged How can I generate a search to find hosts which are missing a certain sourcetype? on Splunk Search. 09-12-2016 09:30 AM
- Posted Re: Script:InstalledApps Not properly breaking into events from some hosts on All Apps and Add-ons. 05-26-2014 08:45 AM
- Posted Re: Is 1w ago the same as this week in the timewrap app? on All Apps and Add-ons. 12-05-2013 12:35 AM
- Posted Is 1w ago the same as this week in the timewrap app? on All Apps and Add-ons. 12-04-2013 07:04 AM
- Tagged Is 1w ago the same as this week in the timewrap app? on All Apps and Add-ons. 12-04-2013 07:04 AM
- Posted Re: Splunk app for active directory event types not working on All Apps and Add-ons. 06-27-2013 01:23 PM
- Posted Re: Splunk app for active directory event types not working on All Apps and Add-ons. 06-27-2013 07:58 AM
- Posted Re: Splunk app for active directory event types not working on All Apps and Add-ons. 06-27-2013 05:24 AM
- Posted Splunk app for active directory event types not working on All Apps and Add-ons. 06-27-2013 04:59 AM
- Tagged Splunk app for active directory event types not working on All Apps and Add-ons. 06-27-2013 04:59 AM
- Tagged Splunk app for active directory event types not working on All Apps and Add-ons. 06-27-2013 04:59 AM
- Posted Re: calculate time statistics over an hour, but only find releated events that occur within one minute on Splunk Search. 06-20-2013 12:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
09-12-2016
09:45 AM
Awsome, it worked perfectly.. and fast also!
... View more
09-12-2016
09:30 AM
I have a sourcetype which is a log created by the AV application on the host. I would like to find hosts which are missing this particular sourcetype (over 4 hours). It seems like a easy search but I cannot figure out how to write it. Theoretically I would like to do a search on all hosts and sourcetypes and then find the hosts which haven't sent any log with this sourcetype. Easy in theory but I cannot figure it out. Please help me. This is how far i have come:
| metasearch sourcetype=* host=* | dedup sourcetype, host | "here I would like a tabular output of hosts missing this sourcetype"
... View more
05-26-2014
08:45 AM
I am also having this problem, is there a solution for it available?
... View more
12-05-2013
12:35 AM
Ok, i see now. I really like your app, now i dont need to twist my brain to get the week vs week graphs right. But it would be nice to be able to somehow change the text on the graphs so people not getting confused about 1w ago = current week. Or if you could change the text to like most recent week as you suggested?
... View more
12-04-2013
07:04 AM
1 Karma
In the timewrap app. is 1week ago the same as current week? at least i think so if i look at the log data that feeds timewrap. Maby it should say "current week" then instead of 1w ago
... View more
- Tags:
- Timewrap
06-27-2013
01:23 PM
I solved it after a day of troubleshooting 🙂 the problem was that the eventtypes where only accessible inside the app in splunk web, but i used the standard searchapp for testing. after searching in the search app inside splunk app for active directory it works like a charm
... View more
06-27-2013
07:58 AM
using btool i can see that settings from eventtypes.conf in \Splunk_for_ActiveDirectory\default are being consumed by splunk, how come i cannot search for those eventtypes??
... View more
06-27-2013
05:24 AM
previously i had the splunk app for windows installed, but i have deleted it today. could that cause any problems?
... View more
06-27-2013
04:59 AM
none of the event types in eventtypes.conf under \Splunk\etc\apps\Splunk_for_ActiveDirectory\default\ work in search. For example if i search for "eventtype=wineventlog-security" i get "Unable to find an eventtype wineventlog-security" but if i instead search for the underlying search string "index=main source=WinEventLog:Security" i get a lot of events. it looks like all eventtypes under "splunk_TA_windows" are searchable but non of the eventtypes under plunk_for_ActiveDirectory.
What could be wrong
... View more
06-20-2013
12:27 PM
I solved it myself!
sourcetype="Filter" a44 | transaction research maxevents=2 |stats min(duration) max(duration) avg(duration) median(duration) perc95(duration)
... View more
06-20-2013
06:06 AM
A better alternative would be to find consecutive occurences of the same value for the keys "research" and "Locsite" (request and response)
... View more
06-20-2013
05:34 AM
I am trying to calculate statistics for when a transaction enters our application, and when the reply is sent from the application. I would like to calculate statistics over an hour and there are two key values that i use to find the events to caculate on (research and Locsite). Here is the query:
sourcetype="Filter" transactionType=A44 | stats min(_time) AS earliest max(_time) AS latest by research,Locsite | eval duration=latest-earliest
this query returns the duration of the transaction. this query is good enough most of the time but sometimes events with the same "research" and "Locsite" is returned more than two times within the time range of an hour, then the duration value will be calculated over too long time. So i would like my query to only look for events with the same "Locsite" and "research" within one minute, but calculate statistics over the whole timerange
... View more
06-17-2013
11:58 PM
When i removed the app folder TA-DNSServer-NT6 from splunk and restarted splunk it starts to forward events! the server is a DC with ad integrated DNS.
... View more
06-17-2013
02:19 AM
thanks for the tips.. here is a snippet from my inputs.conf found in C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local
[default]
evt_dc_name =
evt_dns_name =
OS Logs
[WinEventLog:Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
[WinEventLog:Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
[WinEventLog:System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
... View more
06-12-2013
05:50 AM
[EDIT2]
Domain and dns information seems to be sent to the indexer, but not any logs from the security, application or system event log
... View more
06-12-2013
04:52 AM
What should i look for? the rows below seems suspicious..
6-12-2013 12:17:13.440 +0200 ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
06-12-2013 12:17:13.440 +0200 INFO TcpOutputProc - Connection to 192.168.19.47:9997 closed. Read error. Either the application has not called WSAStartup, or WSAStartup failed.
[EDIT]
further down this message is written, so i guess that there are no connection problem
INFO TcpOutputProc - Connected to idx=192.168.19.47:9997
... View more
06-12-2013
04:30 AM
I have a problem with a universal forwarder as i configured on a domain controller to use with splunk app for active directory. The forwarder is not forwarding anything. what i have done so far:
1. installed the forwarder to gather remote data and used an domain admin account. i did not check any of the checkboxes during the installation. but i typed in the reciving indexer when asked for
2. i have downloaded and copied the folders Splunk_TA_windows, TA-DNSServer-NT6 and TA-DomainController-NT6 to the apps directory on the universal forwarder
3. I have put a inputs.conf file under Splunk_TA_windows\local folder and then restarted the forwarder
But noting is sent to indexer. I am sure that there is no firewall or anything like that blocking because i first installed the forwarder as usual and checked the security log input in the installation wizard (after reading the manual about splunk app for active directory i uninstalled it) and saw that events where sent to and recieved by the indexer.
... View more
